diff --git a/.github/scripts/build_translation_cache.py b/.github/scripts/build_translation_cache.py
new file mode 100644
index 00000000..e3603aaa
--- /dev/null
+++ b/.github/scripts/build_translation_cache.py
@@ -0,0 +1,388 @@
+#!/usr/bin/env python3
+"""
+Build the ProxMenux translation cache from translate calls in scripts/.
+
+The generated JSON keeps the same shape used by scripts/utils.sh:
+
+{
+  "Original English text": {
+    "es": "Translated text",
+    "fr": "Translated text"
+  }
+}
+"""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import json
+import os
+import subprocess
+import re
+import sys
+import time
+from pathlib import Path
+from typing import Iterable
+from urllib.parse import quote
+from urllib.request import Request, urlopen
+
+
+DEFAULT_LANGUAGES = ("es", "fr", "de", "it", "pt")
+DEFAULT_CONTEXT = "Context: Technical message for Proxmox and IT. Translate:"
+TRANSLATE_CALL_RE = re.compile(
+    r"""translate\s+(?P<quote>["'])(?P<text>(?:\\.|(?! (?P=quote) ).)*?)(?P=quote)""",
+    re.VERBOSE | re.DOTALL,
+)
+
+
+def iter_script_files(
+    scripts_dir: Path, extra_files: Iterable[Path] = ()
+) -> Iterable[Path]:
+    # Walk the main scripts tree.
+    for path in sorted(scripts_dir.rglob("*")):
+        if not path.is_file():
+            continue
+        if path.name == "utils.sh":
+            continue
+        if path.suffix not in {".sh", ".func"}:
+            continue
+        yield path
+    # Yield additional files passed explicitly (e.g. the root-level `menu`
+    # entry point or install_proxmenux*.sh). These live outside scripts/
+    # but still contain translate "..." calls we want in the cache.
+    # No extension filter and no utils.sh skip — the caller decided
+    # they belong, we just check the file actually exists.
+    for extra in extra_files:
+        if extra.is_file():
+            yield extra
+
+
+def decode_shell_string(raw: str, quote_char: str) -> str:
+    if quote_char == "'":
+        return raw
+    try:
+        return ast.literal_eval(f'"{raw}"')
+    except Exception:
+        return raw.replace(r"\"", '"').replace(r"\\", "\\")
+
+
+def extract_translate_texts(
+    scripts_dir: Path, extra_files: Iterable[Path] = ()
+) -> list[str]:
+    found: dict[str, None] = {}
+    for path in iter_script_files(scripts_dir, extra_files):
+        try:
+            content = path.read_text(encoding="utf-8")
+        except UnicodeDecodeError:
+            content = path.read_text(encoding="utf-8", errors="replace")
+
+        for match in TRANSLATE_CALL_RE.finditer(content):
+            text = decode_shell_string(match.group("text"), match.group("quote"))
+            text = text.strip()
+            if text and "$" not in text and "`" not in text:
+                found.setdefault(text, None)
+
+    return sorted(found)
+
+
+def translate_googletrans(text: str, dest_lang: str, context: str) -> str:
+    try:
+        from googletrans import Translator  # type: ignore
+    except Exception as exc:
+        raise RuntimeError(
+            "googletrans is not installed. Install googletrans==4.0.0-rc1 "
+            "or run with --provider google-web."
+        ) from exc
+
+    translator = Translator()
+    full_text = f"{context} {text}".strip()
+    return translator.translate(full_text, dest=dest_lang).text
+
+
+def translate_google_web(text: str, dest_lang: str, context: str, timeout: int) -> str:
+    # The public Google endpoint is not prompt-aware: if we prepend context,
+    # it often translates and returns that context as part of the result.
+    full_text = text
+    url = (
+        "https://translate.googleapis.com/translate_a/single"
+        f"?client=gtx&sl=en&tl={quote(dest_lang)}&dt=t&q={quote(full_text)}"
+    )
+    req = Request(url, headers={"User-Agent": "ProxMenux translation cache builder"})
+    with urlopen(req, timeout=timeout) as response:
+        payload = json.loads(response.read().decode("utf-8"))
+    return "".join(part[0] for part in payload[0] if part and part[0])
+
+
+def translate_appimage(
+    text: str,
+    dest_lang: str,
+    context: str,
+    timeout: int,
+    appimage_path: Path,
+) -> str:
+    if not appimage_path.exists():
+        prev_path = appimage_path.with_name(appimage_path.name + ".prev")
+        if prev_path.exists():
+            appimage_path = prev_path
+        else:
+            raise FileNotFoundError(f"AppImage not found: {appimage_path}")
+
+    req = {
+        "text": text,
+        "dest_lang": dest_lang,
+        "context": context,
+        "cache_file": "",
+    }
+    env = os.environ.copy()
+    env.setdefault("APPIMAGE_EXTRACT_AND_RUN", "1")
+    completed = subprocess.run(
+        [str(appimage_path), "--translate"],
+        input=json.dumps(req, ensure_ascii=False),
+        text=True,
+        capture_output=True,
+        timeout=timeout,
+        check=False,
+        env=env,
+    )
+    if completed.returncode != 0:
+        raise RuntimeError((completed.stderr or completed.stdout).strip())
+
+    # AppRun may print a startup line before translate_cli.py emits JSON.
+    for line in reversed(completed.stdout.splitlines()):
+        line = line.strip()
+        if not line.startswith("{"):
+            continue
+        payload = json.loads(line)
+        if payload.get("success"):
+            return str(payload.get("text", text))
+        raise RuntimeError(str(payload.get("error", "unknown AppImage translation error")))
+
+    raise RuntimeError(f"AppImage did not return JSON: {completed.stdout.strip()}")
+
+
+def clean_translation(value: str) -> str:
+    separator = r"[\s\u00a0]*[:：]"
+    translate_labels = "Translate|Traducir|Traduire|Übersetzen|Tradurre|Traduci|Traduzir"
+    context_labels = "Context|Contexto|Contexte|Kontext|Contesto"
+    value = re.sub(
+        rf"^.*?({translate_labels}){separator}",
+        "",
+        value,
+        flags=re.IGNORECASE | re.DOTALL,
+    )
+    value = re.sub(
+        rf"^.*?({context_labels}){separator}.*?({translate_labels}){separator}",
+        "",
+        value,
+        flags=re.IGNORECASE | re.DOTALL,
+    )
+    value = re.sub(
+        rf"^.*?({context_labels}){separator}",
+        "",
+        value,
+        flags=re.IGNORECASE | re.DOTALL,
+    )
+    return value.strip()
+
+
+def translate_text(
+    text: str,
+    dest_lang: str,
+    provider: str,
+    context: str,
+    timeout: int,
+    appimage_path: Path,
+) -> str:
+    if provider == "googletrans":
+        translated = translate_googletrans(text, dest_lang, context)
+    elif provider == "google-web":
+        translated = translate_google_web(text, dest_lang, context, timeout)
+    elif provider == "appimage":
+        translated = translate_appimage(text, dest_lang, context, timeout, appimage_path)
+    else:
+        raise ValueError(f"Unknown provider: {provider}")
+    return clean_translation(translated) or text
+
+
+def load_language_cache(path: Path) -> dict[str, str]:
+    if not path.exists():
+        return {}
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except Exception:
+        return {}
+    if not isinstance(data, dict):
+        return {}
+    return {str(text): str(value) for text, value in data.items()}
+
+
+def write_language_cache(path: Path, cache: dict[str, str]) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp_path = path.with_suffix(path.suffix + ".tmp")
+    tmp_path.write_text(
+        json.dumps(cache, ensure_ascii=False, indent=2, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    tmp_path.replace(path)
+
+
+def build_arg_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        description="Extract translate calls from scripts/ and build json/cache.json."
+    )
+    parser.add_argument("--scripts-dir", default="scripts", type=Path)
+    parser.add_argument(
+        "--extra-file",
+        action="append",
+        default=[],
+        type=Path,
+        metavar="PATH",
+        help=(
+            "Extra individual files to scan for translate calls in addition "
+            "to --scripts-dir. Useful for the root-level `menu` entry point "
+            "and install_proxmenux*.sh, which sit outside scripts/. "
+            "Pass multiple times to add more than one file."
+        ),
+    )
+    parser.add_argument(
+        "--output-dir",
+        default=Path("lang"),
+        type=Path,
+        help="Directory where per-language JSON files are written. Default: lang",
+    )
+    parser.add_argument(
+        "--output",
+        default=None,
+        type=Path,
+        help="Deprecated combined cache path. If used, per-language files are written next to it under its parent directory.",
+    )
+    parser.add_argument(
+        "--languages",
+        default=",".join(DEFAULT_LANGUAGES),
+        help="Comma-separated destination languages. Default: es,fr,de,it,pt",
+    )
+    parser.add_argument(
+        "--provider",
+        choices=("appimage", "googletrans", "google-web"),
+        default="appimage",
+        help="Translation provider to use. Default: appimage",
+    )
+    parser.add_argument(
+        "--appimage-path",
+        default=Path("/usr/local/share/proxmenux/ProxMenux-Monitor.AppImage"),
+        type=Path,
+        help="Path to the ProxMenux AppImage when using --provider appimage.",
+    )
+    parser.add_argument("--context", default=DEFAULT_CONTEXT)
+    parser.add_argument("--timeout", default=30, type=int)
+    parser.add_argument("--sleep", default=0.15, type=float)
+    parser.add_argument(
+        "--refresh",
+        action="store_true",
+        help="Translate all entries again instead of reusing existing cache values.",
+    )
+    parser.add_argument(
+        "--extract-only",
+        action="store_true",
+        help="Only update the cache keys; missing translations are left empty.",
+    )
+    parser.add_argument(
+        "--limit",
+        type=int,
+        default=0,
+        help="Only process the first N extracted strings. Useful for test runs.",
+    )
+    parser.add_argument(
+        "--save-every",
+        type=int,
+        default=1,
+        help="Write the output JSON every N translated items. Default: 1",
+    )
+    return parser
+
+
+def main() -> int:
+    args = build_arg_parser().parse_args()
+    scripts_dir = args.scripts_dir.resolve()
+    if args.output is not None:
+        output_dir = args.output.resolve().parent / "lang"
+    else:
+        output_dir = args.output_dir.resolve()
+    languages = [lang.strip() for lang in args.languages.split(",") if lang.strip()]
+
+    if not scripts_dir.is_dir():
+        print(f"Scripts directory not found: {scripts_dir}", file=sys.stderr)
+        return 1
+    if not languages:
+        print("No destination languages selected.", file=sys.stderr)
+        return 1
+
+    texts = extract_translate_texts(scripts_dir, args.extra_file)
+    if args.limit > 0:
+        texts = texts[: args.limit]
+    existing_by_lang = {
+        lang: load_language_cache(output_dir / f"{lang}.json")
+        for lang in languages
+    }
+    next_by_lang: dict[str, dict[str, str]] = {lang: {} for lang in languages}
+    print(f"Found {len(texts)} unique translate strings.", flush=True)
+    print(f"Output directory: {output_dir}", flush=True)
+    print(f"Languages: {', '.join(languages)}", flush=True)
+
+    failures: list[tuple[str, str, str]] = []
+    total = len(texts) * len(languages)
+    done = 0
+
+    for lang in languages:
+        existing = existing_by_lang.get(lang, {})
+        print(f"Starting language: {lang}", flush=True)
+
+        for index, text in enumerate(texts, start=1):
+            done += 1
+            if not args.refresh and existing.get(text):
+                next_by_lang[lang][text] = existing[text]
+                continue
+            if args.extract_only:
+                next_by_lang[lang][text] = existing.get(text, "")
+                continue
+
+            print(f"[{done}/{total}] {lang} ({index}/{len(texts)}): {text[:80]}", flush=True)
+            try:
+                next_by_lang[lang][text] = translate_text(
+                    text,
+                    lang,
+                    args.provider,
+                    args.context,
+                    args.timeout,
+                    args.appimage_path,
+                )
+                print(f"  => {next_by_lang[lang][text][:100]}", flush=True)
+            except Exception as exc:
+                next_by_lang[lang][text] = existing.get(text, text)
+                failures.append((text, lang, str(exc)))
+                print(f"  failed: {exc}", file=sys.stderr, flush=True)
+            if args.save_every > 0 and index % args.save_every == 0:
+                write_language_cache(output_dir / f"{lang}.json", next_by_lang[lang])
+            time.sleep(args.sleep)
+
+        write_language_cache(output_dir / f"{lang}.json", next_by_lang[lang])
+        print(f"Completed language: {lang}", flush=True)
+
+    for lang, cache in next_by_lang.items():
+        write_language_cache(output_dir / f"{lang}.json", cache)
+
+    if failures:
+        print(f"Completed with {len(failures)} translation failures.", file=sys.stderr, flush=True)
+        for text, lang, error in failures[:20]:
+            print(f"- {lang}: {text[:80]} -> {error}", file=sys.stderr, flush=True)
+        if len(failures) > 20:
+            print(f"... and {len(failures) - 20} more.", file=sys.stderr, flush=True)
+        return 2
+
+    print("Translation cache generated successfully.", flush=True)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/.github/workflows/build-translation-cache.yml b/.github/workflows/build-translation-cache.yml
new file mode 100644
index 00000000..9ed029d1
--- /dev/null
+++ b/.github/workflows/build-translation-cache.yml
@@ -0,0 +1,99 @@
+name: Build translation cache
+
+# Regenerates lang/*.json whenever a bash script under scripts/ changes.
+# The runtime translate() in scripts/utils.sh reads these JSON files and
+# falls back to the English source on miss, so keeping them up-to-date is
+# what makes ProxMenux multilingual without any runtime googletrans
+# dependency on the user's host.
+#
+# Triggers:
+#   - push to develop touching scripts/**/*.sh
+#   - manual via workflow_dispatch (force --refresh)
+
+on:
+  push:
+    branches: [develop]
+    paths:
+      - 'scripts/**/*.sh'
+      - 'menu'
+      - 'install_proxmenux.sh'
+      - 'install_proxmenux_beta.sh'
+      - '.github/scripts/build_translation_cache.py'
+      - '.github/workflows/build-translation-cache.yml'
+  workflow_dispatch:
+    inputs:
+      refresh:
+        description: 'Re-translate every entry (ignore cached values)'
+        type: boolean
+        default: false
+
+# Avoid two cache rebuilds from racing each other on the same branch and
+# fighting over the auto-commit.
+concurrency:
+  group: build-translation-cache-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  rebuild-cache:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # auto-commit lang/*.json back to develop
+
+    steps:
+      - name: Checkout develop
+        uses: actions/checkout@v4
+        with:
+          ref: develop
+          # Need full history so the auto-commit doesn't fail when the
+          # cache job runs minutes after the trigger push (GH default
+          # fetch-depth=1 sometimes diverges from origin/develop after a
+          # quick follow-up push).
+          fetch-depth: 0
+          # Use a PAT (or default GITHUB_TOKEN if branch protections allow
+          # it) so the push back to develop actually fires later steps
+          # (workflow runs from auto-commits) if you ever need them.
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install googletrans
+        run: |
+          python -m pip install --upgrade pip
+          # 4.0.0-rc1 is the same pin that build_translation_cache.py
+          # was written against. Bump in lockstep with the script.
+          pip install 'googletrans==4.0.0-rc1' 'httpx==0.13.3' 'httpcore==0.9.1' 'h11==0.9.0'
+
+      - name: Regenerate lang/*.json
+        run: |
+          REFRESH_FLAG=""
+          if [[ "${{ github.event.inputs.refresh }}" == "true" ]]; then
+            REFRESH_FLAG="--refresh"
+          fi
+          # Extra files outside scripts/ that also contain translate "..."
+          # calls. Keep this list in sync with the `paths` trigger above.
+          python .github/scripts/build_translation_cache.py \
+            --scripts-dir scripts \
+            --extra-file menu \
+            --extra-file install_proxmenux.sh \
+            --extra-file install_proxmenux_beta.sh \
+            --output-dir lang \
+            --provider googletrans \
+            $REFRESH_FLAG
+
+      - name: Commit + push if changed
+        run: |
+          if git diff --quiet -- lang/; then
+            echo "No translation changes — skipping commit."
+            exit 0
+          fi
+          git config user.name  "ProxMenuxBot"
+          git config user.email "bot@proxmenux.local"
+          git add lang/
+          git commit -m "chore(lang): auto-rebuild translation cache
+
+          Source: ${GITHUB_SHA::7}
+          Triggered by: ${{ github.event_name }}"
+          git push origin develop
diff --git a/AppImage/ProxMenux-1.2.2.AppImage b/AppImage/ProxMenux-1.2.2.AppImage
deleted file mode 100755
index 74c81a32..00000000
Binary files a/AppImage/ProxMenux-1.2.2.AppImage and /dev/null differ
diff --git a/AppImage/ProxMenux-1.2.3.AppImage b/AppImage/ProxMenux-1.2.3.AppImage
new file mode 100755
index 00000000..1c7f21dd
Binary files /dev/null and b/AppImage/ProxMenux-1.2.3.AppImage differ
diff --git a/AppImage/ProxMenux-Monitor.AppImage.sha256 b/AppImage/ProxMenux-Monitor.AppImage.sha256
index 0a4c8f89..c3dd36ec 100644
--- a/AppImage/ProxMenux-Monitor.AppImage.sha256
+++ b/AppImage/ProxMenux-Monitor.AppImage.sha256
@@ -1 +1 @@
-e0128ac327ea74b645b37bcfab03aa744f067a355f9960a822b411c6ac75cb02  ProxMenux-1.2.2.AppImage
+4a4f069f6e1dc78fc16741b810bfb38ad1c2fc08e4f06490901bfe2b42a6a560  ProxMenux-1.2.3.AppImage
diff --git a/AppImage/README.md b/AppImage/README.md
index 28ba074b..8c221020 100644
--- a/AppImage/README.md
+++ b/AppImage/README.md
@@ -27,19 +27,97 @@ A modern, responsive dashboard for monitoring Proxmox VE systems built with Next
 
 ## Overview
 
-**ProxMenux Monitor** is a comprehensive, real-time monitoring dashboard for Proxmox VE environments. Built with modern web technologies, it provides an intuitive interface to monitor system resources, virtual machines, containers, storage, network traffic, and system logs.
+**ProxMenux Monitor** is a comprehensive, real-time monitoring dashboard for Proxmox VE environments. Built with modern web technologies, it provides an intuitive interface to monitor system resources, virtual machines, containers, storage, network traffic, backups, health status and system logs — all from a single browser tab.
 
 The application runs as a standalone AppImage on your Proxmox server and serves a web interface accessible from any device on your network.
 
+**Full documentation:** [proxmenux.com/docs/monitor](https://proxmenux.com/docs/monitor) — per-feature walkthroughs, API reference and integration guides.
+
 
 ## Screenshots
 
-Get a quick overview of ProxMenux Monitor's main features:
+A tour of the Monitor's main areas. See the [public documentation](https://proxmenux.com/docs/monitor) for the full walkthrough.
+
+### Dashboard overview
 
 <p align="center">
-  <img src="public/images/onboarding/imagen1.png" alt="Overview Dashboard" width="800"/>
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/dashboard-home.png" alt="Dashboard home" width="900"/>
   <br/>
-  <em>System Overview - Monitor CPU, memory, temperature, and uptime in real-time</em>
+  <em>Real-time CPU, memory, temperature, storage and network activity on one glance-optimised page.</em>
+</p>
+
+### Backup & Restore
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/images/docs/backup-restore/scheduled-backup-monitor.png" alt="Scheduled backup jobs" width="900"/>
+  <br/>
+  <em>Integrated host backup & restore — Local, PBS or Borg destinations; own timer or attached to a PVE vzdump job with live-inherited retention; PBS encryption with paired recovery blobs; direction-aware cross-kernel restore.</em>
+</p>
+
+### Storage & SMART
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/storage-top-row.png" alt="Storage top row" width="900"/>
+  <br/>
+  <em>Per-disk cards with capacity palette shared across Storage and Backups. USB-NVMe enclosures (ASMedia / JMicron / Realtek) show the drive's real identity and temperature, not the bridge.</em>
+</p>
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/disk-modal-smart.png" alt="Disk SMART modal" width="900"/>
+  <br/>
+  <em>Per-disk detail modal — SMART attributes, temperature history, observations and downloadable PDF report.</em>
+</p>
+
+### Network — live topology
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/network-flow-overview.png" alt="Network Flow diagram" width="900"/>
+  <br/>
+  <em>Network Flow — live view of NICs → host → bridges → guests with animated rx / tx pulses on every link. Bridges without active guests are hidden.</em>
+</p>
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/network-latency-historical.png" alt="Network latency historical" width="900"/>
+  <br/>
+  <em>Latency modal — historical view and real-time ping test against Gateway / Cloudflare / Google, with a downloadable PDF report.</em>
+</p>
+
+### Virtual machines & LXCs
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/vms-top-row.png" alt="VMs & LXCs overview" width="900"/>
+  <br/>
+  <em>Inventory of running VMs and containers with resource usage and per-guest controls.</em>
+</p>
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/vms-modal-status.png" alt="VM detail modal — status" width="900"/>
+  <br/>
+  <em>Per-guest modal with status, backups, mounts and (for LXC) apt / apk / community-scripts update inventory.</em>
+</p>
+
+### Health Monitor
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/health-monitor.png" alt="Health Monitor" width="900"/>
+  <br/>
+  <em>Ten categories of proactive health checks with hysteresis, per-error dismiss (24 h / 7 d / permanent) and an Active Suppressions panel to revoke.</em>
+</p>
+
+### System overview — top processes
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/system-overview-top-processes.png" alt="Top processes" width="900"/>
+  <br/>
+  <em>Per-process CPU / memory / I/O sorted by consumer, with a click-through detail modal.</em>
+</p>
+
+### Mobile
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/mobile-home.png" alt="Mobile responsive layout" width="360"/>
+  <br/>
+  <em>Fully responsive — every panel adapts to phone and tablet layouts.</em>
 </p>
 
 
@@ -47,18 +125,21 @@ Get a quick overview of ProxMenux Monitor's main features:
 
 ## Features
 
-- **System Overview**: Real-time monitoring of CPU, memory, temperature, and system uptime
-- **Storage Management**: Visual representation of storage distribution, disk health, and SMART data
-- **Network Monitoring**: Network interface statistics, real-time traffic graphs, and bandwidth usage
-- **Virtual Machines & LXC**: Comprehensive view of all VMs and containers with resource usage and controls
-- **Hardware Information**: Detailed hardware specifications including CPU, GPU, PCIe devices, and disks
-- **System Logs**: Real-time system log monitoring with filtering and search capabilities
-- **Health Monitoring**: Proactive system health checks with persistent error tracking
-- **Authentication & 2FA**: Optional password protection with TOTP-based two-factor authentication
-- **RESTful API**: Complete API access for integrations with Homepage, Home Assistant, and custom dashboards
-- **Dark/Light Theme**: Toggle between themes with Proxmox-inspired design
-- **Responsive Design**: Works seamlessly on desktop, tablet, and mobile devices
-- **Release Notes**: Automatic notifications of new features and improvements
+- **Host Backup & Restore** — integrated section covering Local, PBS and Borg destinations; schedule with a systemd timer or attach to an existing PVE vzdump job; PBS encryption with paired recovery blobs; direction-aware cross-kernel restore with kernel-agnostic hydration (IOMMU / VFIO / GRUB), cascade-safe package replay, and NIC auto-remap by MAC after a motherboard swap
+- **System Overview** — real-time CPU / memory / temperature / uptime with a per-process drill-down (Top Processes view) and click-through detail modal
+- **Storage & SMART** — per-disk cards in a responsive grid; temperature history, SMART attributes and a downloadable PDF SMART report per drive. USB-NVMe bridges (ASMedia / JMicron / Realtek) show the real drive's identity and temperature instead of the enclosure's
+- **Network** — live topology (Network Flow) with animated rx / tx pulses, per-interface RRD charts, latency modal against Gateway / Cloudflare / Google with a downloadable PDF report
+- **Virtual Machines & LXCs** — inventory, per-guest metrics and controls, per-LXC update inventory (apt / apk / community-scripts), backup state, mount inspection
+- **Hardware** — CPU / GPU / PCIe / disks / NICs, with correct SSD vs HDD classification even behind USB-SATA bridges
+- **System Logs** — journalctl with severity / since / free-text filters and a download-as-text action
+- **Health Monitor** — ten categories of proactive checks with hysteresis and configurable thresholds; per-error dismiss (24 h / 7 d / permanent) and an Active Suppressions panel to revoke
+- **Notifications** — five channels (Telegram, Discord, Gotify, Email, Apprise for ~80 endpoints), per-event toggles, Quiet Hours, Daily Digest, optional AI enrichment (Groq / OpenAI / Ollama / Gemini / Anthropic / OpenRouter)
+- **Authentication & 2FA** — optional password protection with TOTP-based two-factor authentication and long-lived API tokens (365 days) for integrations
+- **RESTful API** — complete access with JWT auth; ready-made recipes for Homepage, Home Assistant and custom dashboards; Prometheus scrape endpoint
+- **Reports (PDF)** — SMART report per-disk and Network Latency report per-target, ready to send to a vendor or an ISP
+- **Dark / Light Theme** — Proxmox-inspired palette with live switch
+- **Responsive Design** — desktop, tablet and mobile layouts
+- **Release Notes** — automatic notification of new features on each Monitor upgrade
 
 ## Technology Stack
 
@@ -106,7 +187,7 @@ On first launch, you'll be presented with three options:
 2. **Enable 2FA** - Add TOTP-based two-factor authentication for enhanced security
 3. **Skip** - Continue without authentication (not recommended for production environments)
 
-![Authentication Setup](AppImage/public/images/docs/auth-setup.png)
+![Authentication Setup](https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/auth-setup.png)
 
 ### Two-Factor Authentication (2FA)
 
@@ -118,7 +199,7 @@ After setting up your password, you can enable 2FA using any TOTP authenticator
 4. Enter the 6-digit code to verify
 5. Save your backup codes in a secure location
 
-![2FA Setup](AppImage/public/images/docs/2fa-setup.png)
+![2FA Setup](https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/2fa-setup.png)
 
 ### Security Best Practices for API Tokens
 
@@ -254,7 +335,7 @@ The easiest way to generate an API token is through the ProxMenux Monitor web in
 6. Click **Generate Token**
 7. Copy the token immediately - it will not be shown again
 
-![Generate API Token](AppImage/public/images/docs/generate-api-token.png)
+![Generate API Token](https://raw.githubusercontent.com/MacRimi/ProxMenux/main/web/public/monitor/api-tokens.png)
 
 The token will be valid for **365 days** (1 year) and can be used for integrations with Homepage, Home Assistant, or any custom application.
 
@@ -643,8 +724,6 @@ Finally, reference the secret in your `services.yaml`:
           format: bytes
 ```
 
-![Homepage Integration Example](AppImage/public/images/docs/homepage-integration.png)
-
 ### Home Assistant Integration
 
 [Home Assistant](https://www.home-assistant.io/) is an open-source home automation platform.
@@ -727,24 +806,13 @@ entities:
     icon: mdi:clock-outline
 ```
 
-![Home Assistant Integration Example](AppImage/public/images/docs/homeassistant-integration.png)
-
-
 ---
 
 ## License
 
-This project is licensed under the **Creative Commons Attribution-NonCommercial 4.0 International License (CC BY-NC 4.0)**.
+This project is licensed under the **GNU General Public License, version 3 (GPL-3.0)**.
 
-You are free to:
-- Share — copy and redistribute the material in any medium or format
-- Adapt — remix, transform, and build upon the material
-
-Under the following terms:
-- Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made
-- NonCommercial — You may not use the material for commercial purposes
-
-For more details, see the [full license](https://creativecommons.org/licenses/by-nc/4.0/).
+You are free to use, study, share and modify the software under the terms of the licence. Any distributed derivative work must be licensed under the same terms and include the full source code — see the [full licence text](https://www.gnu.org/licenses/gpl-3.0.html) or the [`LICENSE`](https://github.com/MacRimi/ProxMenux/blob/main/LICENSE) file at the repository root.
 
 
 
diff --git a/AppImage/app/layout.tsx b/AppImage/app/layout.tsx
index 1f13d3e9..2dd4be27 100644
--- a/AppImage/app/layout.tsx
+++ b/AppImage/app/layout.tsx
@@ -3,6 +3,7 @@ import type { Metadata, Viewport } from "next"
 import { GeistSans } from "geist/font/sans"
 import { GeistMono } from "geist/font/mono"
 import { ThemeProvider } from "../components/theme-provider"
+import { PwaRegister } from "../components/pwa-register"
 import { Suspense } from "react"
 import "./globals.css"
 
@@ -46,6 +47,7 @@ export default function RootLayout({
             {children}
           </ThemeProvider>
         </Suspense>
+        <PwaRegister />
       </body>
     </html>
   )
diff --git a/AppImage/components/disk-temperature-card.tsx b/AppImage/components/disk-temperature-card.tsx
index b892f0cb..1a9904e8 100644
--- a/AppImage/components/disk-temperature-card.tsx
+++ b/AppImage/components/disk-temperature-card.tsx
@@ -3,7 +3,7 @@
 import { useEffect, useRef, useState } from "react"
 import { Thermometer } from "lucide-react"
 import { Badge } from "./ui/badge"
-import { AreaChart, Area, ResponsiveContainer, Tooltip } from "recharts"
+import { AreaChart, Area, ResponsiveContainer, Tooltip, YAxis } from "recharts"
 import { fetchApi } from "@/lib/api-config"
 import { useDiskTempThresholds } from "@/lib/health-thresholds"
 
@@ -64,8 +64,11 @@ export function DiskTemperatureCard({
     const fetchHistory = async () => {
       setLoading(true)
       try {
+        // 24-h timeframe gives a more useful "is this drive trending
+        // up over a day" view; the 1-h window was too short to spot
+        // anything that mattered.
         const result = await fetchApi<{ data: TempPoint[] }>(
-          `/api/disk/${encodeURIComponent(diskName)}/temperature/history?timeframe=hour`,
+          `/api/disk/${encodeURIComponent(diskName)}/temperature/history?timeframe=day`,
         )
         if (cancelled.current) return
         setData(result?.data || [])
@@ -142,6 +145,18 @@ export function DiskTemperatureCard({
                   <stop offset="100%" stopColor={lineColor} stopOpacity={0.02} />
                 </linearGradient>
               </defs>
+              {/* Y domain is computed the same way the detail modal
+                  does — floor(min−3) / ceil(max+3), floor at 0 — so
+                  the line shape here matches the bigger chart instead
+                  of recharts' auto-domain collapsing 24 → 29 °C into
+                  a near-flat line that doesn't look like the modal. */}
+              <YAxis
+                hide
+                domain={[
+                  (dataMin: number) => Math.max(0, Math.floor(dataMin - 3)),
+                  (dataMax: number) => Math.ceil(dataMax + 3),
+                ]}
+              />
               <Tooltip content={<MiniTooltip />} cursor={{ stroke: lineColor, strokeOpacity: 0.3, strokeWidth: 1 }} />
               <Area
                 type="monotone"
diff --git a/AppImage/components/hardware.tsx b/AppImage/components/hardware.tsx
index d986d7c4..28487e73 100644
--- a/AppImage/components/hardware.tsx
+++ b/AppImage/components/hardware.tsx
@@ -7,6 +7,7 @@ import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } f
 import { Cpu, HardDrive, Thermometer, Zap, Loader2, CpuIcon, Cpu as Gpu, Network, MemoryStick, PowerIcon, FanIcon, Battery, Usb, BrainCircuit, AlertCircle } from "lucide-react"
 import { Download } from "lucide-react"
 import { Button } from "@/components/ui/button"
+import { getDiskType } from "../lib/disk-type"
 import useSWR from "swr"
 import { useState, useEffect } from "react"
 import {
@@ -2460,25 +2461,10 @@ return (
               )
               .map((device, index) => {
                 const getDiskTypeBadge = (diskName: string, rotationRate: number | string | undefined) => {
-                  let diskType = "HDD"
-
-                  // Check if it's NVMe
-                  if (diskName.startsWith("nvme")) {
-                    diskType = "NVMe"
-                  }
-                  // Check rotation rate for SSD vs HDD
-                  else if (rotationRate !== undefined && rotationRate !== null) {
-                    // Handle both number and string formats
-                    const rateNum = typeof rotationRate === "string" ? Number.parseInt(rotationRate) : rotationRate
-                    if (rateNum === 0 || isNaN(rateNum)) {
-                      diskType = "SSD"
-                    }
-                  }
-                  // If rotation_rate is "Solid State Device" string
-                  else if (typeof rotationRate === "string" && rotationRate.includes("Solid State")) {
-                    diskType = "SSD"
-                  }
-
+                  // Classifier lives in lib/disk-type.ts — same rules
+                  // the Storage page uses, so a drive can't show up as
+                  // HDD here while showing as SSD there.
+                  const diskType = getDiskType(diskName, rotationRate)
                   const badgeStyles: Record<string, { className: string; label: string }> = {
                     NVMe: {
                       className: "bg-purple-500/10 text-purple-500 border-purple-500/20",
@@ -2600,38 +2586,22 @@ return (
               <div className="flex justify-between border-b border-border/50 pb-2">
                 <span className="text-sm font-medium text-muted-foreground">Type</span>
                 {(() => {
-                  const getDiskTypeBadge = (diskName: string, rotationRate: number | string | undefined) => {
-                    let diskType = "HDD"
-
-                    if (diskName.startsWith("nvme")) {
-                      diskType = "NVMe"
-                    } else if (rotationRate !== undefined && rotationRate !== null) {
-                      const rateNum = typeof rotationRate === "string" ? Number.parseInt(rotationRate) : rotationRate
-                      if (rateNum === 0 || isNaN(rateNum)) {
-                        diskType = "SSD"
-                      }
-                    } else if (typeof rotationRate === "string" && rotationRate.includes("Solid State")) {
-                      diskType = "SSD"
-                    }
-
-                    const badgeStyles: Record<string, { className: string; label: string }> = {
-                      NVMe: {
-                        className: "bg-purple-500/10 text-purple-500 border-purple-500/20",
-                        label: "NVMe SSD",
-                      },
-                      SSD: {
-                        className: "bg-cyan-500/10 text-cyan-500 border-cyan-500/20",
-                        label: "SSD",
-                      },
-                      HDD: {
-                        className: "bg-blue-500/10 text-blue-500 border-blue-500/20",
-                        label: "HDD",
-                      },
-                    }
-                    return badgeStyles[diskType]
+                  const diskType = getDiskType(selectedDisk.name, selectedDisk.rotation_rate)
+                  const badgeStyles: Record<string, { className: string; label: string }> = {
+                    NVMe: {
+                      className: "bg-purple-500/10 text-purple-500 border-purple-500/20",
+                      label: "NVMe SSD",
+                    },
+                    SSD: {
+                      className: "bg-cyan-500/10 text-cyan-500 border-cyan-500/20",
+                      label: "SSD",
+                    },
+                    HDD: {
+                      className: "bg-blue-500/10 text-blue-500 border-blue-500/20",
+                      label: "HDD",
+                    },
                   }
-
-                  const diskBadge = getDiskTypeBadge(selectedDisk.name, selectedDisk.rotation_rate)
+                  const diskBadge = badgeStyles[diskType]
                   return <Badge className={diskBadge.className}>{diskBadge.label}</Badge>
                 })()}
               </div>
diff --git a/AppImage/components/health-thresholds.tsx b/AppImage/components/health-thresholds.tsx
index adcba2cb..935cc73c 100644
--- a/AppImage/components/health-thresholds.tsx
+++ b/AppImage/components/health-thresholds.tsx
@@ -250,6 +250,35 @@ function pathKey(path: string[]): string {
   return path.join("/")
 }
 
+// Trim the visible slider range to a window around the saved +
+// recommended values so the track has usable resolution (e.g. CPU
+// 60–100 instead of the backend's 0–100). Derived from stable inputs
+// so the range does NOT shift under an active drag.
+function computeVisualRange(
+  values: number[],
+  backendMin: number,
+  backendMax: number,
+  step: number,
+): { min: number; max: number } {
+  const totalRange = Math.max(1, backendMax - backendMin)
+  // Margin ≈ 25% of total range, clamped to at least 5 steps so tiny
+  // step sizes (e.g. step=1 on 0–100) still get a usable window.
+  const rawMargin = Math.max(step * 5, Math.round(totalRange * 0.25))
+  const lo = Math.min(...values)
+  const hi = Math.max(...values)
+  const snap = (n: number) => Math.round(n / step) * step
+  let visMin = Math.max(backendMin, snap(lo - rawMargin))
+  let visMax = Math.min(backendMax, snap(hi + rawMargin))
+  // Ensure the window is at least 4 steps wide so the slider has
+  // room to move even if all inputs collapse to one value.
+  if (visMax - visMin < step * 4) {
+    const mid = (visMax + visMin) / 2
+    visMin = Math.max(backendMin, snap(mid - step * 2))
+    visMax = Math.min(backendMax, snap(mid + step * 2))
+  }
+  return { min: visMin, max: visMax }
+}
+
 // ─── Component ───────────────────────────────────────────────────────────────
 
 export function HealthThresholds() {
@@ -394,29 +423,13 @@ export function HealthThresholds() {
   }
 
   const renderField = (path: string[], label: string) => {
+    // Kept for single-value leaves that don't have a warn/crit pair
+    // (e.g. Memory's swap_critical). The pair-cases route to
+    // renderThresholdRange below.
     const leaf = getLeaf(tree, path)
     if (!leaf) return null
     const key = pathKey(path)
     const editingValue = pending[key] ?? String(leaf.value)
-    // Visual rules (rebuilt — the original used /40 opacity borders +
-    // a blue ring stacked on top of the colour border, both of which
-    // were nearly invisible in read-only mode and stacked weirdly when
-    // a value was customised):
-    //
-    //   • Read-only mode (editMode=false): keep severity colour on the
-    //     border at a higher opacity (/70 instead of /40) and on the
-    //     background (/10) so the field is clearly readable, and
-    //     restore foreground colour (no `opacity-70` washout). This is
-    //     the default state the user sees most of the time — it must
-    //     match the visual weight of the rest of the Settings page.
-    //   • Edit mode + value matches the recommended default: severity
-    //     border + soft severity bg, same as read-only.
-    //   • Edit mode + value customised: ONE border in blue, replacing
-    //     (not stacking on top of) the severity border. This is the
-    //     single signal that "this value differs from recommended".
-    //
-    // `swap_critical` and any other `*_critical` leaf falls into the
-    // red bucket via the substring check.
     const last = path[path.length - 1] || ""
     const isCritical = last.toLowerCase().includes("critical")
     const isWarning = last.toLowerCase().includes("warning")
@@ -456,6 +469,206 @@ export function HealthThresholds() {
     )
   }
 
+  // Single-handle slider for thresholds that don't have a warn/crit
+  // pair (only Memory's swap_critical today). Same visual language as
+  // the dual-handle: red handle, value above, OK / CRIT zones below
+  // — so the operator doesn't read it as a different control.
+  const renderSingleThresholdSlider = (path: string[], severity: "warning" | "critical" = "critical") => {
+    const leaf = getLeaf(tree, path)
+    if (!leaf) return null
+    const key = pathKey(path)
+    const val = Number(pending[key] ?? leaf.value)
+    const step = leaf.step || 1
+    const unit = leaf.unit || ""
+    const { min, max } = computeVisualRange(
+      [leaf.value, leaf.recommended],
+      leaf.min,
+      leaf.max,
+      step,
+    )
+    const pct = ((Math.max(min, Math.min(max, val)) - min) / (max - min)) * 100
+    const custom = leaf.customised && !(key in pending)
+    const color = severity === "critical" ? "red" : "amber"
+    const handleClass = severity === "critical"
+      ? "[&::-webkit-slider-thumb]:bg-red-500 [&::-moz-range-thumb]:bg-red-500"
+      : "[&::-webkit-slider-thumb]:bg-amber-500 [&::-moz-range-thumb]:bg-amber-500"
+    const numberColor = custom
+      ? "text-blue-400"
+      : severity === "critical"
+        ? "text-red-500"
+        : "text-amber-500"
+    const fillColor = severity === "critical" ? "bg-red-500/30" : "bg-amber-500/30"
+
+    return (
+      <div className="px-1 py-3">
+        <div className="relative h-6 sm:h-5 mb-1 select-none">
+          <span
+            className={`absolute -translate-x-1/2 text-xs font-semibold tabular-nums ${numberColor}`}
+            style={{ left: `${pct}%` }}
+          >
+            {val}{unit}
+          </span>
+        </div>
+        <div className="relative h-9 sm:h-6">
+          <div className="absolute inset-x-0 top-1/2 -translate-y-1/2 h-1.5 rounded-full bg-muted" />
+          <div
+            className={`absolute top-1/2 -translate-y-1/2 h-1.5 rounded-r-full ${fillColor}`}
+            style={{ left: `${pct}%`, right: 0 }}
+          />
+          <input
+            type="range"
+            min={min}
+            max={max}
+            step={step}
+            disabled={!editMode}
+            value={val}
+            onChange={(e) => setPending((p) => ({ ...p, [key]: e.target.value }))}
+            className={`absolute inset-0 w-full appearance-none bg-transparent pointer-events-none [&::-webkit-slider-thumb]:pointer-events-auto [&::-moz-range-thumb]:pointer-events-auto [&::-webkit-slider-thumb]:appearance-none [&::-webkit-slider-thumb]:h-8 [&::-webkit-slider-thumb]:w-8 sm:[&::-webkit-slider-thumb]:h-4 sm:[&::-webkit-slider-thumb]:w-4 [&::-webkit-slider-thumb]:rounded-full [&::-webkit-slider-thumb]:border-2 [&::-webkit-slider-thumb]:border-background [&::-webkit-slider-thumb]:shadow [&::-moz-range-thumb]:h-8 [&::-moz-range-thumb]:w-8 sm:[&::-moz-range-thumb]:h-4 sm:[&::-moz-range-thumb]:w-4 [&::-moz-range-thumb]:rounded-full [&::-moz-range-thumb]:border-2 [&::-moz-range-thumb]:border-background ${handleClass}`}
+            title={`Recommended: ${leaf.recommended}${unit}`}
+          />
+        </div>
+        <div className="grid grid-cols-2 gap-2 mt-1.5 text-[10px] uppercase tracking-wider text-muted-foreground">
+          <span>OK &lt; {val}{unit}</span>
+          <span className="text-right">{severity === "critical" ? "CRIT" : "WARN"} &gt; {val}{unit}</span>
+        </div>
+      </div>
+    )
+  }
+
+  // Dual-handle range slider replacing the two stacked number inputs
+  // for warn/crit pairs. Visual model: a horizontal track split into
+  // three zones — OK (left of warning, muted), WARN→CRIT (between
+  // handles, amber-to-red gradient), and OVER-CRIT (right of critical,
+  // dark red overlay). The handles themselves stay coloured (amber for
+  // warning, red for critical) so the operator reads the same severity
+  // mapping they're used to from the old inputs. Numbers ride above
+  // each handle and double as a click-to-edit affordance — clicking a
+  // number swaps it for a tight `<Input type="number">` so precise
+  // values are still keyboard-friendly. Customised values surface as a
+  // small blue dot on the affected handle (same signal as the old blue
+  // ring, less visual weight).
+  const renderThresholdRange = (
+    basePath: string[],
+    options?: { hideLabels?: boolean }
+  ) => {
+    const wPath = [...basePath, "warning"]
+    const cPath = [...basePath, "critical"]
+    const wLeaf = getLeaf(tree, wPath)
+    const cLeaf = getLeaf(tree, cPath)
+    if (!wLeaf || !cLeaf) return null
+
+    const wKey = pathKey(wPath)
+    const cKey = pathKey(cPath)
+    const wVal = Number(pending[wKey] ?? wLeaf.value)
+    const cVal = Number(pending[cKey] ?? cLeaf.value)
+
+    // Backend validates warning <= critical on save.
+    const step = Math.max(wLeaf.step, cLeaf.step) || 1
+    const backendMin = Math.min(wLeaf.min, cLeaf.min)
+    const backendMax = Math.max(wLeaf.max, cLeaf.max)
+    const { min, max } = computeVisualRange(
+      [wLeaf.value, cLeaf.value, wLeaf.recommended, cLeaf.recommended],
+      backendMin,
+      backendMax,
+      step,
+    )
+    const pct = (v: number) => ((Math.max(min, Math.min(max, v)) - min) / (max - min)) * 100
+    const wPct = pct(wVal)
+    const cPct = pct(cVal)
+    const unit = wLeaf.unit || cLeaf.unit || ""
+
+    const wCustom = wLeaf.customised && !(wKey in pending)
+    const cCustom = cLeaf.customised && !(cKey in pending)
+
+    const setVal = (key: string, value: number, peer: number, isWarn: boolean) => {
+      // Clamp on the fly: warning can't cross critical and vice-versa,
+      // matching the backend invariant so the user can't drag into an
+      // invalid state.
+      let v = value
+      if (isWarn && v >= peer) v = peer - step
+      if (!isWarn && v <= peer) v = peer + step
+      setPending((p) => ({ ...p, [key]: String(v) }))
+    }
+
+    return (
+      <div className="px-1 py-3">
+        {/* Numeric labels above each handle, positioned absolutely so
+            they ride above the corresponding thumb regardless of the
+            slider width. Pointer events disabled so they don't steal
+            clicks from the underlying range inputs. */}
+        <div className="relative h-6 sm:h-5 mb-1 select-none">
+          <span
+            className={`absolute -translate-x-1/2 text-xs font-semibold tabular-nums ${wCustom ? "text-blue-400" : "text-amber-500"}`}
+            style={{ left: `${wPct}%` }}
+          >
+            {wVal}{unit}
+          </span>
+          <span
+            className={`absolute -translate-x-1/2 text-xs font-semibold tabular-nums ${cCustom ? "text-blue-400" : "text-red-500"}`}
+            style={{ left: `${cPct}%` }}
+          >
+            {cVal}{unit}
+          </span>
+        </div>
+
+        {/* Two range inputs stacked. Mobile track box is taller so the
+            enlarged thumbs (h-7) have room to sit without clipping. */}
+        <div className="relative h-9 sm:h-6">
+          {/* Background track: OK zone (muted) running the full width */}
+          <div className="absolute inset-x-0 top-1/2 -translate-y-1/2 h-1.5 rounded-full bg-muted" />
+          {/* Warn-to-Crit gradient between the two handles */}
+          <div
+            className="absolute top-1/2 -translate-y-1/2 h-1.5 rounded-full"
+            style={{
+              left: `${wPct}%`,
+              width: `${Math.max(0, cPct - wPct)}%`,
+              background: "linear-gradient(90deg, rgb(245 158 11), rgb(239 68 68))",
+            }}
+          />
+          {/* OVER-CRIT zone (right of critical) — solid red dim */}
+          <div
+            className="absolute top-1/2 -translate-y-1/2 h-1.5 rounded-r-full bg-red-500/30"
+            style={{ left: `${cPct}%`, right: 0 }}
+          />
+          {/* Two superposed range inputs. Pointer-events on the thumb
+              only, so the inert track bar above stays visible. */}
+          <input
+            type="range"
+            min={min}
+            max={max}
+            step={step}
+            disabled={!editMode}
+            value={wVal}
+            onChange={(e) => setVal(wKey, Number(e.target.value), cVal, true)}
+            className="absolute inset-0 w-full appearance-none bg-transparent pointer-events-none [&::-webkit-slider-thumb]:pointer-events-auto [&::-moz-range-thumb]:pointer-events-auto [&::-webkit-slider-thumb]:appearance-none [&::-webkit-slider-thumb]:h-8 [&::-webkit-slider-thumb]:w-8 sm:[&::-webkit-slider-thumb]:h-4 sm:[&::-webkit-slider-thumb]:w-4 [&::-webkit-slider-thumb]:rounded-full [&::-webkit-slider-thumb]:bg-amber-500 [&::-webkit-slider-thumb]:border-2 [&::-webkit-slider-thumb]:border-background [&::-webkit-slider-thumb]:shadow [&::-moz-range-thumb]:h-8 [&::-moz-range-thumb]:w-8 sm:[&::-moz-range-thumb]:h-4 sm:[&::-moz-range-thumb]:w-4 [&::-moz-range-thumb]:rounded-full [&::-moz-range-thumb]:bg-amber-500 [&::-moz-range-thumb]:border-2 [&::-moz-range-thumb]:border-background"
+            title={`Warning (recommended: ${wLeaf.recommended}${unit})`}
+          />
+          <input
+            type="range"
+            min={min}
+            max={max}
+            step={step}
+            disabled={!editMode}
+            value={cVal}
+            onChange={(e) => setVal(cKey, Number(e.target.value), wVal, false)}
+            className="absolute inset-0 w-full appearance-none bg-transparent pointer-events-none [&::-webkit-slider-thumb]:pointer-events-auto [&::-moz-range-thumb]:pointer-events-auto [&::-webkit-slider-thumb]:appearance-none [&::-webkit-slider-thumb]:h-8 [&::-webkit-slider-thumb]:w-8 sm:[&::-webkit-slider-thumb]:h-4 sm:[&::-webkit-slider-thumb]:w-4 [&::-webkit-slider-thumb]:rounded-full [&::-webkit-slider-thumb]:bg-red-500 [&::-webkit-slider-thumb]:border-2 [&::-webkit-slider-thumb]:border-background [&::-webkit-slider-thumb]:shadow [&::-moz-range-thumb]:h-8 [&::-moz-range-thumb]:w-8 sm:[&::-moz-range-thumb]:h-4 sm:[&::-moz-range-thumb]:w-4 [&::-moz-range-thumb]:rounded-full [&::-moz-range-thumb]:bg-red-500 [&::-moz-range-thumb]:border-2 [&::-moz-range-thumb]:border-background"
+            title={`Critical (recommended: ${cLeaf.recommended}${unit})`}
+          />
+        </div>
+
+        {/* Zone labels — explicit ranges so the operator knows where
+            "warn" starts and ends without having to read the handles. */}
+        {!options?.hideLabels && (
+          <div className="grid grid-cols-3 gap-2 mt-1.5 text-[10px] uppercase tracking-wider text-muted-foreground">
+            <span>OK &lt; {wVal}{unit}</span>
+            <span className="text-center">WARN {wVal}–{cVal}{unit}</span>
+            <span className="text-right">CRIT &gt; {cVal}{unit}</span>
+          </div>
+        )}
+      </div>
+    )
+  }
+
   return (
     <Card>
       <CardHeader>
@@ -518,9 +731,9 @@ export function HealthThresholds() {
         </div>
         <CardDescription>
           The Health Monitor and notifications fire when these thresholds are crossed.
-          Amber inputs are warning levels, red inputs are critical levels. A blue ring
-          marks a value you've customised away from the recommended default — hover the
-          field to see the recommendation, or use Reset to restore it.
+          Drag the amber handle to set the warning level and the red handle to set the
+          critical level. Values that differ from the recommended default appear in blue —
+          hover a handle to see the recommendation, or use Reset to restore it.
         </CardDescription>
       </CardHeader>
       <CardContent>
@@ -556,7 +769,7 @@ export function HealthThresholds() {
                       <Icon className="h-4 w-4 text-muted-foreground flex-shrink-0" />
                       <h4 className="text-sm font-medium">{section.title}</h4>
                     </div>
-                    {!editMode && (
+                    {editMode && (
                       <button
                         className="h-6 w-6 rounded-md text-muted-foreground hover:bg-muted hover:text-foreground transition-colors flex items-center justify-center"
                         onClick={() => handleResetSection(section.id)}
@@ -571,18 +784,51 @@ export function HealthThresholds() {
                       {section.description}
                     </p>
                   )}
-                  <div className="divide-y divide-border/40">
-                    {section.rowGroups
-                      ? section.rowGroups.map((group) => (
-                          <div key={group.subKey} className="py-1.5">
-                            <div className="text-[11px] uppercase tracking-wider text-muted-foreground mb-0.5 px-1">
-                              {group.label}
-                            </div>
-                            {renderField([section.id, group.subKey, "warning"], "Warning")}
-                            {renderField([section.id, group.subKey, "critical"], "Critical")}
+                  <div>
+                    {section.rowGroups ? (
+                      // Per-class disk temperature: one slider per row
+                      // (HDD / SSD / NVMe / SAS). Group label sits on
+                      // top of each slider so the operator scans the
+                      // column from top down without losing context.
+                      section.rowGroups.map((group) => (
+                        <div key={group.subKey} className="py-1.5 border-b border-border/40 last:border-b-0">
+                          <div className="text-[11px] uppercase tracking-wider text-muted-foreground px-1">
+                            {group.label}
                           </div>
-                        ))
-                      : section.fields.map((f) => renderField(f.path, f.label))}
+                          {renderThresholdRange([section.id, group.subKey])}
+                        </div>
+                      ))
+                    ) : section.id === "memory" ? (
+                      // Memory & Swap is special: warn/crit pair for
+                      // RAM, plus a single Swap threshold that has no
+                      // companion (it's a "critical only" metric).
+                      // Both use sliders so the section reads as one
+                      // visual language end to end.
+                      <>
+                        <div className="text-[11px] uppercase tracking-wider text-muted-foreground px-1">
+                          RAM
+                        </div>
+                        {renderThresholdRange(["memory"])}
+                        <div className="border-t border-border/40">
+                          <div className="text-[11px] uppercase tracking-wider text-muted-foreground px-1 pt-1.5">
+                            Swap (critical only)
+                          </div>
+                          {renderSingleThresholdSlider(["memory", "swap_critical"], "critical")}
+                        </div>
+                      </>
+                    ) : section.fields.length === 2 &&
+                      section.fields[0].path[section.fields[0].path.length - 1] === "warning" &&
+                      section.fields[1].path[section.fields[1].path.length - 1] === "critical" ? (
+                      // Generic warn+crit pair (CPU, CPU temp, storage
+                      // capacities …) → single slider.
+                      renderThresholdRange([section.id])
+                    ) : (
+                      // Fallback for any future section shape — keep
+                      // the original per-field number inputs.
+                      <div className="divide-y divide-border/40">
+                        {section.fields.map((f) => renderField(f.path, f.label))}
+                      </div>
+                    )}
                   </div>
                 </div>
               )
diff --git a/AppImage/components/host-backup.tsx b/AppImage/components/host-backup.tsx
new file mode 100644
index 00000000..2759a837
--- /dev/null
+++ b/AppImage/components/host-backup.tsx
@@ -0,0 +1,8923 @@
+"use client"
+
+import { useState, useEffect, useRef } from "react"
+import useSWR from "swr"
+import { Card, CardContent, CardHeader, CardTitle } from "./ui/card"
+import { Button } from "./ui/button"
+import { Badge } from "./ui/badge"
+import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription, DialogFooter } from "./ui/dialog"
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
+import { Input } from "./ui/input"
+import { Label } from "./ui/label"
+import { Checkbox } from "./ui/checkbox"
+import { ScrollArea } from "./ui/scroll-area"
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "./ui/tabs"
+import {
+  DatabaseBackup,
+  Clock,
+  HardDrive,
+  Server,
+  CheckCircle2,
+  AlertTriangle,
+  XCircle,
+  Loader2,
+  PlayCircle,
+  Archive,
+  FileSearch,
+  Calendar,
+  Trash2,
+  Plus,
+  ChevronRight,
+  ChevronLeft,
+  Pencil,
+  Save,
+  Download,
+  FileText,
+  Power,
+  RefreshCw,
+  Lock,
+  Eye,
+  Network,
+  Cpu,
+  Package,
+  ShieldCheck,
+  Info,
+  ListTree,
+  History,
+} from "lucide-react"
+import { ScriptTerminalModal } from "./script-terminal-modal"
+import { RestoreProgressCard } from "./restore-progress-card"
+import { fetchApi, getApiUrl } from "../lib/api-config"
+import { fetchTerminalTicket } from "../lib/terminal-ws"
+import { formatStorage, formatBytes } from "../lib/utils"
+import { getStorageUsageColor } from "../lib/storage-usage-color"
+
+// ── Shape contracts with the backend (flask_server.py: api_host_backups_*) ──
+
+interface BackupJob {
+  id: string
+  destination: string
+  method: string                 // "pbs" | "borg" | "local" | "unknown"
+  on_calendar: string            // "OnCalendar=..." for timer jobs, "attached → storage:X" for attached
+  retention: string              // "last=5, daily=7, ..."
+  timer_enabled: boolean         // legacy — only meaningful for non-attached jobs
+  enabled: boolean               // unified state (timer for non-attached, ENABLED= for attached)
+  attached: boolean              // PVE vzdump-attached: no own timer, trigger from hook
+  pve_storage: string | null     // storage id the attached job listens for
+  profile_mode: string           // "default" | "custom"
+  manual: boolean                // MANUAL_RUN=1 — one-shot, no schedule, won't re-fire
+  last_status: string | null
+  next_run: string | null
+  // True when this job ships encrypted backups — PBS_KEYFILE set for
+  // PBS, or BORG_ENCRYPT_MODE != "none" for Borg. Drives the lock
+  // badge in the row + the toggle's initial state in Edit.
+  encrypted?: boolean
+}
+
+// Sprint H — remote backups (PBS + Borg). Listing is cheap (metadata
+// only); the heavy lifting happens on demand when the operator clicks
+// Download. Same shape for both backends so the UI renders them
+// uniformly — `backend` is the only switch.
+interface RemoteSnapshot {
+  backend: "pbs" | "borg"
+  repo_name: string
+  repo_repository: string
+  snapshot: string             // canonical id used to extract / restore
+  backup_type: string
+  backup_id: string
+  backup_time: number          // unix seconds
+  size_bytes: number           // 0 for Borg (omitted by `borg list`)
+  owner: string | null
+  protected: boolean
+  files: Array<{ filename: string; size: number }>
+  fingerprint: string | null
+  // Whether THIS snapshot is encrypted. For PBS it's derived from
+  // any file having crypt-mode != "none"; for Borg it follows the
+  // target's encrypt_mode.
+  encrypted?: boolean
+  borg_id?: string             // Borg-only fields when available
+  borg_start_iso?: string
+}
+
+interface RemoteArchivesResp {
+  snapshots: RemoteSnapshot[]
+  errors: Array<{ backend: string; repo_name: string; error: string }>
+}
+
+interface ExportTask {
+  task_id: string
+  backend: string
+  repo_name: string
+  snapshot: string
+  state: "queued" | "restoring" | "packing" | "completed" | "failed"
+  message: string
+  size_bytes: number
+  output_path: string | null
+  error: string | null
+}
+
+// Unified archive descriptor — local .tar.zst files and remote PBS /
+// Borg snapshots share the same row layout; `source` decides which
+// code paths apply (inline download vs export-then-download, manifest
+// available vs not, etc.).
+interface UnifiedArchive {
+  source: "local" | "pbs" | "borg"
+  display_id: string           // what shows in mono in the row
+  size_bytes: number
+  created_at: number           // unix seconds
+  source_label: string         // "/var/lib/vz/dump" or "PBS my-pbs" or "Borg my-borg"
+  // One of the two is populated depending on `source`.
+  local?: BackupArchive
+  remote?: RemoteSnapshot      // for both pbs and borg
+}
+
+interface BackupArchive {
+  id: string                     // basename of the .tar file (also the URL slug)
+  path: string                   // absolute path on host
+  size_bytes: number
+  mtime: number                  // unix seconds
+  // From the backend identifier — see _identify_host_backup() in flask_server.py.
+  // kind: "manual" / "scheduled" when we know; "legacy" when only the in-tar
+  //       marker confirmed it's a ProxMenux backup (no sidecar, no name match).
+  job_id: string | null
+  kind: "manual" | "scheduled" | "legacy"
+  profile: string | null
+  source_hostname: string | null
+  // Which detection path identified this archive. Surfaced as a small tooltip
+  // hint so the operator knows whether the metadata is authoritative
+  // (sidecar) or inferred (filename / tar-peek).
+  detected_via: "sidecar" | "job_id_match" | "hostcfg_prefix" | "tar_peek"
+}
+
+interface ManifestSourceHost {
+  hostname: string
+  pve_version: string | null
+  roles: string[]
+  kernel: string
+  boot_mode: string
+  cpu_model: string
+  memory_kb: number
+}
+
+interface PreflightCheck {
+  id: string
+  severity: "pass" | "warn" | "fail"
+  message: string
+  details: Record<string, unknown> | null
+}
+
+interface PreflightReport {
+  source_host_at_backup: ManifestSourceHost
+  selected_mode: {
+    mode: string
+    paths_include: string[]
+    paths_exclude: string[]
+    components_include: string[]
+    storage_apply: boolean
+    network_apply: boolean
+  }
+  preflight: {
+    checks: PreflightCheck[]
+    summary: { pass: number; warn: number; fail: number }
+  }
+  storage: {
+    zfs: Array<{ name: string; action: string; present: string[]; missing: string[] }>
+    lvm: Array<{ name: string; action: string }>
+    pve_storage: Array<{ id: string; type: string; action: string; note: string | null }>
+    in_selected_mode: boolean
+  }
+  network: {
+    keep: Array<{ ifname: string; mac: string }>
+    remap: Array<{ source_ifname: string; destination_ifname: string; mac: string }>
+    orphan: Array<{ source_ifname: string; source_mac: string }>
+    new: Array<{ ifname: string; mac: string }>
+    in_selected_mode: boolean
+  }
+  driver_reinstall: {
+    plan: Array<{
+      component_id: string
+      type: string
+      version: string
+      installer: string | null
+      action: string
+      reason: string
+    }>
+  }
+  abort_reason: string | null
+}
+
+const fetcher = async (url: string) => fetchApi(url)
+
+// Detect encrypted-backup key errors coming from proxmox-backup-client
+// and pull the manifest + provided fingerprints out of the message so
+// the UI can render them prominently instead of burying the info
+// inside a raw stack-trace-shaped string. Returns null when the error
+// is not encryption-related — the caller should fall back to plain
+// text rendering in that case.
+type KeyfileError = {
+  manifestFp: string | null
+  providedFp: string | null
+  raw: string
+}
+const parseKeyfileError = (raw: string): KeyfileError | null => {
+  if (!raw) return null
+  const lower = raw.toLowerCase()
+  if (!/missing key|wrong key|was created with key|manifest.?s key|does not match|no key found|unable to (load|read) key|failed to decrypt/.test(lower)) {
+    return null
+  }
+  const manifest = raw.match(/(?:was created with key|manifest'?s key)\s+([0-9a-f:]+)/i)
+  const provided = raw.match(/provided key\s+([0-9a-f:]+)/i)
+  return {
+    manifestFp: manifest?.[1] ?? null,
+    providedFp: provided?.[1] ?? null,
+    raw,
+  }
+}
+
+const KeyfileErrorBlock: React.FC<{ err: KeyfileError; className?: string }> = ({ err, className }) => (
+  <div className={`text-xs rounded-md border border-amber-500/40 bg-amber-500/10 text-amber-100 px-3 py-3 space-y-2 ${className ?? ""}`}>
+    <div className="flex items-start gap-2">
+      <Lock className="h-4 w-4 mt-0.5 shrink-0 text-amber-400" />
+      <div className="flex-1 min-w-0 space-y-1">
+        <div className="font-semibold text-amber-300">Encrypted backup — wrong keyfile on this host</div>
+        <div className="text-amber-100/90">
+          The keyfile installed here does not match the one used to create this backup, so PBS refuses to open it.
+        </div>
+        {err.manifestFp && (
+          <div className="pt-1">
+            <div className="text-[10.5px] uppercase tracking-wider text-amber-300/80">Required (manifest)</div>
+            <div className="font-mono text-[11px] break-all">{err.manifestFp}</div>
+          </div>
+        )}
+        {err.providedFp && (
+          <div>
+            <div className="text-[10.5px] uppercase tracking-wider text-amber-300/80">Currently installed</div>
+            <div className="font-mono text-[11px] break-all">{err.providedFp}</div>
+          </div>
+        )}
+        <div className="pt-1 text-amber-100/90">
+          Import the correct keyfile from{" "}
+          <span className="font-medium">Backup configuration → Destinations → PBS row → Upload</span>
+          {" "}(you may need to Delete the current one first) and retry.
+        </div>
+      </div>
+    </div>
+  </div>
+)
+
+const formatMtime = (mtime: number) =>
+  new Date(mtime * 1000).toLocaleString(undefined, {
+    year: "numeric",
+    month: "short",
+    day: "numeric",
+    hour: "2-digit",
+    minute: "2-digit",
+  })
+
+const formatNext = (iso: string | null) => {
+  if (!iso) return "—"
+  try {
+    return new Date(iso).toLocaleString()
+  } catch {
+    return iso
+  }
+}
+
+// Best-effort human form of systemd OnCalendar expressions. Whatever
+// we don't recognise falls back to "<raw> (systemd OnCalendar)" so the
+// operator at least knows what kind of string they're looking at.
+// Handles the patterns the host-backup wizard can emit ("hourly",
+// "daily", "weekly", "monthly", "*-*-* HH:MM:SS", "Mon..Sun *-*-* …").
+const humanizeOnCalendar = (raw: string | null | undefined): string => {
+  if (!raw) return "—"
+  const s = raw.trim()
+  if (!s) return "—"
+  const lower = s.toLowerCase()
+  if (lower === "hourly") return "Every hour (at minute 0)"
+  if (lower === "daily") return "Every day at 00:00"
+  if (lower === "weekly") return "Every Monday at 00:00"
+  if (lower === "monthly") return "On the 1st of every month at 00:00"
+  if (lower === "yearly" || lower === "annually") return "On Jan 1st at 00:00"
+  if (lower === "minutely") return "Every minute"
+  // *-*-* HH:MM[:SS]  → "Every day at HH:MM"
+  let m = s.match(/^\*-\*-\*\s+(\d{1,2}):(\d{2})(?::(\d{2}))?$/)
+  if (m) return `Every day at ${m[1].padStart(2, "0")}:${m[2]}`
+  // *-*-* *:MM:SS    → "Every hour at minute MM"
+  m = s.match(/^\*-\*-\*\s+\*:(\d{2})(?::(\d{2}))?$/)
+  if (m) return `Every hour at minute ${m[1]}`
+  // Mon,Tue *-*-* HH:MM:SS   →  "<weekdays> at HH:MM"
+  m = s.match(/^([A-Za-z,.\s]+)\s+\*-\*-\*\s+(\d{1,2}):(\d{2})(?::(\d{2}))?$/)
+  if (m) {
+    const expandWeekdays = (chunk: string): string => {
+      const days: Record<string, string> = {
+        mon: "Monday", tue: "Tuesday", wed: "Wednesday",
+        thu: "Thursday", fri: "Friday", sat: "Saturday", sun: "Sunday",
+      }
+      const rangeMatch = chunk.match(/^([A-Za-z]+)\.\.([A-Za-z]+)$/)
+      if (rangeMatch) {
+        const order = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"]
+        const start = order.indexOf(rangeMatch[1].slice(0, 3).toLowerCase())
+        const end = order.indexOf(rangeMatch[2].slice(0, 3).toLowerCase())
+        if (start >= 0 && end >= 0 && start <= end) {
+          return order.slice(start, end + 1).map((d) => days[d]).join(", ")
+        }
+      }
+      return chunk
+        .split(",")
+        .map((d) => days[d.trim().slice(0, 3).toLowerCase()] || d.trim())
+        .join(", ")
+    }
+    return `${expandWeekdays(m[1])} at ${m[2].padStart(2, "0")}:${m[3]}`
+  }
+  return `${s} (systemd OnCalendar)`
+}
+
+// A job is "running" when its .status file has RUN_AT (runner started)
+// but no RESULT yet (runner hasn't written the verdict). Lets the UI
+// flag in-progress runs both inline (badge in the row) and from the
+// Manual backups card so an operator who closes the dialog can re-open
+// the live stream.
+function isJobRunning(j: BackupJob | null | undefined): boolean {
+  if (!j?.last_status) return false
+  const s = parseJobStatus(j.last_status)
+  return !!(s?.runAt && !s?.result)
+}
+
+// last_status is the raw RUN_AT=..., RESULT=..., LOG_FILE=... blob the
+// scheduler runner persists. We only care about RESULT + RUN_AT for the
+// UI; everything else is noise the operator doesn't need on a list view.
+function parseJobStatus(raw: string | null): { result: string | null; runAt: string | null; logFile: string | null } | null {
+  if (!raw) return null
+  const map: Record<string, string> = {}
+  for (const line of raw.split("\n")) {
+    const m = line.match(/^([A-Z_]+)=(.*)$/)
+    if (m) map[m[1]] = m[2]
+  }
+  return {
+    result: map["RESULT"] || null,
+    runAt: map["RUN_AT"] || null,
+    logFile: map["LOG_FILE"] || null,
+  }
+}
+
+// Backend-method color scheme, mirrored exactly from storage-overview.tsx
+// (line 414 et al.) so a PBS job badge here looks identical to a PBS
+// snapshot badge on the Storage page.
+const methodBadgeCls = (m: string | undefined): string => {
+  switch ((m || "").toLowerCase()) {
+    case "pbs":
+      return "bg-purple-500/10 text-purple-400 border-purple-500/20"
+    case "borg":
+      return "bg-fuchsia-500/10 text-fuchsia-400 border-fuchsia-500/20"
+    case "local":
+    default:
+      return "bg-blue-500/10 text-blue-400 border-blue-500/20"
+  }
+}
+
+const formatRunAt = (iso: string | null) => {
+  if (!iso) return null
+  try {
+    return new Date(iso).toLocaleString(undefined, {
+      day: "2-digit",
+      month: "short",
+      year: "numeric",
+      hour: "2-digit",
+      minute: "2-digit",
+    })
+  } catch {
+    return iso
+  }
+}
+
+// ── PBS keyfile management (shared between CreateJob + ManualBackup) ──
+//
+// Rendered inside the encryption section when a keyfile is already
+// installed. Replaces the older static info box that pointed to a
+// non-existent "Settings → Host backup" panel: the operator now has
+// concrete actions (download keyfile, update stored passphrase,
+// change recovery model, remove keyfile) with destructive-confirmation
+// modals that call the /api/host-backups/pbs-encryption/* endpoints
+// and mutate pbsRecoveryStatus so the parent dialog re-renders on
+// success. There is no "Replace keyfile" action any more — replacing
+// the key would silently orphan every encrypted backup that used it.
+// The operator instead uses Remove + set up again via the normal flow
+// (Generate a new keyfile / Use an existing keyfile), which surfaces
+// the source picker properly.
+// ──────────────────────────────────────────────────────────────
+// PbsKeyfileActions — the trimmed action set the operator sees
+// inside every PBS destination row: Download, Upload (import a new
+// keyfile), Delete. No stored-passphrase rotation, no escrow toggle
+// — those live in the setup dialogs where the operator makes the
+// initial call. Placing these three next to the destination they
+// belong to matches "the key is a PBS thing" without dragging in
+// the fuller management surface.
+// ──────────────────────────────────────────────────────────────
+function PbsKeyfileActions({ pbsRepository }: { pbsRepository?: string }) {
+  const { data: info, mutate: mutateInfo } = useSWR<{
+    installed: boolean
+    fingerprint?: string
+    path: string
+    escrow_mode?: "none" | "local" | "full"
+  }>("/api/host-backups/pbs-encryption/keyfile-info", fetcher)
+
+  const [uploadOpen, setUploadOpen] = useState(false)
+  const [deleteOpen, setDeleteOpen] = useState(false)
+  const [importFile, setImportFile] = useState<File | null>(null)
+  const [importPath, setImportPath] = useState("")
+  const [busy, setBusy] = useState(false)
+  const [err, setErr] = useState<string | null>(null)
+
+  // Auto-discover a PVE-managed keyfile at /etc/pve/priv/storage/<NAME>.enc
+  // that matches this specific PBS repository. When present, the Upload
+  // modal surfaces a one-click "Use PVE-managed key" shortcut at the
+  // top so the operator doesn't have to hunt down the file path — the
+  // exact convenience the shell TUI already provides during its import
+  // wizard. Only fetched while the modal is open + a repository is known.
+  const { data: pveDiscover } = useSWR<{
+    entries: Array<{ name: string; server: string; datastore: string; path: string; matches_repository: boolean }>
+  }>(
+    uploadOpen && pbsRepository
+      ? `/api/host-backups/pbs-encryption/discover-pve-keyfiles?repository=${encodeURIComponent(pbsRepository)}`
+      : null,
+    fetcher,
+  )
+  const pveMatch = pveDiscover?.entries?.find((e) => e.matches_repository) || null
+
+  const closeUpload = () => {
+    setUploadOpen(false)
+    setImportFile(null)
+    setImportPath("")
+    setBusy(false)
+    setErr(null)
+  }
+  const closeDelete = () => {
+    setDeleteOpen(false)
+    setBusy(false)
+    setErr(null)
+  }
+
+  const download = () => {
+    // Same plain-<a>-download trick used elsewhere: bypasses fetch so
+    // an ad-blocker or a stale SWR cache can't intervene.
+    const a = document.createElement("a")
+    a.href = "/api/host-backups/pbs-encryption/download-keyfile"
+    a.download = "pbs-key.conf"
+    document.body.appendChild(a)
+    a.click()
+    document.body.removeChild(a)
+  }
+
+  const runUpload = async () => {
+    if (!importFile && !importPath.trim()) {
+      setErr("Pick a keyfile file or enter an absolute path on this host.")
+      return
+    }
+    setBusy(true)
+    setErr(null)
+    try {
+      const body: Record<string, unknown> = { escrow_mode: "none" }
+      if (importFile) {
+        const buf = new Uint8Array(await importFile.arrayBuffer())
+        let bin = ""
+        for (let i = 0; i < buf.length; i++) bin += String.fromCharCode(buf[i])
+        body.source = "content"
+        body.content_b64 = btoa(bin)
+      } else {
+        body.source = "path"
+        body.keyfile_path = importPath.trim()
+      }
+      await fetchApi("/api/host-backups/pbs-encryption/import", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      })
+      await mutateInfo()
+      closeUpload()
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : String(e))
+      setBusy(false)
+    }
+  }
+
+  const runDelete = async () => {
+    setBusy(true)
+    setErr(null)
+    try {
+      await fetchApi("/api/host-backups/pbs-encryption/remove", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({}),
+      })
+      await mutateInfo()
+      closeDelete()
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : String(e))
+      setBusy(false)
+    }
+  }
+
+  const installed = !!info?.installed
+
+  return (
+    <div className="mt-2 border-t border-white/10 pt-2 space-y-1.5">
+      <div className="flex items-center gap-2 flex-wrap">
+        <div className="text-xs min-w-0 flex-1 flex items-center gap-1.5">
+          <span className="font-medium text-muted-foreground">Encryption keyfile:</span>{" "}
+          {installed ? (
+            <span
+              className="inline-flex items-center gap-1 text-emerald-400 font-medium"
+              title={info?.fingerprint ? `Keyfile fingerprint: ${info.fingerprint}` : undefined}
+            >
+              <CheckCircle2 className="h-4 w-4" />
+              installed
+            </span>
+          ) : (
+            <span className="text-blue-400 font-medium">not installed on this host</span>
+          )}
+        </div>
+        <div className="flex items-center gap-1.5 shrink-0">
+          {installed && (
+            <>
+              <Button
+                type="button"
+                size="sm"
+                variant="outline"
+                className="h-7 text-[11px] !text-emerald-400 border-emerald-500/40 hover:bg-emerald-500/10"
+                onClick={download}
+                title="Download the keyfile as pbs-key.conf"
+              >
+                <Download className="h-3.5 w-3.5 mr-1" />
+                Download
+              </Button>
+              <Button
+                type="button"
+                size="sm"
+                variant="outline"
+                className="h-7 text-[11px] !text-red-400 border-red-500/40 hover:bg-red-500/10"
+                onClick={() => setDeleteOpen(true)}
+                title="Remove the local keyfile"
+              >
+                <Trash2 className="h-3.5 w-3.5 mr-1" />
+                Delete
+              </Button>
+            </>
+          )}
+          {!installed && (
+            <Button
+              type="button"
+              size="sm"
+              variant="outline"
+              className="h-7 text-[11px] !text-blue-400 border-blue-500/40 hover:bg-blue-500/10"
+              onClick={() => setUploadOpen(true)}
+              title="Import a keyfile you already have"
+            >
+              <Lock className="h-3.5 w-3.5 mr-1" />
+              Upload
+            </Button>
+          )}
+        </div>
+      </div>
+
+      <Dialog open={uploadOpen} onOpenChange={(v) => !v && closeUpload()}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Upload PBS keyfile</DialogTitle>
+            <DialogDescription>
+              Import a keyfile you already have. It lands at <code className="font-mono">/usr/local/share/proxmenux/pbs-key.conf</code> and every subsequent encrypted backup reuses it. Recovery escrow stays off — use the setup wizard if you want to enable it.
+            </DialogDescription>
+          </DialogHeader>
+          <div className="space-y-3">
+            {pveMatch && (
+              <div className="rounded-md border border-emerald-500/40 bg-emerald-500/10 p-3 space-y-2 text-xs">
+                <div className="flex items-start gap-2">
+                  <Lock className="h-4 w-4 text-emerald-400 mt-0.5 shrink-0" />
+                  <div className="flex-1 space-y-1">
+                    <div className="font-semibold text-emerald-300">PVE-managed keyfile detected for this PBS</div>
+                    <div className="text-muted-foreground">
+                      Proxmox already stores an encryption key for storage <code className="font-mono text-[10.5px]">{pveMatch.name}</code> at{" "}
+                      <code className="font-mono text-[10.5px] break-all">{pveMatch.path}</code>. Import it in one click.
+                    </div>
+                  </div>
+                </div>
+                <div className="flex justify-end">
+                  <Button
+                    size="sm"
+                    onClick={() => {
+                      setImportPath(pveMatch.path)
+                      setImportFile(null)
+                    }}
+                    disabled={busy}
+                    className="!bg-emerald-600 hover:!bg-emerald-700 !text-white h-7 text-[11px]"
+                  >
+                    Use this key
+                  </Button>
+                </div>
+              </div>
+            )}
+            {pveMatch && <div className="text-[10px] text-center text-muted-foreground">— or upload your own —</div>}
+            <div>
+              <Label htmlFor="pbsKfUploadFile" className="text-xs">Upload from your machine</Label>
+              <Input
+                id="pbsKfUploadFile"
+                type="file"
+                accept=".conf,.key,application/json,text/plain"
+                onChange={(e) => setImportFile(e.target.files?.[0] ?? null)}
+                disabled={busy || !!importPath.trim()}
+                className="h-9 mt-1"
+              />
+            </div>
+            <div className="text-[10px] text-center text-muted-foreground">— or —</div>
+            <div>
+              <Label htmlFor="pbsKfUploadPath" className="text-xs">Absolute path on this host</Label>
+              <Input
+                id="pbsKfUploadPath"
+                type="text"
+                value={importPath}
+                onChange={(e) => setImportPath(e.target.value)}
+                disabled={busy || !!importFile}
+                placeholder="e.g. /etc/pve/priv/storage/<NAME>.enc or /root/my-pbs-key"
+                className="h-9 mt-1 font-mono text-xs"
+              />
+            </div>
+            {err && (
+              <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">{err}</div>
+            )}
+          </div>
+          <DialogFooter>
+            <Button variant="outline" onClick={closeUpload} disabled={busy}>Cancel</Button>
+            <Button
+              onClick={runUpload}
+              disabled={busy || (!importFile && !importPath.trim())}
+              className="!bg-blue-500 hover:!bg-blue-600 !text-white"
+            >
+              {busy ? <Loader2 className="h-4 w-4 animate-spin" /> : "Import"}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+
+      <Dialog open={deleteOpen} onOpenChange={(v) => !v && closeDelete()}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle className="flex items-center gap-2">
+              <AlertTriangle className="h-5 w-5 text-red-400" />
+              Delete keyfile
+            </DialogTitle>
+            <DialogDescription>
+              Backups already stored on PBS were encrypted with the current keyfile. After this action:
+            </DialogDescription>
+          </DialogHeader>
+          <ul className="text-xs text-muted-foreground list-disc list-inside space-y-1 pl-2">
+            <li>New backups will use no encryption on this host until a new keyfile is set up.</li>
+            <li>Downloading pre-existing encrypted backups from this host <strong className="text-red-400">will fail</strong> unless you kept a copy of the current key.</li>
+            <li>Existing recovery blobs on PBS stay intact — they still recover the old key with its original passphrase.</li>
+          </ul>
+          {err && (
+            <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">{err}</div>
+          )}
+          <DialogFooter>
+            <Button variant="outline" onClick={closeDelete} disabled={busy}>Cancel</Button>
+            <Button onClick={runDelete} disabled={busy} className="!bg-red-500 hover:!bg-red-600 !text-white">
+              {busy ? <Loader2 className="h-4 w-4 animate-spin" /> : "Delete"}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </div>
+  )
+}
+
+function KeyfileActionsBar({
+  mutateStatus,
+  escrowMode,
+}: {
+  mutateStatus: () => Promise<unknown>
+  escrowMode?: "none" | "local" | "full"
+}) {
+  const [busy, setBusy] = useState(false)
+  const [err, setErr] = useState<string | null>(null)
+  const [pass1, setPass1] = useState("")
+  const [pass2, setPass2] = useState("")
+  // Pending radio state — reflects the operator's intended mode after
+  // Apply. Seeded from the current mode so a No-op click on Apply is
+  // rejected. Binary UX ('none' vs 'full') matches the setup wizard.
+  const currentIsFull = escrowMode === "full"
+  const [pendingMode, setPendingMode] = useState<"none" | "full">(currentIsFull ? "full" : "none")
+
+  const runApply = async () => {
+    // Yes → passphrase required + match. No → passphrase ignored.
+    if (pendingMode === "full") {
+      if (!pass1) {
+        setErr("Recovery passphrase is required.")
+        return
+      }
+      if (pass1 !== pass2) {
+        setErr("Passphrases do not match.")
+        return
+      }
+    }
+    setBusy(true)
+    setErr(null)
+    try {
+      const body: Record<string, unknown> = { escrow_mode: pendingMode }
+      if (pendingMode === "full") body.escrow_passphrase = pass1
+      await fetchApi("/api/host-backups/pbs-encryption/set-escrow-mode", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      })
+      await mutateStatus()
+      setPass1("")
+      setPass2("")
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  // Contextual Apply-button label. Three transitions:
+  //   No → Yes            → "Start uploading"
+  //   Yes → No            → "Stop uploading"
+  //   Yes → Yes (new pw)  → "Update passphrase" (rewraps envelope)
+  const applyLabel =
+    pendingMode === "full" && !currentIsFull
+      ? "Start uploading"
+      : pendingMode === "none" && currentIsFull
+        ? "Stop uploading"
+        : pendingMode === "full" && currentIsFull
+          ? "Update passphrase"
+          : "Apply"
+
+  // Apply is enabled when there is a real change to commit.
+  const canApply = (
+    (pendingMode !== (currentIsFull ? "full" : "none")) ||        // mode change
+    (pendingMode === "full" && !!pass1 && pass1 === pass2)        // passphrase update
+  )
+
+  const download = () => {
+    const a = document.createElement("a")
+    a.href = "/api/host-backups/pbs-encryption/download-keyfile"
+    a.download = "pbs-key.conf"
+    document.body.appendChild(a)
+    a.click()
+    document.body.removeChild(a)
+  }
+
+  return (
+    <div className="space-y-3">
+      <div className="text-[11px] font-medium text-foreground">Manage installed keyfile</div>
+
+      {/* Current status — icon + colour by state, no truncated fp. */}
+      {escrowMode !== undefined && (
+        <div className="flex items-center gap-2 text-xs bg-background/40 border border-white/10 rounded px-2.5 py-1.5">
+          <span className="font-medium text-foreground">Upload to PBS:</span>
+          {currentIsFull ? (
+            <span className="inline-flex items-center gap-1 text-emerald-400 font-medium">
+              <CheckCircle2 className="h-3.5 w-3.5" />
+              Yes — envelope uploaded on every backup
+            </span>
+          ) : (
+            <span className="inline-flex items-center gap-1 text-blue-400 font-medium">
+              No — kept only on this host
+            </span>
+          )}
+        </div>
+      )}
+
+      {/* Change mode + passphrase — one integrated form, no popover.
+          Radio picks the intent; the passphrase pair unfolds when the
+          intent is Yes (both for a first-time upload and for a
+          passphrase rotation while already in Yes). */}
+      <div className="space-y-2 rounded-md border border-blue-500/30 bg-blue-500/5 p-3">
+        <div className="text-[11px] font-medium text-foreground">Upload key to PBS?</div>
+        <div className="grid gap-1.5">
+          <label className="flex items-start gap-2 cursor-pointer text-[11px]">
+            <input
+              type="radio"
+              name="pendingModeChange"
+              checked={pendingMode === "none"}
+              onChange={() => { setPendingMode("none"); setPass1(""); setPass2("") }}
+              className="mt-1"
+            />
+            <div className="flex-1">
+              <div className="font-medium">No, keep local only</div>
+              <div className="text-muted-foreground">Keyfile stays at <code className="font-mono text-[10.5px]">/usr/local/share/proxmenux/pbs-key.conf</code>. You handle the offsite copy — use <em>Download keyfile</em> below.</div>
+            </div>
+          </label>
+          <label className="flex items-start gap-2 cursor-pointer text-[11px]">
+            <input
+              type="radio"
+              name="pendingModeChange"
+              checked={pendingMode === "full"}
+              onChange={() => setPendingMode("full")}
+              className="mt-1"
+            />
+            <div className="flex-1">
+              <div className="font-medium">Yes, upload</div>
+              <div className="text-muted-foreground">A passphrase-wrapped copy of the keyfile is uploaded to PBS with every backup. Fill the passphrase pair below to enable — or to rotate the current one.</div>
+            </div>
+          </label>
+        </div>
+        {pendingMode === "full" && (
+          <div className="space-y-2 pt-2 border-t border-blue-500/20">
+            <div>
+              <Label htmlFor="mgmtPass1" className="text-[11px]">
+                {currentIsFull ? "New recovery passphrase" : "Recovery passphrase"}
+              </Label>
+              <Input
+                id="mgmtPass1"
+                type="password"
+                value={pass1}
+                onChange={(e) => setPass1(e.target.value)}
+                placeholder={currentIsFull ? "Type a new passphrase to rotate" : "Long random string — write it down somewhere safe"}
+                className="font-mono mt-1 h-8 text-xs"
+              />
+            </div>
+            <div>
+              <Label htmlFor="mgmtPass2" className="text-[11px]">Confirm passphrase</Label>
+              <Input
+                id="mgmtPass2"
+                type="password"
+                value={pass2}
+                onChange={(e) => setPass2(e.target.value)}
+                placeholder="Type it again"
+                className="font-mono mt-1 h-8 text-xs"
+              />
+              {pass1 && pass2 && pass1 !== pass2 && (
+                <p className="text-[11px] text-red-400 mt-1">Passphrases don&apos;t match.</p>
+              )}
+            </div>
+          </div>
+        )}
+        {err && (
+          <div className="text-[11px] text-red-500 px-2 py-1.5 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">{err}</div>
+        )}
+        <div className="flex justify-end">
+          <Button
+            type="button"
+            size="sm"
+            onClick={runApply}
+            disabled={busy || !canApply}
+            className="!bg-blue-500 hover:!bg-blue-600 !text-white disabled:opacity-50"
+          >
+            {busy ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : applyLabel}
+          </Button>
+        </div>
+      </div>
+
+      <div className="flex flex-wrap gap-1.5">
+        <Button
+          type="button"
+          size="sm"
+          variant="outline"
+          className="h-7 text-[11px] !text-emerald-400 border-emerald-500/40 hover:bg-emerald-500/10"
+          onClick={download}
+        >
+          <Download className="h-3.5 w-3.5 mr-1" />
+          Download keyfile
+        </Button>
+      </div>
+
+      {/* Deletion lives inside the PBS destination row (PbsKeyfileActions);
+          setup menus of Create Job / Manual Backup never surface it. */}
+    </div>
+  )
+}
+
+export function HostBackup() {
+  const { data: jobsResp, error: jobsErr, mutate: mutateJobs } = useSWR<{ jobs: BackupJob[] }>(
+    "/api/host-backups/jobs",
+    fetcher,
+    { refreshInterval: 30000 },
+  )
+  const [busyJobId, setBusyJobId] = useState<string | null>(null)
+  const [actionError, setActionError] = useState<string | null>(null)
+  const [jobToDelete, setJobToDelete] = useState<BackupJob | null>(null)
+  const [creatingJob, setCreatingJob] = useState<boolean>(false)
+  const [editingJobId, setEditingJobId] = useState<string | null>(null)
+  const [viewingJobId, setViewingJobId] = useState<string | null>(null)
+  const [watchingManualId, setWatchingManualId] = useState<string | null>(null)
+  const [runningManual, setRunningManual] = useState<boolean>(false)
+  // Independent tracker for the most recent manual backup that's still
+  // running. Survives the operator closing the ManualJobWatchModal —
+  // the modal only drives auto-refresh while it's OPEN, so if the
+  // operator dismisses it before the job finishes, the archive lists
+  // would only refresh on the next SWR tick (30-60 s). Polling the
+  // job status here at 3 s and calling mutate once we see the run
+  // transition to completed closes that gap regardless of modal
+  // state. Set = single slot per launch; a fresh manual replaces the
+  // slot (the previous one falls back to the periodic SWR tick).
+  const [pendingManualJobId, setPendingManualJobId] = useState<string | null>(null)
+
+  async function confirmDeleteJob() {
+    if (!jobToDelete) return
+    const id = jobToDelete.id
+    setBusyJobId(id)
+    setActionError(null)
+    try {
+      await fetchApi(`/api/host-backups/jobs/${encodeURIComponent(id)}`, { method: "DELETE" })
+      mutateJobs()
+      setJobToDelete(null)
+    } catch (e) {
+      setActionError(`Failed to delete "${id}": ${e instanceof Error ? e.message : String(e)}`)
+    } finally {
+      setBusyJobId(null)
+    }
+  }
+  const { data: destinationsResp, mutate: mutateDestinations } = useSWR<DestinationsResp>(
+    "/api/host-backups/destinations",
+    fetcher,
+    { refreshInterval: 60000 },
+  )
+  const { data: remoteArchivesResp, error: remoteArchivesErr, mutate: mutateRemoteArchives } = useSWR<RemoteArchivesResp>(
+    "/api/host-backups/remote-archives",
+    fetcher,
+    { refreshInterval: 60000 },
+  )
+  const { data: archivesResp, error: archivesErr, mutate: mutateArchives } = useSWR<{ archives: BackupArchive[] }>(
+    "/api/host-backups/archives",
+    fetcher,
+    { refreshInterval: 30000 },
+  )
+
+  // Background poll for the pending manual backup, independent of the
+  // watch modal being open. Fires mutateArchives/mutateRemoteArchives
+  // as soon as the run flips to done so the operator sees the new
+  // entry in Available Archives without a manual refresh.
+  const { data: pendingManualPoll } = useSWR<JobDetail>(
+    pendingManualJobId ? `/api/host-backups/jobs/${encodeURIComponent(pendingManualJobId)}` : null,
+    fetcher,
+    { refreshInterval: 3000 },
+  )
+  useEffect(() => {
+    const d = pendingManualPoll as JobDetail | undefined
+    if (pendingManualJobId && d?.last_run_at && d?.last_result) {
+      mutateJobs()
+      mutateArchives()
+      mutateRemoteArchives()
+      setPendingManualJobId(null)
+    }
+  }, [pendingManualPoll, pendingManualJobId, mutateJobs, mutateArchives, mutateRemoteArchives])
+
+  const [inspectingArchive, setInspectingArchive] = useState<UnifiedArchive | null>(null)
+
+  // Merge local archives + remote snapshots (PBS + Borg) into a single
+  // sorted list. Newest first, regardless of source — operators care
+  // about "the most recent backup", not "the most recent local backup".
+  const unifiedArchives: UnifiedArchive[] = (() => {
+    const out: UnifiedArchive[] = []
+    if (archivesResp?.archives) {
+      for (const a of archivesResp.archives) {
+        out.push({
+          source: "local",
+          display_id: a.id,
+          size_bytes: a.size_bytes,
+          created_at: a.mtime,
+          source_label: a.path.replace(/\/[^/]+$/, "") || "/",
+          local: a,
+        })
+      }
+    }
+    if (remoteArchivesResp?.snapshots) {
+      for (const s of remoteArchivesResp.snapshots) {
+        out.push({
+          source: s.backend,
+          display_id: s.snapshot,
+          size_bytes: s.size_bytes,
+          created_at: s.backup_time,
+          source_label: `${s.backend.toUpperCase()} ${s.repo_name}`,
+          remote: s,
+        })
+      }
+    }
+    out.sort((a, b) => b.created_at - a.created_at)
+    return out
+  })()
+
+  return (
+    <div className="space-y-4 md:space-y-6">
+      {/* ── Post-restore progress card ────────────────────
+          Renders only while a restore is running or its
+          summary hasn't been acknowledged. Once dismissed,
+          it collapses to a "Past restores" ghost button. */}
+      <RestoreProgressCard />
+
+      {/* ── Scheduled jobs ───────────────────────────────── */}
+      <Card className="bg-card border-border">
+        <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-3">
+          <div className="flex items-center gap-2">
+            <Calendar className="h-5 w-5 text-blue-500" />
+            <CardTitle className="text-base font-semibold">Scheduled Backup Jobs</CardTitle>
+            <Badge variant="outline" className="ml-1">
+              {jobsResp?.jobs?.filter((j) => !j.manual).length ?? 0}
+            </Badge>
+          </div>
+          <Button
+            size="sm"
+            className="h-8 px-3 bg-blue-500 hover:bg-blue-600 text-white"
+            onClick={() => setCreatingJob(true)}
+          >
+            <Plus className="h-4 w-4 mr-1" />
+            Create job
+          </Button>
+        </CardHeader>
+        <CardContent>
+          {jobsErr ? (
+            <div className="text-sm text-red-500 py-4">Failed to load jobs</div>
+          ) : !jobsResp ? (
+            <div className="flex items-center gap-2 py-4 text-sm text-muted-foreground">
+              <Loader2 className="h-4 w-4 animate-spin" />
+              Loading...
+            </div>
+          ) : jobsResp.jobs.filter((j) => !j.manual).length === 0 ? null : (
+            <div className="space-y-2">
+              {actionError && (
+                <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+                  {actionError}
+                </div>
+              )}
+              {jobsResp.jobs.filter((j) => !j.manual).map((j) => {
+                const status = parseJobStatus(j.last_status)
+                const running = isJobRunning(j)
+                // While running we override the ok/failed pill with a
+                // running spinner — same way the modal does. Clicking
+                // the row re-opens JobDetailModal which auto-detects
+                // the in-progress state and resumes streaming.
+                const statusBadge = running
+                  ? { label: "running", cls: "bg-blue-500/10 border-blue-500/40 text-blue-300" }
+                  : status?.result === "ok"
+                    ? { label: "ok", cls: "bg-emerald-500/10 border-emerald-500/40 text-emerald-400" }
+                    : status?.result
+                      ? { label: status.result, cls: "bg-red-500/10 border-red-500/40 text-red-400" }
+                      : null
+                const lastRunWhen = formatRunAt(status?.runAt ?? null)
+                return (
+                  <button
+                    key={j.id}
+                    type="button"
+                    onClick={() => setViewingJobId(j.id)}
+                    className="w-full text-left flex items-start gap-3 p-3 rounded-md border border-border bg-card hover:bg-white/5 transition-colors group"
+                    title="Click to open this job"
+                  >
+                    <div className="min-w-0 flex-1 w-full">
+                      {/* Title row */}
+                      <div className="flex items-center gap-2 flex-wrap">
+                        <span className="font-semibold text-base truncate" title={j.id}>{j.id}</span>
+                        <Badge variant="outline" className={`text-[10px] uppercase tracking-wide ${methodBadgeCls(j.method)}`}>
+                          {j.method}
+                        </Badge>
+                        {j.manual && (
+                          <Badge variant="outline" className="text-[10px] text-purple-400 border-purple-400/40 bg-purple-500/5">
+                            manual
+                          </Badge>
+                        )}
+                        {j.attached && (
+                          <Badge variant="outline" className="text-[10px] text-blue-400 border-blue-400/40 bg-blue-500/5">
+                            attached
+                          </Badge>
+                        )}
+                        {j.encrypted && (
+                          <Badge
+                            variant="outline"
+                            className="text-[10px] uppercase tracking-wide border-emerald-500/40 text-emerald-400 bg-emerald-500/5"
+                            title="Encrypted backups (client-side keyfile / borg repokey)"
+                          >
+                            <Lock className="h-3.5 w-3.5" />
+                          </Badge>
+                        )}
+                        {/* Surface the profile mode at row level so the
+                            operator can tell at a glance whether the
+                            job ships the default path set or a custom
+                            list — without having to open the detail
+                            modal. Same wording the modal uses. */}
+                        <Badge
+                          variant="outline"
+                          className={`text-[10px] uppercase tracking-wide ${
+                            j.profile_mode === "custom"
+                              ? "border-cyan-500/40 text-cyan-400 bg-cyan-500/5"
+                              : "border-border text-muted-foreground bg-background/40"
+                          }`}
+                          title={
+                            j.profile_mode === "custom"
+                              ? "Custom path list — only the paths the operator picked"
+                              : "Default path list — ProxMenux's recommended host config set"
+                          }
+                        >
+                          {j.profile_mode === "custom" ? "custom" : "default"}
+                        </Badge>
+                        {!j.enabled && !j.manual && (
+                          <Badge variant="outline" className="text-[10px] text-amber-500 border-amber-500/40 bg-amber-500/5">
+                            disabled
+                          </Badge>
+                        )}
+                      </div>
+
+                      {/* Destination */}
+                      <div className="mt-1 text-sm font-mono text-muted-foreground truncate" title={j.destination}>
+                        {j.destination || "—"}
+                      </div>
+
+                      {/* Stats row — icons in green, values in foreground
+                          white to match the rest of the dashboard. */}
+                      <div className="mt-2 text-xs text-foreground flex items-center gap-x-4 gap-y-1 flex-wrap">
+                        <span className="inline-flex items-center gap-1" title={j.on_calendar}>
+                          <Calendar className="h-3.5 w-3.5 text-green-500" />
+                          <span>{humanizeOnCalendar(j.on_calendar)}</span>
+                        </span>
+                        {j.retention && (
+                          <span className="inline-flex items-center gap-1.5 flex-wrap" title="Retention policy">
+                            <Archive className="h-3.5 w-3.5 text-green-500" />
+                            {(() => {
+                              // Backend returns retention as "last=7, daily=7, …".
+                              // Parse and render as labelled chips so the row
+                              // matches the visual style of the modal.
+                              const pairs = j.retention
+                                .split(",")
+                                .map((s) => s.trim())
+                                .map((s) => {
+                                  const m = s.match(/^([a-z]+)=(\d+)$/i)
+                                  return m && Number(m[2]) > 0 ? { label: m[1], value: m[2] } : null
+                                })
+                                .filter((x): x is { label: string; value: string } => x !== null)
+                              if (pairs.length === 0) {
+                                return <span>{j.retention}</span>
+                              }
+                              return pairs.map((p) => (
+                                <span
+                                  key={p.label}
+                                  className="inline-flex items-center gap-1.5 px-2 py-0.5 rounded border border-border bg-background/60"
+                                >
+                                  <span className="text-[10px] uppercase tracking-wide text-muted-foreground">{p.label}</span>
+                                  <span className="font-mono text-xs text-foreground">{p.value}</span>
+                                </span>
+                              ))
+                            })()}
+                          </span>
+                        )}
+                        {!j.attached && j.next_run && (
+                          <span className="inline-flex items-center gap-1" title="Next scheduled run">
+                            <Clock className="h-3.5 w-3.5 text-green-500" />
+                            <span>next: {formatNext(j.next_run)}</span>
+                          </span>
+                        )}
+                        {(statusBadge || lastRunWhen) && (
+                          <span className="inline-flex items-center gap-1" title={status?.logFile ?? ""}>
+                            <Clock className="h-3.5 w-3.5 text-green-500" />
+                            <span>last:</span>
+                            {statusBadge && (
+                              <span className={`inline-flex items-center gap-1 px-1.5 py-0.5 rounded text-[10px] uppercase tracking-wide border ${statusBadge.cls}`}>
+                                {running && <Loader2 className="h-2.5 w-2.5 animate-spin" />}
+                                {statusBadge.label}
+                              </span>
+                            )}
+                            {lastRunWhen && <span>{lastRunWhen}</span>}
+                          </span>
+                        )}
+                        {!status && (
+                          <span className="inline-flex items-center gap-1 text-muted-foreground">
+                            <Clock className="h-3.5 w-3.5 text-green-500" />
+                            <span>never run</span>
+                          </span>
+                        )}
+                      </div>
+                    </div>
+
+                    <ChevronRight className="h-4 w-4 text-muted-foreground group-hover:text-blue-400 transition-colors shrink-0 mt-1" />
+                  </button>
+                )
+              })}
+            </div>
+          )}
+        </CardContent>
+      </Card>
+
+      {/* ── Backup configuration (destinations + custom paths) ── */}
+      <BackupConfigurationCard
+        destinations={destinationsResp}
+        onDestChanged={() => mutateDestinations()}
+      />
+
+      {/* ── Manual backups (entry point) ──────────────────── */}
+      <Card className="bg-card border-border">
+        <CardHeader className="pb-3">
+          <div className="flex items-center gap-2">
+            <PlayCircle className="h-5 w-5 text-purple-400" />
+            <CardTitle className="text-base font-semibold">Manual backups</CardTitle>
+          </div>
+        </CardHeader>
+        <CardContent className="space-y-3">
+          <p className="text-xs text-muted-foreground">
+            Manual backups run once and stop — no schedule.
+          </p>
+          <Button
+            className="w-full sm:w-auto bg-purple-500 hover:bg-purple-600 text-white"
+            onClick={() => setRunningManual(true)}
+          >
+            <PlayCircle className="h-4 w-4 mr-2" />
+            Run manual backup
+          </Button>
+          {/* In-progress manual jobs. If the operator closed the
+              ManualBackupDialog before the runner finished, this
+              banner is the way back into the live log — clicking
+              opens the JobDetailModal which automatically resumes
+              the streaming view for any in-progress job. */}
+          {jobsResp?.jobs
+            ?.filter((j) => j.manual && isJobRunning(j))
+            .map((j) => (
+              <button
+                key={j.id}
+                type="button"
+                onClick={() => setWatchingManualId(j.id)}
+                className="w-full flex items-center gap-2 px-3 py-2 rounded-md border border-blue-500/40 bg-blue-500/5 hover:bg-blue-500/10 transition-colors text-left"
+                title="Click to re-open the live log"
+              >
+                <Loader2 className="h-4 w-4 animate-spin text-blue-400 shrink-0" />
+                <span className="text-sm min-w-0 flex-1 truncate">
+                  Manual backup in progress — <span className="font-mono">{j.id}</span>
+                </span>
+                <span className="text-xs text-blue-300 shrink-0">View progress</span>
+              </button>
+            ))}
+        </CardContent>
+      </Card>
+
+      {/* ── Available archives ─────────────────────────────── */}
+      <Card className="bg-card border-border">
+        <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-3">
+          <div className="flex items-center gap-2">
+            <Archive className="h-5 w-5 text-blue-500" />
+            <CardTitle className="text-base font-semibold">Available Archives</CardTitle>
+          </div>
+          <Badge variant="outline">{unifiedArchives.length}</Badge>
+        </CardHeader>
+        <CardContent>
+          <p className="text-[11px] text-muted-foreground mb-3">
+            All backups visible from this host — local <code className="font-mono">.tar.zst</code> files (PVE default dump dir, configured local target, USB mountpoints, scheduled jobs' destinations) and PBS backups from every configured datastore. Click an entry to inspect, restore or download it — downloads of PBS backups are extracted on-demand only when you request them.
+          </p>
+          {remoteArchivesResp?.errors && remoteArchivesResp.errors.length > 0 && (
+            <div className="text-[11px] text-amber-500 mb-3 px-3 py-2 rounded-md border border-amber-500/30 bg-amber-500/5 space-y-1">
+              <div className="font-medium">Some remote backends couldn't be queried:</div>
+              {remoteArchivesResp.errors.map((e, i) => (
+                <div key={i} className="font-mono break-all">
+                  {e.backend}/{e.repo_name}: {e.error}
+                </div>
+              ))}
+            </div>
+          )}
+          {archivesErr && remoteArchivesErr ? (
+            <div className="text-sm text-red-500 py-4">Failed to load archives</div>
+          ) : !archivesResp && !remoteArchivesResp ? (
+            <div className="flex items-center gap-2 py-4 text-sm text-muted-foreground">
+              <Loader2 className="h-4 w-4 animate-spin" />
+              Loading...
+            </div>
+          ) : unifiedArchives.length === 0 ? (
+            <div className="text-sm text-muted-foreground py-4">
+              No backups found yet. Use <span className="font-medium">Run manual backup</span> above, configure a scheduled job, or check that the configured PBS / Borg destinations have backups.
+            </div>
+          ) : (
+            <div className="space-y-2">
+              {unifiedArchives.map((u) => {
+                const localKind = u.local?.kind
+                const localJobId = u.local?.job_id
+                const localHost = u.local?.source_hostname
+                const localPath = u.local?.path
+                // Same palette as the DestinationRow accents so each
+                // backend reads identically across the two cards.
+                const sourceBadgeCls =
+                  u.source === "pbs"
+                    ? "text-purple-400 border-purple-500/20 bg-purple-500/10"
+                    : u.source === "borg"
+                      ? "text-fuchsia-400 border-fuchsia-500/20 bg-fuchsia-500/10"
+                      : "text-blue-400 border-blue-500/20 bg-blue-500/10"
+                return (
+                  <button
+                    key={`${u.source}:${u.display_id}`}
+                    type="button"
+                    onClick={() => setInspectingArchive(u)}
+                    className="w-full text-left flex items-center justify-between gap-3 p-3 rounded-md border border-border bg-background/40 hover:bg-white/5 hover:border-blue-500/40 transition-colors group"
+                    title="Click to inspect, restore or download this backup"
+                  >
+                    <div className="min-w-0 flex-1">
+                      <div className="font-mono text-xs truncate group-hover:text-blue-400 transition-colors" title={localPath || u.display_id}>
+                        {u.display_id}
+                      </div>
+                      <div className="text-[11px] text-muted-foreground mt-0.5 flex items-center gap-3 flex-wrap">
+                        <span className={`uppercase tracking-wide text-[10px] px-1.5 py-0.5 rounded border ${sourceBadgeCls}`}>
+                          {u.source}
+                        </span>
+                        {u.remote?.encrypted && (
+                          <span
+                            className="uppercase tracking-wide text-[10px] px-1.5 py-0.5 rounded border border-emerald-500/40 text-emerald-400 bg-emerald-500/5 inline-flex items-center"
+                            title="Encrypted backup"
+                          >
+                            <Lock className="h-3.5 w-3.5" />
+                          </span>
+                        )}
+                        <span className="inline-flex items-center gap-1">
+                          <Clock className="h-3 w-3" />
+                          {formatMtime(u.created_at)}
+                        </span>
+                        <span className="inline-flex items-center gap-1">
+                          <HardDrive className="h-3 w-3" />
+                          {formatBytes(u.size_bytes)}
+                        </span>
+                        <span title={u.source_label}>
+                          at: <code className="font-mono">{u.source_label}</code>
+                        </span>
+                        {u.source === "local" && localKind === "scheduled" && localJobId ? (
+                          <span>job: <code className="font-mono">{localJobId}</code></span>
+                        ) : u.source === "local" && localKind === "legacy" ? (
+                          <span className="uppercase tracking-wide text-[10px] px-1.5 py-0.5 rounded bg-amber-500/10 border border-amber-500/40 text-amber-400">
+                            legacy
+                          </span>
+                        ) : u.source === "local" && localKind === "manual" ? (
+                          <span className="uppercase tracking-wide text-[10px] px-1.5 py-0.5 rounded bg-white/5 border border-border">
+                            manual
+                          </span>
+                        ) : null}
+                        {(u.source === "pbs" || u.source === "borg") && u.remote?.backup_id && (
+                          <span>{u.source === "pbs" ? "group" : "archive"}: <code className="font-mono">{u.remote.backup_id}</code></span>
+                        )}
+                        {u.source === "local" && localHost && (
+                          <span>host: <code className="font-mono">{localHost}</code></span>
+                        )}
+                      </div>
+                    </div>
+                    <ChevronRight className="h-4 w-4 text-muted-foreground group-hover:text-blue-400 transition-colors shrink-0" />
+                  </button>
+                )
+              })}
+            </div>
+          )}
+        </CardContent>
+      </Card>
+
+      {/* ── Inspect / preflight modal ──────────────────────── */}
+      <InspectModal
+        archive={inspectingArchive}
+        onClose={() => setInspectingArchive(null)}
+        onDeleted={() => {
+          setInspectingArchive(null)
+          // Refresh both lists — a deleted item might have been local
+          // or remote (PBS/Borg). Cheap enough to revalidate both.
+          mutateArchives()
+          mutateRemoteArchives()
+        }}
+      />
+
+      {/* ── Create / Edit job wizard ─────────────────────── */}
+      <CreateJobDialog
+        open={creatingJob}
+        onClose={() => setCreatingJob(false)}
+        onCreated={() => {
+          setCreatingJob(false)
+          mutateJobs()
+        }}
+      />
+      <CreateJobDialog
+        open={editingJobId !== null}
+        editingJobId={editingJobId}
+        onClose={() => setEditingJobId(null)}
+        onCreated={() => {
+          setEditingJobId(null)
+          mutateJobs()
+        }}
+      />
+
+      {/* ── One-shot manual backup ─────────────────────── */}
+      <ManualBackupDialog
+        open={runningManual}
+        onClose={() => setRunningManual(false)}
+        onLaunched={(jobId) => {
+          // Hand off straight to the live-progress modal so the
+          // operator never has to chase the "View progress" banner
+          // after pressing Run. Mutate jobs first so the new manual
+          // entry is in cache when the watch modal opens.
+          setRunningManual(false)
+          mutateJobs()
+          setWatchingManualId(jobId)
+          // Register the job with the modal-independent background
+          // poller so the Available Archives list refreshes the
+          // instant the run finishes, even if the operator closes
+          // the watch modal before then. Replaces the old fire-and-
+          // forget 5 s mutate that used to miss slow backups.
+          setPendingManualJobId(jobId)
+        }}
+      />
+
+      {/* ── Job detail / actions modal ─────────────────────────── */}
+      <JobDetailModal
+        jobId={viewingJobId}
+        onClose={() => setViewingJobId(null)}
+        onEdit={(id) => {
+          setViewingJobId(null)
+          setEditingJobId(id)
+        }}
+        onRequestDelete={(id) => {
+          const job = jobsResp?.jobs.find((j) => j.id === id)
+          if (job) {
+            setViewingJobId(null)
+            setJobToDelete(job)
+          }
+        }}
+        onChanged={() => {
+          mutateJobs()
+          mutateArchives()
+          mutateRemoteArchives()
+        }}
+      />
+
+      {/* Manual jobs use their own modal — no Schedule/Retention/
+          Profile, no Edit/Run/Disable. Only the live log; the modal
+          is closed with the dialog's own X (no extra footer). */}
+      <ManualJobWatchModal
+        jobId={watchingManualId}
+        onClose={() => setWatchingManualId(null)}
+        onChanged={() => {
+          // The watch modal fires onChanged when a tracked run
+          // finishes (last_result transitions from null → ok/failed).
+          // Refresh jobs (status badge), local archives (new tar.zst)
+          // and remote archives (Borg/PBS snapshots) so the operator
+          // sees the new backup without waiting for the next tick.
+          mutateJobs()
+          mutateArchives()
+          mutateRemoteArchives()
+        }}
+      />
+
+      {/* ── Delete confirmation ────────────────────────────── */}
+      <Dialog open={jobToDelete !== null} onOpenChange={(v) => { if (!v) setJobToDelete(null) }}>
+        <DialogContent className="max-w-md">
+          <DialogHeader>
+            <DialogTitle className="flex items-center gap-2">
+              <AlertTriangle className="h-5 w-5 text-amber-500" />
+              Delete backup job?
+            </DialogTitle>
+            <DialogDescription>
+              This action cannot be undone.
+            </DialogDescription>
+          </DialogHeader>
+          {jobToDelete && (
+            <div className="space-y-3 text-sm">
+              <div className="rounded-md border border-border bg-background/50 p-3 space-y-1">
+                <div className="text-[10px] uppercase tracking-wider text-muted-foreground">Job ID</div>
+                <div className="font-mono text-sm">{jobToDelete.id}</div>
+                {jobToDelete.attached && jobToDelete.pve_storage && (
+                  <>
+                    <div className="text-[10px] uppercase tracking-wider text-muted-foreground mt-2">Type</div>
+                    <div className="text-xs">attached to PVE storage <span className="font-mono">{jobToDelete.pve_storage}</span></div>
+                  </>
+                )}
+              </div>
+              {jobToDelete.attached ? (
+                <p className="text-xs text-muted-foreground">
+                  Only the ProxMenux host backup hook is removed.
+                  PVE vzdump jobs targeting this storage stay intact and keep running.
+                </p>
+              ) : (
+                <p className="text-xs text-muted-foreground">
+                  The systemd timer and service for this job will be stopped, disabled and removed.
+                  Existing backup archives on disk are NOT deleted.
+                </p>
+              )}
+            </div>
+          )}
+          <div className="flex justify-end gap-2 mt-2">
+            <Button
+              variant="ghost"
+              onClick={() => setJobToDelete(null)}
+              disabled={busyJobId === jobToDelete?.id}
+            >
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              onClick={confirmDeleteJob}
+              disabled={busyJobId === jobToDelete?.id}
+            >
+              {busyJobId === jobToDelete?.id ? (
+                <Loader2 className="h-4 w-4 animate-spin mr-2" />
+              ) : (
+                <Trash2 className="h-4 w-4 mr-2" />
+              )}
+              Delete
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </div>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// Inspect modal — shows manifest summary + lets the operator pick
+// a restore mode and run the dry-run preflight + plan against this
+// host. No mutating actions; --apply stays on the CLI for 1.3.0.
+// ──────────────────────────────────────────────────────────────
+function InspectModal({
+  archive,
+  onClose,
+  onDeleted,
+}: {
+  archive: UnifiedArchive | null
+  onClose: () => void
+  onDeleted?: () => void
+}) {
+  const open = archive !== null
+  // Aliases to the source-specific payloads — saves on `.local!` /
+  // `.remote!` repetition later. PBS and Borg share the same shape.
+  const localArc = archive?.source === "local" ? archive.local : undefined
+  const remoteArc = archive && archive.source !== "local" ? archive.remote : undefined
+  const isRemote = archive?.source === "pbs" || archive?.source === "borg"
+  const backendLabel = archive?.source === "pbs" ? "PBS" : archive?.source === "borg" ? "Borg" : "Local"
+  const [mode, setMode] = useState<string>("full")
+  const [report, setReport] = useState<PreflightReport | null>(null)
+  const [running, setRunning] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [instructions, setInstructions] = useState<{
+    archive_basename: string
+    mode_label: string
+    shell_command: string
+    menu_path: string[]
+    reboot_required: boolean
+    notes: string[]
+  } | null>(null)
+  const [fetchingInstructions, setFetchingInstructions] = useState(false)
+  const [downloading, setDownloading] = useState(false)
+  // Per-archive runner log — only available for local archives, where
+  // the runner writes `<stem>.log` next to the `<stem>.tar.zst` in
+  // /var/log/proxmenux/backup-jobs/. PBS / Borg snapshots don't have
+  // a co-located run log on this host.
+  const { data: archiveLog } = useSWR<{
+    log_path: string | null
+    size: number
+    content: string
+    tail: string[]
+  }>(
+    open && archive?.source === "local" && localArc?.id
+      ? `/api/host-backups/archives/${encodeURIComponent(localArc.id)}/log`
+      : null,
+    fetcher,
+  )
+  const [showArchiveFullLog, setShowArchiveFullLog] = useState(false)
+  const [showDeleteArchiveConfirm, setShowDeleteArchiveConfirm] = useState(false)
+  const [viewingContents, setViewingContents] = useState(false)
+  // Restore flow state:
+  //   restorePreparing  — extract running (blocking spinner overlay)
+  //   restoreOptions    — modal open after prepare succeeded
+  //   restoreTerminal   — ScriptTerminalModal open with monitor_apply.sh
+  // The extract happens BEFORE the options modal so the custom
+  // checklist can be filled from `components_available` (what's
+  // actually inside this backup) instead of a hardcoded list.
+  const [restorePreparing, setRestorePreparing] = useState(false)
+  const [restoreError, setRestoreError] = useState<string | null>(null)
+  const [restoreOptions, setRestoreOptions] = useState<{
+    stagingPath: string
+    pathsAvailable: string[]
+    rollbackPlan?: RollbackPlan
+    // Cross-kernel awareness passed through to RestoreOptionsModal:
+    // when direction === "bk_older" the modal shows the safe-subset
+    // banner and grays out any path prefixed by anything in
+    // blockedPaths. "bk_newer" and "same" pass through as no-ops.
+    crossKernel?: {
+      direction: "same" | "bk_older" | "bk_newer"
+      backupKernel: string
+      targetKernel: string
+      blockedPaths: string[]
+    }
+    // Kernel-agnostic hydration preview (bk_older only): what the
+    // restore will re-apply to the target via merge instead of
+    // whole-file copy — IOMMU cmdline tokens, VFIO modules,
+    // operator's GRUB keys, whitelisted vfio/nvidia files.
+    hydration?: {
+      applies: boolean
+      actions: string[]
+    }
+  } | null>(null)
+  const [restoreTerminal, setRestoreTerminal] = useState<{
+    stagingPath: string
+    mode: "full" | "custom"
+    paths: string[]
+    rollbackExecute?: boolean
+  } | null>(null)
+
+  // ── Keyfile-required inline import ────────────────────────────
+  // When this modal opens on an encrypted PBS backup and the local
+  // keyfile is missing at /usr/local/share/proxmenux/pbs-key.conf,
+  // Restore / Download / View contents would all fail with
+  // "missing key". We block the buttons and offer an inline Import
+  // panel that reuses /api/host-backups/pbs-encryption/import with
+  // source=content + escrow_mode=none — same endpoint as the setup
+  // flow, so the imported keyfile lands at the canonical path and is
+  // reused by every subsequent backup + restore.
+  const { data: keyfileInfo, mutate: mutateKeyfileInfo } = useSWR<{
+    installed: boolean
+    fingerprint?: string
+    path: string
+  }>(
+    open && remoteArc?.encrypted ? "/api/host-backups/pbs-encryption/keyfile-info" : null,
+    fetcher,
+  )
+  const needsKeyfile = !!(remoteArc?.encrypted && keyfileInfo && !keyfileInfo.installed)
+  // Same PVE-managed keyfile auto-discovery the setup wizards use: when
+  // the encrypted snapshot lives on a PBS whose PVE storage.cfg entry
+  // has an `encryption-key` file at /etc/pve/priv/storage/<NAME>.enc,
+  // surface a one-click "Use this key" shortcut in the amber panel so
+  // the operator doesn't have to type the full path. Only fetched when
+  // the amber gate is actually rendered (encrypted + no keyfile).
+  const { data: pveDiscoverInspect } = useSWR<{
+    entries: Array<{ name: string; server: string; datastore: string; path: string; matches_repository: boolean }>
+  }>(
+    needsKeyfile && remoteArc?.repo_repository
+      ? `/api/host-backups/pbs-encryption/discover-pve-keyfiles?repository=${encodeURIComponent(remoteArc.repo_repository)}`
+      : null,
+    fetcher,
+  )
+  const pveMatchInspect = pveDiscoverInspect?.entries?.find((e) => e.matches_repository) || null
+  const [importFile, setImportFile] = useState<File | null>(null)
+  const [importPath, setImportPath] = useState<string>("")
+  const [importing, setImporting] = useState(false)
+  const [importError, setImportError] = useState<string | null>(null)
+
+  const runImportKeyfile = async () => {
+    // Either a file upload OR a typed absolute path on this host —
+    // both land at /usr/local/share/proxmenux/pbs-key.conf with
+    // escrow_mode='none'. When both are provided the file wins.
+    if (!importFile && !importPath.trim()) {
+      setImportError("Pick a keyfile file or enter an absolute path on this host.")
+      return
+    }
+    setImporting(true)
+    setImportError(null)
+    try {
+      const body: Record<string, unknown> = { escrow_mode: "none" }
+      if (importFile) {
+        const buf = new Uint8Array(await importFile.arrayBuffer())
+        let bin = ""
+        for (let i = 0; i < buf.length; i++) bin += String.fromCharCode(buf[i])
+        body.source = "content"
+        body.content_b64 = btoa(bin)
+      } else {
+        body.source = "path"
+        body.keyfile_path = importPath.trim()
+      }
+      await fetchApi("/api/host-backups/pbs-encryption/import", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      })
+      await mutateKeyfileInfo()
+      setImportFile(null)
+      setImportPath("")
+    } catch (e) {
+      setImportError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setImporting(false)
+    }
+  }
+
+  const beginRestore = async () => {
+    if (!archive) return
+    setRestoreError(null)
+    setRestorePreparing(true)
+    const body: Record<string, string> = { source: archive.source }
+    if (archive.source === "local") {
+      if (!localArc?.path) { setRestoreError("Local archive path missing"); setRestorePreparing(false); return }
+      body.path = localArc.path
+    } else if (remoteArc) {
+      body.repo_name = remoteArc.repo_name
+      body.snapshot = remoteArc.snapshot
+    } else {
+      setRestoreError("Snapshot info missing")
+      setRestorePreparing(false)
+      return
+    }
+    try {
+      const r: any = await fetchApi("/api/host-backups/restore/prepare", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      })
+      if (!r?.staging_path) throw new Error("backend did not return a staging path")
+      const ck = r.cross_kernel || {}
+      const hyd = r.hydration || {}
+      setRestoreOptions({
+        stagingPath: r.staging_path,
+        pathsAvailable: Array.isArray(r.paths_available) ? r.paths_available : [],
+        rollbackPlan: r.rollback_plan,
+        crossKernel: ck.direction
+          ? {
+              direction: ck.direction,
+              backupKernel: ck.backup_kernel || "",
+              targetKernel: ck.target_kernel || "",
+              blockedPaths: Array.isArray(ck.blocked_paths) ? ck.blocked_paths : [],
+            }
+          : undefined,
+        hydration: hyd.applies
+          ? {
+              applies: true,
+              actions: Array.isArray(hyd.actions) ? hyd.actions : [],
+            }
+          : undefined,
+      })
+    } catch (e) {
+      setRestoreError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setRestorePreparing(false)
+    }
+  }
+  const [deletingArchive, setDeletingArchive] = useState(false)
+  const [archiveDeleteResult, setArchiveDeleteResult] = useState<string[] | null>(null)
+
+  // Local download. Uses a single-use ticket appended to the URL +
+  // `<a download>` instead of fetch+blob — the previous fetch+blob
+  // approach loaded the whole archive into the browser's RAM via
+  // URL.createObjectURL(), which broke around 2 GB on most browsers.
+  // With the ticket-on-URL approach the browser streams the response
+  // straight to disk, so archive size is bounded only by free space.
+  const downloadLocalArchive = async () => {
+    if (!localArc) return
+    setDownloading(true)
+    setError(null)
+    try {
+      const ticket = await fetchTerminalTicket()
+      let url = getApiUrl(`/api/host-backups/archives/${encodeURIComponent(localArc.id)}/download`)
+      if (ticket) url += `?ticket=${encodeURIComponent(ticket)}`
+      const a = document.createElement("a")
+      a.href = url
+      a.download = localArc.id
+      document.body.appendChild(a)
+      a.click()
+      document.body.removeChild(a)
+    } catch (e) {
+      setError(`Download failed: ${e instanceof Error ? e.message : String(e)}`)
+    } finally {
+      // The download itself runs in the browser's network stack;
+      // we just initiated it. Clear the spinner immediately.
+      setDownloading(false)
+    }
+  }
+
+  // Remote export-then-download (PBS or Borg) — kicks off the
+  // server-side extract + pack, polls until the .tar.zst is ready,
+  // then streams it like the local case. Stage feedback (queued /
+  // restoring / packing) goes into `exportTask.state` so the modal
+  // can show what's happening live.
+  const [exportTask, setExportTask] = useState<ExportTask | null>(null)
+  const downloadRemoteArchive = async () => {
+    if (!remoteArc) return
+    setDownloading(true)
+    setError(null)
+    setExportTask({
+      task_id: "",
+      backend: remoteArc.backend,
+      repo_name: remoteArc.repo_name,
+      snapshot: remoteArc.snapshot,
+      state: "queued",
+      message: "Starting export…",
+      size_bytes: 0,
+      output_path: null,
+      error: null,
+    })
+    try {
+      const started = await fetchApi<{ task_id: string; state: string }>(
+        "/api/host-backups/remote-archives/export",
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            backend: remoteArc.backend,
+            repo_name: remoteArc.repo_name,
+            snapshot: remoteArc.snapshot,
+          }),
+        },
+      )
+      // Poll until done. The export can take from seconds (small host
+      // config) to minutes (multi-GB pxar) — poll every 1.5s so the
+      // UI feels responsive without DoS-ing Flask.
+      let task: ExportTask | null = null
+      while (true) {
+        await new Promise((res) => setTimeout(res, 1500))
+        task = await fetchApi<ExportTask>(
+          `/api/host-backups/remote-archives/export/${encodeURIComponent(started.task_id)}`,
+        )
+        setExportTask(task)
+        if (task.state === "completed" || task.state === "failed") break
+      }
+      if (!task || task.state !== "completed") {
+        throw new Error(task?.error || "export did not complete")
+      }
+      // Stream the resulting .tar.zst with a ticketed URL + <a download>.
+      // Same rationale as downloadLocalArchive: bypass fetch+blob to
+      // avoid the ~2 GB browser-RAM limit; the browser writes
+      // straight to disk.
+      const ticket = await fetchTerminalTicket()
+      let url = getApiUrl(`/api/host-backups/remote-archives/export/${encodeURIComponent(started.task_id)}/download`)
+      if (ticket) url += `?ticket=${encodeURIComponent(ticket)}`
+      const safeSnap = remoteArc.snapshot.replace(/\//g, "_")
+      const a = document.createElement("a")
+      a.href = url
+      a.download = `${remoteArc.backend}-${remoteArc.repo_name}-${safeSnap}.tar.zst`
+      document.body.appendChild(a)
+      a.click()
+      document.body.removeChild(a)
+      setExportTask(null)
+    } catch (e) {
+      setError(`Download failed: ${e instanceof Error ? e.message : String(e)}`)
+    } finally {
+      setDownloading(false)
+    }
+  }
+
+  const downloadArchive = () => {
+    if (isRemote) return downloadRemoteArchive()
+    return downloadLocalArchive()
+  }
+
+  // Archive deletion — works for local, PBS and Borg backends.
+  //   • local: DELETE /archives/<id> → removes .tar.zst + sidecar + run log.
+  //   • pbs:   DELETE /remote-archives → `proxmox-backup-client snapshot forget`.
+  //   • borg:  DELETE /remote-archives → `borg delete <repo>::<archive>`.
+  // PBS-protected snapshots come back as 409 with the original message so
+  // the operator can decide whether to lift the protection first.
+  const deleteArchive = async () => {
+    if (!archive) return
+    setDeletingArchive(true)
+    setError(null)
+    try {
+      let removed: string[] = []
+      if (archive.source === "local" && localArc) {
+        const resp = await fetchApi<{ status: string; removed: string[] }>(
+          `/api/host-backups/archives/${encodeURIComponent(localArc.id)}`,
+          { method: "DELETE" },
+        )
+        removed = resp.removed || []
+      } else if (remoteArc) {
+        const resp = await fetchApi<{ status: string; removed: string }>(
+          `/api/host-backups/remote-archives`,
+          {
+            method: "DELETE",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              backend: remoteArc.backend,
+              repo_name: remoteArc.repo_name,
+              snapshot: remoteArc.snapshot,
+            }),
+          },
+        )
+        removed = resp.removed ? [resp.removed] : []
+      }
+      setArchiveDeleteResult(removed)
+      setShowDeleteArchiveConfirm(false)
+      if (onDeleted) onDeleted(); else onClose()
+    } catch (e) {
+      setError(`Failed to delete: ${e instanceof Error ? e.message : String(e)}`)
+    } finally {
+      setDeletingArchive(false)
+    }
+  }
+
+  // Reset instructions when archive or mode changes — the previous
+  // command is no longer relevant.
+  useEffect(() => {
+    setInstructions(null)
+  }, [archive, mode])
+
+  const fetchInstructions = async () => {
+    if (!localArc) return
+    setFetchingInstructions(true)
+    setError(null)
+    try {
+      const res = await fetchApi<typeof instructions extends infer T ? T : never>(
+        `/api/host-backups/archives/${encodeURIComponent(localArc.id)}/prepare-restore`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ mode }),
+        }
+      ) as NonNullable<typeof instructions>
+      setInstructions(res)
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setFetchingInstructions(false)
+    }
+  }
+
+  const { data: manifest, error: manifestErr } = useSWR<{
+    source_host: ManifestSourceHost
+    proxmenux_installed_components: Array<{ id: string; version_at_backup: string | null }>
+    vms_lxcs_at_backup: { vms: unknown[]; lxcs: unknown[] }
+    storage_inventory?: { zfs_pools?: unknown[]; lvm?: { vgs?: unknown[] } }
+  }>(
+    localArc ? `/api/host-backups/archives/${encodeURIComponent(localArc.id)}/manifest` : null,
+    fetcher,
+  )
+
+  const runPreflight = async () => {
+    if (!localArc) return
+    setRunning(true)
+    setError(null)
+    setReport(null)
+    try {
+      const res = await fetchApi<PreflightReport>(
+        `/api/host-backups/archives/${encodeURIComponent(localArc.id)}/preflight`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ mode }),
+        },
+      )
+      setReport(res)
+    } catch (e: any) {
+      setError(e?.message || "Preflight failed")
+    } finally {
+      setRunning(false)
+    }
+  }
+
+  // Reset state when archive changes — the key= prop on DialogContent
+  // forces React to unmount + remount so all useState() values are
+  // discarded automatically. Cleaner than manually tracking each.
+  const archiveKey = archive ? `${archive.source}:${archive.display_id}` : ""
+
+  return (
+    <>
+    <Dialog open={open} onOpenChange={(v) => { if (!v) onClose() }}>
+      <DialogContent key={archiveKey} className="max-w-3xl bg-card border-border p-0 flex flex-col gap-0 max-h-[90vh]">
+        <DialogHeader className="px-4 sm:px-6 pt-4 pb-3 shrink-0 border-b border-border">
+          <DialogTitle className="flex items-center gap-2 flex-wrap text-base pr-8">
+            <DatabaseBackup className="h-5 w-5 text-blue-500 shrink-0" />
+            <span className="font-mono text-xs sm:text-sm break-all flex-1 min-w-0">{archive?.display_id}</span>
+          </DialogTitle>
+        </DialogHeader>
+
+        {/* ── Body: same shape for the 3 backends ─────────────── */}
+        <ScrollArea className="flex-1 min-h-0">
+          <div className="px-4 sm:px-6 py-4 space-y-4">
+            {/* Backup info — uniform grid, with backend-specific
+                rows mixed in only when they carry data. Backend +
+                encryption badges live here (instead of the header,
+                where they used to overlap the close button). */}
+            <section className="rounded-md border border-border bg-background/40 p-3 space-y-1 text-xs">
+              <div className="flex items-center justify-between gap-2 flex-wrap">
+                <div className="text-[10px] uppercase tracking-wider text-muted-foreground">Backup</div>
+                <div className="flex items-center gap-1.5">
+                  {archive && (
+                    <Badge variant="outline" className={`text-[10px] uppercase tracking-wide ${
+                      archive.source === "pbs"
+                        ? "text-purple-400 border-purple-500/40 bg-purple-500/10"
+                        : archive.source === "borg"
+                          ? "text-fuchsia-400 border-fuchsia-500/40 bg-fuchsia-500/10"
+                          : "text-blue-400 border-blue-500/40 bg-blue-500/10"
+                    }`}>
+                      {archive.source}
+                    </Badge>
+                  )}
+                  {remoteArc?.encrypted && (
+                    <Badge
+                      variant="outline"
+                      className="text-emerald-400 border-emerald-500/40 bg-emerald-500/10"
+                      title="Encrypted"
+                    >
+                      <Lock className="h-3.5 w-3.5" />
+                    </Badge>
+                  )}
+                </div>
+              </div>
+              <div className="grid grid-cols-1 sm:grid-cols-2 gap-x-4 gap-y-1">
+                {/* Time + size — present for every backend. */}
+                {archive && (archive.source === "pbs" || archive.source === "borg") && remoteArc ? (
+                  <>
+                    <div><span className="text-muted-foreground">Backup time:</span> {formatMtime(remoteArc.backup_time)}</div>
+                    {remoteArc.size_bytes > 0 && <div><span className="text-muted-foreground">Size:</span> {formatBytes(remoteArc.size_bytes)}</div>}
+                    <div><span className="text-muted-foreground">Repository:</span> <code className="font-mono break-all">{remoteArc.repo_repository}</code></div>
+                    <div><span className="text-muted-foreground">Repo name:</span> <code className="font-mono">{remoteArc.repo_name}</code></div>
+                    <div>
+                      <span className="text-muted-foreground">{remoteArc.backend === "pbs" ? "Backup group:" : "Archive name:"}</span>{" "}
+                      <code className="font-mono break-all">{remoteArc.backend === "pbs" ? `${remoteArc.backup_type}/${remoteArc.backup_id}` : remoteArc.backup_id}</code>
+                    </div>
+                    {remoteArc.owner && <div><span className="text-muted-foreground">Owner:</span> <code className="font-mono">{remoteArc.owner}</code></div>}
+                    {remoteArc.borg_id && <div className="sm:col-span-2"><span className="text-muted-foreground">Borg id:</span> <code className="font-mono text-[10px] break-all">{remoteArc.borg_id}</code></div>}
+                  </>
+                ) : localArc ? (
+                  <>
+                    <div><span className="text-muted-foreground">Created:</span> {formatMtime(localArc.mtime)}</div>
+                    <div><span className="text-muted-foreground">Size:</span> {formatBytes(localArc.size_bytes)}</div>
+                    <div className="sm:col-span-2"><span className="text-muted-foreground">Path:</span> <code className="font-mono break-all">{localArc.path}</code></div>
+                    {localArc.job_id && <div><span className="text-muted-foreground">Job id:</span> <code className="font-mono">{localArc.job_id}</code></div>}
+                    {localArc.profile && <div><span className="text-muted-foreground">Profile:</span> <code className="font-mono">{localArc.profile}</code></div>}
+                    {localArc.source_hostname && <div><span className="text-muted-foreground">Source host:</span> <code className="font-mono">{localArc.source_hostname}</code></div>}
+                    <div><span className="text-muted-foreground">Detected via:</span> <code className="font-mono text-[10px]">{localArc.detected_via}</code></div>
+                  </>
+                ) : null}
+              </div>
+              {/* PBS pxar files list — only PBS exposes this. */}
+              {remoteArc?.files && remoteArc.files.length > 0 && (
+                <div className="pt-2 mt-2 border-t border-border/50">
+                  <div className="text-[10px] uppercase tracking-wider text-muted-foreground mb-1">Files in this backup</div>
+                  <ul className="space-y-0.5">
+                    {remoteArc.files.map((f) => (
+                      <li key={f.filename} className="font-mono text-[11px] flex items-center justify-between gap-2">
+                        <span>{f.filename}</span>
+                        <span className="text-muted-foreground">{formatBytes(f.size)}</span>
+                      </li>
+                    ))}
+                  </ul>
+                </div>
+              )}
+            </section>
+
+            {/* Run log — only Local has a co-located <stem>.log. */}
+            {archive?.source === "local" && archiveLog && archiveLog.log_path && archiveLog.tail.length > 0 && (
+              <section className="space-y-2">
+                <h4 className="text-xs font-semibold uppercase tracking-wide flex items-center gap-1.5 text-green-500">
+                  <FileText className="h-3.5 w-3.5" /> Run log
+                </h4>
+                <div className="rounded-md border border-border bg-background/60 p-2">
+                  <pre className="text-[11px] font-mono whitespace-pre-wrap break-all max-h-48 overflow-auto text-foreground/90">
+{archiveLog.tail.join("\n")}
+                  </pre>
+                  <div className="flex items-center justify-between mt-2 gap-2 flex-wrap">
+                    <span className="text-[10px] text-muted-foreground inline-flex items-center gap-2 min-w-0">
+                      <span>tail · {formatBytes(archiveLog.size)}</span>
+                      <span className="font-mono break-all">{archiveLog.log_path}</span>
+                    </span>
+                    <Button size="sm" variant="ghost" className="h-7 text-xs shrink-0" onClick={() => setShowArchiveFullLog(true)}>
+                      <FileText className="h-3.5 w-3.5 mr-1" />
+                      Open full log
+                    </Button>
+                  </div>
+                </div>
+              </section>
+            )}
+
+            {/* In-flight export task feedback (Download for PBS/Borg). */}
+            {exportTask && (
+              <div className="text-[11px] space-y-1 px-3 py-2 rounded-md border border-border bg-background/40">
+                <div className="flex items-center gap-2">
+                  <Loader2 className={`h-3.5 w-3.5 ${exportTask.state === "completed" || exportTask.state === "failed" ? "" : "animate-spin"}`} />
+                  <span className="font-medium capitalize">{exportTask.state}</span>
+                  <span className="text-muted-foreground">— {exportTask.message}</span>
+                </div>
+                {exportTask.state === "failed" && exportTask.error && (
+                  <div className="text-red-500 mt-1">{exportTask.error}</div>
+                )}
+                {exportTask.state === "completed" && exportTask.size_bytes > 0 && (
+                  <div className="text-emerald-400">Packed size: {formatBytes(exportTask.size_bytes)}</div>
+                )}
+              </div>
+            )}
+
+            {error && (() => {
+              const kf = parseKeyfileError(error)
+              return kf ? (
+                <KeyfileErrorBlock err={kf} />
+              ) : (
+                <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+                  {error}
+                </div>
+              )
+            })()}
+
+            {/* Encrypted-backup gate: no local keyfile → block the
+                three actions until the operator imports the key. The
+                import lands at the canonical path with escrow_mode=
+                'none', so subsequent runs reuse it silently. */}
+            {needsKeyfile && (
+              <section className="rounded-md border border-amber-500/40 bg-amber-500/5 p-3 space-y-2 text-xs">
+                <div className="flex items-start gap-2">
+                  <AlertTriangle className="h-4 w-4 text-amber-400 mt-0.5 shrink-0" />
+                  <div className="flex-1 space-y-1">
+                    <div className="font-semibold text-amber-300">Encrypted backup — keyfile required</div>
+                    <div className="text-muted-foreground leading-relaxed">
+                      This snapshot is encrypted but no local keyfile is installed at
+                      {" "}<code className="font-mono text-[10.5px]">/usr/local/share/proxmenux/pbs-key.conf</code>.
+                      Import the keyfile that was used at backup time to continue.
+                    </div>
+                  </div>
+                </div>
+                {pveMatchInspect && (
+                  <div className="rounded-md border border-emerald-500/40 bg-emerald-500/10 p-2.5 space-y-1.5 text-[11px]">
+                    <div className="flex items-start gap-2">
+                      <Lock className="h-3.5 w-3.5 text-emerald-400 mt-0.5 shrink-0" />
+                      <div className="flex-1 space-y-1">
+                        <div className="font-semibold text-emerald-300">PVE-managed keyfile detected for this PBS</div>
+                        <div className="text-muted-foreground">
+                          Proxmox stores an encryption key for storage <code className="font-mono text-[10.5px]">{pveMatchInspect.name}</code> at{" "}
+                          <code className="font-mono text-[10.5px] break-all">{pveMatchInspect.path}</code>. Import it in one click.
+                        </div>
+                      </div>
+                    </div>
+                    <div className="flex justify-end">
+                      <Button
+                        size="sm"
+                        onClick={() => {
+                          setImportPath(pveMatchInspect.path)
+                          setImportFile(null)
+                        }}
+                        disabled={importing}
+                        className="!bg-emerald-600 hover:!bg-emerald-700 !text-white h-6 text-[10.5px] px-2"
+                      >
+                        Use this key
+                      </Button>
+                    </div>
+                  </div>
+                )}
+                <div className="space-y-1.5 pt-1 border-t border-amber-500/30">
+                  <Label htmlFor="keyfileImport" className="text-[11px] font-medium">
+                    {pveMatchInspect ? "Or upload from your machine" : "Upload from your machine"}
+                  </Label>
+                  <Input
+                    id="keyfileImport"
+                    type="file"
+                    accept=".conf,.key,application/json,text/plain"
+                    onChange={(e) => setImportFile(e.target.files?.[0] ?? null)}
+                    disabled={importing || !!importPath.trim()}
+                    className="h-8 text-[11px]"
+                  />
+                </div>
+                <div className="text-[10px] text-center text-muted-foreground">— or —</div>
+                <div className="space-y-1.5">
+                  <Label htmlFor="keyfileImportPath" className="text-[11px] font-medium">Absolute path on this host</Label>
+                  <Input
+                    id="keyfileImportPath"
+                    type="text"
+                    value={importPath}
+                    onChange={(e) => setImportPath(e.target.value)}
+                    disabled={importing || !!importFile}
+                    placeholder="e.g. /etc/pve/priv/storage/<NAME>.enc or /root/my-pbs-key"
+                    className="h-8 text-[11px] font-mono"
+                  />
+                </div>
+                {importError && (
+                  <div className="text-red-500 px-2 py-1.5 rounded border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+                    {importError}
+                  </div>
+                )}
+                <div className="flex justify-end">
+                  <Button
+                    size="sm"
+                    onClick={runImportKeyfile}
+                    disabled={importing || (!importFile && !importPath.trim())}
+                    className="bg-amber-500/20 border border-amber-500/40 text-amber-300 hover:bg-amber-500/30"
+                    variant="outline"
+                  >
+                    {importing ? (
+                      <Loader2 className="h-3.5 w-3.5 mr-1.5 animate-spin" />
+                    ) : (
+                      <Lock className="h-3.5 w-3.5 mr-1.5" />
+                    )}
+                    Import keyfile
+                  </Button>
+                </div>
+              </section>
+            )}
+          </div>
+        </ScrollArea>
+
+        {/* ── Footer: same 4 buttons for the 3 backends ─────────
+            Restore (green) · Download (blue) · View contents (blue)
+            on the left · Delete (red) on the right. On mobile only
+            Restore keeps its label — the others are icon-only to fit
+            the narrower viewport without wrapping. */}
+        <div className="px-4 sm:px-6 py-3 border-t border-border shrink-0 flex items-center justify-between gap-2">
+          <div className="flex items-center gap-2 flex-wrap">
+            <Button
+              onClick={beginRestore}
+              disabled={restorePreparing || needsKeyfile}
+              className="bg-green-600 hover:bg-green-700 text-white disabled:opacity-50"
+              title={needsKeyfile ? "Import the encryption keyfile above to enable Restore" : "Restore this snapshot to the current host (Complete or Custom by paths)"}
+            >
+              {restorePreparing ? (
+                <Loader2 className="h-4 w-4 sm:mr-2 animate-spin" />
+              ) : (
+                <DatabaseBackup className="h-4 w-4 sm:mr-2" />
+              )}
+              <span>Restore</span>
+            </Button>
+            <Button
+              onClick={downloadArchive}
+              disabled={downloading || needsKeyfile}
+              className="bg-blue-500/10 border border-blue-500/40 text-blue-400 hover:bg-blue-500/20 hover:text-blue-300 disabled:opacity-50"
+              variant="outline"
+              title={needsKeyfile ? "Import the encryption keyfile above to enable Download" : "Download the snapshot as a .tar.zst"}
+            >
+              {downloading ? (
+                <Loader2 className="h-4 w-4 sm:mr-2 animate-spin" />
+              ) : (
+                <Download className="h-4 w-4 sm:mr-2" />
+              )}
+              <span className="hidden sm:inline">Download</span>
+            </Button>
+            <Button
+              onClick={() => setViewingContents(true)}
+              disabled={needsKeyfile}
+              className="bg-blue-500/10 border border-blue-500/40 text-blue-400 hover:bg-blue-500/20 hover:text-blue-300 disabled:opacity-50"
+              variant="outline"
+              title={needsKeyfile ? "Import the encryption keyfile above to enable View contents" : "Extract + show manifest, plan, files, metadata as HTML"}
+            >
+              <Eye className="h-4 w-4 sm:mr-2" />
+              <span className="hidden sm:inline">View contents</span>
+            </Button>
+          </div>
+          <Button
+            onClick={() => setShowDeleteArchiveConfirm(true)}
+            disabled={deletingArchive}
+            className="bg-red-500/10 border border-red-500/40 text-red-400 hover:bg-red-500/20 hover:text-red-300"
+            variant="outline"
+            title={
+              archive?.source === "local"
+                ? "Permanently delete this archive (.tar.zst + sidecar + log)"
+                : archive?.source === "pbs"
+                ? "Permanently forget this PBS snapshot (proxmox-backup-client snapshot forget)"
+                : "Permanently delete this Borg archive (borg delete)"
+            }
+          >
+            {deletingArchive ? (
+              <Loader2 className="h-4 w-4 sm:mr-2 animate-spin" />
+            ) : (
+              <Trash2 className="h-4 w-4 sm:mr-2" />
+            )}
+            <span className="hidden sm:inline">Delete</span>
+          </Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+
+    {/* ── View contents — extract + parse the snapshot, show HTML ──── */}
+    <ArchiveContentsModal
+      open={viewingContents}
+      onClose={() => setViewingContents(false)}
+      source={(archive?.source as "pbs" | "borg" | "local" | null) ?? null}
+      repo_name={remoteArc?.repo_name}
+      snapshot={remoteArc?.snapshot}
+      path={localArc?.path}
+      display_id={archive?.display_id}
+    />
+
+    {/* ── Restore error toast (prepare failed) ─────────────────── */}
+    {restoreError && (() => {
+      const kf = parseKeyfileError(restoreError)
+      return (
+        <Dialog open={true} onOpenChange={() => setRestoreError(null)}>
+          <DialogContent className="max-w-md bg-card border-border">
+            <DialogHeader>
+              <DialogTitle className="text-base flex items-center gap-2">
+                <AlertTriangle className="h-5 w-5 text-red-500" />
+                {kf ? "Restore blocked — encrypted backup" : "Restore preparation failed"}
+              </DialogTitle>
+              {!kf && (
+                <DialogDescription className="text-xs text-red-400 break-all">
+                  {restoreError}
+                </DialogDescription>
+              )}
+            </DialogHeader>
+            {kf && <KeyfileErrorBlock err={kf} />}
+            <div className="flex justify-end">
+              <Button variant="ghost" onClick={() => setRestoreError(null)}>Close</Button>
+            </div>
+          </DialogContent>
+        </Dialog>
+      )
+    })()}
+
+    {/* ── Restore options modal: opens only AFTER the prepare step,
+        so the Custom checklist already knows what's inside. ──── */}
+    <RestoreOptionsModal
+      open={restoreOptions !== null}
+      stagingPath={restoreOptions?.stagingPath ?? ""}
+      pathsAvailable={restoreOptions?.pathsAvailable ?? []}
+      rollbackPlan={restoreOptions?.rollbackPlan}
+      crossKernel={restoreOptions?.crossKernel}
+      hydration={restoreOptions?.hydration}
+      display_id={archive?.display_id}
+      onClose={() => {
+        const sp = restoreOptions?.stagingPath
+        setRestoreOptions(null)
+        if (sp) {
+          fetchApi("/api/host-backups/restore/cleanup", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ staging_path: sp }),
+          }).catch(() => undefined)
+        }
+      }}
+      onLaunch={(mode, paths, rollbackExecute) => {
+        if (!restoreOptions) return
+        const sp = restoreOptions.stagingPath
+        setRestoreOptions(null)
+        setRestoreTerminal({ stagingPath: sp, mode, paths, rollbackExecute })
+      }}
+    />
+
+    {/* ── Restore terminal — uses the canonical ScriptTerminalModal
+        (the same component Hardware/Security/Settings use to run
+        their scripts). Stable `key` per stagingPath so each restore
+        session is a fresh terminal. */}
+    {restoreTerminal && (
+      <ScriptTerminalModal
+        key={restoreTerminal.stagingPath}
+        open={true}
+        onClose={() => {
+          const sp = restoreTerminal.stagingPath
+          fetchApi("/api/host-backups/restore/cleanup", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ staging_path: sp }),
+          }).catch(() => undefined)
+          setRestoreTerminal(null)
+        }}
+        // Auto-dismiss when the script's PTY closes (i.e. the bash
+        // wrapper exited cleanly — the operator pressed Enter at the
+        // "Press Enter to close" prompt). Without this the operator
+        // would have to click Close manually after each restore.
+        onComplete={() => {
+          const sp = restoreTerminal.stagingPath
+          fetchApi("/api/host-backups/restore/cleanup", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ staging_path: sp }),
+          }).catch(() => undefined)
+          setRestoreTerminal(null)
+        }}
+        scriptPath="/usr/local/share/proxmenux/scripts/backup_restore/restore/monitor_apply.sh"
+        scriptName="monitor_apply"
+        title={`Restore — ${restoreTerminal.mode === "full" ? "Complete" : "Custom by paths"}`}
+        description={
+          restoreTerminal.mode === "custom"
+            ? `${restoreTerminal.paths.length} path(s) selected`
+            : "Complete restore — applies the whole backup"
+        }
+        params={{
+          EXECUTION_MODE: "web",
+          STAGING: restoreTerminal.stagingPath,
+          MODE: restoreTerminal.mode,
+          ...(restoreTerminal.mode === "custom" && restoreTerminal.paths.length > 0
+            ? { PATHS: restoreTerminal.paths.join(",") }
+            : {}),
+          ...(restoreTerminal.rollbackExecute ? { ROLLBACK_EXECUTE: "1" } : {}),
+        }}
+      />
+    )}
+
+    {/* ── Confirm archive deletion ───────────────────────────── */}
+    <Dialog open={showDeleteArchiveConfirm} onOpenChange={setShowDeleteArchiveConfirm}>
+      <DialogContent className="max-w-md bg-card border-border">
+        <DialogHeader>
+          <DialogTitle className="text-base flex items-center gap-2">
+            <AlertTriangle className="h-5 w-5 text-red-500" />
+            Delete {backendLabel} backup
+          </DialogTitle>
+          <DialogDescription className="text-xs">
+            {archive?.source === "local"
+              ? "Removes the archive, its sidecar JSON and the matching run log. The action is permanent — restore needs an off-host copy."
+              : archive?.source === "pbs"
+              ? `Forgets this snapshot from the PBS repository "${remoteArc?.repo_name ?? ""}". The action is permanent — PBS GC may reclaim the underlying chunks at the next garbage-collection run.`
+              : `Deletes this archive from the Borg repository "${remoteArc?.repo_name ?? ""}". The action is permanent — Borg compacts the freed space at the next prune.`}
+          </DialogDescription>
+        </DialogHeader>
+        <div className="text-sm font-mono px-3 py-2 rounded-md border border-border bg-background/40 break-all">
+          {archive?.source === "local" ? localArc?.id : remoteArc?.snapshot}
+        </div>
+        <div className="flex justify-end gap-2">
+          <Button variant="ghost" onClick={() => setShowDeleteArchiveConfirm(false)} disabled={deletingArchive}>
+            Cancel
+          </Button>
+          <Button variant="destructive" onClick={deleteArchive} disabled={deletingArchive}>
+            {deletingArchive ? (
+              <Loader2 className="h-4 w-4 mr-2 animate-spin" />
+            ) : (
+              <Trash2 className="h-4 w-4 mr-2" />
+            )}
+            Delete
+          </Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+
+    {/* ── Full run log viewer ─────────────────────────────────── */}
+    <Dialog open={showArchiveFullLog} onOpenChange={setShowArchiveFullLog}>
+      <DialogContent className="max-w-4xl bg-card border-border">
+        <DialogHeader>
+          <DialogTitle className="text-base flex items-center gap-2">
+            <FileText className="h-5 w-5 text-blue-500" />
+            Run log
+          </DialogTitle>
+          <DialogDescription className="text-xs font-mono break-all">
+            {archiveLog?.log_path}
+          </DialogDescription>
+        </DialogHeader>
+        <pre className="text-[11px] font-mono whitespace-pre-wrap break-all max-h-[60vh] overflow-auto rounded-md border border-border bg-background/60 p-3 text-foreground/90">
+{archiveLog?.content ?? ""}
+        </pre>
+        <div className="flex justify-end">
+          <Button variant="ghost" onClick={() => setShowArchiveFullLog(false)}>Close</Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+    </>
+  )
+}
+
+// ── Manifest summary panel ───────────────────────────────────
+function ManifestSummary({
+  manifest,
+}: {
+  manifest: {
+    source_host: ManifestSourceHost
+    proxmenux_installed_components: Array<{ id: string; version_at_backup: string | null }>
+    vms_lxcs_at_backup: { vms: unknown[]; lxcs: unknown[] }
+    storage_inventory?: { zfs_pools?: unknown[]; lvm?: { vgs?: unknown[] } }
+  }
+}) {
+  const sh = manifest.source_host
+  const zfsCount = manifest.storage_inventory?.zfs_pools?.length ?? 0
+  const lvmCount = manifest.storage_inventory?.lvm?.vgs?.length ?? 0
+  return (
+    <div className="space-y-3 py-2">
+      <div className="grid grid-cols-2 sm:grid-cols-3 gap-3 text-xs">
+        <Field icon={<Server className="h-3.5 w-3.5" />} label="Source host" value={sh.hostname} />
+        <Field label="PVE version" value={sh.pve_version || "—"} />
+        <Field label="Roles" value={sh.roles.join(", ")} />
+        <Field label="Kernel" value={sh.kernel} mono />
+        <Field label="Boot mode" value={sh.boot_mode} />
+        <Field label="Memory" value={`${Math.round(sh.memory_kb / 1024)} MB`} />
+        <Field label="ZFS pools" value={String(zfsCount)} />
+        <Field label="LVM VGs" value={String(lvmCount)} />
+        <Field label="VMs / LXCs" value={`${manifest.vms_lxcs_at_backup.vms.length} VM / ${manifest.vms_lxcs_at_backup.lxcs.length} LXC`} />
+      </div>
+      {manifest.proxmenux_installed_components.length > 0 && (
+        <div className="text-xs">
+          <div className="text-muted-foreground mb-1">ProxMenux components at backup time:</div>
+          <div className="flex flex-wrap gap-1.5">
+            {manifest.proxmenux_installed_components.map((c) => (
+              <Badge key={c.id} variant="outline" className="font-mono text-[10px]">
+                {c.id}{c.version_at_backup ? ` @ ${c.version_at_backup}` : ""}
+              </Badge>
+            ))}
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}
+
+function Field({ icon, label, value, mono, labelClassName }: { icon?: React.ReactNode; label: string; value: string; mono?: boolean; labelClassName?: string }) {
+  return (
+    <div className="min-w-0">
+      <div className={`text-[10px] uppercase tracking-wider flex items-center gap-1 ${labelClassName ?? "text-muted-foreground"}`}>
+        {icon}
+        {label}
+      </div>
+      <div className={`${mono ? "font-mono break-all" : "break-words"}`} title={value}>
+        {value}
+      </div>
+    </div>
+  )
+}
+
+// Renders the retention policy as a row of labeled badges. The runner's
+// .env stores six discrete keys (KEEP_LAST / HOURLY / DAILY / WEEKLY /
+// MONTHLY / YEARLY); the original UI dumped them as a comma-separated
+// `key=val, key=val…` string which read like a config file. This view
+// drops zero-valued entries and presents what survives as ordered chips.
+function RetentionDisplay({ retention }: { retention: Record<string, string | undefined> }) {
+  const order: Array<[string, string]> = [
+    ["keep_last", "last"],
+    ["keep_hourly", "hourly"],
+    ["keep_daily", "daily"],
+    ["keep_weekly", "weekly"],
+    ["keep_monthly", "monthly"],
+    ["keep_yearly", "yearly"],
+  ]
+  const items = order
+    .map(([k, lbl]) => {
+      const v = (retention[k] || "").trim()
+      const n = Number.parseInt(v, 10)
+      if (!v || !Number.isFinite(n) || n <= 0) return null
+      return { label: lbl, value: n }
+    })
+    .filter((x): x is { label: string; value: number } => x !== null)
+
+  return (
+    <div>
+      <div className="text-[10px] uppercase tracking-wider flex items-center gap-1 text-green-500/90">
+        <Archive className="h-3 w-3 text-green-500/80" /> retention
+      </div>
+      {items.length === 0 ? (
+        <div className="text-muted-foreground italic text-xs mt-1">No retention rules — backups will accumulate.</div>
+      ) : (
+        <div className="mt-1 flex flex-wrap gap-1.5">
+          {items.map((it) => (
+            <span
+              key={it.label}
+              className="inline-flex items-center gap-1.5 px-2 py-0.5 rounded border border-border bg-background/60"
+            >
+              <span className="text-[10px] uppercase tracking-wide text-muted-foreground">{it.label}</span>
+              <span className="font-mono text-xs text-foreground">{it.value}</span>
+            </span>
+          ))}
+        </div>
+      )}
+    </div>
+  )
+}
+
+// Renders the backup profile paths as a 2-column grid of monospaced
+// rows instead of a single ` · `-separated line. With ~30 paths the
+// old layout forced a horizontal scroll on the dialog because the
+// line couldn't be wrapped without breaking the path identifiers.
+function PathsDisplay({ paths }: { paths: string[] }) {
+  return (
+    <div>
+      <div className="text-[10px] uppercase tracking-wider flex items-center gap-1 text-green-500/90">
+        <HardDrive className="h-3 w-3 text-green-500/80" /> paths
+        <span className="ml-1 text-muted-foreground normal-case">({paths.length})</span>
+      </div>
+      <div className="mt-1 grid grid-cols-1 sm:grid-cols-2 gap-x-3 gap-y-0.5">
+        {paths.map((p) => (
+          <code
+            key={p}
+            className="font-mono text-[11px] text-foreground/90 truncate"
+            title={p}
+          >
+            {p}
+          </code>
+        ))}
+      </div>
+    </div>
+  )
+}
+
+// ── Preflight report view ────────────────────────────────────
+function PreflightReportView({ report }: { report: PreflightReport }) {
+  const { summary, checks } = report.preflight
+  const passColor = "text-emerald-500"
+  const warnColor = "text-amber-500"
+  const failColor = "text-red-500"
+
+  return (
+    <div className="space-y-3 border border-border rounded-md p-3 bg-muted/30">
+      {/* Summary line */}
+      <div className="flex items-center gap-4 text-sm">
+        <span className={`inline-flex items-center gap-1 ${passColor}`}>
+          <CheckCircle2 className="h-4 w-4" />
+          {summary.pass} pass
+        </span>
+        <span className={`inline-flex items-center gap-1 ${warnColor}`}>
+          <AlertTriangle className="h-4 w-4" />
+          {summary.warn} warn
+        </span>
+        <span className={`inline-flex items-center gap-1 ${failColor}`}>
+          <XCircle className="h-4 w-4" />
+          {summary.fail} fail
+        </span>
+        {summary.fail > 0 && (
+          <span className="ml-auto text-xs text-red-500">
+            --apply would be refused
+          </span>
+        )}
+      </div>
+
+      {/* Per-check list */}
+      <div className="space-y-1.5">
+        {checks.map((c) => {
+          const color =
+            c.severity === "pass" ? passColor :
+            c.severity === "warn" ? warnColor :
+            failColor
+          const Icon =
+            c.severity === "pass" ? CheckCircle2 :
+            c.severity === "warn" ? AlertTriangle :
+            XCircle
+          return (
+            <div key={c.id} className="flex items-start gap-2 text-xs">
+              <Icon className={`h-3.5 w-3.5 ${color} flex-shrink-0 mt-0.5`} />
+              <div className="flex-1 min-w-0">
+                <span className={`font-mono ${color}`}>{c.id}</span>
+                <span className="text-muted-foreground ml-2">{c.message}</span>
+              </div>
+            </div>
+          )
+        })}
+      </div>
+
+      {/* Storage / network counts */}
+      <div className="grid grid-cols-2 gap-3 text-xs pt-2 border-t border-border/40">
+        <div>
+          <div className="text-muted-foreground mb-1">Storage [in mode: {String(report.storage.in_selected_mode)}]</div>
+          <div>
+            {report.storage.zfs.length} ZFS pool(s) ·
+            {" "}{report.storage.lvm.length} LVM VG(s) ·
+            {" "}{report.storage.pve_storage.length} PVE storage(s)
+          </div>
+        </div>
+        <div>
+          <div className="text-muted-foreground mb-1">Network [in mode: {String(report.network.in_selected_mode)}]</div>
+          <div>
+            {report.network.keep.length} keep ·
+            {" "}{report.network.remap.length} remap ·
+            {" "}{report.network.orphan.length} orphan ·
+            {" "}{report.network.new.length} new
+          </div>
+        </div>
+      </div>
+
+      {/* Driver plan */}
+      {report.driver_reinstall.plan.length > 0 && (
+        <div className="text-xs pt-2 border-t border-border/40">
+          <div className="text-muted-foreground mb-1.5">Driver reinstall plan ({report.driver_reinstall.plan.length})</div>
+          <div className="space-y-1">
+            {report.driver_reinstall.plan.map((p) => (
+              <div key={p.component_id} className="flex items-center justify-between gap-2">
+                <span className="font-mono">{p.component_id}</span>
+                <Badge variant="outline" className="text-[10px]">{p.action}</Badge>
+              </div>
+            ))}
+          </div>
+        </div>
+      )}
+
+      {/* Abort reason (if --apply would have been refused) */}
+      {report.abort_reason && (
+        <div className="text-xs text-red-500 p-2 border border-red-500/30 rounded-md bg-red-500/10">
+          {report.abort_reason}
+        </div>
+      )}
+    </div>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// Create job wizard (A3.1 — attached jobs only).
+//
+// Pre-loads three things in parallel so the form can render selects
+// the moment the operator opens it:
+//   - PVE vzdump jobs (filtered by backend once they pick one)
+//   - Pre-configured destinations (PBS repos, Borg targets, local)
+//   - Default profile path list (used when profile_mode === "default"
+//     and also as the pool the custom checklist is populated from)
+// ──────────────────────────────────────────────────────────────
+
+interface PveVzdumpJob {
+  id: string
+  storage: string | null
+  storage_type: string | null
+  schedule: string | null
+  prune: string | null
+  enabled: boolean
+}
+
+// All Destination shapes carry `jobs_using`: list of job_ids that
+// currently depend on the destination. Surfaced in the Delete-
+// destination confirm flow so the operator sees the cascade impact
+// before agreeing.
+
+interface PbsRepo {
+  name: string
+  repository: string
+  fingerprint: string | null
+  source: "proxmox" | "manual"
+  jobs_using?: string[]
+}
+
+interface BorgRepo {
+  name: string
+  repository: string
+  ssh_key_path?: string
+  // Encryption + saved-passphrase metadata. Newer backends ship these;
+  // older deployments without the fields default to "repokey" (the
+  // shell installer's historical default) and unknown-passphrase.
+  encrypt_mode?: "none" | "repokey" | "keyfile" | "authenticated"
+  has_passphrase?: boolean
+  jobs_using?: string[]
+}
+
+interface LocalTargetEntry {
+  path: string
+  source: "default" | "custom"
+  removable: boolean
+  jobs_using?: string[]
+}
+
+interface LocalTarget {
+  configured: string | null
+  default: string
+  effective: string
+  // Multi-path layout: the default plus any custom paths stacked on
+  // top. Present on every recent backend; older deployments without
+  // this field fall back to the single configured/effective accessors.
+  entries?: LocalTargetEntry[]
+}
+
+interface DestinationsResp {
+  pbs: PbsRepo[]
+  borg: BorgRepo[]
+  local: LocalTarget
+}
+
+interface JobDetail {
+  id: string
+  attached: boolean
+  enabled: boolean
+  manual: boolean
+  method: string
+  destination: string
+  on_calendar: string             // human-formatted ("attached → storage:pbs" or "*-*-* 02:00")
+  next_run: string | null
+  pve_storage: string | null
+  pve_parent_job_id: string | null
+  profile_mode: string
+  paths: string[]
+  on_calendar_raw: string | null
+  retention: Record<string, string | undefined>
+  pbs_repository: string | null
+  pbs_backup_id: string | null
+  pbs_fingerprint: string | null
+  has_pbs_password: boolean
+  // Legacy — kept for backend responses that only track the on/off
+  // toggle. Newer builds also send pbs_encrypt_mode ("none" | "new"
+  // | "existing"); loadFromJobDetail prefers that when present.
+  pbs_encrypt: boolean
+  pbs_encrypt_mode?: "none" | "new" | "existing"
+  local_dest_dir: string | null
+  local_archive_ext: string | null
+  borg_repo: string | null
+  borg_encrypt_mode: string
+  has_borg_passphrase: boolean
+  // Log fields from Sprint Pulido P1
+  last_result: string | null      // "ok" / "failed" / etc.
+  last_run_at: string | null      // ISO-8601
+  last_log_path: string | null
+  last_log_size: number
+  last_log_tail: string[]
+}
+
+function CreateJobDialog({
+  open,
+  onClose,
+  onCreated,
+  editingJobId,
+}: {
+  open: boolean
+  onClose: () => void
+  onCreated: () => void
+  editingJobId?: string | null
+}) {
+  const isEdit = !!editingJobId
+  const [step, setStep] = useState<1 | 2 | 3 | 4 | 5>(1)
+  const [jobId, setJobId] = useState("")
+  const [backend, setBackend] = useState<"pbs" | "local" | "borg">("pbs")
+  const [mode, setMode] = useState<"new" | "attach">("new")
+  const [pveJobId, setPveJobId] = useState<string>("")
+  const [profileMode, setProfileMode] = useState<"default" | "custom">("default")
+  const [customPaths, setCustomPaths] = useState<Set<string>>(new Set())
+
+  // New (timer-based) mode fields — onCalendar is computed from the
+  // builder controls below; the raw expression is only directly edited
+  // when scheduleType === "advanced".
+  const [scheduleType, setScheduleType] = useState<"daily" | "hourly" | "weekly" | "monthly" | "advanced">("daily")
+  const [scheduleTime, setScheduleTime] = useState<string>("02:00")
+  const [scheduleMinute, setScheduleMinute] = useState<string>("0")
+  const [scheduleWeekdays, setScheduleWeekdays] = useState<Set<string>>(new Set(["Sun"]))
+  const [scheduleDayOfMonth, setScheduleDayOfMonth] = useState<string>("1")
+  const [scheduleAdvanced, setScheduleAdvanced] = useState<string>("daily")
+  const [keepLast, setKeepLast] = useState<string>("7")
+  const [keepHourly, setKeepHourly] = useState<string>("0")
+  const [keepDaily, setKeepDaily] = useState<string>("7")
+  const [keepWeekly, setKeepWeekly] = useState<string>("4")
+  const [keepMonthly, setKeepMonthly] = useState<string>("3")
+  const [keepYearly, setKeepYearly] = useState<string>("0")
+
+  // Backend-specific fields
+  const [pbsRepository, setPbsRepository] = useState<string>("")
+  const [pbsBackupId, setPbsBackupId] = useState<string>("")
+  // Client-side PBS encryption mode. Three modes match the shell wizard:
+  //   - "none"     — plain backup, no --keyfile
+  //   - "new"      — backend generates a fresh per-host keyfile (default)
+  //   - "existing" — operator uploads their own keyfile (shared across
+  //                  hosts). The upload happens via a dedicated endpoint
+  //                  BEFORE the job create call — see handleCreate below.
+  const [pbsEncryptMode, setPbsEncryptMode] = useState<"none" | "new" | "existing">("none")
+  // File picked in the "existing" mode. Kept in a ref-like state so a
+  // stale reference doesn't linger across modal opens.
+  const [pbsImportFile, setPbsImportFile] = useState<File | null>(null)
+  // Absolute-path alternative to the file upload — mirrors the shell
+  // wizard's `_hb_pbs_import_dialog` when there is no PVE .enc match.
+  const [pbsImportPath, setPbsImportPath] = useState<string>("")
+  const [pbsImportBusy, setPbsImportBusy] = useState<boolean>(false)
+  // Legacy alias for the many recovery / gating checks below — a truthy
+  // value means "the operator wants an encrypted backup" regardless of
+  // whether that keyfile came from a fresh generate or from an import.
+  const pbsEncrypt = pbsEncryptMode !== "none"
+  // Optional recovery passphrase. When set, the backend encrypts the
+  // keyfile with openssl and the runner uploads that blob to PBS with
+  // every backup so the keyfile can be rebuilt on a fresh host with
+  // only the passphrase. Mirrors hb_pbs_setup_recovery from the shell.
+  const [pbsRecoveryPass, setPbsRecoveryPass] = useState<string>("")
+  const [pbsRecoveryPass2, setPbsRecoveryPass2] = useState<string>("")
+  // Operator opted to replace an already-configured recovery escrow.
+  // Default behavior matches the shell: don't prompt for the
+  // passphrase if one is already saved — only show the inputs when
+  // there's no escrow yet OR the operator explicitly asks to change.
+  const [pbsRecoveryChange, setPbsRecoveryChange] = useState<boolean>(false)
+  // Binary "upload key to PBS?" toggle. `true` maps to escrow_mode='full'
+  // (passphrase required, envelope uploaded on every backup); `false`
+  // maps to escrow_mode='none' (keyfile stays local, operator handles
+  // the offsite copy). Defaults to 'No' — the keyfile is always
+  // downloadable from the Monitor, so the operator can grab it and
+  // save it offsite themselves without leaving a passphrase-wrapped
+  // copy on the PBS server.
+  const [pbsUploadToPbs, setPbsUploadToPbs] = useState<boolean>(false)
+  // Whether the host already has an escrow blob configured. When
+  // present, the passphrase input becomes optional ("leave blank to
+  // keep saved"). Refreshed after a successful setup call.
+  const { data: pbsRecoveryStatus, mutate: mutatePbsRecovery } = useSWR<{
+    has_keyfile: boolean; has_recovery: boolean; has_keyfile_passphrase?: boolean; escrow_mode?: "none" | "local" | "full"
+  }>(
+    open && backend === "pbs" ? "/api/host-backups/pbs-recovery/status" : null,
+    fetcher,
+  )
+  // Auto-discover a PVE-managed keyfile for the currently selected
+  // PBS repository. When one is found, the "Use an existing keyfile"
+  // radio uses it silently (matches the shell wizard's PVE auto-detect
+  // path — the operator doesn't have to upload the same file twice).
+  const { data: pbsPveDiscover } = useSWR<{
+    entries: Array<{ name: string; server: string; datastore: string; path: string; matches_repository: boolean }>
+  }>(
+    open && backend === "pbs" && pbsRepository && !pbsRecoveryStatus?.has_keyfile
+      ? `/api/host-backups/pbs-encryption/discover-pve-keyfiles?repository=${encodeURIComponent(pbsRepository)}`
+      : null,
+    fetcher,
+  )
+  const pbsPveMatch = pbsPveDiscover?.entries?.find((e) => e.matches_repository)
+  const [localDestDir, setLocalDestDir] = useState<string>("")
+  const [borgRepoSelected, setBorgRepoSelected] = useState<string>("")
+  const [borgPassphrase, setBorgPassphrase] = useState<string>("")
+  const [borgEncryptMode, setBorgEncryptMode] = useState<"none" | "repokey" | "keyfile" | "authenticated">("repokey")
+
+  const [submitting, setSubmitting] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  // Build the canonical OnCalendar string from the builder controls.
+  // The dropdown plus the small sub-inputs are friendlier than asking
+  // the operator to remember the systemd Calendar Events grammar.
+  const padHH = (s: string) => {
+    const [hh = "00", mm = "00"] = s.split(":")
+    return `${hh.padStart(2, "0")}:${mm.padStart(2, "0")}:00`
+  }
+  let onCalendar = "daily"
+  if (scheduleType === "daily") {
+    onCalendar = `*-*-* ${padHH(scheduleTime)}`
+  } else if (scheduleType === "hourly") {
+    const m = Math.max(0, Math.min(59, Number(scheduleMinute) || 0))
+    onCalendar = `*-*-* *:${String(m).padStart(2, "0")}:00`
+  } else if (scheduleType === "weekly") {
+    const days = Array.from(scheduleWeekdays)
+    onCalendar = days.length > 0
+      ? `${days.join(",")} *-*-* ${padHH(scheduleTime)}`
+      : `*-*-* ${padHH(scheduleTime)}`
+  } else if (scheduleType === "monthly") {
+    const d = Math.max(1, Math.min(31, Number(scheduleDayOfMonth) || 1))
+    onCalendar = `*-*-${String(d).padStart(2, "0")} ${padHH(scheduleTime)}`
+  } else if (scheduleType === "advanced") {
+    onCalendar = scheduleAdvanced.trim()
+  }
+
+  // Edit mode: fetch the full job (paths, retention, backend-specific) once
+  // the dialog opens, then pre-populate the form fields on arrival.
+  const { data: jobDetail } = useSWR<JobDetail>(
+    open && isEdit ? `/api/host-backups/jobs/${encodeURIComponent(editingJobId || "")}` : null,
+    fetcher,
+  )
+
+  const [editPreloaded, setEditPreloaded] = useState(false)
+  // Snapshot of the job's backend/mode at the moment we entered edit
+  // mode, so Step 5 can call out a change explicitly ("you're now
+  // configuring a Borg destination" etc.) instead of just dropping the
+  // operator into an unfamiliar set of fields.
+  const [originalBackend, setOriginalBackend] = useState<"pbs" | "local" | "borg" | null>(null)
+  const [originalMode, setOriginalMode] = useState<"new" | "attach" | null>(null)
+  useEffect(() => {
+    if (!isEdit || !jobDetail || editPreloaded) return
+    setJobId(jobDetail.id)
+    setBackend((jobDetail.method as "pbs" | "local" | "borg") || "pbs")
+    setMode(jobDetail.attached ? "attach" : "new")
+    setOriginalBackend((jobDetail.method as "pbs" | "local" | "borg") || "pbs")
+    setOriginalMode(jobDetail.attached ? "attach" : "new")
+    setProfileMode((jobDetail.profile_mode as "default" | "custom") || "default")
+    if (jobDetail.profile_mode === "custom") {
+      setCustomPaths(new Set(jobDetail.paths))
+    }
+    if (!jobDetail.attached && jobDetail.on_calendar_raw) {
+      setScheduleType("advanced")
+      setScheduleAdvanced(jobDetail.on_calendar_raw)
+    }
+    if (jobDetail.attached && jobDetail.pve_parent_job_id) {
+      setPveJobId(jobDetail.pve_parent_job_id)
+    }
+    const r = jobDetail.retention || {}
+    if (r.keep_last !== undefined) setKeepLast(String(r.keep_last))
+    if (r.keep_hourly !== undefined) setKeepHourly(String(r.keep_hourly))
+    if (r.keep_daily !== undefined) setKeepDaily(String(r.keep_daily))
+    if (r.keep_weekly !== undefined) setKeepWeekly(String(r.keep_weekly))
+    if (r.keep_monthly !== undefined) setKeepMonthly(String(r.keep_monthly))
+    if (r.keep_yearly !== undefined) setKeepYearly(String(r.keep_yearly))
+    if (jobDetail.pbs_repository) setPbsRepository(jobDetail.pbs_repository)
+    if (jobDetail.pbs_backup_id) setPbsBackupId(jobDetail.pbs_backup_id)
+    // Prefer the new pbs_encrypt_mode string when the backend sends it;
+    // fall back to the legacy bool for older `.env` layouts that only
+    // remember the on/off toggle.
+    const jd = jobDetail as unknown as { pbs_encrypt_mode?: string; pbs_encrypt?: boolean }
+    if (jd.pbs_encrypt_mode === "new" || jd.pbs_encrypt_mode === "existing" || jd.pbs_encrypt_mode === "none") {
+      setPbsEncryptMode(jd.pbs_encrypt_mode)
+    } else {
+      setPbsEncryptMode(jd.pbs_encrypt ? "new" : "none")
+    }
+    if (jobDetail.local_dest_dir) setLocalDestDir(jobDetail.local_dest_dir)
+    if (jobDetail.borg_repo) setBorgRepoSelected(jobDetail.borg_repo)
+    if (jobDetail.borg_encrypt_mode) {
+      setBorgEncryptMode(jobDetail.borg_encrypt_mode as "none" | "repokey" | "keyfile" | "authenticated")
+    }
+    setEditPreloaded(true)
+  }, [isEdit, jobDetail, editPreloaded])
+
+  // Reset the preload flag whenever the dialog closes so the next open
+  // (potentially for a different job) re-populates fresh.
+  useEffect(() => {
+    if (!open) {
+      setEditPreloaded(false)
+      setOriginalBackend(null)
+      setOriginalMode(null)
+    }
+  }, [open])
+
+  const { data: pveJobsResp } = useSWR<{ jobs: PveVzdumpJob[] }>(
+    open && mode === "attach" && backend !== "borg" ? `/api/host-backups/pve-vzdump-jobs?backend=${backend}` : null,
+    fetcher,
+  )
+
+  // Live calendar preview — only fetch when we're actually on Step 3 in
+  // "new" mode, otherwise the request is noise.
+  const calendarPreviewKey = open && mode === "new" && step === 3 && onCalendar.trim().length > 0
+    ? `calendar-preview::${onCalendar}`
+    : null
+  const { data: calendarPreview } = useSWR<{
+    valid: boolean
+    error?: string
+    normalized?: string
+    next_elapse?: string
+    from_now?: string
+  }>(
+    calendarPreviewKey,
+    () =>
+      fetchApi("/api/host-backups/calendar-preview", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ expr: onCalendar }),
+      }),
+    { dedupingInterval: 400 },
+  )
+  const { data: destResp, mutate: mutateDest } = useSWR<DestinationsResp>(
+    open ? "/api/host-backups/destinations" : null,
+    fetcher,
+  )
+  const { data: pathsResp } = useSWR<{ paths: string[] }>(
+    open ? "/api/host-backups/default-paths" : null,
+    fetcher,
+  )
+  // The wizard can spawn AddDestinationDialog inline so the operator
+  // configures a PBS / Borg destination without leaving the flow.
+  // When AddDestinationDialog saves, we capture the new repository
+  // string and auto-select it on the next destResp refresh — saves the
+  // operator from picking what they just configured from the dropdown.
+  const [addingDestType, setAddingDestType] = useState<"pbs" | "borg" | "local" | null>(null)
+  const [pendingAutoSelectDest, setPendingAutoSelectDest] = useState<{ kind: "pbs" | "borg"; repository: string } | null>(null)
+
+  // When the destinations load, auto-pick the first PBS repo + fill in
+  // the fingerprint reference so the operator doesn't have to navigate
+  // away just to copy it. Same convenience for the backup-id.
+  const selectedPbs: PbsRepo | undefined =
+    destResp?.pbs?.find((r) => r.repository === pbsRepository) ?? destResp?.pbs?.[0]
+
+  // Reset state on open / backend change
+  useEffect(() => {
+    if (!open) {
+      setStep(1)
+      setJobId("")
+      setBackend("pbs")
+      setMode("new")
+      setPveJobId("")
+      setProfileMode("default")
+      setCustomPaths(new Set())
+      setScheduleType("daily")
+      setScheduleTime("02:00")
+      setScheduleMinute("0")
+      setScheduleWeekdays(new Set(["Sun"]))
+      setScheduleDayOfMonth("1")
+      setScheduleAdvanced("daily")
+      setKeepLast("7")
+      setKeepHourly("0")
+      setKeepDaily("7")
+      setKeepWeekly("4")
+      setKeepMonthly("3")
+      setKeepYearly("0")
+      setPbsRepository("")
+      setPbsBackupId("")
+      setPbsEncryptMode("none")
+      setPbsImportFile(null)
+      setPbsImportPath("")
+      setPbsImportBusy(false)
+      setPbsRecoveryPass("")
+      setPbsRecoveryPass2("")
+      setPbsRecoveryChange(false)
+      setPbsUploadToPbs(false)
+      setLocalDestDir("")
+      setBorgRepoSelected("")
+      setBorgPassphrase("")
+      setBorgEncryptMode("repokey")
+      setError(null)
+      setSubmitting(false)
+    }
+  }, [open])
+
+  // Borg can only be timer-based; coerce mode back to "new" if the
+  // operator picks borg after having selected attach.
+  useEffect(() => {
+    if (backend === "borg" && mode === "attach") {
+      setMode("new")
+    }
+  }, [backend, mode])
+
+  useEffect(() => {
+    setPveJobId("")
+  }, [backend, mode])
+
+  useEffect(() => {
+    if (backend === "pbs" && !pbsRepository && destResp?.pbs?.length) {
+      setPbsRepository(destResp.pbs[0].repository)
+    }
+    if (backend === "borg" && !borgRepoSelected && destResp?.borg?.length) {
+      setBorgRepoSelected(destResp.borg[0].repository)
+    }
+  }, [backend, destResp, pbsRepository, borgRepoSelected])
+
+  useEffect(() => {
+    if (!pendingAutoSelectDest || !destResp) return
+    if (pendingAutoSelectDest.kind === "pbs") {
+      const hit = destResp.pbs?.find((r) => r.repository === pendingAutoSelectDest.repository)
+      if (hit) {
+        setPbsRepository(hit.repository)
+        setPendingAutoSelectDest(null)
+      }
+    } else {
+      const hit = destResp.borg?.find((r) => r.repository === pendingAutoSelectDest.repository)
+      if (hit) {
+        setBorgRepoSelected(hit.repository)
+        setPendingAutoSelectDest(null)
+      }
+    }
+  }, [destResp, pendingAutoSelectDest])
+
+  const togglePath = (path: string) => {
+    setCustomPaths((prev) => {
+      const next = new Set(prev)
+      if (next.has(path)) next.delete(path)
+      else next.add(path)
+      return next
+    })
+  }
+
+  const selectedPveJob: PveVzdumpJob | undefined = pveJobsResp?.jobs?.find((j) => j.id === pveJobId)
+  const selectedBorgRepo: BorgRepo | undefined = destResp?.borg?.find((r) => r.repository === borgRepoSelected)
+
+  // ── Step validation gates ──
+  const idValid = /^[a-zA-Z0-9_-]+$/.test(jobId) && jobId.length > 0
+  const canAdvanceFrom1 = idValid
+  const canAdvanceFrom2 = true   // selecting New/Attach is always possible
+
+  // Step 3 depends on mode. For "new" we additionally block advancing
+  // if the live calendar preview already came back invalid, or if
+  // weekly was picked without any day selected.
+  const canAdvanceFrom3 =
+    mode === "attach"
+      ? !!pveJobId
+      : onCalendar.trim().length > 0
+        && (calendarPreview === undefined || calendarPreview.valid !== false)
+        && (scheduleType !== "weekly" || scheduleWeekdays.size > 0)
+
+  // Step 4: profile
+  const canAdvanceFrom4 =
+    profileMode === "default" || (profileMode === "custom" && customPaths.size > 0)
+
+  // Step 5 (submit) — backend-specific requirements
+  const backendValid =
+    backend === "pbs"
+      ? !!pbsRepository
+      : backend === "local"
+        ? true
+        : /* borg */ !!borgRepoSelected
+
+  // PBS encryption gate — choosing "Encrypt" makes the recovery
+  // passphrase mandatory. The button stays disabled until a matching
+  // passphrase pair is entered (or an already-saved escrow is reused).
+  // There is no opt-out: encrypting without recovery would leave the
+  // keyfile only on this host, and a reinstall would render every
+  // encrypted backup unrecoverable.
+  // Passphrase requirement only kicks in when: encryption is on AND
+  // there's no keyfile installed yet (fresh setup) AND the operator
+  // opted to upload the key to PBS. Every other case (reuse existing
+  // keyfile, or "no upload" mode) doesn't need a passphrase.
+  const pbsRecoveryOk = !(backend === "pbs" && pbsEncrypt) ||
+    pbsRecoveryStatus?.has_keyfile ||
+    !pbsUploadToPbs ||
+    (pbsRecoveryPass !== "" && pbsRecoveryPass === pbsRecoveryPass2)
+
+  const canSubmit =
+    canAdvanceFrom1 && canAdvanceFrom2 && canAdvanceFrom3 && canAdvanceFrom4 && backendValid && pbsRecoveryOk
+
+  async function handleCreate() {
+    if (!canSubmit) return
+    if (mode === "attach" && !selectedPveJob) return
+    setSubmitting(true)
+    setError(null)
+    // Encryption submit paths:
+    //   • enabled + keyfile already on disk → mode = "existing", no upload
+    //     (backend reuses the canonical file at _PBS_KEYFILE_PATH).
+    //   • enabled + no keyfile + Generate    → mode = "new", backend creates it.
+    //   • enabled + no keyfile + Import      → upload the file first, then
+    //     mode = "existing" so the backend uses the freshly-installed key.
+    //
+    // Only the third branch actually needs to POST to
+    // /api/host-backups/pbs-encryption/import — the second is handled
+    // server-side, and the first has nothing to upload.
+    // Unified encryption setup: one atomic call to /pbs-encryption/import
+    // covers keyfile install + escrow setup, whether the operator picked
+    // "generate a new keyfile" or "import an existing one", and whether
+    // they opted to upload the envelope to PBS or keep the key local.
+    const needsInstall =
+      backend === "pbs" &&
+      pbsEncrypt &&
+      !pbsRecoveryStatus?.has_keyfile
+    if (needsInstall) {
+      // Existing + no PVE auto-detect requires either a file upload
+      // or a typed absolute path — mirrors the shell wizard.
+      // Existing + PVE auto-detect uses source=pve-storage.
+      if (pbsEncryptMode === "existing" && !pbsPveMatch && !pbsImportFile && !pbsImportPath.trim()) {
+        setError("Pick a keyfile file or enter an absolute path on this host.")
+        setSubmitting(false)
+        return
+      }
+      if (pbsUploadToPbs && pbsRecoveryPass !== pbsRecoveryPass2) {
+        setError("Recovery passphrases don't match.")
+        setSubmitting(false)
+        return
+      }
+      setPbsImportBusy(true)
+      try {
+        // Source picker mirrors the shell wizard's dispatch:
+        //   generate       → new keyfile via proxmox-backup-client
+        //   pve-storage    → reuse /etc/pve/priv/storage/<name>.enc
+        //   content        → upload a file the operator picked
+        //   path           → read a file at an absolute path
+        let source: "generate" | "pve-storage" | "content" | "path"
+        if (pbsEncryptMode === "new") source = "generate"
+        else if (pbsPveMatch) source = "pve-storage"
+        else if (pbsImportFile) source = "content"
+        else source = "path"
+        const body: Record<string, unknown> = {
+          source,
+          escrow_mode: pbsUploadToPbs ? "full" : "none",
+        }
+        if (pbsUploadToPbs) body.escrow_passphrase = pbsRecoveryPass
+        if (source === "pve-storage") {
+          body.pve_storage_name = pbsPveMatch!.name
+        } else if (source === "content") {
+          const buf = new Uint8Array(await pbsImportFile!.arrayBuffer())
+          let bin = ""
+          for (let i = 0; i < buf.length; i++) bin += String.fromCharCode(buf[i])
+          body.content_b64 = btoa(bin)
+        } else if (source === "path") {
+          body.keyfile_path = pbsImportPath.trim()
+        }
+        await fetchApi("/api/host-backups/pbs-encryption/import", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(body),
+        })
+        mutatePbsRecovery()
+      } catch (e) {
+        const err = e as Error & { body?: { tool_output?: string; tool_exit_code?: number } }
+        const detail = err.body?.tool_output
+          ? `${err.message}\n\nproxmox-backup-client output:\n${err.body.tool_output}`
+          : err.message
+        setError(`Encryption setup failed: ${detail || String(e)}`)
+        setPbsImportBusy(false)
+        setSubmitting(false)
+        return
+      }
+      setPbsImportBusy(false)
+    }
+    // NOTE: recovery escrow is now bundled into the /pbs-encryption/import
+    // call above. No separate /pbs-recovery/setup pass is needed.
+    try {
+      const body: Record<string, unknown> = {
+        id: jobId,
+        backend,
+        attached: mode === "attach",
+        profile_mode: profileMode,
+        enabled: true,
+      }
+      if (mode === "attach" && selectedPveJob) {
+        body.pve_storage = selectedPveJob.storage
+        body.pve_parent_job_id = selectedPveJob.id
+      } else {
+        body.on_calendar = onCalendar.trim()
+        body.retention = {
+          keep_last: Number(keepLast) || 0,
+          keep_hourly: Number(keepHourly) || 0,
+          keep_daily: Number(keepDaily) || 0,
+          keep_weekly: Number(keepWeekly) || 0,
+          keep_monthly: Number(keepMonthly) || 0,
+          keep_yearly: Number(keepYearly) || 0,
+        }
+      }
+      if (profileMode === "custom") {
+        body.paths = Array.from(customPaths)
+      }
+      if (backend === "pbs") {
+        body.pbs_repository = pbsRepository
+        body.pbs_password = ""
+        if (pbsBackupId) body.pbs_backup_id = pbsBackupId
+        if (selectedPbs?.fingerprint) body.pbs_fingerprint = selectedPbs.fingerprint
+        body.pbs_encrypt_mode = pbsEncryptMode
+      } else if (backend === "local") {
+        if (localDestDir.trim()) body.local_dest_dir = localDestDir.trim()
+      } else if (backend === "borg") {
+        // Passphrase + encrypt_mode are inherited from the destination
+        // (the runner reads borg-pass-<name>.txt + the 4th field of
+        // borg-targets.txt). Only send overrides when the operator
+        // really typed a new one in an edit flow.
+        body.borg_repo = borgRepoSelected
+        if (isEdit && borgPassphrase) body.borg_passphrase = borgPassphrase
+      }
+      // fetchApi returns the parsed JSON and throws (with the backend's
+      // error message in `error.message` when the body was JSON) on any
+      // non-2xx status — no need to inspect .ok or call .json() ourselves.
+      const url = isEdit
+        ? `/api/host-backups/jobs/${encodeURIComponent(editingJobId || "")}`
+        : "/api/host-backups/jobs"
+      await fetchApi(url, {
+        method: isEdit ? "PUT" : "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      })
+      onCreated()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  const compatibleJobs = pveJobsResp?.jobs ?? []
+  const defaultPaths = pathsResp?.paths ?? []
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => { if (!v) onClose() }}>
+      <DialogContent className="max-w-2xl max-h-[85vh] flex flex-col">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            {isEdit ? (
+              <Pencil className="h-5 w-5 text-blue-500" />
+            ) : (
+              <Plus className="h-5 w-5 text-blue-500" />
+            )}
+            {isEdit ? "Edit scheduled backup job" : "Create scheduled backup job"}
+          </DialogTitle>
+          <DialogDescription>
+            Step {step} of 5 · {mode === "attach" ? "Attached to PVE vzdump" : "Standalone scheduled job"}
+          </DialogDescription>
+        </DialogHeader>
+
+        {/* Step progress bar */}
+        <div className="flex items-center gap-1">
+          {[1, 2, 3, 4, 5].map((n) => (
+            <div
+              key={n}
+              className={`h-1 flex-1 rounded-full ${n <= step ? "bg-blue-500" : "bg-border"}`}
+            />
+          ))}
+        </div>
+
+        <div className="overflow-y-auto pr-2 -mr-2 space-y-4 flex-1">
+          {/* ── Step 1: ID + Backend ─────────────────────── */}
+          {step === 1 && (
+            <div className="space-y-4">
+              <div>
+                <Label htmlFor="jobId">Job name</Label>
+                <Input
+                  id="jobId"
+                  value={jobId}
+                  onChange={(e) => setJobId(e.target.value)}
+                  disabled={isEdit}
+                  className="font-mono mt-1"
+                  placeholder="my-host-backup"
+                />
+                <p className="text-xs text-muted-foreground mt-1">
+                  {isEdit
+                    ? "The job name can't be changed. Delete and recreate the job if you want to rename it."
+                    : <>A short name to identify this job in the list, logs, and shell menu. Letters, digits, <code className="font-mono">_</code> and <code className="font-mono">-</code> only (no spaces or accents).</>}
+                </p>
+                {!idValid && jobId.length > 0 && !isEdit && (
+                  <p className="text-xs text-red-500 mt-1">Invalid characters. Use letters, digits, _ or -.</p>
+                )}
+              </div>
+
+              <div>
+                <Label>Backend</Label>
+                {isEdit && (
+                  <p className="text-xs text-muted-foreground mb-2">
+                    You can change where the backup is sent. The destination of the new option is set on Step 5.
+                  </p>
+                )}
+                <div className="grid grid-cols-1 sm:grid-cols-3 gap-2 mt-1">
+                  {(["pbs", "local", "borg"] as const).map((b) => {
+                    const Icon = b === "pbs" ? Server : b === "local" ? HardDrive : Archive
+                    const desc = b === "pbs"
+                      ? "Proxmox Backup Server. Incremental, encrypted, dedup."
+                      : b === "local"
+                        ? "tar.zst archive into a local directory or mounted disk."
+                        : "Borg repo over SSH or on a local/USB disk (timer only)."
+                    return (
+                      <button
+                        key={b}
+                        type="button"
+                        onClick={() => setBackend(b)}
+                        className={`text-left p-3 rounded-md border transition-colors ${
+                          backend === b ? "border-blue-500 bg-blue-500/5" : "border-border bg-background/40"
+                        } hover:bg-white/5`}
+                      >
+                        <div className="flex items-center gap-2 font-medium text-sm">
+                          <Icon className="h-4 w-4" />
+                          {b.toUpperCase()}
+                        </div>
+                        <div className="text-xs text-muted-foreground mt-1">{desc}</div>
+                      </button>
+                    )
+                  })}
+                </div>
+              </div>
+            </div>
+          )}
+
+          {/* ── Step 2: How to schedule ──────────────────── */}
+          {step === 2 && (
+            <div className="space-y-3">
+              <div>
+                <Label>How to schedule</Label>
+                <p className="text-xs text-muted-foreground mb-2">
+                  {backend === "borg"
+                    ? "Borg backups only run on their own timer — they're not produced by PVE vzdump."
+                    : "Either run on a schedule you define here, or hook into an existing PVE vzdump job and inherit its schedule + retention."}
+                </p>
+              </div>
+              <div className="space-y-2">
+                <button
+                  type="button"
+                  onClick={() => setMode("new")}
+                  className={`w-full text-left p-3 rounded-md border transition-colors ${mode === "new" ? "border-blue-500 bg-blue-500/5" : "border-border bg-background/40"} hover:bg-white/5`}
+                >
+                  <div className="text-sm font-medium flex items-center gap-2">
+                    <Calendar className="h-4 w-4" />
+                    New scheduled job
+                  </div>
+                  <div className="text-xs text-muted-foreground mt-1">
+                    Own systemd timer with the OnCalendar and retention policy you pick on the next steps.
+                  </div>
+                </button>
+                <button
+                  type="button"
+                  onClick={() => backend !== "borg" && setMode("attach")}
+                  disabled={backend === "borg"}
+                  className={`w-full text-left p-3 rounded-md border transition-colors ${
+                    mode === "attach" && backend !== "borg"
+                      ? "border-blue-500 bg-blue-500/5"
+                      : "border-border bg-background/40"
+                  } ${backend === "borg" ? "opacity-60 cursor-not-allowed" : "hover:bg-white/5"}`}
+                >
+                  <div className="text-sm font-medium flex items-center gap-2">
+                    <Server className="h-4 w-4" />
+                    Attach to existing PVE vzdump job
+                    {backend === "borg" && (
+                      <Badge variant="outline" className="text-[10px] text-muted-foreground">
+                        not available for borg
+                      </Badge>
+                    )}
+                  </div>
+                  <div className="text-xs text-muted-foreground mt-1">
+                    Fires on every <code className="font-mono">job-end</code> of a PVE vzdump job that writes to a <code className="font-mono">{backend}</code> storage. Inherits schedule + retention.
+                  </div>
+                </button>
+              </div>
+            </div>
+          )}
+
+          {/* ── Step 3: branches by mode ─────────────────── */}
+          {step === 3 && mode === "attach" && (
+            <div className="space-y-3">
+              <div>
+                <Label>Pick the parent PVE vzdump job</Label>
+                <p className="text-xs text-muted-foreground mb-2">
+                  The host config backup will fire on every <code className="font-mono">job-end</code> of this job.
+                </p>
+              </div>
+              {compatibleJobs.length === 0 ? (
+                <div className="p-4 rounded-md border border-amber-500/40 bg-amber-500/5 text-sm">
+                  <div className="flex items-center gap-2 text-amber-500 font-medium">
+                    <AlertTriangle className="h-4 w-4" />
+                    No compatible PVE vzdump job
+                  </div>
+                  <p className="text-xs text-muted-foreground mt-1">
+                    No PVE vzdump job currently uses a <span className="font-mono">{backend}</span> storage. Create one in <span className="font-medium">Datacenter → Backup</span> first, then come back here to attach.
+                  </p>
+                </div>
+              ) : (
+                <div className="space-y-1">
+                  {compatibleJobs.map((j) => (
+                    <button
+                      key={j.id}
+                      type="button"
+                      onClick={() => setPveJobId(j.id)}
+                      className={`w-full text-left p-3 rounded-md border ${pveJobId === j.id ? "border-blue-500 bg-blue-500/5" : "border-border bg-background/40"} hover:bg-white/5 transition-colors`}
+                    >
+                      <div className="flex items-center justify-between gap-2 flex-wrap">
+                        <span className="font-mono text-xs">{j.id}</span>
+                        {!j.enabled && (
+                          <Badge variant="outline" className="text-[10px] text-amber-500 border-amber-500/40">
+                            disabled
+                          </Badge>
+                        )}
+                      </div>
+                      <div className="mt-1 text-xs text-muted-foreground flex items-center gap-x-3 gap-y-1 flex-wrap">
+                        <span>storage: <code className="font-mono">{j.storage}</code></span>
+                        <span>schedule: <code className="font-mono">{j.schedule || "—"}</code></span>
+                        <span>retention: <code className="font-mono">{j.prune || "—"}</code></span>
+                      </div>
+                    </button>
+                  ))}
+                </div>
+              )}
+            </div>
+          )}
+
+          {step === 3 && mode === "new" && (
+            <div className="space-y-4">
+              <div>
+                <Label>Schedule</Label>
+                <p className="text-xs text-muted-foreground mb-2">
+                  Pick how often this backup runs. The expression is built and validated for you.
+                </p>
+                <Select
+                  value={scheduleType}
+                  onValueChange={(v) => setScheduleType(v as typeof scheduleType)}
+                >
+                  <SelectTrigger>
+                    <SelectValue />
+                  </SelectTrigger>
+                  <SelectContent>
+                    <SelectItem value="daily">Daily — every day at a specific time</SelectItem>
+                    <SelectItem value="hourly">Hourly — every hour at a specific minute</SelectItem>
+                    <SelectItem value="weekly">Weekly — on specific weekdays at a time</SelectItem>
+                    <SelectItem value="monthly">Monthly — on a specific day of the month</SelectItem>
+                    <SelectItem value="advanced">Advanced — type the OnCalendar expression myself</SelectItem>
+                  </SelectContent>
+                </Select>
+              </div>
+
+              {scheduleType === "daily" && (
+                <div>
+                  <Label htmlFor="schedTime">Time of day</Label>
+                  <Input
+                    id="schedTime"
+                    type="time"
+                    value={scheduleTime}
+                    onChange={(e) => setScheduleTime(e.target.value)}
+                    className="font-mono mt-1 max-w-[140px]"
+                  />
+                </div>
+              )}
+
+              {scheduleType === "hourly" && (
+                <div>
+                  <Label htmlFor="schedMinute">Minute of the hour (0–59)</Label>
+                  <Input
+                    id="schedMinute"
+                    type="number"
+                    min="0"
+                    max="59"
+                    value={scheduleMinute}
+                    onChange={(e) => setScheduleMinute(e.target.value)}
+                    className="font-mono mt-1 max-w-[120px]"
+                  />
+                  <p className="text-xs text-muted-foreground mt-1">
+                    The job fires every hour at this minute. <code className="font-mono">0</code> = on the hour, <code className="font-mono">30</code> = half past, etc.
+                  </p>
+                </div>
+              )}
+
+              {scheduleType === "weekly" && (
+                <div className="space-y-3">
+                  <div>
+                    <Label>Days of the week</Label>
+                    <div className="flex flex-wrap gap-1 mt-1">
+                      {["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"].map((d) => {
+                        const active = scheduleWeekdays.has(d)
+                        return (
+                          <button
+                            key={d}
+                            type="button"
+                            onClick={() => {
+                              setScheduleWeekdays((prev) => {
+                                const next = new Set(prev)
+                                if (next.has(d)) next.delete(d)
+                                else next.add(d)
+                                return next
+                              })
+                            }}
+                            className={`px-3 py-1.5 rounded-md text-xs font-mono border transition-colors ${
+                              active
+                                ? "border-blue-500 bg-blue-500/10 text-blue-400"
+                                : "border-border bg-background/40 text-muted-foreground hover:bg-white/5"
+                            }`}
+                          >
+                            {d}
+                          </button>
+                        )
+                      })}
+                    </div>
+                    {scheduleWeekdays.size === 0 && (
+                      <p className="text-xs text-amber-500 mt-1">Pick at least one day.</p>
+                    )}
+                  </div>
+                  <div>
+                    <Label htmlFor="schedTimeW">Time of day</Label>
+                    <Input
+                      id="schedTimeW"
+                      type="time"
+                      value={scheduleTime}
+                      onChange={(e) => setScheduleTime(e.target.value)}
+                      className="font-mono mt-1 max-w-[140px]"
+                    />
+                  </div>
+                </div>
+              )}
+
+              {scheduleType === "monthly" && (
+                <div className="space-y-3">
+                  <div>
+                    <Label htmlFor="schedDay">Day of the month (1–31)</Label>
+                    <Input
+                      id="schedDay"
+                      type="number"
+                      min="1"
+                      max="31"
+                      value={scheduleDayOfMonth}
+                      onChange={(e) => setScheduleDayOfMonth(e.target.value)}
+                      className="font-mono mt-1 max-w-[120px]"
+                    />
+                    <p className="text-xs text-muted-foreground mt-1">
+                      If the chosen day doesn't exist in a given month (e.g. 31 in February), systemd skips that month.
+                    </p>
+                  </div>
+                  <div>
+                    <Label htmlFor="schedTimeM">Time of day</Label>
+                    <Input
+                      id="schedTimeM"
+                      type="time"
+                      value={scheduleTime}
+                      onChange={(e) => setScheduleTime(e.target.value)}
+                      className="font-mono mt-1 max-w-[140px]"
+                    />
+                  </div>
+                </div>
+              )}
+
+              {scheduleType === "advanced" && (
+                <div>
+                  <Label htmlFor="schedAdv">OnCalendar expression</Label>
+                  <Input
+                    id="schedAdv"
+                    value={scheduleAdvanced}
+                    onChange={(e) => setScheduleAdvanced(e.target.value)}
+                    className="font-mono mt-1"
+                    placeholder="*-*-* 02:00, Mon..Fri *-*-* 04:00, daily, ..."
+                  />
+                  <p className="text-xs text-muted-foreground mt-1">
+                    Any expression accepted by <code className="font-mono">systemd-analyze calendar</code>. See <span className="font-mono">man systemd.time</span> for the full grammar.
+                  </p>
+                </div>
+              )}
+
+              {/* Live preview from the backend */}
+              <div className="rounded-md border border-border bg-background/40 p-3 space-y-1 text-xs">
+                <div className="text-[10px] uppercase tracking-wider text-muted-foreground">Preview</div>
+                <div className="flex items-baseline gap-2">
+                  <span className="text-muted-foreground">Expression:</span>
+                  <code className="font-mono">{onCalendar}</code>
+                </div>
+                {calendarPreview ? (
+                  calendarPreview.valid ? (
+                    <>
+                      {calendarPreview.normalized && calendarPreview.normalized !== onCalendar && (
+                        <div className="flex items-baseline gap-2">
+                          <span className="text-muted-foreground">Normalized:</span>
+                          <code className="font-mono">{calendarPreview.normalized}</code>
+                        </div>
+                      )}
+                      {calendarPreview.next_elapse && (
+                        <div className="flex items-baseline gap-2">
+                          <span className="text-muted-foreground">Next run:</span>
+                          <span className="text-emerald-400">{calendarPreview.next_elapse}</span>
+                          {calendarPreview.from_now && (
+                            <span className="text-muted-foreground">({calendarPreview.from_now})</span>
+                          )}
+                        </div>
+                      )}
+                    </>
+                  ) : (
+                    <div className="text-red-500">
+                      <span className="font-medium">Invalid:</span> {calendarPreview.error}
+                    </div>
+                  )
+                ) : (
+                  <div className="text-muted-foreground italic">checking…</div>
+                )}
+              </div>
+
+              <div>
+                <Label>Retention</Label>
+                <p className="text-xs text-muted-foreground mb-2">Zero disables that bucket.</p>
+                <div className="grid grid-cols-2 sm:grid-cols-3 gap-2">
+                  {[
+                    { id: "keep-last", lbl: "keep-last", v: keepLast, set: setKeepLast },
+                    { id: "keep-hourly", lbl: "keep-hourly", v: keepHourly, set: setKeepHourly },
+                    { id: "keep-daily", lbl: "keep-daily", v: keepDaily, set: setKeepDaily },
+                    { id: "keep-weekly", lbl: "keep-weekly", v: keepWeekly, set: setKeepWeekly },
+                    { id: "keep-monthly", lbl: "keep-monthly", v: keepMonthly, set: setKeepMonthly },
+                    { id: "keep-yearly", lbl: "keep-yearly", v: keepYearly, set: setKeepYearly },
+                  ].map((row) => (
+                    <div key={row.id}>
+                      <Label htmlFor={row.id} className="text-xs">{row.lbl}</Label>
+                      <Input
+                        id={row.id}
+                        type="number"
+                        min="0"
+                        value={row.v}
+                        onChange={(e) => row.set(e.target.value)}
+                        className="font-mono mt-1"
+                      />
+                    </div>
+                  ))}
+                </div>
+              </div>
+            </div>
+          )}
+
+          {/* ── Step 4: Profile + paths ──────────────────── */}
+          {step === 4 && (
+            <div className="space-y-4">
+              <div>
+                <Label>Backup profile</Label>
+                <div className="grid grid-cols-2 gap-2 mt-1">
+                  <button
+                    type="button"
+                    onClick={() => setProfileMode("default")}
+                    className={`text-left p-3 rounded-md border ${profileMode === "default" ? "border-blue-500 bg-blue-500/5" : "border-border bg-background/40"} hover:bg-white/5 transition-colors`}
+                  >
+                    <div className="text-sm font-medium">Default</div>
+                    <div className="text-xs text-muted-foreground mt-1">
+                      Critical config paths ({defaultPaths.length} entries): /etc/pve, /etc/network, /root, /usr/local, etc.
+                    </div>
+                  </button>
+                  <button
+                    type="button"
+                    onClick={() => setProfileMode("custom")}
+                    className={`text-left p-3 rounded-md border ${profileMode === "custom" ? "border-blue-500 bg-blue-500/5" : "border-border bg-background/40"} hover:bg-white/5 transition-colors`}
+                  >
+                    <div className="text-sm font-medium">Custom</div>
+                    <div className="text-xs text-muted-foreground mt-1">
+                      Pick from the default list which paths to include. At least one is required.
+                    </div>
+                  </button>
+                </div>
+              </div>
+              {profileMode === "custom" && (
+                <div>
+                  <Label>Paths to include ({customPaths.size}/{defaultPaths.length})</Label>
+                  <ScrollArea className="h-64 mt-1 rounded-md border border-border p-2">
+                    {defaultPaths.map((p) => (
+                      <label
+                        key={p}
+                        className="flex items-center gap-2 py-1 px-1 hover:bg-white/5 rounded text-xs cursor-pointer"
+                      >
+                        <Checkbox
+                          checked={customPaths.has(p)}
+                          onCheckedChange={() => togglePath(p)}
+                        />
+                        <span className="font-mono">{p}</span>
+                      </label>
+                    ))}
+                  </ScrollArea>
+                </div>
+              )}
+            </div>
+          )}
+
+          {/* ── Step 5: Backend-specific + summary ──────── */}
+          {step === 5 && (
+            <div className="space-y-4">
+              {backend === "pbs" && (
+                <>
+                  <div>
+                    <Label>PBS repository</Label>
+                    {destResp?.pbs?.length ? (
+                      <div className="mt-1 flex items-center gap-2">
+                        <Select value={pbsRepository} onValueChange={setPbsRepository}>
+                          <SelectTrigger className="flex-1 min-w-0">
+                            {/* Manual render: SelectValue's default mode
+                                duplicates the item children and cuts
+                                them in the middle on mobile. We render
+                                "name — repository" ourselves with a
+                                proper trailing ellipsis. */}
+                            {(() => {
+                              const sel = destResp.pbs.find((r) => r.repository === pbsRepository)
+                              if (!sel) {
+                                return <span className="truncate text-muted-foreground">Pick a PBS repository</span>
+                              }
+                              return (
+                                <span className="truncate font-mono text-left">
+                                  {sel.name}
+                                  <span className="text-muted-foreground"> — {sel.repository}</span>
+                                </span>
+                              )
+                            })()}
+                          </SelectTrigger>
+                          <SelectContent>
+                            {destResp.pbs.map((r) => (
+                              <SelectItem key={`${r.name}-${r.repository}`} value={r.repository}>
+                                <span className="font-mono">{r.name}</span>
+                                <span className="text-muted-foreground ml-2">— {r.repository}</span>
+                              </SelectItem>
+                            ))}
+                          </SelectContent>
+                        </Select>
+                        <Button
+                          type="button"
+                          size="sm"
+                          variant="outline"
+                          className="shrink-0 bg-blue-500/10 border-blue-500/40 !text-blue-400 hover:bg-blue-500/20 hover:!text-blue-300"
+                          onClick={() => setAddingDestType("pbs")}
+                          title="Save another PBS repository"
+                        >
+                          <Plus className="h-3.5 w-3.5 mr-1" />
+                          Add another
+                        </Button>
+                      </div>
+                    ) : (
+                      <div className="mt-1 p-3 rounded-md border border-amber-500/40 bg-amber-500/5 text-xs space-y-2">
+                        <div>No PBS repository configured yet. You can add one without leaving this wizard.</div>
+                        <Button
+                          type="button"
+                          size="sm"
+                          variant="outline"
+                          className="bg-blue-500/10 border-blue-500/40 !text-blue-400 hover:bg-blue-500/20 hover:!text-blue-300"
+                          onClick={() => setAddingDestType("pbs")}
+                        >
+                          <Plus className="h-3.5 w-3.5 mr-1" />
+                          Add PBS repository
+                        </Button>
+                      </div>
+                    )}
+                  </div>
+                  <div>
+                    <Label htmlFor="pbsBackupId">Group name in PBS</Label>
+                    <Input
+                      id="pbsBackupId"
+                      value={pbsBackupId}
+                      onChange={(e) => setPbsBackupId(e.target.value)}
+                      placeholder="Leave blank for the default"
+                      className="font-mono mt-1"
+                    />
+                    <p className="text-xs text-muted-foreground mt-1">
+                      PBS organises backups into named groups, each with its own retention. Leave blank to use the automatic default for this host (recommended).
+                    </p>
+                  </div>
+                  {/* PBS client-side encryption — mirrors the shell wizard:
+                      step 1 is a plain yes/no, step 2 only appears when
+                      no keyfile is installed yet. Once a keyfile exists,
+                      every future encrypted job silently reuses it. */}
+                  <div className="pt-2 border-t border-border space-y-3">
+                    <label className="flex items-start gap-2 cursor-pointer">
+                      <Checkbox
+                        checked={pbsEncrypt}
+                        onCheckedChange={(v) => {
+                          const checked = !!v
+                          if (!checked) {
+                            setPbsEncryptMode("none")
+                          } else {
+                            // Yes → if the host already has a keyfile, submit
+                            // "existing" (reuse it silently). If not, default
+                            // to "new" (Generate) — the operator can flip to
+                            // "existing" (Import) via the radio below.
+                            setPbsEncryptMode(pbsRecoveryStatus?.has_keyfile ? "existing" : "new")
+                          }
+                        }}
+                        className="mt-0.5"
+                      />
+                      <div className="flex-1">
+                        <div className="inline-flex items-center gap-1.5 text-sm">
+                          <Lock className="h-3.5 w-3.5 text-emerald-400" />
+                          Encrypt backups (client-side keyfile)
+                        </div>
+                        <p className="text-[11px] text-muted-foreground mt-1">
+                          Adds <code className="font-mono">--keyfile</code> to <code className="font-mono">proxmox-backup-client backup</code>. Encryption happens before upload so chunks land on PBS already ciphered. The keyfile is installed at <code className="font-mono">/usr/local/share/proxmenux/pbs-key.conf</code> (chmod 0600) and reused by every encrypted PBS job on this host.
+                        </p>
+                      </div>
+                    </label>
+
+
+                    {pbsEncrypt && !pbsRecoveryStatus?.has_keyfile && (
+                      <div className="space-y-2 rounded-md border border-emerald-500/30 bg-emerald-500/5 p-3">
+                        <div className="text-[11px] font-medium">
+                          No encryption key is stored on this host. Choose how to set one up:
+                        </div>
+                        <label className="flex items-start gap-2 cursor-pointer text-[11px]">
+                          <input
+                            type="radio"
+                            name="pbsEncryptSetupCreate"
+                            checked={pbsEncryptMode === "new"}
+                            onChange={() => setPbsEncryptMode("new")}
+                            className="mt-1"
+                          />
+                          <div className="flex-1">
+                            <div className="font-medium">Generate a new keyfile (per host — safest isolation)</div>
+                            <div className="text-muted-foreground">Creates a fresh keyfile at <code className="font-mono">/usr/local/share/proxmenux/pbs-key.conf</code>. Backup up the recovery passphrase (below) to survive host loss.</div>
+                          </div>
+                        </label>
+                        <label className="flex items-start gap-2 cursor-pointer text-[11px]">
+                          <input
+                            type="radio"
+                            name="pbsEncryptSetupCreate"
+                            checked={pbsEncryptMode === "existing"}
+                            onChange={() => setPbsEncryptMode("existing")}
+                            className="mt-1"
+                          />
+                          <div className="flex-1">
+                            <div className="font-medium">Import an existing keyfile (shared across hosts)</div>
+                            <div className="text-muted-foreground">Use the same keyfile another host already has — enables cross-host restore of encrypted backups.</div>
+                          </div>
+                        </label>
+                        {pbsEncryptMode === "existing" && pbsPveMatch && (
+                          <div className="pt-1 rounded-md border border-emerald-500/40 bg-emerald-500/5 p-2.5 text-[11px] space-y-1">
+                            <div className="flex items-start gap-1.5">
+                              <CheckCircle2 className="h-3.5 w-3.5 text-emerald-400 mt-0.5 shrink-0" />
+                              <div className="flex-1">
+                                <div className="font-medium text-foreground">Auto-detected from PVE storage &apos;{pbsPveMatch.name}&apos;</div>
+                                <div className="text-muted-foreground mt-0.5">
+                                  Existing key at <code className="font-mono text-[10.5px]">{pbsPveMatch.path}</code>
+                                </div>
+                                <div className="text-muted-foreground mt-0.5">Will be copied to the ProxMenux state directory. No file upload needed.</div>
+                              </div>
+                            </div>
+                          </div>
+                        )}
+                        {pbsEncryptMode === "existing" && !pbsPveMatch && (
+                          <div className="space-y-2 pt-1">
+                            <div className="space-y-1.5">
+                              <Label htmlFor="pbsImportFile" className="text-[11px] font-medium">
+                                Upload from your machine
+                              </Label>
+                              <Input
+                                id="pbsImportFile"
+                                type="file"
+                                accept=".conf,.key,application/json,text/plain"
+                                onChange={(e) => setPbsImportFile(e.target.files?.[0] ?? null)}
+                                disabled={pbsImportBusy || !!pbsImportPath.trim()}
+                                className="h-8 text-[11px]"
+                              />
+                            </div>
+                            <div className="text-[10px] text-center text-muted-foreground">— or —</div>
+                            <div className="space-y-1.5">
+                              <Label htmlFor="pbsImportPath" className="text-[11px] font-medium">
+                                Absolute path on this host
+                              </Label>
+                              <Input
+                                id="pbsImportPath"
+                                type="text"
+                                value={pbsImportPath}
+                                onChange={(e) => setPbsImportPath(e.target.value)}
+                                disabled={pbsImportBusy || !!pbsImportFile}
+                                placeholder="e.g. /etc/pve/priv/storage/<NAME>.enc or /root/my-pbs-key"
+                                className="h-8 text-[11px] font-mono"
+                              />
+                              <p className="text-[10px] text-muted-foreground">
+                                Either option works. The file lands at <code className="font-mono">/usr/local/share/proxmenux/pbs-key.conf</code> and every subsequent encrypted backup reuses it.
+                              </p>
+                            </div>
+                          </div>
+                        )}
+                      </div>
+                    )}
+
+                    {pbsEncrypt && (
+                      <div className="pl-7 space-y-3 rounded-md border border-blue-500/30 bg-blue-500/5 p-3">
+                        {pbsRecoveryStatus?.has_keyfile && !pbsRecoveryChange && (
+                          <div className="flex items-start gap-2 text-[11px]">
+                            <CheckCircle2 className="h-3.5 w-3.5 text-emerald-400 mt-0.5 shrink-0" />
+                            <div className="flex-1">
+                              <div className="text-foreground">Keyfile installed. Backups reuse it silently.</div>
+                              <div className="text-muted-foreground mt-0.5">The current PBS-upload setting stays in effect.</div>
+                            </div>
+                            <button
+                              type="button"
+                              onClick={() => setPbsRecoveryChange(true)}
+                              className="text-blue-400 hover:text-blue-300 underline underline-offset-2 shrink-0"
+                            >
+                              Change
+                            </button>
+                          </div>
+                        )}
+                        {pbsRecoveryStatus?.has_keyfile && pbsRecoveryChange && (
+                          <>
+                            <KeyfileActionsBar
+                              mutateStatus={mutatePbsRecovery}
+                              escrowMode={pbsRecoveryStatus?.escrow_mode}
+                            />
+                            <button
+                              type="button"
+                              onClick={() => setPbsRecoveryChange(false)}
+                              className="text-[11px] text-muted-foreground hover:text-foreground underline underline-offset-2"
+                            >
+                              Done — hide keyfile options
+                            </button>
+                          </>
+                        )}
+                        {!pbsRecoveryStatus?.has_keyfile && (
+                          <>
+                            <div>
+                              <div className="text-[11px] font-medium text-foreground mb-2">Upload key to PBS?</div>
+                              <div className="grid gap-1.5">
+                                <label className="flex items-start gap-2 cursor-pointer text-[11px]">
+                                  <input
+                                    type="radio"
+                                    name="pbsUploadToPbsCreate"
+                                    checked={!pbsUploadToPbs}
+                                    onChange={() => setPbsUploadToPbs(false)}
+                                    className="mt-1"
+                                  />
+                                  <div className="flex-1">
+                                    <div className="font-medium">No, keep local only</div>
+                                    <div className="text-muted-foreground">Keyfile stays only at <code className="font-mono text-[10.5px]">/usr/local/share/proxmenux/pbs-key.conf</code>. You are responsible for keeping an offsite copy — losing it makes every encrypted backup unreadable.</div>
+                                  </div>
+                                </label>
+                                <label className="flex items-start gap-2 cursor-pointer text-[11px]">
+                                  <input
+                                    type="radio"
+                                    name="pbsUploadToPbsCreate"
+                                    checked={pbsUploadToPbs}
+                                    onChange={() => setPbsUploadToPbs(true)}
+                                    className="mt-1"
+                                  />
+                                  <div className="flex-1">
+                                    <div className="font-medium">Yes, upload</div>
+                                    <div className="text-muted-foreground">Set a recovery passphrase now. ProxMenux uploads a passphrase-wrapped copy of the keyfile to PBS with every backup so you can recover it on a reinstalled host with just the passphrase.</div>
+                                  </div>
+                                </label>
+                              </div>
+                            </div>
+                            {pbsUploadToPbs ? (
+                              <div className="space-y-2 pt-1 border-t border-blue-500/20">
+                                <div>
+                                  <Label htmlFor="pbsRecPass" className="text-[11px]">Recovery passphrase</Label>
+                                  <Input
+                                    id="pbsRecPass"
+                                    type="password"
+                                    value={pbsRecoveryPass}
+                                    onChange={(e) => setPbsRecoveryPass(e.target.value)}
+                                    placeholder="Long random string — write it down somewhere safe"
+                                    className="font-mono mt-1 h-8 text-xs"
+                                  />
+                                </div>
+                                <div>
+                                  <Label htmlFor="pbsRecPass2" className="text-[11px]">Confirm passphrase</Label>
+                                  <Input
+                                    id="pbsRecPass2"
+                                    type="password"
+                                    value={pbsRecoveryPass2}
+                                    onChange={(e) => setPbsRecoveryPass2(e.target.value)}
+                                    placeholder="Type it again"
+                                    className="font-mono mt-1 h-8 text-xs"
+                                  />
+                                  {pbsRecoveryPass && pbsRecoveryPass2 && pbsRecoveryPass !== pbsRecoveryPass2 && (
+                                    <p className="text-[11px] text-red-400 mt-1">Passphrases don't match.</p>
+                                  )}
+                                </div>
+                              </div>
+                            ) : (
+                              <div className="pt-1 border-t border-blue-500/20 text-[11px] text-amber-300 bg-amber-500/10 border border-amber-500/30 rounded px-3 py-2 leading-relaxed space-y-1">
+                                <div className="font-semibold">Keep an offsite copy of the keyfile.</div>
+                                <div>After the job is created, copy <code className="font-mono text-[10.5px] bg-amber-500/20 rounded px-1">/usr/local/share/proxmenux/pbs-key.conf</code> to an external medium (USB, password manager, another host).</div>
+                                <div>Without that copy, losing this host makes every encrypted backup on PBS unreadable.</div>
+                              </div>
+                            )}
+                          </>
+                        )}
+                      </div>
+                    )}
+                  </div>
+                </>
+              )}
+              {backend === "local" && (
+                <div className="space-y-2">
+                  <Label htmlFor="localDest">Destination directory</Label>
+                  {mode === "attach" ? (
+                    <>
+                      <Input
+                        id="localDest"
+                        value={localDestDir}
+                        onChange={(e) => setLocalDestDir(e.target.value)}
+                        placeholder="Auto (derived from the PVE storage path)"
+                        className="font-mono"
+                      />
+                      <p className="text-xs text-muted-foreground">
+                        Leave blank to derive automatically from the parent PVE job's storage at backup time. Default is the storage's <code className="font-mono">/dump</code> subdir, falling back to <code className="font-mono">/var/lib/vz/dump</code>.
+                      </p>
+                    </>
+                  ) : (
+                    <>
+                      {(destResp?.local?.entries?.length ?? 0) > 0 && (
+                        <div className="flex items-center gap-2">
+                          <Select
+                            value={localDestDir || (destResp?.local?.effective ?? "")}
+                            onValueChange={(v) => setLocalDestDir(v)}
+                          >
+                            <SelectTrigger className="flex-1">
+                              <SelectValue placeholder="Pick a configured local destination" />
+                            </SelectTrigger>
+                            <SelectContent>
+                              {destResp?.local?.entries?.map((e) => (
+                                <SelectItem key={e.path} value={e.path}>
+                                  <span className="font-mono">{e.path}</span>
+                                  {e.source === "default" && (
+                                    <span className="text-muted-foreground ml-2 text-[10px] uppercase">default</span>
+                                  )}
+                                </SelectItem>
+                              ))}
+                            </SelectContent>
+                          </Select>
+                          <Button
+                            type="button"
+                            size="sm"
+                            variant="outline"
+                            className="shrink-0 bg-blue-500/10 border-blue-500/40 !text-blue-400 hover:bg-blue-500/20 hover:!text-blue-300"
+                            onClick={() => setAddingDestType("local")}
+                            title="Save another local destination"
+                          >
+                            <Plus className="h-3.5 w-3.5 mr-1" />
+                            Add another
+                          </Button>
+                        </div>
+                      )}
+                      <Input
+                        id="localDest"
+                        value={localDestDir}
+                        onChange={(e) => setLocalDestDir(e.target.value)}
+                        placeholder={destResp?.local?.effective || "/var/lib/vz/dump"}
+                        className="font-mono"
+                      />
+                      <p className="text-xs text-muted-foreground">
+                        Pick a configured destination above, or type a custom directory path. Empty input falls back to <span className="font-mono">{destResp?.local?.effective || "/var/lib/vz/dump"}</span>.
+                      </p>
+                    </>
+                  )}
+                </div>
+              )}
+              {backend === "borg" && (
+                <>
+                  <div>
+                    <Label>Borg repository</Label>
+                    {destResp?.borg?.length ? (
+                      <div className="mt-1 flex items-center gap-2">
+                        <Select value={borgRepoSelected} onValueChange={setBorgRepoSelected}>
+                          <SelectTrigger className="flex-1 min-w-0">
+                            {(() => {
+                              const sel = destResp.borg.find((r) => r.repository === borgRepoSelected)
+                              if (!sel) {
+                                return <span className="truncate text-muted-foreground">Pick a Borg repository</span>
+                              }
+                              return (
+                                <span className="truncate font-mono text-left">
+                                  {sel.name}
+                                  <span className="text-muted-foreground"> — {sel.repository}</span>
+                                </span>
+                              )
+                            })()}
+                          </SelectTrigger>
+                          <SelectContent>
+                            {destResp.borg.map((r) => (
+                              <SelectItem key={`${r.name}-${r.repository}`} value={r.repository}>
+                                <span className="font-mono">{r.name}</span>
+                                <span className="text-muted-foreground ml-2">— {r.repository}</span>
+                              </SelectItem>
+                            ))}
+                          </SelectContent>
+                        </Select>
+                        <Button
+                          type="button"
+                          size="sm"
+                          variant="outline"
+                          className="shrink-0 bg-fuchsia-500/10 border-fuchsia-500/40 !text-fuchsia-400 hover:bg-fuchsia-500/20 hover:!text-fuchsia-300"
+                          onClick={() => setAddingDestType("borg")}
+                          title="Save another Borg repository"
+                        >
+                          <Plus className="h-3.5 w-3.5 mr-1" />
+                          Add another
+                        </Button>
+                      </div>
+                    ) : (
+                      <div className="mt-1 p-3 rounded-md border border-amber-500/40 bg-amber-500/5 text-xs space-y-2">
+                        <div>No Borg repository configured yet. You can add one without leaving this wizard (SSH or local/USB path supported).</div>
+                        <Button
+                          type="button"
+                          size="sm"
+                          variant="outline"
+                          className="bg-fuchsia-500/10 border-fuchsia-500/40 !text-fuchsia-400 hover:bg-fuchsia-500/20 hover:!text-fuchsia-300"
+                          onClick={() => setAddingDestType("borg")}
+                        >
+                          <Plus className="h-3.5 w-3.5 mr-1" />
+                          Add Borg repository
+                        </Button>
+                      </div>
+                    )}
+                  </div>
+                  {/* Encryption + passphrase aren't asked here — they
+                      live on the borg destination. The runner reads
+                      the saved sidecar at run time. */}
+                  {(() => {
+                    const dest = destResp?.borg?.find((r) => r.repository === borgRepoSelected)
+                    if (!dest) return null
+                    const mode = dest.encrypt_mode || "repokey"
+                    return (
+                      <p className="text-[11px] text-muted-foreground">
+                        Encryption + passphrase are taken from the destination ({mode === "none" ? "no encryption" : mode}). Edit the destination if you need to change them.
+                      </p>
+                    )
+                  })()}
+                </>
+              )}
+
+              {/* Summary preview — mirrors the JobDetailModal styling so
+                  what the operator sees at Create time is what they'll
+                  see when they open the job later. */}
+              {(() => {
+                const retentionPairs: Array<[string, string]> = [
+                  ["last", String(keepLast || "")],
+                  ["hourly", String(keepHourly || "")],
+                  ["daily", String(keepDaily || "")],
+                  ["weekly", String(keepWeekly || "")],
+                  ["monthly", String(keepMonthly || "")],
+                  ["yearly", String(keepYearly || "")],
+                ].filter(([, v]) => Number(v) > 0) as Array<[string, string]>
+                return (
+                  <div className="rounded-md border border-border bg-background/40 p-3 space-y-2 text-xs">
+                    <div className="text-[10px] uppercase tracking-wider text-muted-foreground mb-1">Summary</div>
+                    <div><span className="text-muted-foreground">Name:</span> <span className="font-mono text-foreground">{jobId}</span></div>
+                    <div className="flex items-center gap-2 flex-wrap">
+                      <span className="text-muted-foreground">Backend:</span>
+                      <Badge variant="outline" className={`text-[10px] uppercase tracking-wide ${methodBadgeCls(backend)}`}>
+                        {backend}
+                      </Badge>
+                      <Badge variant="outline" className="text-[10px] text-blue-400 border-blue-400/40 bg-blue-500/5">
+                        {mode === "attach" ? "attached" : "scheduled"}
+                      </Badge>
+                    </div>
+                    {mode === "attach" && selectedPveJob && (
+                      <>
+                        <div><span className="text-muted-foreground">PVE job:</span> <span className="font-mono text-foreground">{selectedPveJob.id}</span></div>
+                        <div className="flex items-center gap-1.5 flex-wrap">
+                          <Calendar className="h-3 w-3 text-green-500/80" />
+                          <span className="text-green-500/90 uppercase tracking-wider text-[10px]">inherited schedule:</span>
+                          <span className="text-foreground">{humanizeOnCalendar(selectedPveJob.schedule)}</span>
+                        </div>
+                        <div className="flex items-center gap-1.5 flex-wrap">
+                          <Archive className="h-3 w-3 text-green-500/80" />
+                          <span className="text-green-500/90 uppercase tracking-wider text-[10px]">inherited retention:</span>
+                          <span className="font-mono text-foreground">{selectedPveJob.prune}</span>
+                        </div>
+                      </>
+                    )}
+                    {mode === "new" && (
+                      <>
+                        <div className="flex items-center gap-1.5 flex-wrap">
+                          <Calendar className="h-3 w-3 text-green-500/80" />
+                          <span className="text-green-500/90 uppercase tracking-wider text-[10px]">when:</span>
+                          <span className="text-foreground">{humanizeOnCalendar(onCalendar)}</span>
+                        </div>
+                        <div className="flex items-start gap-1.5 flex-wrap">
+                          <span className="text-green-500/90 uppercase tracking-wider text-[10px] inline-flex items-center gap-1 pt-0.5">
+                            <Archive className="h-3 w-3 text-green-500/80" /> retention:
+                          </span>
+                          {retentionPairs.length === 0 ? (
+                            <span className="text-muted-foreground italic">No retention rules</span>
+                          ) : (
+                            <div className="flex flex-wrap gap-1.5">
+                              {retentionPairs.map(([k, v]) => (
+                                <span key={k} className="inline-flex items-center gap-1.5 px-2 py-0.5 rounded border border-border bg-background/60">
+                                  <span className="text-[10px] uppercase tracking-wide text-muted-foreground">{k}</span>
+                                  <span className="font-mono text-xs text-foreground">{v}</span>
+                                </span>
+                              ))}
+                            </div>
+                          )}
+                        </div>
+                      </>
+                    )}
+                    <div className="inline-flex items-center gap-1.5">
+                      <FileSearch className="h-3 w-3 text-green-500/80" />
+                      <span className="text-green-500/90 uppercase tracking-wider text-[10px]">profile:</span>
+                      <span className="text-foreground">{profileMode}</span>
+                      <span className="text-muted-foreground">({profileMode === "default" ? defaultPaths.length : customPaths.size} paths)</span>
+                    </div>
+                  </div>
+                )
+              })()}
+
+              {error && (
+                <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+                  {error}
+                </div>
+              )}
+            </div>
+          )}
+        </div>
+
+        {/* Footer navigation */}
+        <div className="flex items-center justify-between gap-2 pt-3 border-t border-border">
+          <Button
+            variant="ghost"
+            onClick={onClose}
+            disabled={submitting}
+          >
+            Cancel
+          </Button>
+          <div className="flex items-center gap-2">
+            {step > 1 && (
+              <Button
+                variant="outline"
+                onClick={() => setStep((s) => (s - 1) as 1 | 2 | 3 | 4 | 5)}
+                disabled={submitting}
+              >
+                <ChevronLeft className="h-4 w-4 mr-1" />
+                Back
+              </Button>
+            )}
+            {step < 5 ? (
+              <Button
+                onClick={() => setStep((s) => (s + 1) as 1 | 2 | 3 | 4 | 5)}
+                disabled={
+                  (step === 1 && !canAdvanceFrom1) ||
+                  (step === 2 && !canAdvanceFrom2) ||
+                  (step === 3 && !canAdvanceFrom3) ||
+                  (step === 4 && !canAdvanceFrom4)
+                }
+              >
+                Next
+                <ChevronRight className="h-4 w-4 ml-1" />
+              </Button>
+            ) : (
+              <Button
+                onClick={handleCreate}
+                disabled={!canSubmit || submitting}
+                className="bg-blue-600 hover:bg-blue-700 text-white"
+              >
+                {submitting ? (
+                  <Loader2 className="h-4 w-4 animate-spin mr-2" />
+                ) : isEdit ? (
+                  <Save className="h-4 w-4 mr-2" />
+                ) : (
+                  <Plus className="h-4 w-4 mr-2" />
+                )}
+                {isEdit ? "Save changes" : "Create job"}
+              </Button>
+            )}
+          </div>
+        </div>
+      </DialogContent>
+
+      {/* AddDestinationDialog spawned from inside the wizard. When the
+          operator saves a new PBS or Borg destination we refresh the
+          dest list and queue the freshly-saved repository so the next
+          destResp render auto-selects it in the dropdown. */}
+      <AddDestinationDialog
+        type={addingDestType}
+        onClose={() => setAddingDestType(null)}
+        onSaved={(repo) => {
+          if (repo && (addingDestType === "pbs" || addingDestType === "borg")) {
+            setPendingAutoSelectDest({ kind: addingDestType, repository: repo })
+          }
+          setAddingDestType(null)
+          mutateDest()
+        }}
+      />
+    </Dialog>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// Manual backup dialog (Sprint B).
+//
+// One-shot version of CreateJobDialog: same backends + profile + paths
+// + backend-specific config, but NO schedule, NO retention, NO timer.
+// Writes a `manual-<ts>` .env with ENABLED=0 + MANUAL_RUN=1 and fires
+// the runner in the background. The resulting job appears in the
+// scheduler list with a "manual" badge and can be deleted when the
+// operator wants to clean up.
+// ──────────────────────────────────────────────────────────────
+
+function ManualBackupDialog({
+  open,
+  onClose,
+  onLaunched,
+}: {
+  open: boolean
+  onClose: () => void
+  // The job_id of the just-launched manual run. The caller uses it to
+  // transition straight into the live-progress modal so the operator
+  // never has to chase a banner after pressing Run.
+  onLaunched: (jobId: string) => void
+}) {
+  const [step, setStep] = useState<1 | 2>(1)
+  const [backend, setBackend] = useState<"pbs" | "local" | "borg">("local")
+  const [profileMode, setProfileMode] = useState<"default" | "custom">("default")
+  const [customPaths, setCustomPaths] = useState<Set<string>>(new Set())
+
+  const [pbsRepository, setPbsRepository] = useState<string>("")
+  const [pbsBackupId, setPbsBackupId] = useState<string>("")
+  // Encryption mode. See CreateJobDialog above for the full comment
+  // block — the three modes and the import flow are identical here.
+  const [pbsEncryptMode, setPbsEncryptMode] = useState<"none" | "new" | "existing">("none")
+  const [pbsImportFile, setPbsImportFile] = useState<File | null>(null)
+  // Absolute-path alternative to the file upload — mirrors the shell
+  // wizard's `_hb_pbs_import_dialog` when there is no PVE .enc match.
+  const [pbsImportPath, setPbsImportPath] = useState<string>("")
+  const [pbsImportBusy, setPbsImportBusy] = useState<boolean>(false)
+  const pbsEncrypt = pbsEncryptMode !== "none"
+  const [pbsRecoveryPass, setPbsRecoveryPass] = useState<string>("")
+  const [pbsRecoveryPass2, setPbsRecoveryPass2] = useState<string>("")
+  // Operator opted to replace an already-configured recovery escrow.
+  // Default behavior matches the shell: don't prompt for the
+  // passphrase if one is already saved — only show the inputs when
+  // there's no escrow yet OR the operator explicitly asks to change.
+  const [pbsRecoveryChange, setPbsRecoveryChange] = useState<boolean>(false)
+  // Binary "upload key to PBS?" toggle. `true` maps to escrow_mode='full'
+  // (passphrase required, envelope uploaded on every backup); `false`
+  // maps to escrow_mode='none' (keyfile stays local, operator handles
+  // the offsite copy). Defaults to 'No' — the keyfile is always
+  // downloadable from the Monitor, so the operator can grab it and
+  // save it offsite themselves without leaving a passphrase-wrapped
+  // copy on the PBS server.
+  const [pbsUploadToPbs, setPbsUploadToPbs] = useState<boolean>(false)
+  // Whether the host already has an escrow blob configured. When
+  // present, the passphrase input becomes optional ("leave blank to
+  // keep saved"). Refreshed after a successful setup call.
+  const { data: pbsRecoveryStatus, mutate: mutatePbsRecovery } = useSWR<{
+    has_keyfile: boolean; has_recovery: boolean; has_keyfile_passphrase?: boolean; escrow_mode?: "none" | "local" | "full"
+  }>(
+    open && backend === "pbs" ? "/api/host-backups/pbs-recovery/status" : null,
+    fetcher,
+  )
+  // Auto-discover a PVE-managed keyfile for the currently selected
+  // PBS repository. When one is found, the "Use an existing keyfile"
+  // radio uses it silently (matches the shell wizard's PVE auto-detect
+  // path — the operator doesn't have to upload the same file twice).
+  const { data: pbsPveDiscover } = useSWR<{
+    entries: Array<{ name: string; server: string; datastore: string; path: string; matches_repository: boolean }>
+  }>(
+    open && backend === "pbs" && pbsRepository && !pbsRecoveryStatus?.has_keyfile
+      ? `/api/host-backups/pbs-encryption/discover-pve-keyfiles?repository=${encodeURIComponent(pbsRepository)}`
+      : null,
+    fetcher,
+  )
+  const pbsPveMatch = pbsPveDiscover?.entries?.find((e) => e.matches_repository)
+  const [localDestDir, setLocalDestDir] = useState<string>("")
+  const [borgRepoSelected, setBorgRepoSelected] = useState<string>("")
+  const [borgPassphrase, setBorgPassphrase] = useState<string>("")
+  const [borgEncryptMode, setBorgEncryptMode] = useState<"none" | "repokey" | "keyfile" | "authenticated">("repokey")
+
+  const [submitting, setSubmitting] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  const { data: destResp, mutate: mutateDest } = useSWR<DestinationsResp>(
+    open ? "/api/host-backups/destinations" : null,
+    fetcher,
+  )
+  const { data: pathsResp } = useSWR<{ paths: string[] }>(
+    open ? "/api/host-backups/default-paths" : null,
+    fetcher,
+  )
+  // Same inline AddDestinationDialog flow as the scheduled CreateJobDialog.
+  const [addingDestType, setAddingDestType] = useState<"pbs" | "borg" | "local" | null>(null)
+  const [pendingAutoSelectDest, setPendingAutoSelectDest] = useState<{ kind: "pbs" | "borg"; repository: string } | null>(null)
+  useEffect(() => {
+    if (!pendingAutoSelectDest || !destResp) return
+    if (pendingAutoSelectDest.kind === "pbs") {
+      const hit = destResp.pbs?.find((r) => r.repository === pendingAutoSelectDest.repository)
+      if (hit) {
+        setPbsRepository(hit.repository)
+        setPendingAutoSelectDest(null)
+      }
+    } else {
+      const hit = destResp.borg?.find((r) => r.repository === pendingAutoSelectDest.repository)
+      if (hit) {
+        setBorgRepoSelected(hit.repository)
+        setPendingAutoSelectDest(null)
+      }
+    }
+  }, [destResp, pendingAutoSelectDest])
+
+  const selectedPbs = destResp?.pbs?.find((r) => r.repository === pbsRepository) ?? destResp?.pbs?.[0]
+
+  useEffect(() => {
+    if (!open) {
+      setStep(1)
+      setBackend("local")
+      setProfileMode("default")
+      setCustomPaths(new Set())
+      setPbsRepository("")
+      setPbsBackupId("")
+      setPbsEncryptMode("none")
+      setPbsImportFile(null)
+      setPbsImportPath("")
+      setPbsImportBusy(false)
+      setPbsRecoveryPass("")
+      setPbsRecoveryPass2("")
+      setPbsRecoveryChange(false)
+      setPbsUploadToPbs(false)
+      setLocalDestDir("")
+      setBorgRepoSelected("")
+      setBorgPassphrase("")
+      setBorgEncryptMode("repokey")
+      setError(null)
+      setSubmitting(false)
+    }
+  }, [open])
+
+  useEffect(() => {
+    if (backend === "pbs" && !pbsRepository && destResp?.pbs?.length) {
+      setPbsRepository(destResp.pbs[0].repository)
+    }
+    if (backend === "borg" && !borgRepoSelected && destResp?.borg?.length) {
+      setBorgRepoSelected(destResp.borg[0].repository)
+    }
+  }, [backend, destResp, pbsRepository, borgRepoSelected])
+
+  const togglePath = (path: string) => {
+    setCustomPaths((prev) => {
+      const next = new Set(prev)
+      if (next.has(path)) next.delete(path)
+      else next.add(path)
+      return next
+    })
+  }
+
+  const defaultPaths = pathsResp?.paths ?? []
+  const canAdvanceFrom1 = profileMode === "default" || (profileMode === "custom" && customPaths.size > 0)
+  const backendValid =
+    backend === "pbs"
+      ? !!pbsRepository
+      : backend === "local"
+        ? true
+        // Borg destination carries its own passphrase + encryption.
+        // No need to gate on local state — the wizard no longer asks.
+        : !!borgRepoSelected
+  // Recovery gate for PBS encryption. Choosing "Encrypt" makes the
+  // recovery passphrase mandatory — same as the CLI. The "Run backup"
+  // button stays disabled until a matching passphrase pair is entered
+  // (or an already-saved escrow is reused). No accept-risk escape:
+  // encrypting without recovery would leave the keyfile only on this
+  // host, and a reinstall would render every encrypted backup
+  // unrecoverable.
+  // Passphrase requirement only kicks in when: encryption is on AND
+  // there's no keyfile installed yet (fresh setup) AND the operator
+  // opted to upload the key to PBS. Every other case (reuse existing
+  // keyfile, or "no upload" mode) doesn't need a passphrase.
+  const pbsRecoveryOk = !(backend === "pbs" && pbsEncrypt) ||
+    pbsRecoveryStatus?.has_keyfile ||
+    !pbsUploadToPbs ||
+    (pbsRecoveryPass !== "" && pbsRecoveryPass === pbsRecoveryPass2)
+  const canSubmit = canAdvanceFrom1 && backendValid && pbsRecoveryOk
+
+  async function handleRun() {
+    if (!canSubmit) return
+    setSubmitting(true)
+    setError(null)
+    // Unified encryption setup — mirrors CreateJobDialog. One atomic
+    // /pbs-encryption/import call covers keyfile install + escrow
+    // setup with source picked from what the operator provided.
+    const needsInstall =
+      backend === "pbs" &&
+      pbsEncrypt &&
+      !pbsRecoveryStatus?.has_keyfile
+    if (needsInstall) {
+      if (pbsEncryptMode === "existing" && !pbsPveMatch && !pbsImportFile && !pbsImportPath.trim()) {
+        setError("Pick a keyfile file or enter an absolute path on this host.")
+        setSubmitting(false)
+        return
+      }
+      if (pbsUploadToPbs && pbsRecoveryPass !== pbsRecoveryPass2) {
+        setError("Recovery passphrases don't match.")
+        setSubmitting(false)
+        return
+      }
+      setPbsImportBusy(true)
+      try {
+        let source: "generate" | "pve-storage" | "content" | "path"
+        if (pbsEncryptMode === "new") source = "generate"
+        else if (pbsPveMatch) source = "pve-storage"
+        else if (pbsImportFile) source = "content"
+        else source = "path"
+        const body: Record<string, unknown> = {
+          source,
+          escrow_mode: pbsUploadToPbs ? "full" : "none",
+        }
+        if (pbsUploadToPbs) body.escrow_passphrase = pbsRecoveryPass
+        if (source === "pve-storage") {
+          body.pve_storage_name = pbsPveMatch!.name
+        } else if (source === "content") {
+          const buf = new Uint8Array(await pbsImportFile!.arrayBuffer())
+          let bin = ""
+          for (let i = 0; i < buf.length; i++) bin += String.fromCharCode(buf[i])
+          body.content_b64 = btoa(bin)
+        } else if (source === "path") {
+          body.keyfile_path = pbsImportPath.trim()
+        }
+        await fetchApi("/api/host-backups/pbs-encryption/import", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(body),
+        })
+        mutatePbsRecovery()
+      } catch (e) {
+        const err = e as Error & { body?: { tool_output?: string; tool_exit_code?: number } }
+        const detail = err.body?.tool_output
+          ? `${err.message}\n\nproxmox-backup-client output:\n${err.body.tool_output}`
+          : err.message
+        setError(`Encryption setup failed: ${detail || String(e)}`)
+        setPbsImportBusy(false)
+        setSubmitting(false)
+        return
+      }
+      setPbsImportBusy(false)
+    }
+    // NOTE: recovery escrow is now bundled into the /pbs-encryption/import
+    // call above. No separate /pbs-recovery/setup pass is needed.
+    try {
+      const body: Record<string, unknown> = {
+        backend,
+        profile_mode: profileMode,
+      }
+      if (profileMode === "custom") {
+        body.paths = Array.from(customPaths)
+      }
+      if (backend === "pbs") {
+        body.pbs_repository = pbsRepository
+        body.pbs_password = ""
+        if (pbsBackupId) body.pbs_backup_id = pbsBackupId
+        if (selectedPbs?.fingerprint) body.pbs_fingerprint = selectedPbs.fingerprint
+        body.pbs_encrypt_mode = pbsEncryptMode
+      } else if (backend === "local") {
+        if (localDestDir.trim()) body.local_dest_dir = localDestDir.trim()
+      } else if (backend === "borg") {
+        // Passphrase + encrypt_mode are inherited from the destination
+        // (borg-pass-<name>.txt sidecar + 4th field of borg-targets.txt).
+        body.borg_repo = borgRepoSelected
+      }
+      const resp = await fetchApi<{ status: string; job_id: string }>(
+        "/api/host-backups/manual-run",
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(body),
+        },
+      )
+      onLaunched(resp.job_id)
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => { if (!v) onClose() }}>
+      <DialogContent className="max-w-2xl max-h-[85vh] flex flex-col">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <PlayCircle className="h-5 w-5 text-blue-500" />
+            Run a one-shot backup
+          </DialogTitle>
+          <DialogDescription>
+            Step {step} of 2 · The backup runs once. It appears in the list with a "manual" badge and won't fire again.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="flex items-center gap-1">
+          {[1, 2].map((n) => (
+            <div
+              key={n}
+              className={`h-1 flex-1 rounded-full ${n <= step ? "bg-blue-500" : "bg-border"}`}
+            />
+          ))}
+        </div>
+
+        <div className="overflow-y-auto pr-2 -mr-2 space-y-4 flex-1">
+          {step === 1 && (
+            <div className="space-y-4">
+              <div>
+                <Label>Backend</Label>
+                <div className="grid grid-cols-1 sm:grid-cols-3 gap-2 mt-1">
+                  {(["pbs", "local", "borg"] as const).map((b) => {
+                    const Icon = b === "pbs" ? Server : b === "local" ? HardDrive : Archive
+                    const desc = b === "pbs"
+                      ? "Proxmox Backup Server."
+                      : b === "local"
+                        ? "tar.zst archive into a local directory."
+                        : "Borg repo (SSH or local/USB disk)."
+                    return (
+                      <button
+                        key={b}
+                        type="button"
+                        onClick={() => setBackend(b)}
+                        className={`text-left p-3 rounded-md border ${backend === b ? "border-blue-500 bg-blue-500/5" : "border-border bg-background/40"} hover:bg-white/5 transition-colors`}
+                      >
+                        <div className="flex items-center gap-2 font-medium text-sm">
+                          <Icon className="h-4 w-4" />
+                          {b.toUpperCase()}
+                        </div>
+                        <div className="text-xs text-muted-foreground mt-1">{desc}</div>
+                      </button>
+                    )
+                  })}
+                </div>
+              </div>
+
+              <div>
+                <Label>Backup profile</Label>
+                <div className="grid grid-cols-2 gap-2 mt-1">
+                  <button
+                    type="button"
+                    onClick={() => setProfileMode("default")}
+                    className={`text-left p-3 rounded-md border ${profileMode === "default" ? "border-blue-500 bg-blue-500/5" : "border-border bg-background/40"} hover:bg-white/5 transition-colors`}
+                  >
+                    <div className="text-sm font-medium">Default</div>
+                    <div className="text-xs text-muted-foreground mt-1">
+                      Critical config paths ({defaultPaths.length} entries).
+                    </div>
+                  </button>
+                  <button
+                    type="button"
+                    onClick={() => setProfileMode("custom")}
+                    className={`text-left p-3 rounded-md border ${profileMode === "custom" ? "border-blue-500 bg-blue-500/5" : "border-border bg-background/40"} hover:bg-white/5 transition-colors`}
+                  >
+                    <div className="text-sm font-medium">Custom</div>
+                    <div className="text-xs text-muted-foreground mt-1">
+                      Pick which paths to include.
+                    </div>
+                  </button>
+                </div>
+              </div>
+
+              {profileMode === "custom" && (
+                <div>
+                  <Label>Paths to include ({customPaths.size}/{defaultPaths.length})</Label>
+                  <ScrollArea className="h-48 mt-1 rounded-md border border-border p-2">
+                    {defaultPaths.map((p) => (
+                      <label
+                        key={p}
+                        className="flex items-center gap-2 py-1 px-1 hover:bg-white/5 rounded text-xs cursor-pointer"
+                      >
+                        <Checkbox
+                          checked={customPaths.has(p)}
+                          onCheckedChange={() => togglePath(p)}
+                        />
+                        <span className="font-mono">{p}</span>
+                      </label>
+                    ))}
+                  </ScrollArea>
+                </div>
+              )}
+            </div>
+          )}
+
+          {step === 2 && (
+            <div className="space-y-4">
+              {backend === "pbs" && (
+                <>
+                  <div>
+                    <Label>PBS repository</Label>
+                    {destResp?.pbs?.length ? (
+                      <div className="mt-1 flex items-center gap-2">
+                        <Select value={pbsRepository} onValueChange={setPbsRepository}>
+                          <SelectTrigger className="flex-1 min-w-0">
+                            {/* Manual render: SelectValue's default mode
+                                duplicates the item children and cuts
+                                them in the middle on mobile. We render
+                                "name — repository" ourselves with a
+                                proper trailing ellipsis. */}
+                            {(() => {
+                              const sel = destResp.pbs.find((r) => r.repository === pbsRepository)
+                              if (!sel) {
+                                return <span className="truncate text-muted-foreground">Pick a PBS repository</span>
+                              }
+                              return (
+                                <span className="truncate font-mono text-left">
+                                  {sel.name}
+                                  <span className="text-muted-foreground"> — {sel.repository}</span>
+                                </span>
+                              )
+                            })()}
+                          </SelectTrigger>
+                          <SelectContent>
+                            {destResp.pbs.map((r) => (
+                              <SelectItem key={`${r.name}-${r.repository}`} value={r.repository}>
+                                <span className="font-mono">{r.name}</span>
+                                <span className="text-muted-foreground ml-2">— {r.repository}</span>
+                              </SelectItem>
+                            ))}
+                          </SelectContent>
+                        </Select>
+                        <Button
+                          type="button"
+                          size="sm"
+                          variant="outline"
+                          className="shrink-0 bg-blue-500/10 border-blue-500/40 !text-blue-400 hover:bg-blue-500/20 hover:!text-blue-300"
+                          onClick={() => setAddingDestType("pbs")}
+                          title="Save another PBS repository"
+                        >
+                          <Plus className="h-3.5 w-3.5 mr-1" />
+                          Add another
+                        </Button>
+                      </div>
+                    ) : (
+                      <div className="mt-1 p-3 rounded-md border border-amber-500/40 bg-amber-500/5 text-xs space-y-2">
+                        <div>No PBS repository configured yet. You can add one without leaving this dialog.</div>
+                        <Button
+                          type="button"
+                          size="sm"
+                          variant="outline"
+                          className="bg-blue-500/10 border-blue-500/40 !text-blue-400 hover:bg-blue-500/20 hover:!text-blue-300"
+                          onClick={() => setAddingDestType("pbs")}
+                        >
+                          <Plus className="h-3.5 w-3.5 mr-1" />
+                          Add PBS repository
+                        </Button>
+                      </div>
+                    )}
+                  </div>
+                  <div>
+                    <Label htmlFor="manualPbsBackupId">Group name in PBS</Label>
+                    <Input
+                      id="manualPbsBackupId"
+                      value={pbsBackupId}
+                      onChange={(e) => setPbsBackupId(e.target.value)}
+                      placeholder="Leave blank for the default"
+                      className="font-mono mt-1"
+                    />
+                  </div>
+                  <div className="pt-2 border-t border-border space-y-3">
+                    <label className="flex items-start gap-2 cursor-pointer">
+                      <Checkbox
+                        checked={pbsEncrypt}
+                        onCheckedChange={(v) => {
+                          const checked = !!v
+                          if (!checked) {
+                            setPbsEncryptMode("none")
+                          } else {
+                            setPbsEncryptMode(pbsRecoveryStatus?.has_keyfile ? "existing" : "new")
+                          }
+                        }}
+                        className="mt-0.5"
+                      />
+                      <div className="flex-1">
+                        <div className="inline-flex items-center gap-1.5 text-sm">
+                          <Lock className="h-3.5 w-3.5 text-emerald-400" />
+                          Encrypt this backup (client-side keyfile)
+                        </div>
+                        <p className="text-[11px] text-muted-foreground mt-1">
+                          Uses the shared keyfile at <code className="font-mono">/usr/local/share/proxmenux/pbs-key.conf</code>.
+                        </p>
+                      </div>
+                    </label>
+
+
+                    {pbsEncrypt && !pbsRecoveryStatus?.has_keyfile && (
+                      <div className="space-y-2 rounded-md border border-emerald-500/30 bg-emerald-500/5 p-3">
+                        <div className="text-[11px] font-medium">
+                          No encryption key is stored on this host. Choose how to set one up:
+                        </div>
+                        <label className="flex items-start gap-2 cursor-pointer text-[11px]">
+                          <input
+                            type="radio"
+                            name="manualPbsEncryptSetup"
+                            checked={pbsEncryptMode === "new"}
+                            onChange={() => setPbsEncryptMode("new")}
+                            className="mt-1"
+                          />
+                          <div className="flex-1">
+                            <div className="font-medium">Generate a new keyfile (per host — safest isolation)</div>
+                            <div className="text-muted-foreground">Creates a fresh keyfile. Set a recovery passphrase (below) to survive host loss.</div>
+                          </div>
+                        </label>
+                        <label className="flex items-start gap-2 cursor-pointer text-[11px]">
+                          <input
+                            type="radio"
+                            name="manualPbsEncryptSetup"
+                            checked={pbsEncryptMode === "existing"}
+                            onChange={() => setPbsEncryptMode("existing")}
+                            className="mt-1"
+                          />
+                          <div className="flex-1">
+                            <div className="font-medium">Import an existing keyfile (shared across hosts)</div>
+                            <div className="text-muted-foreground">Reuse the same keyfile another host already has.</div>
+                          </div>
+                        </label>
+                        {pbsEncryptMode === "existing" && pbsPveMatch && (
+                          <div className="pt-1 rounded-md border border-emerald-500/40 bg-emerald-500/5 p-2.5 text-[11px] space-y-1">
+                            <div className="flex items-start gap-1.5">
+                              <CheckCircle2 className="h-3.5 w-3.5 text-emerald-400 mt-0.5 shrink-0" />
+                              <div className="flex-1">
+                                <div className="font-medium text-foreground">Auto-detected from PVE storage &apos;{pbsPveMatch.name}&apos;</div>
+                                <div className="text-muted-foreground mt-0.5">
+                                  Existing key at <code className="font-mono text-[10.5px]">{pbsPveMatch.path}</code>
+                                </div>
+                                <div className="text-muted-foreground mt-0.5">Will be copied to the ProxMenux state directory. No file upload needed.</div>
+                              </div>
+                            </div>
+                          </div>
+                        )}
+                        {pbsEncryptMode === "existing" && !pbsPveMatch && (
+                          <div className="space-y-2 pt-1">
+                            <div className="space-y-1.5">
+                              <Label htmlFor="manualPbsImportFile" className="text-[11px] font-medium">
+                                Upload from your machine
+                              </Label>
+                              <Input
+                                id="manualPbsImportFile"
+                                type="file"
+                                accept=".conf,.key,application/json,text/plain"
+                                onChange={(e) => setPbsImportFile(e.target.files?.[0] ?? null)}
+                                disabled={pbsImportBusy || !!pbsImportPath.trim()}
+                                className="h-8 text-[11px]"
+                              />
+                            </div>
+                            <div className="text-[10px] text-center text-muted-foreground">— or —</div>
+                            <div className="space-y-1.5">
+                              <Label htmlFor="manualPbsImportPath" className="text-[11px] font-medium">
+                                Absolute path on this host
+                              </Label>
+                              <Input
+                                id="manualPbsImportPath"
+                                type="text"
+                                value={pbsImportPath}
+                                onChange={(e) => setPbsImportPath(e.target.value)}
+                                disabled={pbsImportBusy || !!pbsImportFile}
+                                placeholder="e.g. /etc/pve/priv/storage/<NAME>.enc or /root/my-pbs-key"
+                                className="h-8 text-[11px] font-mono"
+                              />
+                              <p className="text-[10px] text-muted-foreground">
+                                Either option works. The file lands at <code className="font-mono">/usr/local/share/proxmenux/pbs-key.conf</code> and every subsequent encrypted backup reuses it.
+                              </p>
+                            </div>
+                          </div>
+                        )}
+                      </div>
+                    )}
+
+                    {pbsEncrypt && (
+                      <div className="pl-7 space-y-3 rounded-md border border-blue-500/30 bg-blue-500/5 p-3">
+                        {pbsRecoveryStatus?.has_keyfile && !pbsRecoveryChange && (
+                          <div className="flex items-start gap-2 text-[11px]">
+                            <CheckCircle2 className="h-3.5 w-3.5 text-emerald-400 mt-0.5 shrink-0" />
+                            <div className="flex-1">
+                              <div className="text-foreground">Keyfile installed. This backup reuses it silently.</div>
+                              <div className="text-muted-foreground mt-0.5">The current PBS-upload setting stays in effect.</div>
+                            </div>
+                            <button
+                              type="button"
+                              onClick={() => setPbsRecoveryChange(true)}
+                              className="text-blue-400 hover:text-blue-300 underline underline-offset-2 shrink-0"
+                            >
+                              Change
+                            </button>
+                          </div>
+                        )}
+                        {pbsRecoveryStatus?.has_keyfile && pbsRecoveryChange && (
+                          <>
+                            <KeyfileActionsBar
+                              mutateStatus={mutatePbsRecovery}
+                              escrowMode={pbsRecoveryStatus?.escrow_mode}
+                            />
+                            <button
+                              type="button"
+                              onClick={() => setPbsRecoveryChange(false)}
+                              className="text-[11px] text-muted-foreground hover:text-foreground underline underline-offset-2"
+                            >
+                              Done — hide keyfile options
+                            </button>
+                          </>
+                        )}
+                        {!pbsRecoveryStatus?.has_keyfile && (
+                          <>
+                            <div>
+                              <div className="text-[11px] font-medium text-foreground mb-2">Upload key to PBS?</div>
+                              <div className="grid gap-1.5">
+                                <label className="flex items-start gap-2 cursor-pointer text-[11px]">
+                                  <input
+                                    type="radio"
+                                    name="pbsUploadToPbsManual"
+                                    checked={!pbsUploadToPbs}
+                                    onChange={() => setPbsUploadToPbs(false)}
+                                    className="mt-1"
+                                  />
+                                  <div className="flex-1">
+                                    <div className="font-medium">No, keep local only</div>
+                                    <div className="text-muted-foreground">Keyfile stays only at <code className="font-mono text-[10.5px]">/usr/local/share/proxmenux/pbs-key.conf</code>. You are responsible for keeping an offsite copy — losing it makes every encrypted backup unreadable.</div>
+                                  </div>
+                                </label>
+                                <label className="flex items-start gap-2 cursor-pointer text-[11px]">
+                                  <input
+                                    type="radio"
+                                    name="pbsUploadToPbsManual"
+                                    checked={pbsUploadToPbs}
+                                    onChange={() => setPbsUploadToPbs(true)}
+                                    className="mt-1"
+                                  />
+                                  <div className="flex-1">
+                                    <div className="font-medium">Yes, upload</div>
+                                    <div className="text-muted-foreground">Set a recovery passphrase now. ProxMenux uploads a passphrase-wrapped copy of the keyfile to PBS with every backup so you can recover it on a reinstalled host with just the passphrase.</div>
+                                  </div>
+                                </label>
+                              </div>
+                            </div>
+                            {pbsUploadToPbs ? (
+                              <div className="space-y-2 pt-1 border-t border-blue-500/20">
+                                <div>
+                                  <Label htmlFor="manualPbsRecPass" className="text-[11px]">Recovery passphrase</Label>
+                                  <Input
+                                    id="manualPbsRecPass"
+                                    type="password"
+                                    value={pbsRecoveryPass}
+                                    onChange={(e) => setPbsRecoveryPass(e.target.value)}
+                                    placeholder="Long random string — write it down somewhere safe"
+                                    className="font-mono mt-1 h-8 text-xs"
+                                  />
+                                </div>
+                                <div>
+                                  <Label htmlFor="manualPbsRecPass2" className="text-[11px]">Confirm passphrase</Label>
+                                  <Input
+                                    id="manualPbsRecPass2"
+                                    type="password"
+                                    value={pbsRecoveryPass2}
+                                    onChange={(e) => setPbsRecoveryPass2(e.target.value)}
+                                    placeholder="Type it again"
+                                    className="font-mono mt-1 h-8 text-xs"
+                                  />
+                                  {pbsRecoveryPass && pbsRecoveryPass2 && pbsRecoveryPass !== pbsRecoveryPass2 && (
+                                    <p className="text-[11px] text-red-400 mt-1">Passphrases don't match.</p>
+                                  )}
+                                </div>
+                              </div>
+                            ) : (
+                              <div className="pt-1 border-t border-blue-500/20 text-[11px] text-amber-300 bg-amber-500/10 border border-amber-500/30 rounded px-3 py-2 leading-relaxed space-y-1">
+                                <div className="font-semibold">Keep an offsite copy of the keyfile.</div>
+                                <div>After this backup, copy <code className="font-mono text-[10.5px] bg-amber-500/20 rounded px-1">/usr/local/share/proxmenux/pbs-key.conf</code> to an external medium (USB, password manager, another host).</div>
+                                <div>Without that copy, losing this host makes every encrypted backup on PBS unreadable.</div>
+                              </div>
+                            )}
+                          </>
+                        )}
+                      </div>
+                    )}
+                  </div>
+                </>
+              )}
+              {backend === "local" && (
+                <div className="space-y-2">
+                  <Label>Local destination</Label>
+                  {(destResp?.local?.entries?.length ?? 0) > 0 && (
+                    <div className="flex items-center gap-2">
+                      <Select
+                        value={localDestDir || (destResp?.local?.effective ?? "")}
+                        onValueChange={(v) => setLocalDestDir(v)}
+                      >
+                        <SelectTrigger className="flex-1">
+                          <SelectValue placeholder="Pick a configured local destination" />
+                        </SelectTrigger>
+                        <SelectContent>
+                          {destResp?.local?.entries?.map((e) => (
+                            <SelectItem key={e.path} value={e.path}>
+                              <span className="font-mono">{e.path}</span>
+                              {e.source === "default" && (
+                                <span className="text-muted-foreground ml-2 text-[10px] uppercase">default</span>
+                              )}
+                            </SelectItem>
+                          ))}
+                        </SelectContent>
+                      </Select>
+                      <Button
+                        type="button"
+                        size="sm"
+                        variant="outline"
+                        className="shrink-0 bg-blue-500/10 border-blue-500/40 !text-blue-400 hover:bg-blue-500/20 hover:!text-blue-300"
+                        onClick={() => setAddingDestType("local")}
+                        title="Save another local destination"
+                      >
+                        <Plus className="h-3.5 w-3.5 mr-1" />
+                        Add another
+                      </Button>
+                    </div>
+                  )}
+                  <p className="text-xs text-muted-foreground">
+                    Pick one of the configured local destinations, or type a custom directory path below. Empty input falls back to the selected destination above.
+                  </p>
+                  <Input
+                    id="manualLocalDest"
+                    value={localDestDir}
+                    onChange={(e) => setLocalDestDir(e.target.value)}
+                    placeholder={destResp?.local?.effective || "/var/lib/vz/dump"}
+                    className="font-mono"
+                  />
+                </div>
+              )}
+              {backend === "borg" && (
+                <>
+                  <div>
+                    <Label>Borg repository</Label>
+                    {destResp?.borg?.length ? (
+                      <div className="mt-1 flex items-center gap-2">
+                        <Select value={borgRepoSelected} onValueChange={setBorgRepoSelected}>
+                          <SelectTrigger className="flex-1 min-w-0">
+                            {(() => {
+                              const sel = destResp.borg.find((r) => r.repository === borgRepoSelected)
+                              if (!sel) {
+                                return <span className="truncate text-muted-foreground">Pick a Borg repository</span>
+                              }
+                              return (
+                                <span className="truncate font-mono text-left">
+                                  {sel.name}
+                                  <span className="text-muted-foreground"> — {sel.repository}</span>
+                                </span>
+                              )
+                            })()}
+                          </SelectTrigger>
+                          <SelectContent>
+                            {destResp.borg.map((r) => (
+                              <SelectItem key={`${r.name}-${r.repository}`} value={r.repository}>
+                                <span className="font-mono">{r.name}</span>
+                                <span className="text-muted-foreground ml-2">— {r.repository}</span>
+                              </SelectItem>
+                            ))}
+                          </SelectContent>
+                        </Select>
+                        <Button
+                          type="button"
+                          size="sm"
+                          variant="outline"
+                          className="shrink-0 bg-fuchsia-500/10 border-fuchsia-500/40 !text-fuchsia-400 hover:bg-fuchsia-500/20 hover:!text-fuchsia-300"
+                          onClick={() => setAddingDestType("borg")}
+                          title="Save another Borg repository"
+                        >
+                          <Plus className="h-3.5 w-3.5 mr-1" />
+                          Add another
+                        </Button>
+                      </div>
+                    ) : (
+                      <div className="mt-1 p-3 rounded-md border border-amber-500/40 bg-amber-500/5 text-xs space-y-2">
+                        <div>No Borg repository configured yet. You can add one without leaving this dialog (SSH or local/USB path supported).</div>
+                        <Button
+                          type="button"
+                          size="sm"
+                          variant="outline"
+                          className="bg-fuchsia-500/10 border-fuchsia-500/40 !text-fuchsia-400 hover:bg-fuchsia-500/20 hover:!text-fuchsia-300"
+                          onClick={() => setAddingDestType("borg")}
+                        >
+                          <Plus className="h-3.5 w-3.5 mr-1" />
+                          Add Borg repository
+                        </Button>
+                      </div>
+                    )}
+                  </div>
+                  {(() => {
+                    const dest = destResp?.borg?.find((r) => r.repository === borgRepoSelected)
+                    if (!dest) return null
+                    const mode = dest.encrypt_mode || "repokey"
+                    return (
+                      <p className="text-[11px] text-muted-foreground">
+                        Encryption + passphrase are taken from the destination ({mode === "none" ? "no encryption" : mode}). Edit the destination if you need to change them.
+                      </p>
+                    )
+                  })()}
+                </>
+              )}
+
+              {/* Summary — mirrors the styling of the JobDetailModal. */}
+              <div className="rounded-md border border-border bg-background/40 p-3 space-y-2 text-xs">
+                <div className="text-[10px] uppercase tracking-wider text-muted-foreground mb-1">Summary</div>
+                <div className="flex items-center gap-2 flex-wrap">
+                  <span className="text-muted-foreground">Backend:</span>
+                  <Badge variant="outline" className={`text-[10px] uppercase tracking-wide ${methodBadgeCls(backend)}`}>
+                    {backend}
+                  </Badge>
+                  <Badge variant="outline" className="text-[10px] text-purple-400 border-purple-400/40 bg-purple-500/5">
+                    manual / one-shot
+                  </Badge>
+                </div>
+                <div className="flex items-center gap-1.5 flex-wrap">
+                  <FileSearch className="h-3 w-3 text-green-500/80" />
+                  <span className="text-green-500/90 uppercase tracking-wider text-[10px]">profile:</span>
+                  <span className="text-foreground">{profileMode}</span>
+                  <span className="text-muted-foreground">({profileMode === "default" ? defaultPaths.length : customPaths.size} paths)</span>
+                </div>
+              </div>
+
+              {error && (
+                <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+                  {error}
+                </div>
+              )}
+            </div>
+          )}
+        </div>
+
+        <div className="flex items-center justify-between gap-2 pt-3 border-t border-border">
+          <Button variant="ghost" onClick={onClose} disabled={submitting}>
+            Cancel
+          </Button>
+          <div className="flex items-center gap-2">
+            {step > 1 && (
+              <Button
+                variant="outline"
+                onClick={() => setStep((s) => (s - 1) as 1 | 2)}
+                disabled={submitting}
+              >
+                <ChevronLeft className="h-4 w-4 mr-1" />
+                Back
+              </Button>
+            )}
+            {step < 2 ? (
+              <Button
+                onClick={() => setStep(2)}
+                disabled={!canAdvanceFrom1}
+              >
+                Next
+                <ChevronRight className="h-4 w-4 ml-1" />
+              </Button>
+            ) : (
+              <Button
+                onClick={handleRun}
+                disabled={!canSubmit || submitting}
+                className="bg-purple-500 hover:bg-purple-600 text-white"
+              >
+                {submitting ? (
+                  <Loader2 className="h-4 w-4 animate-spin mr-2" />
+                ) : (
+                  <PlayCircle className="h-4 w-4 mr-2" />
+                )}
+                Run backup
+              </Button>
+            )}
+          </div>
+        </div>
+      </DialogContent>
+
+      {/* AddDestinationDialog spawned from inside the manual-backup
+          dialog. Same auto-select-on-save behavior as the wizard. */}
+      <AddDestinationDialog
+        type={addingDestType}
+        onClose={() => setAddingDestType(null)}
+        onSaved={(repo) => {
+          if (repo && (addingDestType === "pbs" || addingDestType === "borg")) {
+            setPendingAutoSelectDest({ kind: addingDestType, repository: repo })
+          }
+          setAddingDestType(null)
+          mutateDest()
+        }}
+      />
+    </Dialog>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// Backup destinations CRUD (Sprint D).
+//
+// Three persistence files live in $HB_STATE_DIR (= /usr/local/share/proxmenux/):
+//   - pbs-manual-configs.txt  (manual PBS configs the shell also reads)
+//   - borg-targets.txt        (Borg repos saved by the shell)
+//   - local-target.conf       (single local target — default or override)
+//
+// Auto-discovered PBS storages from /etc/pve/storage.cfg show with a
+// "proxmox" badge and are NOT deletable here (PVE owns those).
+// ──────────────────────────────────────────────────────────────
+
+// One entry in the unified destinations list. PBS / Borg / Local all
+// flatten into this shape so the row component doesn't need to know
+// which backend a given destination targets — only the color, the
+// label and the action set.
+type UnifiedDest =
+  | { id: string; kind: "local"; path: string; source: "default" | "custom"; removable: boolean; jobsUsing: string[] }
+  | {
+      id: string; kind: "pbs"; name: string; repository: string;
+      source: "proxmox" | "manual"; fingerprint?: string; removable: boolean
+      jobsUsing: string[]
+    }
+  | {
+      id: string; kind: "borg"; name: string; repository: string;
+      isSsh: boolean; ssh?: { user: string; host: string; remotePath: string };
+      sshKeyPath?: string;
+      // The destination's encryption mode + whether a passphrase is
+      // saved server-side; used to render a Lock / Unlock badge so the
+      // operator sees at a glance which Borg repos are encrypted.
+      encryptMode?: "none" | "repokey" | "keyfile" | "authenticated"
+      hasPassphrase?: boolean
+      removable: boolean
+      jobsUsing: string[]
+    }
+
+interface CapacityInfo {
+  id: string
+  total?: number
+  available?: number
+  used?: number
+  is_usb?: boolean
+  remote?: boolean
+  error?: string
+}
+
+// Parse a Borg repository string into {user, host, remotePath} when
+// it's an SSH URL — used for the capacity probe over ssh.
+function parseBorgSsh(repo: string): { user: string; host: string; remotePath: string } | null {
+  const m = repo.match(/^ssh:\/\/([^@]+)@([^/]+)\/(.+)$/)
+  if (!m) return null
+  return { user: m[1], host: m[2], remotePath: `/${m[3]}` }
+}
+
+function DestinationsSection({
+  destinations,
+  onChanged,
+}: {
+  destinations?: DestinationsResp
+  onChanged: () => void
+}) {
+  const [configuring, setConfiguring] = useState<boolean>(false)
+  const [editingDest, setEditingDest] = useState<EditingDest | null>(null)
+  const [confirmingDest, setConfirmingDest] = useState<UnifiedDest | null>(null)
+  const [busyKey, setBusyKey] = useState<string | null>(null)
+  const [error, setError] = useState<string | null>(null)
+
+  // Used by the Delete-destination confirm to tell the operator how
+  // many backups already live on this target (they're kept after the
+  // destination + jobs cascade, so the warning is informational).
+  const { data: localArchivesResp } = useSWR<{ archives: BackupArchive[] }>(
+    "/api/host-backups/archives",
+    fetcher,
+    { refreshInterval: 60_000, revalidateOnFocus: false },
+  )
+  const { data: remoteArchivesResp } = useSWR<RemoteArchivesResp>(
+    "/api/host-backups/remote-archives",
+    fetcher,
+    { refreshInterval: 60_000, revalidateOnFocus: false },
+  )
+  // Recovery state — only needed when at least one PBS destination
+  // exists. Drives the "Recover keyfile" banner and the "PBS encryption
+  // key" management block.
+  const hasPbs = (destinations?.pbs?.length ?? 0) > 0
+  const { data: pbsRecoveryStatus, mutate: mutatePbsRecovery } = useSWR<{
+    has_keyfile: boolean; has_recovery: boolean; has_keyfile_passphrase?: boolean; escrow_mode?: "none" | "local" | "full"; keyfile_fingerprint?: string
+  }>(hasPbs ? "/api/host-backups/pbs-recovery/status" : null, fetcher)
+  const { data: pbsRecoveryAvailable } = useSWR<{
+    snapshots: Array<{ repo_name: string; repo_repository: string; backup_id: string; source_host: string; backup_time: number; snapshot: string }>
+    errors: Array<{ repo_name: string; error: string }>
+  }>(
+    hasPbs && pbsRecoveryStatus && !pbsRecoveryStatus.has_keyfile
+      ? "/api/host-backups/pbs-recovery/available"
+      : null,
+    fetcher,
+  )
+  const [recoveringKeyfile, setRecoveringKeyfile] = useState<boolean>(false)
+  const backupsCountFor = (it: UnifiedDest): number => {
+    if (it.kind === "local") {
+      const root = it.path.replace(/\/+$/, "") + "/"
+      return (localArchivesResp?.archives || []).filter(
+        (a) => (a.path || "").startsWith(root),
+      ).length
+    }
+    const name = it.kind === "pbs" ? it.name : it.kind === "borg" ? it.name : ""
+    return (remoteArchivesResp?.snapshots || []).filter(
+      (s) => s.backend === it.kind && s.repo_name === name,
+    ).length
+  }
+
+  // Flatten PBS + Borg + Local into one list. Order: locals first
+  // (default always on top), then PBS, then Borg — matches the
+  // mental model of "what's already on this machine" before any
+  // remote target.
+  const items: UnifiedDest[] = (() => {
+    const out: UnifiedDest[] = []
+    for (const e of destinations?.local?.entries || []) {
+      out.push({
+        id: `local:${e.path}`,
+        kind: "local",
+        path: e.path,
+        source: e.source as "default" | "custom",
+        removable: e.removable,
+        jobsUsing: e.jobs_using || [],
+      })
+    }
+    for (const r of destinations?.pbs || []) {
+      out.push({
+        id: `pbs:${r.name}:${r.repository}`,
+        kind: "pbs",
+        name: r.name,
+        repository: r.repository,
+        source: r.source as "proxmox" | "manual",
+        fingerprint: r.fingerprint || undefined,
+        removable: r.source === "manual",
+        jobsUsing: r.jobs_using || [],
+      })
+    }
+    for (const r of destinations?.borg || []) {
+      const ssh = parseBorgSsh(r.repository)
+      out.push({
+        id: `borg:${r.name}`,
+        kind: "borg",
+        name: r.name,
+        repository: r.repository,
+        isSsh: !!ssh,
+        ssh: ssh ?? undefined,
+        sshKeyPath: (r as { ssh_key_path?: string }).ssh_key_path,
+        encryptMode: r.encrypt_mode,
+        hasPassphrase: r.has_passphrase,
+        removable: true,
+        jobsUsing: r.jobs_using || [],
+      })
+    }
+    return out
+  })()
+
+  // Build the capacity-probe payload + key for SWR. The key includes
+  // every destination's id so SWR re-fetches when the list changes
+  // (add / remove). 30 s refresh keeps the bars roughly live without
+  // hammering ssh / pbs every render.
+  const capacityTargets = items.map((it) => {
+    if (it.kind === "local") return { id: it.id, kind: "local", path: it.path }
+    if (it.kind === "pbs") return { id: it.id, kind: "pbs", name: it.name, repository: it.repository }
+    if (it.isSsh && it.ssh) {
+      return {
+        id: it.id, kind: "borg-ssh",
+        host: it.ssh.host, user: it.ssh.user,
+        remote_path: it.ssh.remotePath,
+        key_path: it.sshKeyPath || "",
+      }
+    }
+    return { id: it.id, kind: "borg-local", path: it.repository }
+  })
+  const capacityKey = items.length
+    ? `/api/host-backups/destinations/capacity?keys=${items.map((i) => i.id).join(",")}`
+    : null
+  const { data: capacityResp } = useSWR<{ results: CapacityInfo[] }>(
+    capacityKey,
+    () =>
+      fetchApi("/api/host-backups/destinations/capacity", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ targets: capacityTargets }),
+      }),
+    { refreshInterval: 30_000, revalidateOnFocus: false },
+  )
+  const capByEdid = new Map<string, CapacityInfo>(
+    (capacityResp?.results || []).map((r) => [r.id, r] as const),
+  )
+
+  async function removePbs(name: string, force = false) {
+    setBusyKey(`pbs:${name}`)
+    setError(null)
+    try {
+      await fetchApi(`/api/host-backups/destinations/pbs/${encodeURIComponent(name)}${force ? "?force=true" : ""}`, { method: "DELETE" })
+      onChanged()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusyKey(null)
+    }
+  }
+  async function removeBorg(name: string, force = false) {
+    setBusyKey(`borg:${name}`)
+    setError(null)
+    try {
+      await fetchApi(`/api/host-backups/destinations/borg/${encodeURIComponent(name)}${force ? "?force=true" : ""}`, { method: "DELETE" })
+      onChanged()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusyKey(null)
+    }
+  }
+  async function removeLocal(path: string, force = false) {
+    setBusyKey(`local:${path}`)
+    setError(null)
+    try {
+      const params = new URLSearchParams({ path })
+      if (force) params.set("force", "true")
+      await fetchApi(
+        `/api/host-backups/destinations/local?${params.toString()}`,
+        { method: "DELETE" },
+      )
+      onChanged()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusyKey(null)
+    }
+  }
+  async function confirmDeleteDest() {
+    const it = confirmingDest
+    if (!it) return
+    const force = it.jobsUsing.length > 0
+    setConfirmingDest(null)
+    if (it.kind === "pbs") return removePbs(it.name, force)
+    if (it.kind === "borg") return removeBorg(it.name, force)
+    if (it.kind === "local") return removeLocal(it.path, force)
+  }
+  // Detach a USB drive — only the filesystem is unmounted; the path
+  // stays in local-target.conf so re-plugging the same disk picks it
+  // up again without re-adding the destination.
+  async function unmountUsb(mountpoint: string) {
+    setBusyKey(`umount:${mountpoint}`)
+    setError(null)
+    try {
+      await fetchApi("/api/host-backups/usb-drives/unmount", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ mountpoint }),
+      })
+      onChanged()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusyKey(null)
+    }
+  }
+
+  return (
+    <div className="space-y-3">
+      <div className="flex justify-end">
+        <Button
+          size="sm"
+          className="h-8 px-3 bg-blue-500 hover:bg-blue-600 text-white"
+          onClick={() => setConfiguring(true)}
+        >
+          <Plus className="h-4 w-4 mr-1" />
+          Configure destination
+        </Button>
+      </div>
+      {error && (
+        <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+          {error}
+        </div>
+      )}
+      {/* Recovery banner: only when there's no local keyfile AND at
+          least one escrow blob was found on a configured PBS. Click
+          opens a passphrase dialog and the keyfile is rebuilt from
+          the blob. Equivalent to hb_pbs_try_keyfile_recovery in the
+          shell — what runs after a fresh PVE install when the
+          operator points the new host at the same PBS. */}
+      {hasPbs && pbsRecoveryStatus && !pbsRecoveryStatus.has_keyfile && (pbsRecoveryAvailable?.snapshots?.length ?? 0) > 0 && (
+        <button
+          type="button"
+          onClick={() => setRecoveringKeyfile(true)}
+          className="w-full flex items-start gap-2 px-3 py-2.5 rounded-md border border-emerald-500/40 bg-emerald-500/5 hover:bg-emerald-500/10 transition-colors text-left"
+          title="A recovery copy of the PBS keyfile was found on this PBS server"
+        >
+          <Lock className="h-4 w-4 mt-0.5 text-emerald-400 shrink-0" />
+          <div className="min-w-0 flex-1">
+            <div className="text-sm font-medium text-foreground">
+              PBS keyfile is missing — recover it from PBS
+            </div>
+            <div className="text-[11px] text-muted-foreground mt-0.5">
+              An encrypted recovery copy of the keyfile is available ({pbsRecoveryAvailable!.snapshots.length} backup{pbsRecoveryAvailable!.snapshots.length === 1 ? "" : "s"}). Click to rebuild the keyfile using your recovery passphrase.
+            </div>
+          </div>
+          <span className="text-xs text-emerald-300 shrink-0 self-center">Recover →</span>
+        </button>
+      )}
+
+      <div className="space-y-2">
+        {items.map((it) => {
+          const cap = capByEdid.get(it.id)
+          const busy = busyKey === it.id ||
+            (it.kind === "pbs" && busyKey === `pbs:${it.name}`) ||
+            (it.kind === "borg" && busyKey === `borg:${it.name}`) ||
+            (it.kind === "local" && busyKey === `local:${it.path}`)
+          // Borg local-mode repos sit on top of a path — the same
+          // /mnt/proxmenux-backup-disk-* USB mountpoint a Local target
+          // would use. Expose Unmount for them too so the operator
+          // doesn't have to remember which destination type is on the
+          // disk they want to detach.
+          const borgLocalUsbPath = it.kind === "borg" && !it.isSsh && cap?.is_usb
+            ? it.repository
+            : null
+          const umountTarget = it.kind === "local" ? it.path : borgLocalUsbPath
+          const unmountBusy = !!umountTarget && busyKey === `umount:${umountTarget}`
+          return (
+            <DestinationRow
+              key={it.id}
+              item={it}
+              capacity={cap}
+              busy={busy}
+              unmountBusy={unmountBusy}
+              onDelete={() => setConfirmingDest(it)}
+              onUnmount={
+                umountTarget && cap?.is_usb
+                  ? () => unmountUsb(umountTarget)
+                  : undefined
+              }
+              onEdit={
+                // Only PBS-manual and Borg are editable from the UI.
+                // PBS-proxmox is managed by Datacenter → Storage and
+                // local destinations have no fields beyond the path.
+                it.kind === "pbs" && it.source === "manual"
+                  ? () => {
+                      const [user, rest] = it.repository.includes("@")
+                        ? [it.repository.split("@").slice(0, -1).join("@"), it.repository.split("@").pop() || ""]
+                        : ["root@pam", it.repository]
+                      const [server, datastore] = rest.includes(":")
+                        ? [rest.split(":").slice(0, -1).join(":"), rest.split(":").pop() || ""]
+                        : [rest, ""]
+                      setEditingDest({
+                        kind: "pbs",
+                        name: it.name,
+                        username: user,
+                        server,
+                        datastore,
+                        fingerprint: it.fingerprint,
+                        has_password: true,
+                      })
+                    }
+                  : it.kind === "borg"
+                    ? () => setEditingDest({
+                        kind: "borg",
+                        name: it.name,
+                        repository: it.repository,
+                        ssh_key_path: it.sshKeyPath,
+                        encrypt_mode: (destinations?.borg?.find((b) => b.name === it.name)?.encrypt_mode) || "repokey",
+                        has_passphrase: !!destinations?.borg?.find((b) => b.name === it.name)?.has_passphrase,
+                      })
+                    : undefined
+              }
+            />
+          )
+        })}
+      </div>
+      <ConfigureDestinationWizard
+        open={configuring}
+        onClose={() => setConfiguring(false)}
+        onSaved={() => {
+          setConfiguring(false)
+          onChanged()
+        }}
+      />
+      {/* Edit-an-existing-destination dialog. Uses the same form as
+          Add, just hydrated with the saved values and with `name`
+          locked. The POST endpoint is upsert-by-name on the backend
+          so no separate route is needed. */}
+      <AddDestinationDialog
+        type={editingDest?.kind ?? null}
+        editing={editingDest}
+        onClose={() => setEditingDest(null)}
+        onSaved={() => {
+          setEditingDest(null)
+          onChanged()
+        }}
+      />
+      <PbsKeyfileRecoveryDialog
+        open={recoveringKeyfile}
+        snapshots={pbsRecoveryAvailable?.snapshots || []}
+        onClose={() => setRecoveringKeyfile(false)}
+        onRecovered={() => {
+          setRecoveringKeyfile(false)
+          mutatePbsRecovery()
+        }}
+      />
+      {/* Delete-destination confirm. Always opens (uniform UX) but
+          the body adapts: a plain "Remove?" when no jobs/backups
+          depend on the destination, or a warning summarizing the
+          cascade (jobs go, backups stay) when there's something at
+          stake. The destination + its sidecars are removed; backups
+          on disk / on the remote stay untouched so the operator can
+          decide what to do with them later. */}
+      {confirmingDest && (() => {
+        const it = confirmingDest
+        const jobs = it.jobsUsing
+        const backups = backupsCountFor(it)
+        const headline =
+          it.kind === "local" ? it.path
+          : it.kind === "pbs" ? `${it.name} — ${it.repository}`
+          : `${it.name} — ${it.repository}`
+        return (
+          <Dialog open={true} onOpenChange={(v) => { if (!v) setConfirmingDest(null) }}>
+            <DialogContent className="max-w-md bg-card border-border">
+              <DialogHeader>
+                <DialogTitle className="text-base flex items-center gap-2">
+                  <AlertTriangle className={`h-5 w-5 ${jobs.length > 0 ? "text-amber-500" : "text-red-500"}`} />
+                  Remove destination
+                </DialogTitle>
+                <DialogDescription className="text-xs">
+                  {jobs.length === 0 && backups === 0
+                    ? "Removes the destination from the list. Nothing else depends on it."
+                    : "The destination + its saved credentials will be removed. Backups already stored stay where they are — you decide what to do with them later."}
+                </DialogDescription>
+              </DialogHeader>
+              <div className="text-sm font-mono px-3 py-2 rounded-md border border-border bg-background/40 break-all">
+                {headline}
+              </div>
+              {(jobs.length > 0 || backups > 0) && (
+                <div className="text-xs space-y-1.5 text-foreground">
+                  {jobs.length > 0 && (
+                    <div className="px-3 py-2 rounded-md border border-amber-500/40 bg-amber-500/5">
+                      <div className="font-medium text-amber-400">
+                        {jobs.length} job{jobs.length === 1 ? "" : "s"} will be deleted (cascade):
+                      </div>
+                      <div className="mt-1 flex flex-wrap gap-1">
+                        {jobs.map((j) => (
+                          <span key={j} className="font-mono text-[11px] px-1.5 py-0.5 rounded bg-background/60 border border-border">
+                            {j}
+                          </span>
+                        ))}
+                      </div>
+                    </div>
+                  )}
+                  {backups > 0 && (
+                    <div className="px-3 py-2 rounded-md border border-blue-500/40 bg-blue-500/5">
+                      <span className="font-medium text-blue-400">{backups}</span> backup{backups === 1 ? "" : "s"} already at this destination — they are <span className="font-medium">kept</span>.
+                    </div>
+                  )}
+                </div>
+              )}
+              <div className="flex justify-end gap-2">
+                <Button variant="ghost" onClick={() => setConfirmingDest(null)}>
+                  Cancel
+                </Button>
+                <Button variant="destructive" onClick={confirmDeleteDest}>
+                  <Trash2 className="h-4 w-4 mr-2" />
+                  {jobs.length > 0 ? "Remove + delete jobs" : "Remove destination"}
+                </Button>
+              </div>
+            </DialogContent>
+          </Dialog>
+        )
+      })()}
+    </div>
+  )
+}
+
+// Single row in the unified destinations list. Layout mirrors the
+// disk-card chrome from storage-overview.tsx: icon + headline + all
+// badges + actions on ONE top row, capacity bar in storage-page blue,
+// stats grid below. No hover effect — these rows are inert (no modal
+// behind them), so the contrast change would only confuse the eye.
+function DestinationRow({
+  item,
+  capacity,
+  busy,
+  unmountBusy,
+  onDelete,
+  onUnmount,
+  onEdit,
+}: {
+  item: UnifiedDest
+  capacity?: CapacityInfo
+  busy: boolean
+  unmountBusy: boolean
+  onDelete: () => void
+  onUnmount?: () => void
+  onEdit?: () => void
+}) {
+  const accent =
+    item.kind === "pbs" ? "bg-purple-500/10 text-purple-400 border-purple-500/20"
+    : item.kind === "borg" ? "bg-fuchsia-500/10 text-fuchsia-400 border-fuchsia-500/20"
+    : "bg-blue-500/10 text-blue-400 border-blue-500/20"
+  const iconColor =
+    item.kind === "pbs" ? "text-purple-400"
+    : item.kind === "borg" ? "text-fuchsia-400"
+    : "text-blue-400"
+  const Icon = item.kind === "pbs" ? Server : item.kind === "borg" ? Archive : HardDrive
+  const headline =
+    item.kind === "pbs" ? item.name
+    : item.kind === "borg" ? item.name
+    : item.path
+  const subline =
+    item.kind === "pbs" ? item.repository
+    : item.kind === "borg" ? item.repository
+    : null
+  const isUsb = !!capacity?.is_usb || (item.kind === "borg" && !item.isSsh && /\/(?:mnt|media)\//.test(item.repository))
+  const sourceLabel =
+    item.kind === "local" ? (item.source === "default" ? "built-in default" : "manually added")
+    : item.kind === "pbs" ? (item.source === "proxmox" ? "Datacenter → Storage" : "manually added")
+    // Borg targets are always operator-configured (no Datacenter
+    // auto-discovery path), so they all share the "manually added"
+    // wording for visual consistency with the Local custom row.
+    : "manually added"
+
+  const pct = capacity?.total && capacity.available !== undefined
+    ? Math.min(100, Math.round(((capacity.total - capacity.available) / capacity.total) * 100))
+    : null
+
+  return (
+    <div className="rounded-lg border border-white/10 bg-card p-4">
+      {/* Top row split in two: a wrappable left side (icon + headline +
+          badges) and a fixed right side (Unmount + Remove). The right
+          side never falls to a new line even if `headline` is long,
+          because the outer container is a non-wrapping flex. */}
+      <div className="space-y-2 mb-3">
+        <div className="flex items-start gap-2">
+          <div className="min-w-0 flex-1 flex items-start gap-2 flex-wrap">
+            <Icon className={`h-5 w-5 flex-shrink-0 ${iconColor} mt-0.5`} />
+            <h3 className="font-mono font-semibold text-sm break-all">{headline}</h3>
+            <Badge variant="outline" className={`text-[10px] uppercase tracking-wide ${accent}`}>
+              {item.kind}
+            </Badge>
+          {item.kind === "local" && item.source === "default" && (
+            <Badge variant="outline" className="text-[10px] uppercase tracking-wide border-border text-muted-foreground">
+              default
+            </Badge>
+          )}
+          {item.kind === "borg" ? (
+            // For Borg the sub-type is one of three (mutually exclusive):
+            //   ssh    → remote repo
+            //   usb    → local repo whose path lives on a USB mount
+            //   local  → local repo on an internal disk / regular dir
+            // Previously we showed BORG + LOCAL + USB which read like
+            // three orthogonal facets and confused the badge with the
+            // Local destination kind. Collapsing to a single sub-type
+            // badge avoids the overlap.
+            <>
+              {item.isSsh ? (
+                <Badge variant="outline" className="text-[10px] uppercase tracking-wide border-cyan-500/40 text-cyan-400 bg-cyan-500/5">
+                  ssh
+                </Badge>
+              ) : isUsb ? (
+                <Badge variant="outline" className="text-[10px] uppercase tracking-wide border-orange-500/40 text-orange-400 bg-orange-500/5 gap-1">
+                  <HardDrive className="h-2.5 w-2.5" />
+                  USB
+                </Badge>
+              ) : (
+                <Badge variant="outline" className="text-[10px] uppercase tracking-wide border-amber-500/40 text-amber-400 bg-amber-500/5">
+                  local
+                </Badge>
+              )}
+              {/* Encryption indicator — icon-only chip for encrypted
+                  repos. Plaintext repos get no chip (visually quiet
+                  for the common case). The tooltip carries the mode +
+                  saved-passphrase state for hover detail. */}
+              {item.encryptMode && item.encryptMode !== "none" && (
+                <Badge
+                  variant="outline"
+                  className="text-[10px] uppercase tracking-wide border-emerald-500/40 text-emerald-400 bg-emerald-500/5"
+                  title={`Encrypted (${item.encryptMode})${item.hasPassphrase ? " · passphrase saved" : " · passphrase NOT saved"}`}
+                >
+                  {/* Icon sized to roughly the text-[10px] line-box of
+                      the neighbouring text badges (BORG, USB, …) so the
+                      pill itself ends up the same height — matching
+                      visual weight without adding a label. */}
+                  <Lock className="h-3.5 w-3.5" />
+                </Badge>
+              )}
+            </>
+          ) : isUsb && (
+            // PBS / Local destinations: USB badge is additive (the kind
+            // badge alone doesn't say where the path lives).
+            <Badge variant="outline" className="text-[10px] uppercase tracking-wide border-orange-500/40 text-orange-400 bg-orange-500/5 gap-1">
+              <HardDrive className="h-2.5 w-2.5" />
+              USB
+            </Badge>
+          )}
+          </div>
+          {/* Action chips — always pinned to the right, never wrap.
+              The outer flex container has no flex-wrap so even a very
+              long headline keeps these two buttons in place. Chip
+              style (square border + tinted bg) makes them read as
+              actionable rather than decorative icons. */}
+          <div className="shrink-0 flex items-start gap-1.5">
+            {onEdit && (
+              <button
+                type="button"
+                disabled={busy || unmountBusy}
+                onClick={onEdit}
+                title="Edit destination — update credentials, encryption, repository path"
+                className="inline-flex items-center justify-center h-7 w-7 rounded-md border border-emerald-500/40 bg-emerald-500/10 text-emerald-400 hover:bg-emerald-500/20 hover:text-emerald-300 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+              >
+                <Pencil className="h-3.5 w-3.5" />
+              </button>
+            )}
+            {onUnmount && (
+              <button
+                type="button"
+                disabled={unmountBusy || busy}
+                onClick={onUnmount}
+                title="Unmount — detach the USB filesystem only. The destination stays in the list so re-plugging the disk picks it up again."
+                className="inline-flex items-center justify-center h-7 w-7 rounded-md border border-amber-500/40 bg-amber-500/10 text-amber-400 hover:bg-amber-500/20 hover:text-amber-300 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+              >
+                {unmountBusy ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <Power className="h-3.5 w-3.5" />}
+              </button>
+            )}
+            {item.removable ? (
+              <button
+                type="button"
+                disabled={busy || unmountBusy}
+                onClick={onDelete}
+                title="Remove from the destinations list — the filesystem on disk is left untouched"
+                className="inline-flex items-center justify-center h-7 w-7 rounded-md border border-red-500/40 bg-red-500/10 text-red-400 hover:bg-red-500/20 hover:text-red-300 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+              >
+                {busy ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <Trash2 className="h-3.5 w-3.5" />}
+              </button>
+            ) : (
+              <span className="text-[10px] text-muted-foreground italic self-center px-2 whitespace-nowrap">
+                {item.kind === "local" ? "built-in" : "managed by PVE"}
+              </span>
+            )}
+          </div>
+        </div>
+        {subline && (
+          <p className="text-xs font-mono text-muted-foreground break-all pl-7" title={subline}>
+            {subline}
+          </p>
+        )}
+      </div>
+
+      {/* Capacity bar — matches the height of the <Progress> component
+          used on the Storage page (h-2). Bar colour comes from the
+          shared storage palette so a 100% PBS datastore flags red
+          here too, not just on the Storage page. */}
+      {capacity?.total && capacity.available !== undefined && (
+        <div className="mb-3 h-2 bg-muted rounded-full overflow-hidden">
+          <div
+            className={`h-full rounded-full ${getStorageUsageColor(pct ?? 0).bgClass}`}
+            style={{ width: `${pct}%` }}
+          />
+        </div>
+      )}
+
+      {/* Stats grid */}
+      <div className="grid grid-cols-2 md:grid-cols-4 gap-4 text-sm">
+        {capacity?.total !== undefined && (
+          <div>
+            <p className="text-sm text-muted-foreground">Size</p>
+            <p className="font-medium">{formatBytes(capacity.total)}</p>
+          </div>
+        )}
+        {capacity?.used !== undefined && capacity.total !== undefined && (
+          <div>
+            <p className="text-sm text-muted-foreground">Used</p>
+            <p className="font-medium">
+              {formatBytes(capacity.used)}
+              {pct !== null && <span className="text-muted-foreground"> ({pct}%)</span>}
+            </p>
+          </div>
+        )}
+        {capacity?.available !== undefined && (
+          <div>
+            <p className="text-sm text-muted-foreground">Free</p>
+            <p
+              className={`font-medium ${
+                pct === null ? "" : getStorageUsageColor(pct).textClass
+              }`}
+            >
+              {formatBytes(capacity.available)}
+            </p>
+          </div>
+        )}
+        <div>
+          <p className="text-sm text-muted-foreground">Source</p>
+          <p className="font-medium text-xs">{sourceLabel}</p>
+        </div>
+      </div>
+
+      {capacity?.error && (
+        <p className="mt-3 text-[11px] text-muted-foreground italic">
+          Capacity unavailable: {capacity.error}
+        </p>
+      )}
+      {!capacity && (
+        <p className="mt-3 text-[11px] text-muted-foreground italic flex items-center gap-1.5">
+          <Loader2 className="h-3 w-3 animate-spin" /> Probing capacity…
+        </p>
+      )}
+      {/* Keyfile actions live inside each PBS row — the encryption key
+          is host-wide but conceptually belongs to PBS usage, so the
+          Download / Upload / Delete controls sit next to the
+          destination(s) they support. */}
+      {item.kind === "pbs" && <PbsKeyfileActions pbsRepository={item.repository} />}
+    </div>
+  )
+}
+
+// Single-button wizard that replaces the old per-backend Add buttons.
+// Step 1 lets the operator pick the backend; Step 2 hands off to the
+// existing AddDestinationDialog with that backend pre-selected, so we
+// don't duplicate the per-backend forms.
+function ConfigureDestinationWizard({
+  open,
+  onClose,
+  onSaved,
+}: {
+  open: boolean
+  onClose: () => void
+  onSaved: () => void
+}) {
+  const [picked, setPicked] = useState<"pbs" | "local" | "borg" | null>(null)
+  useEffect(() => {
+    if (!open) setPicked(null)
+  }, [open])
+
+  if (picked) {
+    // Hand off to the existing form. Closing or saving collapses the
+    // whole wizard so the operator lands back in the destinations list.
+    return (
+      <AddDestinationDialog
+        type={picked}
+        onClose={() => { setPicked(null); onClose() }}
+        onSaved={() => { setPicked(null); onSaved() }}
+      />
+    )
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => { if (!v) onClose() }}>
+      <DialogContent className="max-w-2xl bg-card border-border">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <Plus className="h-5 w-5 text-blue-500" />
+            Configure destination
+          </DialogTitle>
+          <DialogDescription className="text-xs">
+            Pick the backend you want to add. The next step has the credentials and path fields for that backend only.
+          </DialogDescription>
+        </DialogHeader>
+        <div className="grid grid-cols-1 sm:grid-cols-3 gap-3">
+          {([
+            { type: "pbs",   label: "PBS",   accent: "border-purple-500/40 hover:border-purple-400 text-purple-400",   blurb: "Proxmox Backup Server. Incremental, encrypted, dedup." },
+            { type: "local", label: "Local", accent: "border-blue-500/40 hover:border-blue-400 text-blue-400",         blurb: "tar.zst archive into a local directory or mounted disk." },
+            { type: "borg",  label: "Borg",  accent: "border-fuchsia-500/40 hover:border-fuchsia-400 text-fuchsia-400", blurb: "Borg repo over SSH or on a local / USB disk." },
+          ] as const).map((opt) => (
+            <button
+              key={opt.type}
+              type="button"
+              onClick={() => setPicked(opt.type)}
+              className={`text-left rounded-lg border-2 p-4 transition-colors bg-background/40 hover:bg-white/5 ${opt.accent}`}
+            >
+              <div className="flex items-center gap-2 mb-1">
+                {opt.type === "pbs" ? <Server className="h-4 w-4" /> :
+                 opt.type === "local" ? <HardDrive className="h-4 w-4" /> :
+                 <Archive className="h-4 w-4" />}
+                <span className="font-semibold uppercase">{opt.label}</span>
+              </div>
+              <p className="text-xs text-muted-foreground">{opt.blurb}</p>
+            </button>
+          ))}
+        </div>
+        <div className="flex justify-end">
+          <Button variant="ghost" onClick={onClose}>Cancel</Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+// One dialog handles all three Add flows — the form is small enough
+// that branching by type keeps it cleaner than three separate components.
+// Pre-fill payload for editing an existing destination. `name` stays
+// fixed (it's the key the sidecar / state files are scoped to);
+// everything else can be re-typed. PBS password and Borg passphrase
+// can be left blank to keep the saved one.
+interface EditingDest {
+  kind: "pbs" | "borg"
+  name: string
+  // PBS fields
+  server?: string
+  datastore?: string
+  username?: string
+  fingerprint?: string
+  has_password?: boolean
+  // Borg fields
+  repository?: string
+  ssh_key_path?: string
+  encrypt_mode?: "none" | "repokey" | "keyfile" | "authenticated"
+  has_passphrase?: boolean
+}
+
+function AddDestinationDialog({
+  type,
+  editing,
+  onClose,
+  onSaved,
+}: {
+  type: "pbs" | "borg" | "local" | null
+  editing?: EditingDest | null
+  onClose: () => void
+  // The repository string of the just-saved destination, so callers
+  // can auto-select it in a dropdown (the wizard does this when an
+  // operator adds a PBS / Borg repo inline). Undefined for `local`
+  // and for the legacy callers that don't care.
+  onSaved: (repository?: string) => void
+}) {
+  const [name, setName] = useState("")
+  // PBS fields
+  const [server, setServer] = useState("")
+  const [datastore, setDatastore] = useState("")
+  const [username, setUsername] = useState("root@pam")
+  const [password, setPassword] = useState("")
+  const [fingerprint, setFingerprint] = useState("")
+  // Borg fields (local mode)
+  const [borgRepo, setBorgRepo] = useState("")
+  // Borg SSH mode
+  const [borgMode, setBorgMode] = useState<"local" | "ssh">("local")
+  const [borgSshUser, setBorgSshUser] = useState("borg")
+  const [borgSshHost, setBorgSshHost] = useState("")
+  const [borgSshRemotePath, setBorgSshRemotePath] = useState("")
+  const [borgSshKeyPath, setBorgSshKeyPath] = useState("/root/.ssh/proxmenux_borg")
+  const [generatedKey, setGeneratedKey] = useState<{ public_key: string; authorized_keys_line: string } | null>(null)
+  const [generatingKey, setGeneratingKey] = useState(false)
+  // Borg encryption + passphrase live on the destination, not on each
+  // job. Two-mode UI: encrypted (repokey, the default) or none. Other
+  // borg modes (keyfile / authenticated) stay supported by the backend
+  // for legacy shell-created configs.
+  const [borgEncryptionEnabled, setBorgEncryptionEnabled] = useState(true)
+  const [borgPassphrase, setBorgPassphraseLocal] = useState("")
+  const [borgPassphrase2, setBorgPassphrase2] = useState("")
+  // Local field
+  const [localPath, setLocalPath] = useState("")
+
+  const [submitting, setSubmitting] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  // Read the current destinations so the UsbPicker can hide any USB
+  // mountpoint already in use as a Local or Borg-local destination —
+  // no point offering the same disk twice.
+  const { data: existingDest } = useSWR<DestinationsResp>(
+    type !== null ? "/api/host-backups/destinations" : null,
+    fetcher,
+  )
+  const usedPaths: string[] = (() => {
+    const out: string[] = []
+    for (const e of existingDest?.local?.entries || []) {
+      if (e.source === "custom") out.push(e.path)
+    }
+    for (const r of existingDest?.borg || []) {
+      // Borg local-mode: the `repository` IS the path. SSH repos
+      // start with `ssh://` and are excluded automatically.
+      if (!r.repository.startsWith("ssh://")) out.push(r.repository)
+    }
+    return out
+  })()
+
+  // Reset every time the dialog OPENS — not just on close. If we're
+  // opening in edit mode, hydrate the form from the saved destination
+  // so the operator only has to change what they want. Name stays
+  // read-only in edit mode (it's the key for sidecars / state files).
+  useEffect(() => {
+    setError(null)
+    setSubmitting(false)
+    setGeneratedKey(null)
+    setGeneratingKey(false)
+    setPassword("")
+    setBorgPassphraseLocal("")
+    setBorgPassphrase2("")
+    if (editing && editing.kind === "pbs") {
+      setName(editing.name)
+      setServer(editing.server || "")
+      setDatastore(editing.datastore || "")
+      setUsername(editing.username || "root@pam")
+      setFingerprint(editing.fingerprint || "")
+      setBorgRepo(""); setBorgMode("local"); setBorgSshUser("borg")
+      setBorgSshHost(""); setBorgSshRemotePath("")
+      setBorgSshKeyPath("/root/.ssh/proxmenux_borg")
+      setBorgEncryptionEnabled(true); setLocalPath("")
+      return
+    }
+    if (editing && editing.kind === "borg") {
+      const repo = editing.repository || ""
+      const ssh = repo.match(/^ssh:\/\/([^@]+)@([^/]+)\/(.+)$/)
+      setName(editing.name)
+      if (ssh) {
+        setBorgMode("ssh")
+        setBorgSshUser(ssh[1])
+        setBorgSshHost(ssh[2])
+        setBorgSshRemotePath(`/${ssh[3]}`)
+        setBorgSshKeyPath(editing.ssh_key_path || "/root/.ssh/proxmenux_borg")
+        setBorgRepo("")
+      } else {
+        setBorgMode("local")
+        setBorgRepo(repo)
+        setBorgSshUser("borg"); setBorgSshHost(""); setBorgSshRemotePath("")
+        setBorgSshKeyPath("/root/.ssh/proxmenux_borg")
+      }
+      const mode = editing.encrypt_mode || "repokey"
+      setBorgEncryptionEnabled(mode !== "none")
+      setServer(""); setDatastore(""); setUsername("root@pam"); setFingerprint("")
+      setLocalPath("")
+      return
+    }
+    // Add-new path: full reset.
+    setName("")
+    setServer("")
+    setDatastore("")
+    setUsername("root@pam")
+    setFingerprint("")
+    setBorgRepo("")
+    setBorgMode("local")
+    setBorgSshUser("borg")
+    setBorgSshHost("")
+    setBorgSshRemotePath("")
+    setBorgSshKeyPath("/root/.ssh/proxmenux_borg")
+    setBorgEncryptionEnabled(true)
+    setLocalPath("")
+  }, [type, editing])
+
+  const isEditing = !!editing
+  const nameValid = /^[a-zA-Z0-9_-]+$/.test(name)
+  const borgPathValid =
+    borgMode === "local"
+      ? !!borgRepo.trim()
+      : !!(borgSshUser.trim() && borgSshHost.trim() && borgSshRemotePath.trim())
+  // In edit mode the saved passphrase / password is reused when the
+  // operator leaves the inputs blank, so validation relaxes.
+  const borgPassphraseValid =
+    !borgEncryptionEnabled
+    || (isEditing && !borgPassphrase && editing?.has_passphrase)
+    || (borgPassphrase.length > 0 && borgPassphrase === borgPassphrase2)
+  const borgValid = borgPathValid && borgPassphraseValid
+  const canSubmit =
+    type === "pbs"
+      ? nameValid && server.trim() && datastore.trim() &&
+          (!!password || (isEditing && !!editing?.has_password))
+      : type === "borg"
+        ? nameValid && borgValid
+        : type === "local"
+          ? localPath.trim().startsWith("/")
+          : false
+
+  async function generateBorgKey() {
+    setGeneratingKey(true)
+    setError(null)
+    try {
+      const resp = await fetchApi<{ public_key: string; authorized_keys_line: string }>(
+        "/api/host-backups/ssh-keys/generate",
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            key_path: borgSshKeyPath.trim() || "/root/.ssh/proxmenux_borg",
+            remote_path: borgSshRemotePath.trim(),
+          }),
+        }
+      )
+      setGeneratedKey(resp)
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setGeneratingKey(false)
+    }
+  }
+
+  async function handleSave() {
+    if (!canSubmit) return
+    setSubmitting(true)
+    setError(null)
+    try {
+      let savedRepo: string | undefined
+      if (type === "pbs") {
+        const resp = await fetchApi<{ repository?: string }>("/api/host-backups/destinations/pbs", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            name,
+            server: server.trim(),
+            datastore: datastore.trim(),
+            username: username.trim() || "root@pam",
+            password,
+            fingerprint: fingerprint.trim() || undefined,
+          }),
+        })
+        savedRepo = resp?.repository
+      } else if (type === "borg") {
+        const body: Record<string, unknown> = {
+          name,
+          mode: borgMode,
+          encrypt_mode: borgEncryptionEnabled ? "repokey" : "none",
+        }
+        if (borgEncryptionEnabled) {
+          body.passphrase = borgPassphrase
+        }
+        if (borgMode === "local") {
+          body.repo = borgRepo.trim()
+        } else {
+          body.ssh_user = borgSshUser.trim()
+          body.ssh_host = borgSshHost.trim()
+          body.ssh_remote_path = borgSshRemotePath.trim()
+          if (borgSshKeyPath.trim()) body.ssh_key_path = borgSshKeyPath.trim()
+        }
+        const resp = await fetchApi<{ repo?: string }>("/api/host-backups/destinations/borg", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(body),
+        })
+        savedRepo = resp?.repo
+      } else if (type === "local") {
+        await fetchApi("/api/host-backups/destinations/local", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ path: localPath.trim() }),
+        })
+      }
+      onSaved(savedRepo)
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  return (
+    <Dialog open={type !== null} onOpenChange={(v) => { if (!v) onClose() }}>
+      <DialogContent className="max-w-lg max-h-[85vh] flex flex-col">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            {isEditing ? (
+              <Pencil className="h-5 w-5 text-emerald-400" />
+            ) : (
+              <Plus className="h-5 w-5 text-blue-500" />
+            )}
+            {isEditing ? "Edit" : "Add"} {type === "pbs" ? "PBS" : type === "borg" ? "Borg" : "local"} destination
+          </DialogTitle>
+        </DialogHeader>
+        <div className="overflow-y-auto -mr-2 pr-2 space-y-3">
+          {type === "pbs" && (
+            <>
+              <div>
+                <Label htmlFor="pbsName">Name</Label>
+                <Input id="pbsName" value={name} onChange={(e) => setName(e.target.value)} className="font-mono mt-1" placeholder="my-pbs" disabled={isEditing} />
+                <p className="text-xs text-muted-foreground mt-1">
+                  {isEditing ? "Name is the key for saved credentials and can't be changed." : "A short identifier. Letters, digits, _ or -."}
+                </p>
+              </div>
+              <div>
+                <Label htmlFor="pbsServer">Server (host or IP)</Label>
+                <Input id="pbsServer" value={server} onChange={(e) => setServer(e.target.value)} className="font-mono mt-1" placeholder="192.168.1.10" />
+              </div>
+              <div>
+                <Label htmlFor="pbsDatastore">Datastore</Label>
+                <Input id="pbsDatastore" value={datastore} onChange={(e) => setDatastore(e.target.value)} className="font-mono mt-1" placeholder="pbs" />
+              </div>
+              <div>
+                <Label htmlFor="pbsUser">Username</Label>
+                <Input id="pbsUser" value={username} onChange={(e) => setUsername(e.target.value)} className="font-mono mt-1" />
+                <p className="text-xs text-muted-foreground mt-1">User that runs <code className="font-mono">proxmox-backup-client</code>. Default <code className="font-mono">root@pam</code>.</p>
+              </div>
+              <div>
+                <Label htmlFor="pbsPass">Password</Label>
+                <Input
+                  id="pbsPass"
+                  type="password"
+                  value={password}
+                  onChange={(e) => setPassword(e.target.value)}
+                  className="font-mono mt-1"
+                  placeholder={isEditing && editing?.has_password ? "(unchanged — type to replace)" : ""}
+                />
+                {isEditing && editing?.has_password && (
+                  <p className="text-xs text-muted-foreground mt-1">Leave blank to keep the saved password.</p>
+                )}
+              </div>
+              <div>
+                <Label htmlFor="pbsFp">Fingerprint (optional)</Label>
+                <Input id="pbsFp" value={fingerprint} onChange={(e) => setFingerprint(e.target.value)} className="font-mono mt-1" placeholder="aa:bb:cc:…" />
+                <p className="text-xs text-muted-foreground mt-1">Required only if the PBS uses a self-signed certificate.</p>
+              </div>
+            </>
+          )}
+          {type === "borg" && (
+            <>
+              <div>
+                <Label htmlFor="borgName">Name</Label>
+                <Input id="borgName" value={name} onChange={(e) => setName(e.target.value)} className="font-mono mt-1" placeholder="usb-borg or remote-borg" disabled={isEditing} />
+                {isEditing && (
+                  <p className="text-xs text-muted-foreground mt-1">Name is the key for the saved passphrase and can't be changed.</p>
+                )}
+              </div>
+
+              <div>
+                <Label>Where is the Borg repository?</Label>
+                <div className="grid grid-cols-2 gap-2 mt-1">
+                  <button
+                    type="button"
+                    onClick={() => setBorgMode("local")}
+                    className={`text-left p-2.5 rounded-md border text-sm ${borgMode === "local" ? "border-blue-500 bg-blue-500/5" : "border-border bg-background/40"} hover:bg-white/5 transition-colors`}
+                  >
+                    <div className="font-medium flex items-center gap-1"><HardDrive className="h-3.5 w-3.5" /> Local / USB</div>
+                    <div className="text-[11px] text-muted-foreground mt-0.5">Path on this host (mounted USB, local dir).</div>
+                  </button>
+                  <button
+                    type="button"
+                    onClick={() => setBorgMode("ssh")}
+                    className={`text-left p-2.5 rounded-md border text-sm ${borgMode === "ssh" ? "border-blue-500 bg-blue-500/5" : "border-border bg-background/40"} hover:bg-white/5 transition-colors`}
+                  >
+                    <div className="font-medium flex items-center gap-1"><Server className="h-3.5 w-3.5" /> Remote (SSH)</div>
+                    <div className="text-[11px] text-muted-foreground mt-0.5">Borg repo on another host over SSH.</div>
+                  </button>
+                </div>
+              </div>
+
+              {borgMode === "local" ? (
+                <div className="space-y-3">
+                  <div>
+                    <Label htmlFor="borgRepoIn">Repository path</Label>
+                    <Input id="borgRepoIn" value={borgRepo} onChange={(e) => setBorgRepo(e.target.value)} className="font-mono mt-1" placeholder="/mnt/usb-disk/borgbackup" />
+                    <p className="text-xs text-muted-foreground mt-1">
+                      Absolute path on this host. Pick a USB drive below to auto-fill, or type the path manually.
+                    </p>
+                  </div>
+                  <UsbPicker onPick={(p) => setBorgRepo(p)} excludePaths={usedPaths} />
+                </div>
+              ) : (
+                <>
+                  <div>
+                    <Label htmlFor="borgSshUser">SSH user</Label>
+                    <Input id="borgSshUser" value={borgSshUser} onChange={(e) => setBorgSshUser(e.target.value)} className="font-mono mt-1" placeholder="borg" />
+                    <p className="text-xs text-muted-foreground mt-1">
+                      User on the remote host that runs <code className="font-mono">borg serve</code>. Conventionally <code className="font-mono">borg</code>, not <code className="font-mono">root</code>.
+                    </p>
+                  </div>
+                  <div>
+                    <Label htmlFor="borgSshHost">SSH host or IP</Label>
+                    <Input id="borgSshHost" value={borgSshHost} onChange={(e) => setBorgSshHost(e.target.value)} className="font-mono mt-1" placeholder="backup.example.com" />
+                  </div>
+                  <div>
+                    <Label htmlFor="borgSshPath">Remote repository path</Label>
+                    <Input id="borgSshPath" value={borgSshRemotePath} onChange={(e) => setBorgSshRemotePath(e.target.value)} className="font-mono mt-1" placeholder="/backup/borgbackup" />
+                  </div>
+                  <div>
+                    <Label htmlFor="borgKeyPath">SSH key path (on this host)</Label>
+                    <Input id="borgKeyPath" value={borgSshKeyPath} onChange={(e) => setBorgSshKeyPath(e.target.value)} className="font-mono mt-1" />
+                    <p className="text-xs text-muted-foreground mt-1">
+                      If you already have an SSH key registered with the server, point to it here.
+                      Otherwise click <span className="font-medium text-foreground">Generate key</span> below and paste the line shown into the server's authorized_keys.
+                    </p>
+                  </div>
+
+                  <div className="rounded-md border border-border bg-background/40 p-3 space-y-2">
+                    <div className="flex items-center justify-between gap-2">
+                      <span className="text-xs font-medium">Generate a new SSH key</span>
+                      <Button
+                        type="button"
+                        size="sm"
+                        variant="outline"
+                        className="h-7"
+                        disabled={generatingKey || !borgSshKeyPath.trim()}
+                        onClick={generateBorgKey}
+                      >
+                        {generatingKey ? <Loader2 className="h-3.5 w-3.5 animate-spin mr-1" /> : <Plus className="h-3.5 w-3.5 mr-1" />}
+                        {generatedKey ? "Regenerate" : "Generate key"}
+                      </Button>
+                    </div>
+                    {generatedKey ? (
+                      <>
+                        <p className="text-[11px] text-muted-foreground">
+                          On the Borg server, append this single line to <code className="font-mono">~{borgSshUser}/.ssh/authorized_keys</code>:
+                        </p>
+                        <textarea
+                          readOnly
+                          value={generatedKey.authorized_keys_line}
+                          className="w-full text-[11px] font-mono p-2 rounded border border-border bg-background h-24 resize-none"
+                          onFocus={(e) => e.currentTarget.select()}
+                        />
+                      </>
+                    ) : (
+                      <p className="text-[11px] text-muted-foreground">
+                        Creates an ed25519 key (no passphrase) at the path above if one isn't there already. The public half — restricted to <code className="font-mono">borg serve</code> for the remote path — will appear here for you to copy.
+                      </p>
+                    )}
+                  </div>
+                </>
+              )}
+
+              {/* Encryption + passphrase live on the destination, not on
+                  each job. Two-mode UI: encrypted (repokey, the borg
+                  recommended default) or none. The other borg modes
+                  (keyfile, authenticated) are still honored by the
+                  backend for legacy shell-created configs but not
+                  exposed here. */}
+              <div className="space-y-2 pt-2 border-t border-border">
+                <Label>Encryption</Label>
+                <div className="grid grid-cols-2 gap-2">
+                  <button
+                    type="button"
+                    onClick={() => setBorgEncryptionEnabled(true)}
+                    className={`text-left p-2.5 rounded-md border text-sm transition-colors ${borgEncryptionEnabled ? "border-fuchsia-500 bg-fuchsia-500/5" : "border-border bg-background/40 hover:bg-white/5"}`}
+                  >
+                    <div className="font-medium">Encrypted (repokey)</div>
+                    <div className="text-[11px] text-muted-foreground">AES-256 + HMAC. Passphrase required to read the repo.</div>
+                  </button>
+                  <button
+                    type="button"
+                    onClick={() => setBorgEncryptionEnabled(false)}
+                    className={`text-left p-2.5 rounded-md border text-sm transition-colors ${!borgEncryptionEnabled ? "border-amber-500 bg-amber-500/5" : "border-border bg-background/40 hover:bg-white/5"}`}
+                  >
+                    <div className="font-medium">No encryption</div>
+                    <div className="text-[11px] text-muted-foreground">Faster but data and checksums are in plain.</div>
+                  </button>
+                </div>
+                {borgEncryptionEnabled && (
+                  <div className="space-y-2 pt-1">
+                    <div>
+                      <Label htmlFor="borgPass">Passphrase</Label>
+                      <Input
+                        id="borgPass"
+                        type="password"
+                        value={borgPassphrase}
+                        onChange={(e) => setBorgPassphraseLocal(e.target.value)}
+                        placeholder={isEditing && editing?.has_passphrase
+                          ? "(unchanged — type to replace)"
+                          : "Long random string — store it somewhere safe"}
+                        className="font-mono mt-1"
+                      />
+                      {isEditing && editing?.has_passphrase && (
+                        <p className="text-[11px] text-muted-foreground mt-1">Leave blank to keep the saved passphrase.</p>
+                      )}
+                    </div>
+                    <div>
+                      <Label htmlFor="borgPass2">Confirm passphrase</Label>
+                      <Input
+                        id="borgPass2"
+                        type="password"
+                        value={borgPassphrase2}
+                        onChange={(e) => setBorgPassphrase2(e.target.value)}
+                        placeholder="Type it again"
+                        className="font-mono mt-1"
+                      />
+                      {borgPassphrase && borgPassphrase2 && borgPassphrase !== borgPassphrase2 && (
+                        <p className="text-[11px] text-red-400 mt-1">Passphrases don't match.</p>
+                      )}
+                    </div>
+                    <div className="mt-1 rounded-md border border-red-500/40 bg-red-500/10 p-2.5">
+                      <div className="flex items-start gap-1.5 text-[11px] text-red-300">
+                        <AlertTriangle className="h-3.5 w-3.5 shrink-0 mt-0.5" />
+                        <div className="space-y-1">
+                          <p>
+                            <span className="font-medium">This passphrase is the ONLY way to access encrypted Borg backups.</span> It's saved server-side at <code className="font-mono">borg-pass-{name || "&lt;name&gt;"}.txt</code> (chmod 0600) so jobs can use it transparently.
+                          </p>
+                          <p>
+                            If you lose or reinstall this host without a copy of the passphrase somewhere else (password manager, offline note, another host, USB stick...), every encrypted archive in this repository becomes <span className="font-semibold">UNRECOVERABLE</span>.
+                          </p>
+                          <p className="font-medium">Save the passphrase somewhere safe NOW, before continuing.</p>
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+                )}
+              </div>
+            </>
+          )}
+          {type === "local" && (
+            <div className="space-y-3">
+              <div>
+                <Label htmlFor="localPath">Directory path</Label>
+                <Input id="localPath" value={localPath} onChange={(e) => setLocalPath(e.target.value)} className="font-mono mt-1" placeholder="/var/lib/vz/dump" />
+                <p className="text-xs text-muted-foreground mt-1">
+                  Where scheduled / manual local backups write the <code className="font-mono">tar.zst</code> archive. Pick a USB drive below to auto-fill, or type the path manually.
+                </p>
+              </div>
+              <UsbPicker onPick={(p) => setLocalPath(p)} excludePaths={usedPaths} />
+            </div>
+          )}
+          {error && (
+            <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+              {error}
+            </div>
+          )}
+        </div>
+        <div className="flex justify-end gap-2 pt-3 border-t border-border">
+          <Button variant="ghost" onClick={onClose} disabled={submitting}>Cancel</Button>
+          <Button
+            onClick={handleSave}
+            disabled={!canSubmit || submitting}
+            className="bg-blue-600 hover:bg-blue-700 text-white"
+          >
+            {submitting ? <Loader2 className="h-4 w-4 animate-spin mr-2" /> : <Save className="h-4 w-4 mr-2" />}
+            Save
+          </Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// UsbPicker — inline picker for mounted / unmounted / empty USB
+// drives. Used inside AddDestinationDialog for Local and Borg-local
+// so the operator can mount + format USB media without leaving the
+// "configure destination" flow.
+// ──────────────────────────────────────────────────────────────
+function UsbPicker({
+  onPick,
+  excludePaths = [],
+}: {
+  onPick: (path: string) => void
+  // Hide a USB drive ONLY when an existing destination already targets
+  // its mountpoint root verbatim. Subdirectory uses don't claim the
+  // whole disk — both Local and Borg can share the same USB by
+  // pointing at different subdirs (`/mnt/usbX/borgbackup` for Borg,
+  // `/mnt/usbX/local-dump` for Local). The previous prefix-based
+  // filter was too greedy and made it impossible to add a second
+  // destination type once any one of them landed on the disk.
+  excludePaths?: string[]
+}) {
+  const { data, mutate, isLoading } = useSWR<{ drives: UsbDrive[] }>(
+    "/api/host-backups/usb-drives",
+    fetcher,
+    { refreshInterval: 0 },
+  )
+  const normalized = new Set((excludePaths || []).map((p) => p.replace(/\/+$/, "")))
+  const drives = (data?.drives ?? []).filter((d) => {
+    const mp = (d.path_or_device || "").replace(/\/+$/, "")
+    return !mp || !normalized.has(mp)
+  })
+  const [busyKey, setBusyKey] = useState<string | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [formatTarget, setFormatTarget] = useState<UsbDrive | null>(null)
+  const [formatTyped, setFormatTyped] = useState("")
+
+  async function mountAndUse(d: UsbDrive) {
+    setBusyKey(d.path_or_device)
+    setError(null)
+    try {
+      const resp = await fetchApi<{ mountpoint: string }>(
+        "/api/host-backups/usb-drives/mount",
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            device: d.path_or_device,
+            label: d.label,
+            uuid: d.uuid,
+          }),
+        },
+      )
+      mutate()
+      if (resp?.mountpoint) onPick(resp.mountpoint)
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusyKey(null)
+    }
+  }
+
+  async function doFormat() {
+    if (!formatTarget) return
+    if (formatTyped !== formatTarget.path_or_device) return
+    setBusyKey(formatTarget.path_or_device)
+    setError(null)
+    try {
+      const resp = await fetchApi<{ mountpoint?: string }>(
+        "/api/host-backups/usb-drives/format",
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            device: formatTarget.path_or_device,
+            confirm_device: formatTyped,
+          }),
+        },
+      )
+      mutate()
+      setFormatTarget(null)
+      setFormatTyped("")
+      if (resp?.mountpoint) onPick(resp.mountpoint)
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusyKey(null)
+    }
+  }
+
+  return (
+    <>
+      <div className="rounded-md border border-border bg-background/40 p-3 space-y-2">
+        <div className="flex items-center justify-between gap-2">
+          <div className="flex items-center gap-2 text-xs font-medium">
+            <HardDrive className="h-3.5 w-3.5 text-orange-400" />
+            USB drives detected
+            {drives.length > 0 && (
+              <Badge variant="outline" className="text-[10px]">{drives.length}</Badge>
+            )}
+          </div>
+          <Button
+            type="button"
+            size="sm"
+            variant="ghost"
+            className="h-7 text-xs"
+            onClick={() => mutate()}
+            disabled={isLoading}
+          >
+            {isLoading ? <Loader2 className="h-3 w-3 animate-spin" /> : <RefreshCw className="h-3 w-3" />}
+            <span className="ml-1">Refresh</span>
+          </Button>
+        </div>
+        {error && (
+          <div className="text-xs text-red-500 px-2 py-1 rounded border border-red-500/30 bg-red-500/10">
+            {error}
+          </div>
+        )}
+        {isLoading ? (
+          <div className="flex items-center gap-2 py-2 text-xs text-muted-foreground">
+            <Loader2 className="h-3 w-3 animate-spin" /> Scanning…
+          </div>
+        ) : drives.length === 0 ? (
+          <p className="text-[11px] text-muted-foreground italic">
+            No USB drives detected. Plug a USB stick and click Refresh.
+          </p>
+        ) : (
+          <div className="space-y-1.5">
+            {drives.map((d) => {
+              const busy = busyKey === d.path_or_device
+              const stateBadge =
+                d.state === "mounted"
+                  ? { label: "mounted", cls: "border-green-500/40 text-green-400 bg-green-500/5" }
+                  : d.state === "unmounted"
+                    ? { label: "unmounted", cls: "border-amber-500/40 text-amber-400 bg-amber-500/5" }
+                    : { label: "unformatted", cls: "border-red-500/40 text-red-400 bg-red-500/5" }
+              return (
+                <div
+                  key={d.uuid || d.path_or_device}
+                  className="flex flex-col sm:flex-row sm:items-center justify-between gap-2 p-2 rounded border border-border bg-background"
+                >
+                  <div className="min-w-0 flex-1">
+                    <div className="flex items-center gap-2 flex-wrap">
+                      <code className="font-mono text-xs text-foreground">{d.path_or_device}</code>
+                      <Badge variant="outline" className={`text-[10px] uppercase tracking-wide ${stateBadge.cls}`}>
+                        {stateBadge.label}
+                      </Badge>
+                      {d.size && (
+                        <span className="text-[10px] text-muted-foreground">{d.size}</span>
+                      )}
+                      {d.fstype && (
+                        <span className="text-[10px] text-muted-foreground font-mono">{d.fstype}</span>
+                      )}
+                      {d.label && (
+                        <span className="text-[10px] text-muted-foreground italic">"{d.label}"</span>
+                      )}
+                    </div>
+                  </div>
+                  <div className="shrink-0 flex items-center gap-1">
+                    {d.state === "mounted" && (
+                      <Button
+                        type="button"
+                        size="sm"
+                        variant="outline"
+                        className="h-7 text-xs bg-blue-500/10 border-blue-500/40 !text-blue-400 hover:bg-blue-500/20 hover:!text-blue-300"
+                        onClick={() => onPick(d.path_or_device)}
+                      >
+                        Use
+                      </Button>
+                    )}
+                    {d.state === "unmounted" && (
+                      <Button
+                        type="button"
+                        size="sm"
+                        variant="outline"
+                        className="h-7 text-xs bg-blue-500/10 border-blue-500/40 !text-blue-400 hover:bg-blue-500/20 hover:!text-blue-300"
+                        disabled={busy}
+                        onClick={() => mountAndUse(d)}
+                      >
+                        {busy ? <Loader2 className="h-3 w-3 animate-spin mr-1" /> : null}
+                        Mount and use
+                      </Button>
+                    )}
+                    {d.state === "empty" && (
+                      <Button
+                        type="button"
+                        size="sm"
+                        variant="outline"
+                        className="h-7 text-xs bg-red-500/10 border-red-500/40 !text-red-400 hover:bg-red-500/20 hover:!text-red-300"
+                        disabled={busy}
+                        onClick={() => { setFormatTarget(d); setFormatTyped("") }}
+                      >
+                        Format & use
+                      </Button>
+                    )}
+                  </div>
+                </div>
+              )
+            })}
+          </div>
+        )}
+      </div>
+
+      {/* Type-to-confirm format dialog — destructive op. */}
+      <Dialog open={formatTarget !== null} onOpenChange={(v) => { if (!v) { setFormatTarget(null); setFormatTyped("") } }}>
+        <DialogContent className="max-w-md bg-card border-border">
+          <DialogHeader>
+            <DialogTitle className="flex items-center gap-2 text-base">
+              <AlertTriangle className="h-5 w-5 text-red-500" />
+              Format USB drive
+            </DialogTitle>
+            <DialogDescription className="text-xs">
+              This will partition the disk (GPT + a single ext4), then mount it. Everything on this device will be permanently lost.
+            </DialogDescription>
+          </DialogHeader>
+          {formatTarget && (
+            <div className="space-y-2">
+              <div className="text-xs font-mono px-3 py-2 rounded-md border border-border bg-background/40 break-all">
+                {formatTarget.path_or_device}
+                {formatTarget.size && <span className="text-muted-foreground"> · {formatTarget.size}</span>}
+              </div>
+              <Label htmlFor="formatConfirmInput" className="text-xs">
+                Type the device path exactly to confirm:
+              </Label>
+              <Input
+                id="formatConfirmInput"
+                value={formatTyped}
+                onChange={(e) => setFormatTyped(e.target.value)}
+                placeholder={formatTarget.path_or_device}
+                className="font-mono"
+              />
+            </div>
+          )}
+          <div className="flex justify-end gap-2">
+            <Button
+              variant="ghost"
+              onClick={() => { setFormatTarget(null); setFormatTyped("") }}
+              disabled={busyKey === formatTarget?.path_or_device}
+            >
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              disabled={formatTyped !== formatTarget?.path_or_device || busyKey === formatTarget?.path_or_device}
+              onClick={doFormat}
+            >
+              {busyKey === formatTarget?.path_or_device ? (
+                <Loader2 className="h-4 w-4 mr-2 animate-spin" />
+              ) : (
+                <AlertTriangle className="h-4 w-4 mr-2" />
+              )}
+              Wipe and format
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// Custom backup paths (Sprint C).
+//
+// Persisted at $HB_STATE_DIR/backup-extra-paths.txt (one path per line).
+// The runner merges this list into every backup — manual or scheduled,
+// default or custom profile.
+// ──────────────────────────────────────────────────────────────
+
+interface ExtraPathEntry {
+  path: string
+  exists: boolean
+}
+
+function ExtraPathsSection() {
+  const { data, mutate } = useSWR<{ paths: ExtraPathEntry[] }>(
+    "/api/host-backups/extra-paths",
+    fetcher,
+    { refreshInterval: 60000 },
+  )
+
+  const [newPath, setNewPath] = useState("")
+  const [busyPath, setBusyPath] = useState<string | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [submitting, setSubmitting] = useState(false)
+
+  const paths = data?.paths ?? []
+
+  async function addPath() {
+    if (!newPath.trim()) return
+    setSubmitting(true)
+    setError(null)
+    try {
+      await fetchApi("/api/host-backups/extra-paths", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ path: newPath.trim() }),
+      })
+      setNewPath("")
+      mutate()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  async function removePath(p: string) {
+    setBusyPath(p)
+    setError(null)
+    try {
+      await fetchApi(`/api/host-backups/extra-paths?path=${encodeURIComponent(p)}`, { method: "DELETE" })
+      mutate()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusyPath(null)
+    }
+  }
+
+  return (
+    <div className="space-y-3">
+      <p className="text-xs text-muted-foreground">
+        Paths added here are included in <span className="font-medium text-foreground">every backup</span> (manual or scheduled, default or custom profile) on top of the default profile list. Useful for application data, custom config dirs, etc. ({paths.length} configured)
+      </p>
+
+        <div className="flex flex-col sm:flex-row gap-2">
+          <Input
+            value={newPath}
+            onChange={(e) => setNewPath(e.target.value)}
+            placeholder="/root/my-folder, /srv/myapp/data, /etc/cron.d ..."
+            className="font-mono"
+            onKeyDown={(e) => { if (e.key === "Enter" && newPath.trim()) addPath() }}
+          />
+          <Button
+            onClick={addPath}
+            disabled={!newPath.trim() || submitting}
+            className="shrink-0 bg-blue-500 hover:bg-blue-600 text-white"
+          >
+            {submitting ? <Loader2 className="h-4 w-4 animate-spin mr-2" /> : <Plus className="h-4 w-4 mr-2" />}
+            Add path
+          </Button>
+        </div>
+        <p className="text-[11px] text-muted-foreground">
+          Use the full absolute path. <code className="font-mono">/hola</code> is not the same as <code className="font-mono">/root/hola</code> — the path has to exist on this host exactly as you type it.
+        </p>
+
+        {error && (
+          <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+            {error}
+          </div>
+        )}
+
+        {paths.length === 0 ? (
+          <div className="text-xs text-muted-foreground py-3 text-center">
+            No custom paths yet — backups use the default profile only.
+          </div>
+        ) : (
+          <div className="space-y-1">
+            {paths.map((p) => (
+              <div
+                key={p.path}
+                className="flex items-center justify-between gap-3 p-2 rounded-md border border-border bg-background/40"
+              >
+                <div className="min-w-0 flex-1 flex items-center gap-2">
+                  <span className="font-mono text-xs truncate" title={p.path}>{p.path}</span>
+                  {!p.exists && (
+                    <Badge variant="outline" className="text-[10px] text-amber-500 border-amber-500/40">
+                      missing on disk
+                    </Badge>
+                  )}
+                </div>
+                <button
+                  type="button"
+                  disabled={busyPath === p.path}
+                  onClick={() => removePath(p.path)}
+                  title="Remove this custom path"
+                  className="shrink-0 inline-flex items-center justify-center h-7 w-7 rounded-md border border-red-500/40 bg-red-500/10 text-red-400 hover:bg-red-500/20 hover:text-red-300 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+                >
+                  {busyPath === p.path ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <Trash2 className="h-3.5 w-3.5" />}
+                </button>
+              </div>
+            ))}
+          </div>
+        )}
+    </div>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// Backup configuration wrapper (Sprint D.2.a).
+//
+// Single card hosting Destinations + Custom paths via top-level tabs.
+// Future tabs (USB drives, ...) plug in here too.
+// ──────────────────────────────────────────────────────────────
+function BackupConfigurationCard({
+  destinations,
+  onDestChanged,
+}: {
+  destinations?: DestinationsResp
+  onDestChanged: () => void
+}) {
+  return (
+    <Card className="bg-card border-border">
+      <CardHeader className="space-y-0 pb-3">
+        <div className="flex items-center gap-2">
+          <Server className="h-5 w-5 text-blue-500" />
+          <CardTitle className="text-base font-semibold">Backup configuration</CardTitle>
+        </div>
+      </CardHeader>
+      <CardContent className="space-y-6">
+        {/* Destinations — list + add/remove of PBS / Borg / Local targets.
+            USB drives are no longer a separate section: they surface in
+            this list when mounted, and the add-destination wizard can
+            mount / format them inline. */}
+        <section className="space-y-2">
+          <h3 className="text-sm font-medium">Destinations</h3>
+          <DestinationsSection destinations={destinations} onChanged={onDestChanged} />
+        </section>
+
+        <div className="h-px bg-border" />
+
+        {/* Custom paths — extra absolute paths included in every backup */}
+        <section className="space-y-2">
+          <h3 className="text-sm font-medium">Custom paths</h3>
+          <ExtraPathsSection />
+        </section>
+      </CardContent>
+    </Card>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// USB drives section (Sprint D.2.b).
+//
+// Thin Monitor UI around the shell helpers hb_list_usb_partitions,
+// hb_mount_usb_partition, hb_format_usb_disk. Mount / unmount are
+// safe-ish; format is destructive and gated by a typed-confirmation
+// dialog (the operator must re-type the device path) so a misclick
+// can't wipe an attached disk.
+// ──────────────────────────────────────────────────────────────
+
+interface UsbDrive {
+  state: "mounted" | "unmounted" | "empty"
+  path_or_device: string
+  label: string
+  size: string
+  fstype: string
+  uuid: string
+}
+
+function UsbDrivesSection() {
+  const { data, mutate, isLoading } = useSWR<{ drives: UsbDrive[] }>(
+    "/api/host-backups/usb-drives",
+    fetcher,
+    { refreshInterval: 30000 },
+  )
+  const drives = data?.drives ?? []
+  const [busyKey, setBusyKey] = useState<string | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [formatTarget, setFormatTarget] = useState<UsbDrive | null>(null)
+  const [formatTyped, setFormatTyped] = useState("")
+
+  async function mountDrive(d: UsbDrive) {
+    setBusyKey(d.path_or_device)
+    setError(null)
+    try {
+      await fetchApi("/api/host-backups/usb-drives/mount", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          device: d.path_or_device,
+          label: d.label,
+          uuid: d.uuid,
+        }),
+      })
+      mutate()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusyKey(null)
+    }
+  }
+
+  async function unmountDrive(d: UsbDrive) {
+    if (!confirm(`Unmount ${d.path_or_device}? Any backup job pointing at this path will fail until you remount it.`)) return
+    setBusyKey(d.path_or_device)
+    setError(null)
+    try {
+      await fetchApi("/api/host-backups/usb-drives/unmount", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ mountpoint: d.path_or_device }),
+      })
+      mutate()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusyKey(null)
+    }
+  }
+
+  async function doFormat() {
+    if (!formatTarget) return
+    if (formatTyped !== formatTarget.path_or_device) return
+    setBusyKey(formatTarget.path_or_device)
+    setError(null)
+    try {
+      await fetchApi("/api/host-backups/usb-drives/format", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          device: formatTarget.path_or_device,
+          confirm_device: formatTyped,
+        }),
+      })
+      mutate()
+      setFormatTarget(null)
+      setFormatTyped("")
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusyKey(null)
+    }
+  }
+
+  return (
+    <div className="space-y-3">
+      <p className="text-xs text-muted-foreground">
+        Mount USB drives so they can be picked as a local or Borg target. Drives that already had a filesystem can be remounted as-is; raw drives (no partition table) can be wiped and formatted to <code className="font-mono">ext4</code>.
+      </p>
+
+      {error && (
+        <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+          {error}
+        </div>
+      )}
+
+      {isLoading ? (
+        <div className="text-xs text-muted-foreground py-3 text-center">
+          <Loader2 className="h-4 w-4 animate-spin inline mr-2" />
+          Scanning USB drives…
+        </div>
+      ) : drives.length === 0 ? (
+        <div className="text-xs text-muted-foreground py-3 text-center">
+          No USB drives detected. Plug one in and refresh — Monitor scans for them automatically every 30s.
+        </div>
+      ) : (
+        <div className="space-y-2">
+          {drives.map((d) => {
+            const isBusy = busyKey === d.path_or_device
+            const stateBadge =
+              d.state === "mounted"
+                ? { label: "mounted", cls: "text-emerald-400 border-emerald-400/40" }
+                : d.state === "unmounted"
+                  ? { label: "not mounted", cls: "text-amber-500 border-amber-500/40" }
+                  : { label: "no filesystem", cls: "text-red-400 border-red-400/40" }
+            return (
+              <div
+                key={`${d.state}-${d.path_or_device}-${d.uuid}`}
+                className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-2 p-3 rounded-md border border-border bg-background/40"
+              >
+                <div className="min-w-0 flex-1">
+                  <div className="flex items-center gap-2 flex-wrap">
+                    <span className="font-mono text-sm font-medium">{d.path_or_device}</span>
+                    <Badge variant="outline" className={`text-[10px] uppercase tracking-wide ${stateBadge.cls}`}>
+                      {stateBadge.label}
+                    </Badge>
+                  </div>
+                  <div className="mt-1 text-[11px] text-muted-foreground flex items-center gap-x-3 gap-y-1 flex-wrap">
+                    {d.label && <span><span className="text-muted-foreground/70">label:</span> <code className="font-mono">{d.label}</code></span>}
+                    {d.size && <span><span className="text-muted-foreground/70">size:</span> <code className="font-mono">{d.size}</code></span>}
+                    {d.fstype && <span><span className="text-muted-foreground/70">fs:</span> <code className="font-mono">{d.fstype}</code></span>}
+                    {d.uuid && <span className="hidden sm:inline" title={`uuid: ${d.uuid}`}><span className="text-muted-foreground/70">uuid:</span> <code className="font-mono">{d.uuid.substring(0, 8)}…</code></span>}
+                  </div>
+                </div>
+                <div className="flex items-center gap-1 shrink-0">
+                  {d.state === "mounted" && (
+                    <Button
+                      size="sm"
+                      variant="ghost"
+                      className="h-8 px-2"
+                      disabled={isBusy}
+                      onClick={() => unmountDrive(d)}
+                    >
+                      {isBusy ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <XCircle className="h-3.5 w-3.5" />}
+                      <span className="ml-1 text-xs">Unmount</span>
+                    </Button>
+                  )}
+                  {d.state === "unmounted" && (
+                    <Button
+                      size="sm"
+                      variant="ghost"
+                      className="h-8 px-2"
+                      disabled={isBusy}
+                      onClick={() => mountDrive(d)}
+                    >
+                      {isBusy ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <CheckCircle2 className="h-3.5 w-3.5" />}
+                      <span className="ml-1 text-xs">Mount</span>
+                    </Button>
+                  )}
+                  {d.state === "empty" && (
+                    <Button
+                      size="sm"
+                      variant="ghost"
+                      className="h-8 px-2 text-red-500 hover:text-red-400 hover:bg-red-500/10"
+                      disabled={isBusy}
+                      onClick={() => { setFormatTarget(d); setFormatTyped("") }}
+                      title="Wipe + format this disk as ext4"
+                    >
+                      <AlertTriangle className="h-3.5 w-3.5" />
+                      <span className="ml-1 text-xs">Format</span>
+                    </Button>
+                  )}
+                </div>
+              </div>
+            )
+          })}
+        </div>
+      )}
+
+      {/* Format confirmation dialog */}
+      <Dialog open={formatTarget !== null} onOpenChange={(v) => { if (!v) { setFormatTarget(null); setFormatTyped("") } }}>
+        <DialogContent className="max-w-md">
+          <DialogHeader>
+            <DialogTitle className="flex items-center gap-2">
+              <AlertTriangle className="h-5 w-5 text-red-500" />
+              Wipe and format this disk?
+            </DialogTitle>
+            <DialogDescription>
+              Everything on the disk will be destroyed. This cannot be undone.
+            </DialogDescription>
+          </DialogHeader>
+          {formatTarget && (
+            <div className="space-y-3 text-sm">
+              <div className="rounded-md border border-red-500/40 bg-red-500/5 p-3 space-y-1">
+                <div className="text-[10px] uppercase tracking-wider text-red-400">Target</div>
+                <div className="font-mono text-base">{formatTarget.path_or_device}</div>
+                <div className="text-xs text-muted-foreground">Size: {formatTarget.size || "?"}</div>
+              </div>
+              <div>
+                <Label htmlFor="formatConfirm">Type the device path EXACTLY to confirm:</Label>
+                <Input
+                  id="formatConfirm"
+                  value={formatTyped}
+                  onChange={(e) => setFormatTyped(e.target.value)}
+                  className="font-mono mt-1"
+                  placeholder={formatTarget.path_or_device}
+                />
+              </div>
+              <p className="text-xs text-muted-foreground">
+                The disk will be re-partitioned (GPT + single ext4 partition) and mounted automatically.
+              </p>
+            </div>
+          )}
+          <div className="flex justify-end gap-2 mt-2">
+            <Button variant="ghost" onClick={() => { setFormatTarget(null); setFormatTyped("") }} disabled={busyKey === formatTarget?.path_or_device}>
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              onClick={doFormat}
+              disabled={formatTyped !== formatTarget?.path_or_device || busyKey === formatTarget?.path_or_device}
+            >
+              {busyKey === formatTarget?.path_or_device ? (
+                <Loader2 className="h-4 w-4 animate-spin mr-2" />
+              ) : (
+                <AlertTriangle className="h-4 w-4 mr-2" />
+              )}
+              Wipe and format
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </div>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// JobDetailModal
+// ──────────────────────────────────────────────────────────────────────
+// Opens when the user clicks a job row. Everything about the job lives
+// inside this modal: schedule, retention, profile, destination, the tail
+// of the most recent log, and the action buttons (Run / Enable·Disable /
+// Edit / Delete). Run polls the job detail every 2s so the user sees the
+// result of the manual trigger without having to close-reopen.
+// ──────────────────────────────────────────────────────────────────────
+function JobDetailModal({
+  jobId,
+  onClose,
+  onEdit,
+  onRequestDelete,
+  onChanged,
+}: {
+  jobId: string | null
+  onClose: () => void
+  onEdit: (id: string) => void
+  onRequestDelete: (id: string) => void
+  onChanged: () => void
+}) {
+  const open = jobId !== null
+  const [running, setRunning] = useState(false)
+  const [runBaseline, setRunBaseline] = useState<string | null>(null)
+  const [runBaselineLogPath, setRunBaselineLogPath] = useState<string | null>(null)
+  const [actionError, setActionError] = useState<string | null>(null)
+  const [busy, setBusy] = useState<"" | "toggle">("")
+  const [showDisableConfirm, setShowDisableConfirm] = useState(false)
+
+  const { data: detail, mutate: refetch, isLoading } = useSWR<JobDetail>(
+    open ? `/api/host-backups/jobs/${encodeURIComponent(jobId!)}` : null,
+    fetcher,
+    { refreshInterval: running ? 2000 : 0 },
+  )
+
+  // While the job is actively running, poll the full log every 1.5 s so
+  // the modal shows the runner's output in real time — same UX the
+  // "Run manual backup" dialog provides. SWR is disabled when not
+  // running, so this only fires during an active trigger.
+  const { data: liveLog } = useSWR<{ content: string; log_path: string | null; size: number }>(
+    open && running ? `/api/host-backups/jobs/${encodeURIComponent(jobId!)}/log` : null,
+    fetcher,
+    { refreshInterval: 1500 },
+  )
+
+  // Auto-scroll the live log <pre> to the bottom as new lines arrive,
+  // otherwise the operator has to manually scroll on every poll cycle.
+  const liveLogRef = useRef<HTMLPreElement | null>(null)
+  useEffect(() => {
+    if (running && liveLogRef.current) {
+      liveLogRef.current.scrollTop = liveLogRef.current.scrollHeight
+    }
+  }, [liveLog, running])
+
+  // The runner truncates the .status file at start (writing RUN_AT
+  // only) and appends RESULT= at finish. So during a run we'll see:
+  //
+  //   last_run_at  = NEW timestamp (advanced past baseline)
+  //   last_result  = null
+  //
+  // and only when it really finishes:
+  //
+  //   last_run_at  = NEW timestamp
+  //   last_result  = "ok" | "failed" | ...
+  //
+  // Requiring BOTH conditions keeps the live log streaming visible
+  // for the whole duration of the run — the previous version exited
+  // streaming mode as soon as the runner wrote the new RUN_AT.
+  useEffect(() => {
+    if (!running || !detail) return
+    if (
+      detail.last_run_at &&
+      detail.last_run_at !== runBaseline &&
+      detail.last_result
+    ) {
+      setRunning(false)
+      setRunBaseline(null)
+      setRunBaselineLogPath(null)
+      onChanged()
+    }
+  }, [detail, running, runBaseline, onChanged])
+
+  // When the modal opens onto a job that's already running (last_run_at
+  // set but last_result still null), jump straight into streaming mode
+  // so the operator can resume watching from anywhere — including the
+  // "Manual backup in progress" banner on the Manual backups card and
+  // a click on a scheduled job row that's currently mid-run.
+  useEffect(() => {
+    if (!open || running || !detail) return
+    if (detail.last_run_at && !detail.last_result) {
+      // Baseline = empty so the exit condition still fires (any
+      // non-empty last_run_at + a non-null last_result will trip it).
+      setRunBaseline("")
+      setRunBaselineLogPath(detail.last_log_path ?? null)
+      setRunning(true)
+    }
+  }, [open, running, detail])
+
+  // Reset on close.
+  useEffect(() => {
+    if (!open) {
+      setRunning(false)
+      setRunBaseline(null)
+      setRunBaselineLogPath(null)
+      setActionError(null)
+      setBusy("")
+      setShowDisableConfirm(false)
+    }
+  }, [open])
+
+  async function handleRun() {
+    if (!detail) return
+    setActionError(null)
+    setRunBaseline(detail.last_run_at ?? "")
+    // Remember the previous run's log path so the streaming view can
+    // tell "the runner hasn't created its log yet" (we'd see the OLD
+    // path) from "the runner is writing now" (path advanced).
+    setRunBaselineLogPath(detail.last_log_path ?? null)
+    setRunning(true)
+    try {
+      await fetchApi(`/api/host-backups/jobs/${encodeURIComponent(detail.id)}/run`, { method: "POST" })
+      setTimeout(() => refetch(), 800)
+    } catch (e) {
+      setRunning(false)
+      setRunBaseline(null)
+      setRunBaselineLogPath(null)
+      setActionError(`Failed to run: ${e instanceof Error ? e.message : String(e)}`)
+    }
+  }
+
+  async function handleToggle() {
+    if (!detail) return
+    setActionError(null)
+    setBusy("toggle")
+    setShowDisableConfirm(false)
+    try {
+      await fetchApi(`/api/host-backups/jobs/${encodeURIComponent(detail.id)}/toggle`, { method: "POST" })
+      await refetch()
+      onChanged()
+    } catch (e) {
+      setActionError(`Failed to toggle: ${e instanceof Error ? e.message : String(e)}`)
+    } finally {
+      setBusy("")
+    }
+  }
+
+  const lastResult = detail?.last_result ?? null
+  const lastRunWhen = formatRunAt(detail?.last_run_at ?? null)
+  const resultBadge = running
+    ? { label: "running", cls: "bg-blue-500/10 border-blue-500/40 text-blue-300" }
+    : lastResult === "ok"
+      ? { label: "ok", cls: "bg-emerald-500/10 border-emerald-500/40 text-emerald-300" }
+      : lastResult
+        ? { label: lastResult, cls: "bg-red-500/10 border-red-500/40 text-red-300" }
+        : null
+
+  return (
+    <>
+      <Dialog open={open} onOpenChange={(v) => { if (!v) onClose() }}>
+        {/* Sized down to 3xl now that the log tail lives in the
+            archive's inspect modal — the job dialog only needs to fit
+            the schedule, retention chips, paths grid and destination.
+            overflow-hidden + the inner ScrollArea keep any long repo
+            or path string from forcing a horizontal scrollbar. */}
+        <DialogContent className="max-w-3xl bg-card border-border overflow-hidden">
+          <DialogHeader>
+            <DialogTitle className="flex items-center gap-2 flex-wrap text-base pr-8">
+              <DatabaseBackup className="h-5 w-5 text-blue-500" />
+              <span className="font-mono break-all">{detail?.id ?? jobId}</span>
+              {detail && (
+                <>
+                  <Badge variant="outline" className={`text-[10px] uppercase tracking-wide ${methodBadgeCls(detail.method)}`}>
+                    {detail.method}
+                  </Badge>
+                  {/* Encryption badge — mirrors the InspectModal one
+                      so the operator sees the lock in both the summary
+                      list and the job detail view. */}
+                  {(detail.pbs_encrypt || (detail.borg_encrypt_mode && detail.borg_encrypt_mode !== "none")) && (
+                    <Badge
+                      variant="outline"
+                      className="text-emerald-400 border-emerald-500/40 bg-emerald-500/10"
+                      title="Encrypted"
+                    >
+                      <Lock className="h-3.5 w-3.5" />
+                    </Badge>
+                  )}
+                  {detail.attached && (
+                    <Badge variant="outline" className="text-[10px] text-blue-400 border-blue-400/40 bg-blue-500/5">
+                      attached
+                    </Badge>
+                  )}
+                  {!detail.enabled && (
+                    <Badge variant="outline" className="text-[10px] text-amber-500 border-amber-500/40 bg-amber-500/5">
+                      disabled
+                    </Badge>
+                  )}
+                </>
+              )}
+            </DialogTitle>
+            <DialogDescription className="text-xs">
+              Schedule, profile, destination and last run for this job.
+            </DialogDescription>
+          </DialogHeader>
+
+          {actionError && (
+            <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+              {actionError}
+            </div>
+          )}
+
+          {isLoading || !detail ? (
+            <div className="flex items-center gap-2 py-6 text-sm text-muted-foreground">
+              <Loader2 className="h-4 w-4 animate-spin" />
+              Loading job…
+            </div>
+          ) : (
+            <ScrollArea className="max-h-[60vh] pr-2">
+              {(() => {
+                // One accent color per section. The destination color is
+                // bound to the job's backend (purple/blue/fuchsia) so the
+                // section feels like a continuation of the method badge in
+                // the title; the other sections use neutral accent colors
+                // that match their semantic (time → amber, content → emerald).
+                const destAccent =
+                  detail.method === "pbs"
+                    ? "text-purple-400"
+                    : detail.method === "borg"
+                      ? "text-fuchsia-400"
+                      : "text-blue-400"
+                return (
+                  <div className="space-y-4 text-sm">
+                    {/* ─── Last run ─────────────────────────── */}
+                    {/* The job modal shows only the verdict + timestamp.
+                        The actual log lives in the archive's inspect
+                        modal where it belongs (one log per .tar.zst). */}
+                    <section className="space-y-2">
+                      <h4 className="text-xs font-semibold uppercase tracking-wide flex items-center gap-1.5 text-green-500">
+                        <Clock className="h-3.5 w-3.5" /> Last run
+                      </h4>
+                      <div className="flex items-center gap-2 flex-wrap text-xs">
+                        {resultBadge ? (
+                          <span className={`px-2 py-0.5 rounded text-[10px] uppercase tracking-wide border inline-flex items-center gap-1 ${resultBadge.cls}`}>
+                            {running && <Loader2 className="h-3 w-3 animate-spin" />}
+                            {resultBadge.label}
+                          </span>
+                        ) : (
+                          <span className="text-muted-foreground">never run</span>
+                        )}
+                        {lastRunWhen && <span className="text-muted-foreground">{lastRunWhen}</span>}
+                      </div>
+                      {running && (
+                        // Live mode — poll /log every 1.5 s and auto-scroll
+                        // so the operator watches the runner output as it
+                        // happens. The archive isn't on disk yet, so this
+                        // is the only place to surface the running log.
+                        // Suppressed once the run finishes.
+                        (() => {
+                          const sameOldLog =
+                            !!liveLog?.log_path &&
+                            !!runBaselineLogPath &&
+                            liveLog.log_path === runBaselineLogPath
+                          const showContent = liveLog?.content && !sameOldLog
+                          return (
+                            <div className="rounded-md border border-blue-500/40 bg-blue-500/5 p-2">
+                              <pre
+                                ref={liveLogRef}
+                                className="text-[11px] font-mono whitespace-pre-wrap break-all max-h-64 overflow-auto text-foreground/90"
+                              >
+{showContent ? liveLog!.content : "Waiting for runner to start…"}
+                              </pre>
+                              <div className="flex items-center justify-between mt-2">
+                                <span className="text-[10px] text-blue-300 inline-flex items-center gap-1.5">
+                                  <Loader2 className="h-3 w-3 animate-spin" />
+                                  {showContent
+                                    ? `live · ${formatBytes(liveLog?.size ?? 0)}`
+                                    : "starting…"}
+                                </span>
+                                {showContent && liveLog?.log_path && (
+                                  <span className="text-[10px] text-muted-foreground font-mono break-all">
+                                    {liveLog.log_path}
+                                  </span>
+                                )}
+                              </div>
+                            </div>
+                          )
+                        })()
+                      )}
+                    </section>
+
+                    {/* ─── Schedule + retention ─────────────── */}
+                    <section className="space-y-2">
+                      <h4 className="text-xs font-semibold uppercase tracking-wide flex items-center gap-1.5 text-green-500">
+                        <Calendar className="h-3.5 w-3.5" /> Schedule
+                      </h4>
+                      <Field
+                        icon={<Calendar className="h-3 w-3 text-green-500/80" />}
+                        label="when"
+                        value={humanizeOnCalendar(detail.on_calendar)}
+                        labelClassName="text-green-500/90"
+                      />
+                      {detail.next_run && (
+                        <Field
+                          icon={<Clock className="h-3 w-3 text-green-500/80" />}
+                          label="next run"
+                          value={formatNext(detail.next_run)}
+                          labelClassName="text-green-500/90"
+                        />
+                      )}
+                      <RetentionDisplay retention={detail.retention || {}} />
+                    </section>
+
+                    {/* ─── Profile + paths ──────────────────── */}
+                    <section className="space-y-2">
+                      <h4 className="text-xs font-semibold uppercase tracking-wide flex items-center gap-1.5 text-green-500">
+                        <FileSearch className="h-3.5 w-3.5" /> Profile
+                      </h4>
+                      <Field
+                        icon={<Server className="h-3 w-3 text-green-500/80" />}
+                        label="mode"
+                        value={detail.profile_mode || "—"}
+                        mono
+                        labelClassName="text-green-500/90"
+                      />
+                      {detail.paths && detail.paths.length > 0 && (
+                        <PathsDisplay paths={detail.paths} />
+                      )}
+                    </section>
+
+                    {/* ─── Destination ──────────────────────── */}
+                    <section className="space-y-1">
+                      <h4 className={`text-xs font-semibold uppercase tracking-wide flex items-center gap-1.5 ${destAccent}`}>
+                        <HardDrive className="h-3.5 w-3.5" /> Destination
+                      </h4>
+                      <Field icon={<HardDrive className={`h-3 w-3 ${destAccent} opacity-80`} />} label="target" value={detail.destination || "—"} mono />
+                      {detail.method === "pbs" && (
+                        <>
+                          {detail.pbs_repository && (
+                            <Field icon={<Server className={`h-3 w-3 ${destAccent} opacity-80`} />} label="repository" value={detail.pbs_repository} mono />
+                          )}
+                          {detail.pbs_backup_id && (
+                            <Field icon={<Archive className={`h-3 w-3 ${destAccent} opacity-80`} />} label="backup-id" value={detail.pbs_backup_id} mono />
+                          )}
+                        </>
+                      )}
+                      {detail.method === "borg" && (
+                        <>
+                          {detail.borg_repo && (
+                            <Field icon={<Server className={`h-3 w-3 ${destAccent} opacity-80`} />} label="repo" value={detail.borg_repo} mono />
+                          )}
+                          <Field icon={<FileSearch className={`h-3 w-3 ${destAccent} opacity-80`} />} label="encryption" value={detail.borg_encrypt_mode} mono />
+                        </>
+                      )}
+                      {detail.method === "local" && detail.local_dest_dir && (
+                        <Field icon={<HardDrive className={`h-3 w-3 ${destAccent} opacity-80`} />} label="dir" value={detail.local_dest_dir} mono />
+                      )}
+                      {detail.pve_storage && (
+                        <Field icon={<DatabaseBackup className={`h-3 w-3 ${destAccent} opacity-80`} />} label="pve storage" value={detail.pve_storage} mono />
+                      )}
+                    </section>
+                  </div>
+                )
+              })()}
+            </ScrollArea>
+          )}
+
+          {detail && (
+            // Layout mirrors the InspectModal footer: primary action on
+            // the left in solid green (Run, matches Restore), secondary
+            // Edit next to it in blue outline, then state-changers on
+            // the right (Disable / Delete) — both outlined to read as
+            // less prominent than Run.
+            <div className="border-t border-border pt-3 flex items-center justify-between gap-2 flex-wrap">
+              <div className="flex items-center gap-2 flex-wrap">
+                <Button
+                  size="sm"
+                  onClick={handleRun}
+                  disabled={running || busy !== ""}
+                  className="bg-green-600 hover:bg-green-700 text-white"
+                  title={detail.attached
+                    ? "Trigger an ad-hoc run now (the PVE timer keeps its own schedule)"
+                    : "Trigger this job now"}
+                >
+                  {running ? (
+                    <Loader2 className="h-3.5 w-3.5 mr-1 animate-spin" />
+                  ) : (
+                    <PlayCircle className="h-3.5 w-3.5 mr-1" />
+                  )}
+                  {running ? "Running…" : "Run now"}
+                </Button>
+                <Button
+                  size="sm"
+                  variant="outline"
+                  disabled={running || busy !== ""}
+                  className="bg-blue-500/10 border-blue-500/40 !text-blue-400 hover:bg-blue-500/20 hover:!text-blue-300"
+                  onClick={() => onEdit(detail.id)}
+                >
+                  <Pencil className="h-3.5 w-3.5 mr-1" />
+                  Edit
+                </Button>
+              </div>
+              <div className="flex items-center gap-2 flex-wrap">
+                <Button
+                  size="sm"
+                  variant="outline"
+                  disabled={running || busy !== ""}
+                  className={detail.enabled
+                    ? "bg-amber-500/10 border-amber-500/40 !text-amber-400 hover:bg-amber-500/20 hover:!text-amber-300"
+                    : "bg-emerald-500/10 border-emerald-500/40 !text-emerald-400 hover:bg-emerald-500/20 hover:!text-emerald-300"}
+                  onClick={() => {
+                    if (detail.enabled) setShowDisableConfirm(true)
+                    else handleToggle()
+                  }}
+                >
+                  {busy === "toggle" ? (
+                    <Loader2 className="h-3.5 w-3.5 mr-1 animate-spin" />
+                  ) : detail.enabled ? (
+                    <Power className="h-3.5 w-3.5 mr-1" />
+                  ) : (
+                    <CheckCircle2 className="h-3.5 w-3.5 mr-1" />
+                  )}
+                  {detail.enabled ? "Disable" : "Enable"}
+                </Button>
+                <Button
+                  size="sm"
+                  variant="outline"
+                  disabled={running || busy !== ""}
+                  className="bg-red-500/10 border-red-500/40 !text-red-400 hover:bg-red-500/20 hover:!text-red-300"
+                  onClick={() => onRequestDelete(detail.id)}
+                >
+                  <Trash2 className="h-3.5 w-3.5 mr-1" />
+                  Delete
+                </Button>
+              </div>
+            </div>
+          )}
+        </DialogContent>
+      </Dialog>
+
+      {/* ─── Confirm Disable ──────────────────────────────────── */}
+      <Dialog open={showDisableConfirm} onOpenChange={setShowDisableConfirm}>
+        <DialogContent className="max-w-md bg-card border-border">
+          <DialogHeader>
+            <DialogTitle className="text-base flex items-center gap-2">
+              <Power className="h-5 w-5 text-amber-500" />
+              Disable job
+            </DialogTitle>
+            <DialogDescription className="text-xs">
+              The systemd timer will be stopped — no further automatic runs. You can re-enable it later from this same dialog.
+            </DialogDescription>
+          </DialogHeader>
+          <div className="text-sm font-mono px-3 py-2 rounded-md border border-border bg-background/40 break-all">
+            {detail?.id}
+          </div>
+          <div className="flex justify-end gap-2">
+            <Button variant="ghost" onClick={() => setShowDisableConfirm(false)}>
+              Cancel
+            </Button>
+            <Button
+              variant="outline"
+              className="bg-amber-500/10 border-amber-500/40 !text-amber-400 hover:bg-amber-500/20 hover:!text-amber-300"
+              onClick={handleToggle}
+            >
+              <Power className="h-3.5 w-3.5 mr-1" />
+              Disable
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
+
+    </>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// ManualJobWatchModal
+// ──────────────────────────────────────────────────────────────
+// Sibling of JobDetailModal but tailored to manual / one-shot jobs.
+// A manual job has no schedule, no retention, no profile picker — and
+// once it has run it can't be re-run or edited (it's a frozen
+// snapshot of one trigger). So the modal collapses to:
+//   - the live log when the job is in flight
+//   - the destination details (only the fields that matter for the
+//     picked backend)
+//   - Close + Delete actions (Edit / Run / Disable don't apply)
+// ──────────────────────────────────────────────────────────────
+function ManualJobWatchModal({
+  jobId,
+  onClose,
+  onChanged,
+}: {
+  jobId: string | null
+  onClose: () => void
+  onChanged: () => void
+}) {
+  const open = jobId !== null
+  const [running, setRunning] = useState(false)
+  const [runBaselineLogPath, setRunBaselineLogPath] = useState<string | null>(null)
+  const [actionError, setActionError] = useState<string | null>(null)
+
+  const { data: detail, mutate: refetch, isLoading } = useSWR<JobDetail>(
+    open ? `/api/host-backups/jobs/${encodeURIComponent(jobId!)}` : null,
+    fetcher,
+    { refreshInterval: running ? 2000 : 0 },
+  )
+  const { data: liveLog } = useSWR<{ content: string; log_path: string | null; size: number }>(
+    open && running ? `/api/host-backups/jobs/${encodeURIComponent(jobId!)}/log` : null,
+    fetcher,
+    { refreshInterval: 1500 },
+  )
+  const liveLogRef = useRef<HTMLPreElement | null>(null)
+  useEffect(() => {
+    if (running && liveLogRef.current) {
+      liveLogRef.current.scrollTop = liveLogRef.current.scrollHeight
+    }
+  }, [liveLog, running])
+
+  // Auto-detect in-progress runs (RUN_AT set but RESULT not yet
+  // persisted) and enter streaming mode on open.
+  useEffect(() => {
+    if (!open || running || !detail) return
+    if (detail.last_run_at && !detail.last_result) {
+      setRunBaselineLogPath(detail.last_log_path ?? null)
+      setRunning(true)
+    }
+  }, [open, running, detail])
+
+  // Exit streaming when both RUN_AT and RESULT are set.
+  useEffect(() => {
+    if (!running || !detail) return
+    if (detail.last_run_at && detail.last_result) {
+      setRunning(false)
+      setRunBaselineLogPath(null)
+      onChanged()
+    }
+  }, [detail, running, onChanged])
+
+  useEffect(() => {
+    if (!open) {
+      setRunning(false)
+      setRunBaselineLogPath(null)
+      setActionError(null)
+    }
+  }, [open])
+
+  const resultBadge = running
+    ? { label: "running", cls: "bg-blue-500/10 border-blue-500/40 text-blue-300" }
+    : detail?.last_result === "ok"
+      ? { label: "ok", cls: "bg-emerald-500/10 border-emerald-500/40 text-emerald-300" }
+      : detail?.last_result
+        ? { label: detail.last_result, cls: "bg-red-500/10 border-red-500/40 text-red-300" }
+        : null
+  const lastRunWhen = formatRunAt(detail?.last_run_at ?? null)
+  const destAccent =
+    detail?.method === "pbs" ? "text-purple-400"
+    : detail?.method === "borg" ? "text-fuchsia-400"
+    : "text-blue-400"
+
+  return (
+    <>
+      <Dialog open={open} onOpenChange={(v) => { if (!v) onClose() }}>
+        <DialogContent className="max-w-3xl bg-card border-border overflow-hidden">
+          <DialogHeader>
+            <DialogTitle className="flex items-center gap-2 flex-wrap text-base">
+              <PlayCircle className="h-5 w-5 text-purple-400" />
+              <span className="font-mono break-all">{detail?.id ?? jobId}</span>
+              {detail && (
+                <>
+                  <Badge variant="outline" className={`text-[10px] uppercase tracking-wide ${methodBadgeCls(detail.method)}`}>
+                    {detail.method}
+                  </Badge>
+                  <Badge variant="outline" className="text-[10px] text-purple-400 border-purple-400/40 bg-purple-500/5">
+                    manual / one-shot
+                  </Badge>
+                </>
+              )}
+            </DialogTitle>
+            <DialogDescription className="text-xs">
+              One-shot backup — captured at the time of the trigger. Cannot be re-run or edited.
+            </DialogDescription>
+          </DialogHeader>
+
+          {actionError && (
+            <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+              {actionError}
+            </div>
+          )}
+
+          {isLoading || !detail ? (
+            <div className="flex items-center gap-2 py-6 text-sm text-muted-foreground">
+              <Loader2 className="h-4 w-4 animate-spin" />
+              Loading job…
+            </div>
+          ) : (
+            <ScrollArea className="max-h-[60vh] pr-2">
+              <div className="space-y-4 text-sm">
+                {/* Status + live log — manual one-shot has no concept
+                    of "last run" (the modal IS the run), so we use a
+                    neutral "Status" header here. */}
+                <section className="space-y-2">
+                  <h4 className="text-xs font-semibold uppercase tracking-wide flex items-center gap-1.5 text-green-500">
+                    <Clock className="h-3.5 w-3.5" /> Status
+                  </h4>
+                  <div className="flex items-center gap-2 flex-wrap text-xs">
+                    {resultBadge ? (
+                      <span className={`px-2 py-0.5 rounded text-[10px] uppercase tracking-wide border inline-flex items-center gap-1 ${resultBadge.cls}`}>
+                        {running && <Loader2 className="h-3 w-3 animate-spin" />}
+                        {resultBadge.label}
+                      </span>
+                    ) : (
+                      <span className="text-muted-foreground">starting…</span>
+                    )}
+                    {lastRunWhen && <span className="text-muted-foreground">{lastRunWhen}</span>}
+                  </div>
+                  {running ? (
+                    (() => {
+                      const sameOldLog =
+                        !!liveLog?.log_path &&
+                        !!runBaselineLogPath &&
+                        liveLog.log_path === runBaselineLogPath
+                      const showContent = liveLog?.content && !sameOldLog
+                      return (
+                        <div className="rounded-md border border-blue-500/40 bg-blue-500/5 p-2">
+                          <pre
+                            ref={liveLogRef}
+                            className="text-[11px] font-mono whitespace-pre-wrap break-all max-h-64 overflow-auto text-foreground/90"
+                          >
+{showContent ? liveLog!.content : "Waiting for runner to start…"}
+                          </pre>
+                          <div className="flex items-center justify-between mt-2">
+                            <span className="text-[10px] text-blue-300 inline-flex items-center gap-1.5">
+                              <Loader2 className="h-3 w-3 animate-spin" />
+                              {showContent ? `live · ${formatBytes(liveLog?.size ?? 0)}` : "starting…"}
+                            </span>
+                            {showContent && liveLog?.log_path && (
+                              <span className="text-[10px] text-muted-foreground font-mono break-all">
+                                {liveLog.log_path}
+                              </span>
+                            )}
+                          </div>
+                        </div>
+                      )
+                    })()
+                  ) : detail.last_log_tail && detail.last_log_tail.length > 0 ? (
+                    <div className="rounded-md border border-border bg-background/60 p-2">
+                      <pre className="text-[11px] font-mono whitespace-pre-wrap break-all max-h-48 overflow-auto text-foreground/90">
+{detail.last_log_tail.join("\n")}
+                      </pre>
+                      <div className="text-[10px] text-muted-foreground mt-2">
+                        tail · {detail.last_log_size > 0 ? formatBytes(detail.last_log_size) : "—"}
+                      </div>
+                    </div>
+                  ) : null}
+                </section>
+
+                {/* Destination — only the fields that apply to the
+                    picked backend. No Schedule/Retention/Profile here
+                    because manual jobs don't carry those. */}
+                <section className="space-y-1">
+                  <h4 className={`text-xs font-semibold uppercase tracking-wide flex items-center gap-1.5 ${destAccent}`}>
+                    <HardDrive className="h-3.5 w-3.5" /> Destination
+                  </h4>
+                  {detail.method === "pbs" && (
+                    <>
+                      {detail.pbs_repository && (
+                        <Field icon={<Server className={`h-3 w-3 ${destAccent} opacity-80`} />} label="repository" value={detail.pbs_repository} mono />
+                      )}
+                      {detail.pbs_backup_id && (
+                        <Field icon={<Archive className={`h-3 w-3 ${destAccent} opacity-80`} />} label="backup-id" value={detail.pbs_backup_id} mono />
+                      )}
+                    </>
+                  )}
+                  {detail.method === "borg" && (
+                    <>
+                      {detail.borg_repo && (
+                        <Field icon={<Server className={`h-3 w-3 ${destAccent} opacity-80`} />} label="repo" value={detail.borg_repo} mono />
+                      )}
+                      <Field icon={<FileSearch className={`h-3 w-3 ${destAccent} opacity-80`} />} label="encryption" value={detail.borg_encrypt_mode} mono />
+                    </>
+                  )}
+                  {detail.method === "local" && detail.local_dest_dir && (
+                    <Field icon={<HardDrive className={`h-3 w-3 ${destAccent} opacity-80`} />} label="dir" value={detail.local_dest_dir} mono />
+                  )}
+                </section>
+              </div>
+            </ScrollArea>
+          )}
+
+        </DialogContent>
+      </Dialog>
+    </>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// PbsKeyfileRecoveryDialog
+// ──────────────────────────────────────────────────────────────
+// Drops the missing PBS keyfile back onto disk by pulling the escrow
+// blob from a keyrecovery backup and decrypting it with the operator's
+// recovery passphrase. Mirrors the shell's hb_pbs_try_keyfile_recovery
+// flow. Triggered from the banner in DestinationsSection when the
+// local keyfile is missing but at least one escrow backup is present
+// on a configured PBS. The backend endpoint surfaces both the current
+// `hostcfg-<host>-keyrecovery` and the legacy
+// `proxmenux-keyrecovery-<host>` naming, so pre-1.2.2.2 escrow blobs
+// stay recoverable without manual migration.
+// ──────────────────────────────────────────────────────────────
+function PbsKeyfileRecoveryDialog({
+  open,
+  snapshots,
+  onClose,
+  onRecovered,
+}: {
+  open: boolean
+  snapshots: Array<{ repo_name: string; repo_repository: string; backup_id: string; source_host: string; backup_time: number; snapshot: string }>
+  onClose: () => void
+  onRecovered: () => void
+}) {
+  const [selectedKey, setSelectedKey] = useState<string>("")
+  const [passphrase, setPassphrase] = useState<string>("")
+  const [busy, setBusy] = useState<boolean>(false)
+  const [error, setError] = useState<string | null>(null)
+
+  useEffect(() => {
+    if (!open) {
+      setSelectedKey("")
+      setPassphrase("")
+      setBusy(false)
+      setError(null)
+      return
+    }
+    if (snapshots.length >= 1 && !selectedKey) {
+      setSelectedKey(`${snapshots[0].repo_name}::${snapshots[0].snapshot}`)
+    }
+  }, [open, snapshots])
+
+  const selected = snapshots.find((s) => `${s.repo_name}::${s.snapshot}` === selectedKey) || null
+
+  async function handleRecover() {
+    if (!selected || !passphrase) return
+    setBusy(true)
+    setError(null)
+    try {
+      await fetchApi("/api/host-backups/pbs-recovery/restore", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          repo_name: selected.repo_name,
+          snapshot: selected.snapshot,
+          passphrase,
+        }),
+      })
+      onRecovered()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => { if (!v && !busy) onClose() }}>
+      <DialogContent className="max-w-lg bg-card border-border">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2 text-base">
+            <Lock className="h-5 w-5 text-emerald-400" />
+            Recover PBS keyfile
+          </DialogTitle>
+          <DialogDescription className="text-xs">
+            The encrypted keyfile blob is downloaded from PBS and decrypted with your recovery passphrase. The resulting key is written to <code className="font-mono">/usr/local/share/proxmenux/pbs-key.conf</code>.
+          </DialogDescription>
+        </DialogHeader>
+
+        {snapshots.length > 1 && (
+          <div className="space-y-1">
+            <Label className="text-xs">Recovery snapshot</Label>
+            <Select value={selectedKey} onValueChange={setSelectedKey}>
+              <SelectTrigger>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {snapshots.map((s) => {
+                  let when: string
+                  try { when = new Date(s.backup_time * 1000).toLocaleString() }
+                  catch { when = String(s.backup_time) }
+                  return (
+                    <SelectItem key={`${s.repo_name}::${s.snapshot}`} value={`${s.repo_name}::${s.snapshot}`}>
+                      <span className="font-mono">{s.source_host}</span>
+                      <span className="text-muted-foreground ml-2">— {s.repo_name} · {when}</span>
+                    </SelectItem>
+                  )
+                })}
+              </SelectContent>
+            </Select>
+            <p className="text-[11px] text-muted-foreground">
+              Pick the source host whose passphrase you remember — each install uploads its own escrow.
+            </p>
+          </div>
+        )}
+
+        {selected && (
+          <div className="text-xs space-y-1 px-3 py-2 rounded-md border border-border bg-background/40">
+            <div className="flex items-center gap-2">
+              <span className="text-muted-foreground">Source host:</span>
+              <span className="font-mono">{selected.source_host}</span>
+            </div>
+            <div className="flex items-center gap-2">
+              <span className="text-muted-foreground">PBS:</span>
+              <span className="font-mono break-all">{selected.repo_repository}</span>
+            </div>
+          </div>
+        )}
+
+        <div>
+          <Label htmlFor="recoveryPass" className="text-xs">Recovery passphrase</Label>
+          <Input
+            id="recoveryPass"
+            type="password"
+            value={passphrase}
+            onChange={(e) => setPassphrase(e.target.value)}
+            placeholder="The passphrase set when the keyfile was created"
+            className="font-mono mt-1"
+            autoFocus
+            onKeyDown={(e) => {
+              if (e.key === "Enter" && passphrase && !busy) handleRecover()
+            }}
+          />
+        </div>
+
+        {error && (
+          <div className="text-xs text-red-500 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10 whitespace-pre-wrap break-words">
+            {error}
+          </div>
+        )}
+
+        <div className="flex justify-end gap-2">
+          <Button variant="ghost" onClick={onClose} disabled={busy}>
+            Cancel
+          </Button>
+          <Button
+            className="bg-green-600 hover:bg-green-700 text-white"
+            disabled={!selected || !passphrase || busy}
+            onClick={handleRecover}
+          >
+            {busy ? (
+              <Loader2 className="h-4 w-4 mr-2 animate-spin" />
+            ) : (
+              <Lock className="h-4 w-4 mr-2" />
+            )}
+            Recover keyfile
+          </Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// ArchiveContentsModal
+// ──────────────────────────────────────────────────────────────
+// "View contents" of any backup snapshot. Calls /inspect-archive
+// (extract to staging + parse_manifest + run_restore dry-run +
+// walk rootfs + cleanup) and renders the JSON as a HTML report.
+// Same shape regardless of backend so the operator gets a
+// consistent view across PBS, Borg and local.
+// ──────────────────────────────────────────────────────────────
+
+interface InspectResponse {
+  manifest?: any
+  manifest_error?: string
+  manifest_missing?: boolean
+  plan?: any
+  plan_error?: string
+  plan_raw_stderr?: string
+  files?: Array<{ path: string; size: number }>
+  files_truncated?: boolean
+  files_total_count?: number
+  metadata_files?: Record<string, string>
+  rollback_plan?: RollbackPlan
+}
+
+interface RollbackPlan {
+  backup_time?: string
+  vms_in_backup: number[]
+  vms_in_host: number[]
+  vms_to_remove: number[]
+  vms_to_restore: number[]
+  lxcs_in_backup: number[]
+  lxcs_in_host: number[]
+  lxcs_to_remove: number[]
+  lxcs_to_restore: number[]
+  components_to_uninstall: string[]
+  components_to_reinstall: string[]
+}
+
+function ArchiveContentsModal({
+  open,
+  onClose,
+  source,
+  repo_name,
+  snapshot,
+  path,
+  display_id,
+}: {
+  open: boolean
+  onClose: () => void
+  source: "pbs" | "borg" | "local" | null
+  repo_name?: string
+  snapshot?: string
+  path?: string
+  display_id?: string
+}) {
+  const [data, setData] = useState<InspectResponse | null>(null)
+  const [loading, setLoading] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  useEffect(() => {
+    if (!open || !source) {
+      setData(null)
+      setError(null)
+      setLoading(false)
+      return
+    }
+    const body: Record<string, string> = { source }
+    if (source === "local") {
+      if (!path) { setError("Local archive path missing"); return }
+      body.path = path
+    } else {
+      if (!repo_name || !snapshot) { setError("repo_name and snapshot required"); return }
+      body.repo_name = repo_name
+      body.snapshot = snapshot
+    }
+    setLoading(true)
+    setError(null)
+    fetchApi("/api/host-backups/inspect-archive", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    })
+      .then((r: any) => setData(r))
+      .catch((e) => setError(e instanceof Error ? e.message : String(e)))
+      .finally(() => setLoading(false))
+  }, [open, source, repo_name, snapshot, path])
+
+  const manifest = data?.manifest
+  const plan = data?.plan
+  const files = data?.files
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => { if (!v) onClose() }}>
+      <DialogContent className="max-w-4xl bg-card border-border h-[85vh] flex flex-col p-0">
+        <DialogHeader className="px-6 pt-6 pb-3 shrink-0">
+          <DialogTitle className="flex items-center gap-2 text-base">
+            <Eye className="h-5 w-5 text-blue-400" />
+            Backup contents
+          </DialogTitle>
+          <DialogDescription className="text-xs font-mono break-all">
+            {display_id}
+          </DialogDescription>
+        </DialogHeader>
+
+        {loading && (
+          <div className="flex items-center gap-3 py-12 justify-center text-sm text-muted-foreground px-6">
+            <Loader2 className="h-5 w-5 animate-spin" />
+            Extracting snapshot and analyzing — this may take a minute on large backups…
+          </div>
+        )}
+
+        {error && !loading && (() => {
+          const kf = parseKeyfileError(error)
+          return kf ? (
+            <div className="px-6"><KeyfileErrorBlock err={kf} /></div>
+          ) : (
+            <div className="text-sm text-red-400 px-3 py-3 mx-6 rounded-md border border-red-500/30 bg-red-500/10">
+              {error}
+            </div>
+          )
+        })()}
+
+        {data && !loading && (
+          <ScrollArea className="flex-1 min-h-0 px-6">
+            <div className="space-y-4 pr-2">
+              <ContentsSection icon={Info} title="Manifest" iconColor="text-blue-400">
+                {manifest ? (
+                  <ManifestGrid manifest={manifest} />
+                ) : data.manifest_missing ? (
+                  <div className="text-xs text-muted-foreground italic">
+                    This backup doesn't include a manifest.json. Manifest is generated by the collectors pipeline (not yet wired into the backup runner). The Metadata files below carry the equivalent info: <code className="font-mono">run_info.env</code>, <code className="font-mono">pveversion.txt</code>, <code className="font-mono">selected_paths.txt</code>.
+                  </div>
+                ) : data.manifest_error ? (
+                  <div className="text-xs text-amber-400">{data.manifest_error}</div>
+                ) : (
+                  <div className="text-xs text-muted-foreground italic">No manifest in this archive.</div>
+                )}
+              </ContentsSection>
+
+              {(() => {
+                // Only render plan/storage/network/drivers sections
+                // when they actually carry information — otherwise
+                // they read as "Unknown / No entries reported / No
+                // changes planned" walls of noise.
+                const blockers = plan?.preflight?.blockers || plan?.blockers || []
+                const warnings = plan?.preflight?.warnings || plan?.warnings || []
+                const planStatus = plan?.status || plan?.preflight?.status
+                const planHasInfo = blockers.length > 0 || warnings.length > 0
+                  || (planStatus && planStatus !== "unknown")
+                const storageEntries = (plan?.storage?.entries || plan?.storage?.storages || [])
+                const networkIfaces = (plan?.network?.interfaces || plan?.network?.remap || [])
+                const driverList = (plan?.drivers?.plan || plan?.drivers?.components || plan?.drivers?.entries || [])
+                return (
+                  <>
+                    {planHasInfo && (
+                      <ContentsSection icon={ListTree} title="Restore plan" iconColor="text-emerald-400">
+                        <PlanSummary plan={plan} />
+                      </ContentsSection>
+                    )}
+                    {storageEntries.length > 0 && (
+                      <ContentsSection icon={HardDrive} title="Storage" iconColor="text-amber-400">
+                        <StorageSection storage={plan.storage} />
+                      </ContentsSection>
+                    )}
+                    {networkIfaces.length > 0 && (
+                      <ContentsSection icon={Network} title="Network" iconColor="text-purple-400">
+                        <NetworkSection network={plan.network} />
+                      </ContentsSection>
+                    )}
+                    {driverList.length > 0 && (
+                      <ContentsSection icon={Cpu} title="Drivers to reinstall" iconColor="text-cyan-400">
+                        <DriversSection drivers={plan.drivers} />
+                      </ContentsSection>
+                    )}
+                  </>
+                )
+              })()}
+
+              {data.rollback_plan && (
+                <ContentsSection icon={History} title="Rollback plan" iconColor="text-blue-400">
+                  <RollbackPlanView plan={data.rollback_plan} />
+                </ContentsSection>
+              )}
+
+              {files && files.length > 0 && (
+                <ContentsSection
+                  icon={Package}
+                  title={`Files (${data.files_total_count ?? files.length}${data.files_truncated ? "+" : ""})`}
+                  iconColor="text-fuchsia-400"
+                >
+                  <FilesTree files={files} truncated={data.files_truncated} />
+                </ContentsSection>
+              )}
+
+              {data.metadata_files && Object.keys(data.metadata_files).length > 0 && (
+                <ContentsSection icon={FileText} title="Metadata files" iconColor="text-muted-foreground">
+                  <div className="space-y-3">
+                    {Object.entries(data.metadata_files).map(([fname, content]) => (
+                      <div key={fname}>
+                        <div className="text-[10px] uppercase tracking-wider text-muted-foreground mb-1 font-mono">{fname}</div>
+                        <pre className="text-[11px] font-mono whitespace-pre-wrap break-all max-h-40 overflow-auto rounded border border-border bg-background/40 p-2 text-foreground/80">
+                          {content}
+                        </pre>
+                      </div>
+                    ))}
+                  </div>
+                </ContentsSection>
+              )}
+
+              {data.plan_error && !data.manifest_missing && (
+                <div className="text-[11px] text-amber-400 italic">
+                  Restore plan unavailable: {data.plan_error}
+                </div>
+              )}
+            </div>
+          </ScrollArea>
+        )}
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+function ContentsSection({
+  icon: Icon,
+  iconColor,
+  title,
+  children,
+}: {
+  icon: any
+  iconColor?: string
+  title: string
+  children: React.ReactNode
+}) {
+  return (
+    <section className="rounded-md border border-border bg-background/40 p-3 space-y-2">
+      <h3 className="text-xs font-semibold uppercase tracking-wider flex items-center gap-1.5">
+        <Icon className={`h-3.5 w-3.5 ${iconColor || "text-muted-foreground"}`} />
+        {title}
+      </h3>
+      {children}
+    </section>
+  )
+}
+
+function ManifestGrid({ manifest }: { manifest: any }) {
+  // The manifest follows the proxmenux_backup_manifest schema:
+  //   {source_host: {hostname, pve_version, kernel, boot_mode, cpu_model, memory_kb, roles},
+  //    hardware_inventory: {gpu, tpu, nic, wireless},
+  //    storage_inventory: {zfs_pools, lvm, physical_disks, pve_storage_cfg, mounts},
+  //    proxmenux_installed_components: [...],
+  //    kernel_params: {...},
+  //    vms_lxcs_at_backup: {vms, lxcs},
+  //    backup_metadata: {paths_archived, encrypted, compression, ...},
+  //    created_at, created_by}
+  // So .source_host is an OBJECT — passing it raw to String() gave
+  // the dreaded "[object Object]".
+  const src = manifest.source_host || {}
+  const meta = manifest.backup_metadata || {}
+  const hw = manifest.hardware_inventory || {}
+  const guests = manifest.vms_lxcs_at_backup || {}
+  const rows: Array<[string, any]> = []
+  const push = (k: string, v: any) => {
+    if (v === undefined || v === null || v === "") return
+    rows.push([k, v])
+  }
+  push("Source host", src.hostname || manifest.hostname)
+  push("Created at", manifest.created_at || meta.created_at)
+  push("Kernel", src.kernel || manifest.kernel)
+  push("Proxmox version", src.pve_version || manifest.pve_version)
+  push("Boot mode", src.boot_mode)
+  push("CPU", src.cpu_model)
+  push("Memory", src.memory_kb ? `${(src.memory_kb / 1024 / 1024).toFixed(1)} GB` : undefined)
+  push("Roles", Array.isArray(src.roles) && src.roles.length ? src.roles.join(", ") : undefined)
+  push("GPUs", Array.isArray(hw.gpu) && hw.gpu.length ? `${hw.gpu.length} device(s)` : undefined)
+  push("NICs", Array.isArray(hw.nic) && hw.nic.length ? `${hw.nic.length} interface(s)` : undefined)
+  push("VMs at backup", Array.isArray(guests.vms) ? guests.vms.length : undefined)
+  push("LXCs at backup", Array.isArray(guests.lxcs) ? guests.lxcs.length : undefined)
+  push("Compression", meta.compression)
+  push("Encrypted", meta.encrypted === true ? "yes" : meta.encrypted === false ? "no" : undefined)
+  push("Paths archived", Array.isArray(meta.paths_archived) ? `${meta.paths_archived.length} paths` : undefined)
+  push("Built by", manifest.created_by)
+  return (
+    <div className="grid grid-cols-1 sm:grid-cols-2 gap-x-4 gap-y-1 text-xs">
+      {rows.map(([k, v]) => (
+        <div key={k}>
+          <span className="text-muted-foreground">{k}:</span>{" "}
+          <code className="font-mono text-foreground/90 break-all">{String(v)}</code>
+        </div>
+      ))}
+    </div>
+  )
+}
+
+function PlanSummary({ plan }: { plan: any }) {
+  const status = plan.status || plan.preflight?.status || "unknown"
+  const blockers: any[] = plan.preflight?.blockers || plan.blockers || []
+  const warnings: any[] = plan.preflight?.warnings || plan.warnings || []
+  const StatusIcon = status === "ok" ? CheckCircle2 : status === "warn" ? AlertTriangle : XCircle
+  const statusColor = status === "ok" ? "text-emerald-400" : status === "warn" ? "text-amber-400" : "text-red-400"
+  return (
+    <div className="space-y-2 text-xs">
+      <div className="flex items-center gap-2">
+        <StatusIcon className={`h-4 w-4 ${statusColor}`} />
+        <span className="font-medium capitalize">{status}</span>
+      </div>
+      {blockers.length > 0 && (
+        <div>
+          <div className="text-[10px] uppercase tracking-wider text-red-400 mb-1">Blockers</div>
+          <ul className="space-y-0.5 ml-4 list-disc">
+            {blockers.map((b, i) => (
+              <li key={i} className="text-red-400">{typeof b === "string" ? b : (b.message || JSON.stringify(b))}</li>
+            ))}
+          </ul>
+        </div>
+      )}
+      {warnings.length > 0 && (
+        <div>
+          <div className="text-[10px] uppercase tracking-wider text-amber-400 mb-1">Warnings</div>
+          <ul className="space-y-0.5 ml-4 list-disc">
+            {warnings.map((w, i) => (
+              <li key={i} className="text-amber-400">{typeof w === "string" ? w : (w.message || JSON.stringify(w))}</li>
+            ))}
+          </ul>
+        </div>
+      )}
+      {blockers.length === 0 && warnings.length === 0 && (
+        <div className="text-muted-foreground italic">No blockers or warnings detected.</div>
+      )}
+    </div>
+  )
+}
+
+function StorageSection({ storage }: { storage: any }) {
+  const entries: any[] = storage.entries || storage.storages || []
+  if (entries.length === 0) {
+    return <div className="text-xs text-muted-foreground italic">No storage entries reported.</div>
+  }
+  return (
+    <ul className="space-y-1 text-xs">
+      {entries.map((e: any, i: number) => {
+        const ok = e.status === "ok" || e.matches
+        const Icon = ok ? CheckCircle2 : AlertTriangle
+        const color = ok ? "text-emerald-400" : "text-amber-400"
+        return (
+          <li key={i} className="flex items-start gap-2">
+            <Icon className={`h-3.5 w-3.5 mt-0.5 shrink-0 ${color}`} />
+            <div className="min-w-0 flex-1">
+              <code className="font-mono">{e.name || e.storage || `entry ${i}`}</code>
+              {e.type && <span className="text-muted-foreground ml-2">{e.type}</span>}
+              {e.message && <div className="text-muted-foreground text-[11px]">{e.message}</div>}
+            </div>
+          </li>
+        )
+      })}
+    </ul>
+  )
+}
+
+function NetworkSection({ network }: { network: any }) {
+  const ifaces: any[] = network.interfaces || network.remap || []
+  if (ifaces.length === 0) {
+    return <div className="text-xs text-muted-foreground italic">No interface changes planned.</div>
+  }
+  return (
+    <ul className="space-y-1 text-xs">
+      {ifaces.map((nic: any, i: number) => (
+        <li key={i} className="flex items-start gap-2">
+          <Network className="h-3.5 w-3.5 mt-0.5 shrink-0 text-purple-400" />
+          <div className="min-w-0 flex-1">
+            <code className="font-mono">{nic.source || nic.from || "?"}</code>
+            <span className="text-muted-foreground mx-2">→</span>
+            <code className="font-mono">{nic.target || nic.to || "?"}</code>
+            {nic.action && <span className="text-[10px] text-muted-foreground ml-2">{nic.action}</span>}
+          </div>
+        </li>
+      ))}
+    </ul>
+  )
+}
+
+function DriversSection({ drivers }: { drivers: any }) {
+  const list: any[] = drivers.plan || drivers.components || drivers.entries || []
+  if (list.length === 0) {
+    return <div className="text-xs text-muted-foreground italic">No drivers to reinstall.</div>
+  }
+  return (
+    <ul className="space-y-1 text-xs">
+      {list.map((d: any, i: number) => (
+        <li key={i} className="flex items-start gap-2">
+          <Cpu className="h-3.5 w-3.5 mt-0.5 shrink-0 text-cyan-400" />
+          <div className="min-w-0 flex-1">
+            <code className="font-mono">{d.name || d.id || `driver ${i}`}</code>
+            {d.action && <span className="text-muted-foreground ml-2">{d.action}</span>}
+            {d.detail && <div className="text-muted-foreground text-[11px]">{d.detail}</div>}
+          </div>
+        </li>
+      ))}
+    </ul>
+  )
+}
+
+function FilesTree({ files, truncated }: { files: Array<{ path: string; size: number }>; truncated?: boolean }) {
+  const [query, setQuery] = useState("")
+  const filtered = query
+    ? files.filter((f) => f.path.toLowerCase().includes(query.toLowerCase()))
+    : files
+  return (
+    <div className="space-y-2">
+      <Input
+        type="search"
+        value={query}
+        onChange={(e) => setQuery(e.target.value)}
+        placeholder="Filter paths…"
+        className="h-8 text-xs"
+      />
+      <div className="max-h-72 overflow-auto rounded border border-border bg-background/40">
+        <ul className="text-[11px] font-mono divide-y divide-border/30">
+          {filtered.slice(0, 2000).map((f) => (
+            <li key={f.path} className="flex items-center justify-between gap-3 px-2 py-1 hover:bg-white/5">
+              <span className="truncate" title={f.path}>{f.path}</span>
+              <span className="text-muted-foreground shrink-0">{formatBytes(f.size)}</span>
+            </li>
+          ))}
+        </ul>
+      </div>
+      <div className="text-[10px] text-muted-foreground flex items-center gap-2">
+        Showing {Math.min(filtered.length, 2000)} of {filtered.length}{query ? " filtered" : ""}{filtered.length !== files.length ? ` (total ${files.length})` : ""}
+        {truncated && <span className="text-amber-400">· list truncated at 5000 — open the snapshot manually to see the rest</span>}
+      </div>
+    </div>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// RollbackPlanView
+// ──────────────────────────────────────────────────────────────
+// Visualizes what a "restore to backup state" would do — surfaces
+// the irreversible parts (VMs/LXCs to delete, components to
+// uninstall) in red, the safe re-apply parts in green. Drives the
+// operator confirmation in the Complete restore flow.
+// ──────────────────────────────────────────────────────────────
+function RollbackPlanView({ plan }: { plan: RollbackPlan }) {
+  // The destructive "Not in backup — will be deleted on rollback"
+  // block was removed: operators read it as an action ProxMenux
+  // would take silently. We only show the "Configurations included
+  // in backup" section now, which is purely informative.
+  const hasRollback = (plan.vms_to_restore?.length || 0) > 0
+    || (plan.lxcs_to_restore?.length || 0) > 0
+    || (plan.components_to_reinstall?.length || 0) > 0
+
+  if (!hasRollback) {
+    return (
+      <div className="text-xs text-muted-foreground italic">
+        No host-state differences detected — the backup state matches the current host (or the backup didn't include /etc/pve).
+      </div>
+    )
+  }
+
+  // Pill renders inline with proper flex wrapping so dozens of VM
+  // IDs don't overflow the modal on mobile (previous version used
+  // raw spaces between pills and any value past the viewport got
+  // clipped).
+  const Pill = ({ children }: { children: any }) => (
+    <code className="font-mono px-1.5 py-0.5 rounded border bg-emerald-500/10 border-emerald-500/30 text-emerald-300 text-[11px]">
+      {children}
+    </code>
+  )
+  // Each pill is a direct flex child of the row (no inner wrapper)
+  // so flex-wrap can break a long list of IDs mid-row on mobile.
+  // The previous nested `<div className="flex flex-wrap">` wouldn't
+  // wrap because its width was capped by the parent's flex layout,
+  // and the whole block would overflow the modal instead.
+  const Row = ({ label, items }: { label: string; items: (string | number)[] }) => (
+    <div className="flex flex-wrap items-baseline gap-x-2 gap-y-1.5">
+      <span className="text-muted-foreground shrink-0">{label}</span>
+      {items.map((id) => <Pill key={id}>{id}</Pill>)}
+    </div>
+  )
+
+  return (
+    <div className="rounded-md border border-emerald-500/40 bg-emerald-500/5 p-3 space-y-2 text-xs">
+      <div className="text-[11px] font-semibold uppercase tracking-wider text-emerald-400">
+        Configurations included in backup
+      </div>
+      {plan.vms_to_restore.length > 0 && (
+        <Row label="VM configs:" items={plan.vms_to_restore} />
+      )}
+      {plan.lxcs_to_restore.length > 0 && (
+        <Row label="LXC configs:" items={plan.lxcs_to_restore} />
+      )}
+      {plan.components_to_reinstall.length > 0 && (
+        <Row label="Components:" items={plan.components_to_reinstall} />
+      )}
+      <div className="text-[10px] text-muted-foreground pt-1">
+        Only the /etc/pve config is restored — disk images stay where they live.
+      </div>
+    </div>
+  )
+}
+
+// ──────────────────────────────────────────────────────────────
+// RestoreOptionsModal
+// ──────────────────────────────────────────────────────────────
+// Two-step UI for restoring a snapshot:
+//   Step 1 — pick Complete restore vs Custom by paths.
+//   Step 2 — if Custom, tick the paths to restore.
+// `pathsAvailable` is what the backend's list_paths.sh detected
+// in this specific backup (default profile + operator extras).
+// Perfect parity with the TUI's _rs_select_component_paths after
+// the paths-not-components refactor.
+// ──────────────────────────────────────────────────────────────
+
+function RestoreOptionsModal({
+  open,
+  onClose,
+  stagingPath,
+  pathsAvailable,
+  rollbackPlan,
+  crossKernel,
+  hydration,
+  display_id,
+  onLaunch,
+}: {
+  open: boolean
+  onClose: () => void
+  stagingPath: string
+  pathsAvailable: string[]
+  rollbackPlan?: RollbackPlan
+  crossKernel?: {
+    direction: "same" | "bk_older" | "bk_newer"
+    backupKernel: string
+    targetKernel: string
+    blockedPaths: string[]
+  }
+  hydration?: {
+    applies: boolean
+    actions: string[]
+  }
+  display_id?: string
+  onLaunch: (mode: "full" | "custom", paths: string[], rollbackExecute?: boolean) => void
+}) {
+  // When direction === "bk_older" the CLI-side filter (RS_SKIP_PATHS)
+  // will drop these prefixes from any restore. We mirror that
+  // behavior in the picker so the operator can see what will be
+  // skipped rather than being surprised at run time.
+  const isBkOlder = crossKernel?.direction === "bk_older"
+  const blockedPrefixes = isBkOlder ? (crossKernel?.blockedPaths ?? []) : []
+  const isPathBlocked = (p: string) =>
+    blockedPrefixes.some((b) => p === b || p.startsWith(b.endsWith("/") ? b : `${b}/`))
+  const [step, setStep] = useState<"choose" | "custom">("choose")
+  const [selected, setSelected] = useState<Set<string>>(new Set())
+  const [error, setError] = useState<string | null>(null)
+  const [filter, setFilter] = useState<string>("")
+  const [destructiveAck, setDestructiveAck] = useState<boolean>(false)
+
+  // A Complete restore on a host that has VMs/LXCs/components NOT
+  // present in the backup is destructive (those entries get removed
+  // at next boot by apply_cluster_postboot.sh's rollback step). We
+  // force the operator to tick an explicit "I understand" checkbox
+  // before enabling the launch button.
+  const hasDestructive = !!rollbackPlan && (
+    (rollbackPlan.vms_to_remove?.length || 0) > 0
+    || (rollbackPlan.lxcs_to_remove?.length || 0) > 0
+    || (rollbackPlan.components_to_uninstall?.length || 0) > 0
+  )
+
+  useEffect(() => {
+    if (!open) {
+      setStep("choose")
+      setSelected(new Set())
+      setError(null)
+      setFilter("")
+      setDestructiveAck(false)
+    }
+  }, [open])
+
+  const togglePath = (p: string) => {
+    if (isPathBlocked(p)) return
+    setSelected((prev) => {
+      const next = new Set(prev)
+      if (next.has(p)) next.delete(p)
+      else next.add(p)
+      return next
+    })
+  }
+
+  const toggleAll = () => {
+    const selectable = filteredPaths.filter((p) => !isPathBlocked(p))
+    if (selected.size === selectable.length) {
+      setSelected(new Set())
+    } else {
+      setSelected(new Set(selectable))
+    }
+  }
+
+  const filteredPaths = filter
+    ? pathsAvailable.filter((p) => p.toLowerCase().includes(filter.toLowerCase()))
+    : pathsAvailable
+  const selectableCount = filteredPaths.filter((p) => !isPathBlocked(p)).length
+
+  const launch = (mode: "full" | "custom") => {
+    if (mode === "custom" && selected.size === 0) {
+      setError("Pick at least one path to continue.")
+      return
+    }
+    setError(null)
+    onLaunch(mode, Array.from(selected), mode === "full" && hasDestructive && destructiveAck)
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => { if (!v && step !== "preparing") onClose() }}>
+      <DialogContent className="max-w-2xl bg-card border-border">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2 text-base">
+            <DatabaseBackup className="h-5 w-5 text-emerald-400" />
+            Restore — choose mode
+          </DialogTitle>
+          <DialogDescription className="text-xs font-mono break-all">
+            {display_id}
+          </DialogDescription>
+        </DialogHeader>
+
+        {step === "choose" && (
+          <div className="space-y-3">
+            {/* Post-restore Monitor hint — the Backups tab renders a live
+                progress card driven by /var/lib/proxmenux/restore-state.json,
+                so the operator has a place to watch component reinstalls,
+                sanity warnings, and the rollback delta after the reboot. */}
+            <div className="rounded-md border border-blue-500/40 bg-blue-500/5 p-3 text-[11px] text-muted-foreground flex items-start gap-2">
+              <History className="h-3.5 w-3.5 text-blue-400 shrink-0 mt-0.5" />
+              <div>
+                After the reboot, this Backups tab will show a live post-restore progress card with estimated time, per-component status, log tail and rollback delta. If Telegram/Discord/ntfy notifications are configured, you'll also receive the "Host restore finished" event.
+              </div>
+            </div>
+
+            {isBkOlder && (
+              <div className="rounded-md border border-amber-500/50 bg-amber-500/5 p-3">
+                <div className="text-[11px] font-semibold uppercase tracking-wider text-amber-400 flex items-center gap-1.5">
+                  <AlertTriangle className="h-3.5 w-3.5" />
+                  Cross-kernel restore — safe subset only
+                </div>
+                <div className="text-[11px] text-muted-foreground mt-2 space-y-1.5">
+                  <div>
+                    Backup kernel <code className="font-mono">{crossKernel?.backupKernel}</code> is older than target kernel <code className="font-mono">{crossKernel?.targetKernel}</code>.
+                  </div>
+                  <div>
+                    Both Complete and Custom restore will automatically skip kernel/boot-tied paths to avoid a kernel panic on next boot. Everything else (VMs, LXCs, network, components, custom paths) restores normally.
+                  </div>
+                  {blockedPrefixes.length > 0 && (
+                    <details className="mt-1.5">
+                      <summary className="cursor-pointer text-amber-400/90 hover:text-amber-300">
+                        Paths that will be skipped ({blockedPrefixes.length})
+                      </summary>
+                      <ul className="mt-1.5 pl-3 space-y-0.5 max-h-40 overflow-auto">
+                        {blockedPrefixes.map((p) => (
+                          <li key={p} className="font-mono text-[10.5px] text-muted-foreground/80 break-all">{p}</li>
+                        ))}
+                      </ul>
+                    </details>
+                  )}
+                </div>
+              </div>
+            )}
+
+            {isBkOlder && hydration?.applies && hydration.actions.length > 0 && (
+              <div className="rounded-md border border-emerald-500/50 bg-emerald-500/5 p-3">
+                <div className="text-[11px] font-semibold uppercase tracking-wider text-emerald-400 flex items-center gap-1.5">
+                  <CheckCircle2 className="h-3.5 w-3.5" />
+                  Operator config re-applied via kernel-agnostic merge
+                </div>
+                <div className="text-[11px] text-muted-foreground mt-2 space-y-1.5">
+                  <div>
+                    The following operator-authored settings will be merged into the target automatically, without touching kernel-tied defaults. Runs on both Complete and Custom restore.
+                  </div>
+                  <ul className="mt-1.5 pl-3 space-y-0.5 max-h-40 overflow-auto">
+                    {hydration.actions.map((a, i) => (
+                      <li key={`${a}-${i}`} className="text-[10.5px] text-emerald-300/90 break-all">
+                        <span className="text-emerald-500 mr-1">•</span>{a}
+                      </li>
+                    ))}
+                  </ul>
+                </div>
+              </div>
+            )}
+
+            {/* Surface destructive deltas BEFORE the operator picks
+                Complete. Custom-by-paths can't trigger these
+                (paths-only restore doesn't touch the guest list or
+                components_status.json), so the warning lives here. */}
+            {rollbackPlan && hasDestructive && (
+              <div className="rounded-md border border-red-500/50 bg-red-500/5 p-3 space-y-3">
+                <div className="text-[11px] font-semibold uppercase tracking-wider text-red-400 flex items-center gap-1.5">
+                  <AlertTriangle className="h-3.5 w-3.5" />
+                  Complete restore will REMOVE the following (created after the backup)
+                </div>
+                <RollbackPlanView plan={rollbackPlan} />
+                <label className="flex items-start gap-2 cursor-pointer text-xs">
+                  <Checkbox
+                    checked={destructiveAck}
+                    onCheckedChange={(v) => setDestructiveAck(!!v)}
+                    className="mt-0.5"
+                  />
+                  <span className="text-foreground">
+                    I understand that Complete restore will <strong className="text-red-400">permanently delete</strong> the VMs, LXCs and components listed above. This is irreversible.
+                  </span>
+                </label>
+              </div>
+            )}
+
+            <button
+              type="button"
+              onClick={() => launch("full")}
+              disabled={hasDestructive && !destructiveAck}
+              className="w-full text-left p-4 rounded-md border border-emerald-500/40 bg-emerald-500/5 hover:bg-emerald-500/10 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+            >
+              <div className="flex items-start gap-3">
+                <CheckCircle2 className="h-5 w-5 text-emerald-400 shrink-0 mt-0.5" />
+                <div className="flex-1 min-w-0">
+                  <div className="text-sm font-medium">Complete restore</div>
+                  <div className="text-[11px] text-muted-foreground mt-1">
+                    Replays everything in the backup. Equivalent to picking <em>"Complete restore"</em> in the shell TUI menu. The terminal that opens next will still ask you to confirm safe-only vs safe+reboot vs all-at-once before touching the host.
+                    {hasDestructive && !destructiveAck && (
+                      <span className="block mt-1 text-red-400">Tick the acknowledgement above to enable.</span>
+                    )}
+                  </div>
+                </div>
+              </div>
+            </button>
+
+            <button
+              type="button"
+              onClick={() => setStep("custom")}
+              disabled={pathsAvailable.length === 0}
+              className="w-full text-left p-4 rounded-md border border-blue-500/40 bg-blue-500/5 hover:bg-blue-500/10 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+            >
+              <div className="flex items-start gap-3">
+                <ListTree className="h-5 w-5 text-blue-400 shrink-0 mt-0.5" />
+                <div className="flex-1 min-w-0">
+                  <div className="text-sm font-medium">
+                    Custom restore by paths
+                    {pathsAvailable.length > 0 && (
+                      <span className="ml-2 text-[10px] text-muted-foreground font-normal">
+                        ({pathsAvailable.length} paths in backup)
+                      </span>
+                    )}
+                  </div>
+                  <div className="text-[11px] text-muted-foreground mt-1">
+                    {pathsAvailable.length === 0
+                      ? "This backup carries no restorable paths — only Complete restore is meaningful here."
+                      : "Pick exactly which paths to restore. Lists what's actually in this backup (default profile + your custom paths)."}
+                  </div>
+                </div>
+              </div>
+            </button>
+
+            {error && (
+              <div className="text-xs text-red-400 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10">
+                {error}
+              </div>
+            )}
+          </div>
+        )}
+
+        {step === "custom" && (
+          <div className="space-y-2">
+            <p className="text-[11px] text-muted-foreground">
+              Pick the paths to restore. Your selection feeds <code className="font-mono">_rs_run_custom_restore</code> via the <code className="font-mono">HB_PRESELECTED_PATHS</code> env var — same downstream code as the TUI. Reboot-required paths (kernel, modules, fstab, …) will be detected by the bash flow and you can schedule them for next boot from there.
+            </p>
+            <div className="flex items-center gap-2">
+              <Input
+                type="search"
+                value={filter}
+                onChange={(e) => setFilter(e.target.value)}
+                placeholder="Filter paths…"
+                className="h-8 text-xs"
+              />
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                onClick={toggleAll}
+                className="h-8 text-xs whitespace-nowrap"
+              >
+                {selected.size === selectableCount && selectableCount > 0 ? "Clear" : "All"}
+              </Button>
+            </div>
+            {isBkOlder && (
+              <div className="text-[10.5px] text-amber-400/90 px-2 py-1.5 rounded border border-amber-500/30 bg-amber-500/5">
+                Kernel/boot-tied paths are grayed out and cannot be selected — target runs a newer kernel.
+              </div>
+            )}
+            <div className="rounded-md border border-border bg-background/40 p-1 max-h-72 overflow-auto">
+              <ul className="divide-y divide-border/40">
+                {filteredPaths.map((p) => {
+                  const blocked = isPathBlocked(p)
+                  return (
+                    <li key={p}>
+                      <label
+                        className={`flex items-center gap-2 px-2 py-1 ${blocked ? "opacity-40 cursor-not-allowed" : "hover:bg-white/5 cursor-pointer"}`}
+                        title={blocked ? "Skipped: kernel-tied path, target runs a newer kernel" : undefined}
+                      >
+                        <Checkbox
+                          checked={!blocked && selected.has(p)}
+                          disabled={blocked}
+                          onCheckedChange={() => togglePath(p)}
+                        />
+                        <code className={`font-mono text-xs break-all flex-1 ${blocked ? "line-through" : ""}`}>{p}</code>
+                        {blocked && (
+                          <span className="text-[10px] text-amber-400/80 font-normal shrink-0">skipped</span>
+                        )}
+                      </label>
+                    </li>
+                  )
+                })}
+                {filteredPaths.length === 0 && (
+                  <li className="text-[11px] text-muted-foreground italic px-2 py-2">No paths match the filter.</li>
+                )}
+              </ul>
+            </div>
+            <div className="text-[11px] text-muted-foreground">
+              Selected: {selected.size} / {isBkOlder ? selectableCount : pathsAvailable.length}{filter && filteredPaths.length !== pathsAvailable.length ? ` (${filteredPaths.length} shown)` : ""}
+            </div>
+            {error && (
+              <div className="text-xs text-red-400 px-3 py-2 rounded-md border border-red-500/30 bg-red-500/10">
+                {error}
+              </div>
+            )}
+          </div>
+        )}
+
+        <div className="flex justify-end gap-2 pt-2 border-t border-border">
+          {step === "custom" && (
+            <Button variant="ghost" onClick={() => setStep("choose")}>
+              Back
+            </Button>
+          )}
+          <Button variant="ghost" onClick={onClose}>
+            Cancel
+          </Button>
+          {step === "custom" && (
+            <Button
+              onClick={() => launch("custom")}
+              disabled={selected.size === 0}
+              className="bg-green-600 hover:bg-green-700 text-white"
+            >
+              <DatabaseBackup className="h-4 w-4 mr-2" />
+              Restore selected
+            </Button>
+          )}
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/AppImage/components/login.tsx b/AppImage/components/login.tsx
index 0e48443b..94023370 100644
--- a/AppImage/components/login.tsx
+++ b/AppImage/components/login.tsx
@@ -271,7 +271,7 @@ export function Login({ onLogin }: LoginProps) {
           </form>
         </div>
 
-        <p className="text-center text-sm text-muted-foreground">ProxMenux Monitor v1.2.2.1-beta</p>
+        <p className="text-center text-sm text-muted-foreground">ProxMenux Monitor v1.2.3</p>
       </div>
     </div>
   )
diff --git a/AppImage/components/network-flow.tsx b/AppImage/components/network-flow.tsx
new file mode 100644
index 00000000..8f6e4807
--- /dev/null
+++ b/AppImage/components/network-flow.tsx
@@ -0,0 +1,961 @@
+"use client"
+
+// Network flow diagram — proof of concept.
+// Shows NICs → host → bridges → guests with animated rx/tx pulses.
+// SVG-based so it scales cleanly and animates with CSS keyframes.
+
+import { useEffect, useMemo, useRef, useState } from "react"
+import { Card, CardContent, CardHeader, CardTitle } from "./ui/card"
+import { Activity } from "lucide-react"
+
+// One animated comet-trail pulse. Returned as DATA from the layout
+// renderers instead of an SVG string so the parent component can
+// render them as JSX <path>s and preserve DOM identity across
+// re-renders — otherwise replacing the SVG via innerHTML restarts
+// every CSS animation, producing the visible "rebound" effect.
+type PulseData = {
+  d: string
+  type: "rx" | "tx"
+  strokeWidth: number
+  animDur?: number
+  key: string
+  // Combined rx+tx rate of the originating guest, in MB/s. Used to
+  // escalate the head's glow when a guest is a heavy consumer
+  // (1 MB/s → warm, 30 MB/s → hot).
+  rate?: number
+}
+
+// ─── Public types — match the /api/network shape ────────────
+type NIC = {
+  id: string
+  link: string
+  rx: number   // MB/s
+  tx: number
+  status?: "up" | "down"   // present → drives the active state instead of the rate
+}
+type Bridge = {
+  id: string
+  parent?: string
+}
+type Guest = {
+  id: string
+  label: string
+  kind: "lxc" | "vm" | "host"
+  bridge: string
+  rx: number
+  tx: number
+  offline?: boolean
+}
+export type NetworkFlowData = {
+  nics: NIC[]
+  bridges: Bridge[]
+  consumers: Guest[]   // includes the host pseudo-entry
+}
+
+// ─── Lucide icon paths inlined (we render them as raw <path>) ──
+const ICONS: Record<string, string> = {
+  nic: `<path d="m15 20 3-3h2a2 2 0 0 0 2-2V6a2 2 0 0 0-2-2H4a2 2 0 0 0-2 2v9a2 2 0 0 0 2 2h2l3 3z"/><path d="M6 8v1"/><path d="M10 8v1"/><path d="M14 8v1"/><path d="M18 8v1"/>`,
+  bridge: `<rect x="16" y="16" width="6" height="6" rx="1"/><rect x="2" y="16" width="6" height="6" rx="1"/><rect x="9" y="2" width="6" height="6" rx="1"/><path d="M5 16v-3a1 1 0 0 1 1-1h12a1 1 0 0 1 1 1v3"/><path d="M12 12V8"/>`,
+  host: `<rect x="4" y="4" width="16" height="16" rx="2"/><rect x="9" y="9" width="6" height="6" rx="1"/><path d="M15 2v2"/><path d="M15 20v2"/><path d="M2 15h2"/><path d="M2 9h2"/><path d="M20 15h2"/><path d="M20 9h2"/><path d="M9 2v2"/><path d="M9 20v2"/>`,
+  lxc: `<path d="M22 7.7c0-.6-.4-1.2-.8-1.5l-6.3-3.9a1.72 1.72 0 0 0-1.7 0l-10.3 6c-.5.2-.9.8-.9 1.4v6.6c0 .5.4 1.2.8 1.5l6.3 3.9a1.72 1.72 0 0 0 1.7 0l10.3-6c.5-.3.9-1 .9-1.5Z"/><path d="M10 21.9V14L2.1 9.1"/><path d="m10 14 11.9-6.9"/><path d="M14 19.8v-8.1"/><path d="M18 17.5V9.4"/>`,
+  vm: `<rect width="20" height="8" x="2" y="2" rx="2"/><rect width="20" height="8" x="2" y="14" rx="2"/><path d="M6 6h.01"/><path d="M6 18h.01"/>`,
+}
+
+const COLORS = {
+  host: "var(--amber-500, #f59e0b)",
+  lxc: "var(--cyan-500, #06b6d4)",
+  vm: "var(--purple-500, #a855f7)",
+  nic: "var(--amber-500, #f59e0b)",
+  bridge: "var(--cyan-500, #06b6d4)",
+  gray: "#525252",
+}
+
+function fmt(v: number): string {
+  if (!v) return "0 B/s"
+  // Below 1 KB/s show B/s — the previous "—" hid real-but-low traffic.
+  if (v < 0.001) return `${Math.round(v * 1024 * 1024)} B/s`
+  if (v < 1) return `${(v * 1024).toFixed(0)} KB/s`
+  return `${v.toFixed(1)} MB/s`
+}
+// "Active" = running guest, regardless of current rate. Lab hosts can
+// have idle guests we still want to see in the topology. The previous
+// 50 KB/s threshold hid everything on a quiet host like .1.10.
+function activeConsumers(consumers: Guest[]): Guest[] {
+  return consumers
+    .filter((c) => !c.offline && c.kind !== "host")
+    .sort((a, b) => a.id.localeCompare(b.id))
+}
+// Bridges without ANY active guest are hidden — the diagram stays
+// focused on the parts of the topology that actually carry traffic.
+function visibleBridges(bridges: Bridge[], guests: Guest[]): Bridge[] {
+  const used = new Set(guests.map((c) => c.bridge))
+  return bridges.filter((b) => used.has(b.id))
+}
+
+function svgIcon(kind: string, cx: number, cy: number, size: number, color: string): string {
+  const half = size / 2
+  const path = ICONS[kind] || ""
+  return `<g transform="translate(${cx - half}, ${cy - half}) scale(${size / 24})">
+    <g class="nf-icon" stroke="${color}">${path}</g>
+  </g>`
+}
+
+function orthLink(x1: number, y1: number, x2: number, y2: number, r = 12): string {
+  if (Math.abs(y2 - y1) < 2) return `M ${x1} ${y1} L ${x2} ${y2}`
+  const midX = (x1 + x2) / 2
+  const dy = y2 > y1 ? 1 : -1
+  return [
+    `M ${x1} ${y1}`,
+    `L ${midX - r} ${y1}`,
+    `Q ${midX} ${y1} ${midX} ${y1 + dy * r}`,
+    `L ${midX} ${y2 - dy * r}`,
+    `Q ${midX} ${y2} ${midX + r} ${y2}`,
+    `L ${x2} ${y2}`,
+  ].join(" ")
+}
+function orthLinkV(x1: number, y1: number, x2: number, y2: number, r = 10): string {
+  if (Math.abs(x2 - x1) < 2) return `M ${x1} ${y1} L ${x2} ${y2}`
+  const midY = (y1 + y2) / 2
+  const dx = x2 > x1 ? 1 : -1
+  return [
+    `M ${x1} ${y1}`,
+    `L ${x1} ${midY - r}`,
+    `Q ${x1} ${midY} ${x1 + dx * r} ${midY}`,
+    `L ${x2 - dx * r} ${midY}`,
+    `Q ${x2} ${midY} ${x2} ${midY + r}`,
+    `L ${x2} ${y2}`,
+  ].join(" ")
+}
+
+// Build the COMPLETE flow path for one guest: host → bridge → bus →
+// tap → guest. One SVG path concatenating each segment so a single
+// pulse can travel end-to-end with that guest's own speed.
+function buildFullFlowPath(
+  hostX: number, hostY: number, radHost: number,
+  bridgesX: number, bridgeY: number, radBridge: number,
+  busX0: number, busY: number,
+  cx: number, targetY: number, tapR: number,
+): string {
+  const hbPath = orthLink(hostX + radHost, hostY, bridgesX - radBridge, bridgeY, 14)
+  const bbPath = orthLink(bridgesX + radBridge, bridgeY, busX0, busY, 12)
+  const dy = targetY > busY ? 1 : -1
+  const tail = `L ${cx - tapR} ${busY} Q ${cx} ${busY} ${cx} ${busY + dy * tapR} L ${cx} ${targetY}`
+  return `${hbPath} ${bbPath} ${tail}`
+}
+function curvedTap(cx: number, busY: number, targetY: number, r = 14): string {
+  const dy = targetY > busY ? 1 : -1
+  return `M ${cx - r} ${busY} Q ${cx} ${busY} ${cx} ${busY + dy * r} L ${cx} ${targetY}`
+}
+
+// ─── Renderer: returns full SVG markup string for a given width ──
+function renderHorizontal(data: NetworkFlowData, W: number): { svg: string; pulses: PulseData[]; height: number } {
+  const top = activeConsumers(data.consumers)
+  const bridges = visibleBridges(data.bridges, top)
+  const host = data.consumers.find((c) => c.kind === "host")
+
+  const tight = W < 1100
+  const nicX = tight ? 70 : 90
+  const hostX = tight ? 280 : 340
+  const bridgesX = tight ? 470 : 540
+  const busX0 = tight ? 580 : 660
+  const busXEnd = W - 40
+  const busAvail = busXEnd - busX0
+
+  const radNic = tight ? 26 : 30
+  const radHost = tight ? 38 : 44
+  const radBridge = tight ? 22 : 26
+  const radGuest = 22
+
+  // More vertical breathing room around each guest. The previous 110
+  // crammed circle+label+sub close to the bus; bumping to 135 lets
+  // the text halo fully clear the trunk pulses behind it.
+  const topCellH = 135
+  // Bot was 135; bumped to 160 because we moved the bot guest 30 px
+  // further from the bus so the tap beam has room to flow.
+  const botCellH = 160
+  const minCellW = 140
+  const maxGuestsPerRow = Math.max(2, Math.floor(busAvail / minCellW))
+
+  // Sort bridges so the ones WITH guests come first. Idle bridges
+  // sit compactly at the top (just below the host) and don't push
+  // anything below them down the canvas.
+  const bridgesSorted = [...bridges].sort((a, b) => {
+    const aN = top.filter((c) => c.bridge === a.id).length
+    const bN = top.filter((c) => c.bridge === b.id).length
+    return bN - aN
+  })
+
+  let cursorY = 40
+  const sections = bridgesSorted.map((b) => {
+    const guests = top.filter((c) => c.bridge === b.id)
+    const pairsPerBus = maxGuestsPerRow
+    const totalPairs = Math.ceil(guests.length / 2)
+    const busRowCount = totalPairs > 0 ? Math.ceil(totalPairs / pairsPerBus) : 0
+    const buses: Array<{
+      pairs: Array<{ top: Guest | null; bot: Guest | null }>
+      busY: number
+      cellW: number
+    }> = []
+    for (let r = 0; r < busRowCount; r++) {
+      const sliceStart = r * pairsPerBus * 2
+      const slice = guests.slice(sliceStart, sliceStart + pairsPerBus * 2)
+      const pairs: Array<{ top: Guest | null; bot: Guest | null }> = []
+      for (let p = 0; p < Math.ceil(slice.length / 2); p++) {
+        pairs.push({ top: slice[p * 2] || null, bot: slice[p * 2 + 1] || null })
+      }
+      const cellCount = pairs.length
+      const cellW = Math.max(minCellW, Math.min(220, busAvail / Math.max(1, cellCount)))
+      const busY = cursorY + topCellH
+      buses.push({ pairs, busY, cellW })
+      cursorY += topCellH + botCellH
+    }
+    let sectionTop: number, sectionBot: number, bridgeY: number
+    if (buses.length > 0) {
+      sectionTop = buses[0].busY - topCellH
+      sectionBot = cursorY
+    } else {
+      // Compact slot for an idle bridge — just enough for the circle
+      // + label + sub. Previous 100 px was wasted space and pushed
+      // sibling bridges far below.
+      sectionTop = cursorY
+      sectionBot = cursorY + 60
+      cursorY = sectionBot
+    }
+    bridgeY = (sectionTop + sectionBot) / 2
+    cursorY += 8
+    return { b, guests, buses, sectionTop, sectionBot, bridgeY }
+  })
+
+  const nicCount = data.nics.length
+  // Vertical pitch per NIC = circle + label + sub + breathing
+  // room. Was 118; bumped to 132 because the new 9-px-wide trunk
+  // line passing near sibling NICs ate into the label/sub area
+  // visually (the line and the text were "stuck" together).
+  const nicPitchMin = 132
+  const nicMinH = 80 + nicCount * nicPitchMin
+  const H = Math.max(220, nicMinH, cursorY + 20)
+  const sectionsTop = sections.length ? sections[0].sectionTop : 40
+  const sectionsBot = sections.length ? sections[sections.length - 1].sectionBot : H - 40
+  const hostY = sections.length ? (sectionsTop + sectionsBot) / 2 : H / 2
+  // Always at least nicPitchMin between NICs so labels/subs never collide.
+  const nicSpacing = Math.max(nicPitchMin, Math.min(140, H / Math.max(1, nicCount + 1)))
+  // Center the NIC stack VERTICALLY in the canvas — anchoring it to
+  // hostY (which itself anchors to the centre of the bridge grid)
+  // produced an asymmetric column on hosts where the bridge grid
+  // sits high (e.g. .1.10): first NIC stuck to the top, big empty
+  // space below the last NIC.
+  const nicStackH = (nicCount - 1) * nicSpacing
+  const nicY0 = Math.max(radNic + 8, (H - nicStackH) / 2)
+
+  // Split into two layers so EVERY static line is drawn before EVERY
+  // pulse. Otherwise a later-drawn static path (e.g. ens4f2's grey
+  // trunk) covers the pulses of earlier paths sharing its column,
+  // making them "fade to grey".
+  const linksStatic: string[] = []
+  const linksPulse: PulseData[] = []
+  const nodes: string[] = []
+
+  data.nics.forEach((n, i) => {
+    const y = nicY0 + i * nicSpacing
+    // NIC is "active" when the kernel reports the link up — independent
+    // of current rate (a NIC with 100 B/s of background traffic should
+    // not render as gray).
+    const active = n.status ? n.status === "up" : n.rx + n.tx > 0
+    const stroke = active ? COLORS.nic : COLORS.gray
+    nodes.push(`<g data-node-id="${n.id}" data-node-kind="nic" style="cursor:pointer;opacity:${active ? 1 : 0.45}">
+      <circle class="nf-circle" cx="${nicX}" cy="${y}" r="${radNic}" stroke="${stroke}" />
+      ${svgIcon("nic", nicX, y, 18, stroke)}
+      <text class="nf-label" x="${nicX}" y="${y + radNic + 14}">${n.id}</text>
+      <text class="nf-sub"   x="${nicX}" y="${y + radNic + 26}">${n.link}</text>
+    </g>`)
+  })
+
+  nodes.push(`<g>
+    <circle class="nf-circle" cx="${hostX}" cy="${hostY}" r="${radHost}" stroke="${COLORS.host}" stroke-width="2.5" />
+    ${svgIcon("host", hostX, hostY, 24, COLORS.host)}
+    <text class="nf-label" x="${hostX}" y="${hostY + radHost + 14}" font-weight="600">PROXMOX</text>
+    <text class="nf-sub"   x="${hostX}" y="${hostY + radHost + 26}">${fmt((host?.rx || 0) + (host?.tx || 0))}</text>
+  </g>`)
+
+  // Logarithmic mapping rate (MB/s) → pulse animation duration (s),
+  // then SNAPPED to 7 discrete buckets. Reason: CSS restarts the
+  // keyframe animation whenever animation-duration changes, so a
+  // continuously varying duration produces a visible "rebound /
+  // restart" on every poll. With snapping, duration only changes
+  // when the rate crosses a threshold — smooth otherwise.
+  //
+  //   ≤ 250 KB/s   → 2.5 s
+  //   ~300 KB/s    → 1.8 s
+  //   ~1 MB/s      → 1.4 s
+  //   ~5 MB/s      → 1.0 s
+  //   ~20 MB/s     → 0.75 s
+  //   ~80 MB/s     → 0.5 s
+  //   ≥ 500 MB/s   → 0.3 s
+  const SPEED_BUCKETS = [0.3, 0.5, 0.75, 1.0, 1.4, 1.8, 2.5]
+  const durFor = (rate: number) => {
+    const raw = 1.8 / Math.log10(1 + Math.max(0, rate) * 30)
+    if (!isFinite(raw) || raw >= 2.5) return 2.5
+    return SPEED_BUCKETS.find((b) => b >= raw) ?? 2.5
+  }
+
+  // All structural lines (trunk + taps) share the SAME thickness so
+  // the diagram reads as one consistent network. The only thing that
+  // varies per guest is pulse SPEED — faster animation = heavier
+  // consumer at a glance.
+  // Single-lane in beam mode (rx and tx share the centre line, passing
+  // each other in opposite directions). dashes/gradient still apply a
+  // small perpendicular offset, but 5 px is enough for those too —
+  // 9 px was leftover from a previous two-lane experiment.
+  const TRUNK_WIDTH = 5
+  const TRUNK_PULSE_WIDTH = 3
+  const TAP_WIDTH = TRUNK_WIDTH
+  const TAP_PULSE_WIDTH = TRUNK_PULSE_WIDTH
+  sections.forEach((sec) => {
+    const bridgeRate = sec.guests.reduce((a, c) => a + c.rx + c.tx, 0)
+    // Trunk activates per-bridge only when at least ONE guest of
+    // that bridge has > 1.1 KB/s — not the sum, which adds up
+    // background noise to a meaningless total.
+    const sumRx = sec.guests.some((c) => c.rx > 0.00108) ? 1 : 0
+    const sumTx = sec.guests.some((c) => c.tx > 0.00108) ? 1 : 0
+
+    nodes.push(`<g data-node-id="${sec.b.id}" data-node-kind="bridge" style="cursor:pointer">
+      <circle class="nf-circle" cx="${bridgesX}" cy="${sec.bridgeY}" r="${radBridge}" stroke="${COLORS.bridge}" />
+      ${svgIcon("bridge", bridgesX, sec.bridgeY, 16, COLORS.bridge)}
+      <text class="nf-label" x="${bridgesX}" y="${sec.bridgeY + radBridge + 14}">${sec.b.id}</text>
+      <text class="nf-sub"   x="${bridgesX}" y="${sec.bridgeY + radBridge + 26}">${fmt(bridgeRate)}</text>
+    </g>`)
+
+    // Trunk lines are STATIC only — every per-guest path will travel
+    // over them with its own pulse, so no need for a shared trunk
+    // pulse that would mix all guests into one velocity.
+    const hbPath = orthLink(hostX + radHost + 5, hostY, bridgesX - radBridge - 5, sec.bridgeY, 14)
+    linksStatic.push(`<path class="nf-link" d="${hbPath}" stroke-width="${TRUNK_WIDTH}" />`)
+
+    sec.buses.forEach((bus) => {
+      const conn = orthLink(bridgesX + radBridge + 5, sec.bridgeY, busX0, bus.busY, 12)
+      linksStatic.push(`<path class="nf-link" d="${conn}" stroke-width="${TRUNK_WIDTH}" />`)
+
+      const cellCount = bus.pairs.length
+      const lastCellCentre = busX0 + (cellCount - 1) * bus.cellW + bus.cellW / 2
+      const tapR = 14
+      const busEndX = lastCellCentre - tapR
+      const busPath = `M ${busX0} ${bus.busY} L ${busEndX} ${bus.busY}`
+      linksStatic.push(`<path class="nf-link" d="${busPath}" stroke-width="${TRUNK_WIDTH}" />`)
+
+      const emitGuest = (g: Guest, cx: number, circleY: number, labelY: number, subY: number) => {
+        const stroke = COLORS[g.kind] || COLORS.gray
+        // Heavy-consumer halo: a concentric ring emanates from the
+        // circle when total rate ≥ 5 MB/s. Pulses outward and fades,
+        // making "hot" guests visible at a glance even without
+        // reading the rate label.
+        const rateMBs = (g.rx || 0) + (g.tx || 0)
+        const haloSVG = rateMBs >= 5
+          ? `<circle class="nf-guest-halo" cx="${cx}" cy="${circleY}" r="${radGuest}" stroke="${stroke}" style="--halo-r0:${radGuest}px;--halo-r1:${radGuest + 16}px" />`
+          : ""
+        nodes.push(`<g data-node-id="${g.id}" data-node-kind="${g.kind}" style="cursor:pointer">
+          ${haloSVG}
+          <circle class="nf-circle" cx="${cx}" cy="${circleY}" r="${radGuest}" stroke="${stroke}" />
+          ${svgIcon(g.kind, cx, circleY, 14, stroke)}
+          <text class="nf-label" x="${cx}" y="${labelY}">${g.label}</text>
+          <text class="nf-sub"   x="${cx}" y="${subY}">${fmt(g.rx + g.tx)}</text>
+        </g>`)
+      }
+
+      bus.pairs.forEach((pair, col) => {
+        const cx = busX0 + col * bus.cellW + bus.cellW / 2
+        if (pair.top) {
+          const g = pair.top
+          const circleY = bus.busY - topCellH + radGuest + 8
+          // Text sits BELOW the circle (between circle and bus) —
+          // this is the locked layout convention. The tap therefore
+          // must STOP where the text begins, otherwise it would
+          // visually overlap the label/rate.
+          const labelY = circleY + radGuest + 14
+          const subY = labelY + 14
+          // Coming from the bus (below) the tap stops just under the
+          // SUB text — the first text element it would meet. 8 px of
+          // padding so the tap visibly approaches the text block
+          // without crossing it.
+          const tapTopEnd = subY + 8
+          const tap = curvedTap(cx, bus.busY, tapTopEnd, tapR)
+          linksStatic.push(`<path class="nf-link" d="${tap}" stroke-width="${TAP_WIDTH}" />`)
+          if (g.rx > 0.005 || g.tx > 0.005) {
+            // ONE continuous pulse from host all the way to the
+            // guest. The beam recovers smoothly across trunk, bus
+            // and tap without resync or speed/size jumps at the
+            // curves.
+            const fullD = buildFullFlowPath(
+              hostX, hostY, radHost, bridgesX, sec.bridgeY, radBridge,
+              busX0, bus.busY, cx, tapTopEnd, tapR,
+            )
+            const dur = durFor(g.rx + g.tx)
+            const totalRate = g.rx + g.tx
+            if (g.rx > 0.005) linksPulse.push({ d: fullD, type: "rx", strokeWidth: TAP_PULSE_WIDTH, animDur: dur, key: `top-rx-${g.id}`, rate: totalRate })
+            if (g.tx > 0.005) linksPulse.push({ d: fullD, type: "tx", strokeWidth: TAP_PULSE_WIDTH, animDur: dur, key: `top-tx-${g.id}`, rate: totalRate })
+          }
+          emitGuest(g, cx, circleY, labelY, subY)
+        }
+        if (pair.bot) {
+          const g = pair.bot
+          // Was bus.busY + 30 + radGuest — moved the guest farther
+          // from the bus so the tap is long enough for the beam to
+          // visibly travel down between the curve and the circle.
+          const circleY = bus.busY + 60 + radGuest
+          const labelY = circleY + radGuest + 14
+          const subY = labelY + 14
+          // Coming from the bus (above) the tap stops 5 px above
+          // the circle's top edge — never crosses the circle ring.
+          // The label/rate sit BELOW the circle and remain free.
+          const tapEnd = circleY - radGuest - 5
+          const tap = curvedTap(cx, bus.busY, tapEnd, tapR)
+          linksStatic.push(`<path class="nf-link" d="${tap}" stroke-width="${TAP_WIDTH}" />`)
+          if (g.rx > 0.005 || g.tx > 0.005) {
+            const fullD = buildFullFlowPath(
+              hostX, hostY, radHost, bridgesX, sec.bridgeY, radBridge,
+              busX0, bus.busY, cx, tapEnd, tapR,
+            )
+            const dur = durFor(g.rx + g.tx)
+            const totalRate = g.rx + g.tx
+            if (g.rx > 0.005) linksPulse.push({ d: fullD, type: "rx", strokeWidth: TAP_PULSE_WIDTH, animDur: dur, key: `bot-rx-${g.id}`, rate: totalRate })
+            if (g.tx > 0.005) linksPulse.push({ d: fullD, type: "tx", strokeWidth: TAP_PULSE_WIDTH, animDur: dur, key: `bot-tx-${g.id}`, rate: totalRate })
+          }
+          emitGuest(g, cx, circleY, labelY, subY)
+        }
+      })
+    })
+  })
+
+  // Each NIC's line animates only when that NIC's own rate is above
+  // the threshold. Was 5 KB/s, which flickered on/off when a NIC
+  // hovered around that mark; 2 KB/s sits clearly above the
+  // background noise floor so the animation stays solid.
+  const NIC_PULSE_MIN_MBPS = 0.002   // 2 KB/s
+
+  data.nics.forEach((n, i) => {
+    const y = nicY0 + i * nicSpacing
+    const active = n.status ? n.status === "up" : n.rx + n.tx > 0
+    if (!active) return
+    // Add a 5-px gap between each circle and the trunk line so the
+    // 9-px-wide static lane doesn't visually overlap the node ring.
+    const path = orthLink(nicX + radNic + 5, y, hostX - radHost - 5, hostY, 14)
+    linksStatic.push(`<path class="nf-link" d="${path}" stroke-width="${TRUNK_WIDTH}" />`)
+    // Per-NIC pulse speed mirrors the per-guest logic: more traffic
+    // on this NIC → faster pulse on its line. Each NIC reads
+    // independently from the others.
+    const nicDur = durFor(n.rx + n.tx)
+    if (n.rx > NIC_PULSE_MIN_MBPS) linksPulse.push({ d: path, type: "rx", strokeWidth: TRUNK_PULSE_WIDTH, animDur: nicDur, key: `nic-rx-${n.id}` })
+    if (n.tx > NIC_PULSE_MIN_MBPS) linksPulse.push({ d: path, type: "tx", strokeWidth: TRUNK_PULSE_WIDTH, animDur: nicDur, key: `nic-tx-${n.id}` })
+  })
+
+  // Static svg = lines + nodes. Pulses are returned SEPARATELY as
+  // data so NetworkFlow can render them as JSX <path>s. That keeps
+  // each pulse's DOM node stable across re-renders → CSS animations
+  // never restart unless that specific pulse changes.
+  return {
+    svg: linksStatic.join("") + nodes.join(""),
+    pulses: linksPulse,
+    height: H,
+  }
+}
+
+// Mobile/tree layout. Approved design (mirrors _simulations/network-flow.html):
+//   NIC → PROXMOX → vmbr → VM/LXC, each level in its OWN x column.
+//   The trunk (host) is ONLY on HOST_X; bridges are in BRIDGE_X (a
+//   separate column → trunk doesn't pass through them); the bridge's
+//   own sub-trunk lives at SUB_TRUNK_X and fans out to its guests in
+//   an arc (some above, some below the bridge.cy). All elbows use Q
+//   curves; no sharp 90° corners anywhere.
+function renderVertical(data: NetworkFlowData): { svg: string; pulses: PulseData[]; height: number; viewBox: string } {
+  // Smaller W → SVG scales up on the mobile screen, nodes look bigger.
+  // All four x-columns evenly spaced so curve→target distances are
+  // homogeneous (host→bridge, bridge→spine, spine→guest all ~60 px).
+  const W = 380
+  const top = activeConsumers(data.consumers)
+  const bridges = visibleBridges(data.bridges, top)
+  const host = data.consumers.find((c) => c.kind === "host")
+
+  const linksStatic: string[] = []
+  const linksPulse: PulseData[] = []
+  const nodes: string[] = []
+
+  // Layout constants — kept inline so the function is self-contained.
+  // Spacing model:
+  //   - HOST_X → BRIDGE_X → SUB_TRUNK_X use a fixed inter-column
+  //     step (homogeneous between trunk, bridge and its spine).
+  //   - GUEST_X sits at the MIDDLE between the bridge's sub-trunk
+  //     (the reference line the guests actually hang from) and the
+  //     right edge of the canvas. So the spine-to-guest leg can be
+  //     longer than the others, which is exactly what we want — the
+  //     stub into each guest visibly stretches before the curve.
+  const HOST_X       = 56
+  const COL_STEP     = 60
+  const BRIDGE_X     = HOST_X + COL_STEP
+  const SUB_TRUNK_X  = HOST_X + COL_STEP * 2
+  const GUEST_X      = Math.round((SUB_TRUNK_X + W) / 2)
+  const RAD_HOST = 26
+  const RAD_NIC = 22
+  const RAD_BRIDGE = 24
+  const RAD_GUEST = 20
+  const NIC_TOP_Y = 6
+  const NIC_PITCH_X_PREFERRED = 88
+  const NIC_LEFT_MARGIN = 8
+  // NIC line geometry, split into TWO independent quantities so we
+  // can tune them separately:
+  //   NIC_PATH_START_OFFSET — gap between the circle bottom and where
+  //                           the line BEGINS (must clear the sub text
+  //                           below the circle so the line doesn't
+  //                           cross the rate label).
+  //   NIC_VERTICAL_LEG      — actual length of the vertical drop
+  //                           BEFORE the curve to the convergence row.
+  const NIC_PATH_START_OFFSET = 46    // clears SUB_OFFSET_Y + text height
+  const NIC_VERTICAL_LEG = 56
+  const HOST_GAP_FROM_CONVERGE = 56
+  const GUEST_ROW_H = 100          // más separación vertical entre
+                                   // guests para que sub no toque
+                                   // el círculo del siguiente
+  const BRIDGE_PITCH_PAD = 36
+  // Vertical positions of the label and the sub (rate) BELOW each
+  // node's circle. Both grew when the font went up to 12.5 px; this
+  // matched gap keeps them readable without overlap.
+  const LABEL_OFFSET_Y = 16        // gap circle bottom → label baseline
+  const SUB_OFFSET_Y   = 32        // gap circle bottom → sub baseline
+                                   // (16 px between label and sub)
+  const CORNER_R = 12
+  const PULSE_THRESHOLD = 0.005
+
+  // Orthogonal NIC→host path with an EXPLICIT convergence y. All NICs
+  // (regardless of which row they sit in) drop vertically until they
+  // hit `convergeY`, then run horizontally to HOST_X and drop to
+  // host top. This guarantees that a row-0 NIC's line never crosses
+  // the circle of a row-1 NIC below it.
+  const vPath = (x1: number, y1: number, x2: number, y2: number,
+                 convergeY: number, r = CORNER_R): string => {
+    if (Math.abs(x2 - x1) < 2) return `M ${x1} ${y1} L ${x2} ${y2}`
+    const midY = convergeY
+    const dx = x2 > x1 ? 1 : -1
+    return [
+      `M ${x1} ${y1}`,
+      `L ${x1} ${midY - r}`,
+      `Q ${x1} ${midY} ${x1 + dx * r} ${midY}`,
+      `L ${x2 - dx * r} ${midY}`,
+      `Q ${x2} ${midY} ${x2} ${midY + r}`,
+      `L ${x2} ${y2}`,
+    ].join(" ")
+  }
+  // Single-elbow path (host trunk → bridge left edge, or any "drop
+  // then turn right" connector). Q corner where the verticals meet.
+  const elbow = (x1: number, y1: number, x2: number, y2: number, r = CORNER_R): string => {
+    const dy = y2 > y1 ? 1 : -1
+    const dx = x2 > x1 ? 1 : -1
+    return [
+      `M ${x1} ${y1}`,
+      `L ${x1} ${y2 - dy * r}`,
+      `Q ${x1} ${y2} ${x1 + dx * r} ${y2}`,
+      `L ${x2} ${y2}`,
+    ].join(" ")
+  }
+
+  // ─── 1. NICs ALWAYS in a single horizontal row ────────────
+  // No wrap to a second row — multiple rows cause NIC paths to cross
+  // the circles of NICs sitting underneath them. Instead, the pitch
+  // shrinks dynamically when there are many NICs so they all fit.
+  // Row is centred around HOST_X (not the canvas) so a single NIC
+  // sits directly above the host — straight vertical path, no weird
+  // S-curve. When the row is too wide to be centred there without
+  // falling off the canvas, it slides right (or left, clamped).
+  const nicCount = data.nics.length
+  const fitWidth = W - 2 * (NIC_LEFT_MARGIN + RAD_NIC)
+  const dynamicPitch = nicCount > 1
+    ? Math.min(NIC_PITCH_X_PREFERRED, fitWidth / (nicCount - 1))
+    : 0
+  const rowWidth = (nicCount - 1) * dynamicPitch
+  const minStart = NIC_LEFT_MARGIN + RAD_NIC
+  const maxStart = W - NIC_LEFT_MARGIN - RAD_NIC - rowWidth
+  const idealStart = HOST_X - rowWidth / 2
+  const startX = Math.max(minStart, Math.min(maxStart, idealStart))
+  const nicCy = NIC_TOP_Y + RAD_NIC
+  const nicGeom = data.nics.map((n, i) => ({
+    n, cx: startX + i * dynamicPitch, cy: nicCy, r: RAD_NIC,
+  }))
+
+  // Convergence row: single y-line BELOW every NIC at which all
+  // drops bend horizontally toward HOST_X. The vertical "leg" of the
+  // NIC path (NIC_VERTICAL_LEG) is what makes the line visibly run
+  // a stretch BEFORE turning into the curve.
+  const nicPathStartY = nicCy + RAD_NIC + NIC_PATH_START_OFFSET
+  const convergeY = nicPathStartY + NIC_VERTICAL_LEG
+  const hostY = convergeY + HOST_GAP_FROM_CONVERGE + RAD_HOST
+  const hostTopY = hostY - RAD_HOST - 4
+
+  // NIC → host orth+Q via shared convergence row.
+  nicGeom.forEach(({ n, cx, cy, r }) => {
+    const startX = cx, startY = cy + r + NIC_PATH_START_OFFSET
+    const pathD = vPath(startX, startY, HOST_X, hostTopY, convergeY)
+    linksStatic.push(`<path class="nf-link" d="${pathD}" stroke-width="2.5" />`)
+    const active = n.status ? n.status === "up" : n.rx + n.tx > 0
+    if (active) {
+      const rate = n.rx + n.tx
+      if (n.rx > 0.001) linksPulse.push({ d: pathD, type: "rx", strokeWidth: 3, key: `m-nic-rx-${n.id}`, rate })
+      if (n.tx > 0.001) linksPulse.push({ d: pathD, type: "tx", strokeWidth: 3, key: `m-nic-tx-${n.id}`, rate })
+    }
+    const isDown = n.status === "down"
+    const color = isDown ? COLORS.gray : COLORS.nic
+    nodes.push(`<g data-node-id="${n.id}" data-node-kind="nic" style="cursor:pointer;opacity:${isDown ? 0.45 : 1}">
+      <circle class="nf-circle" cx="${cx}" cy="${cy}" r="${r}" stroke="${color}" />
+      ${svgIcon("nic", cx, cy, 13, color)}
+      <text class="nf-label" x="${cx}" y="${cy + r + LABEL_OFFSET_Y}" text-anchor="middle" style="font-size:12.5px">${n.id}</text>
+      <text class="nf-sub"   x="${cx}" y="${cy + r + SUB_OFFSET_Y}" text-anchor="middle" style="font-size:12.5px">${isDown ? "down" : n.link}</text>
+    </g>`)
+  })
+
+  // ─── 2. Host PROXMOX — LEFT column, label/sub below ──────
+  nodes.push(`<g>
+    <circle class="nf-circle" cx="${HOST_X}" cy="${hostY}" r="${RAD_HOST}" stroke="${COLORS.host}" stroke-width="2.5" />
+    ${svgIcon("host", HOST_X, hostY, 20, COLORS.host)}
+    <text class="nf-label" x="${HOST_X}" y="${hostY + RAD_HOST + LABEL_OFFSET_Y}" text-anchor="middle" font-weight="700" style="font-size:13px">PROXMOX</text>
+    <text class="nf-sub"   x="${HOST_X}" y="${hostY + RAD_HOST + SUB_OFFSET_Y}" text-anchor="middle" style="font-size:12.5px">${fmt((host?.rx || 0) + (host?.tx || 0))}</text>
+  </g>`)
+
+  // ─── 3. Bridges + guests, ARC layout around each bridge ──
+  // Each bridge has its OWN sub-trunk at SUB_TRUNK_X. Guests are
+  // distributed symmetrically around the bridge.cy (some above, some
+  // below) — fans out in an arc, uses the vertical gap efficiently.
+  let cursorY = hostY + RAD_HOST + 40
+  type BridgeSlot = {
+    b: Bridge
+    cx: number; cy: number; r: number
+    guests: Array<{ g: Guest; cx: number; cy: number; r: number }>
+    rate: number
+    sumRx: number
+    sumTx: number
+  }
+  const bridgePos: BridgeSlot[] = []
+
+  bridges.forEach((b) => {
+    const guestsOfBridge = top.filter((c) => c.bridge === b.id && c.kind !== "host")
+    const rate = guestsOfBridge.reduce((a, g) => a + g.rx + g.tx, 0)
+    const sumRx = guestsOfBridge.reduce((a, g) => a + g.rx, 0)
+    const sumTx = guestsOfBridge.reduce((a, g) => a + g.tx, 0)
+    const N = guestsOfBridge.length
+    const mid = (N - 1) / 2
+    const topSpan = mid * GUEST_ROW_H
+    const botSpan = (N - 1 - mid) * GUEST_ROW_H
+    // Bridge sits below cursorY with enough top clearance for the
+    // top-arc guest's label/sub.
+    const topClearance = topSpan + 24
+    const bCy = cursorY + Math.max(RAD_BRIDGE + 6, topClearance)
+    const guests = guestsOfBridge.map((g, gi) => ({
+      g, cx: GUEST_X, r: RAD_GUEST,
+      cy: bCy + (gi - mid) * GUEST_ROW_H,
+    }))
+    bridgePos.push({ b, cx: BRIDGE_X, cy: bCy, r: RAD_BRIDGE, guests,
+                     rate, sumRx, sumTx })
+    const bottom = N > 0 ? bCy + botSpan + RAD_GUEST + 22 : bCy + RAD_BRIDGE + 22
+    cursorY = bottom + BRIDGE_PITCH_PAD
+  })
+
+  // Host trunk — vertical line at HOST_X from host bottom down to the
+  // last bridge's row. The trunk does NOT pass through any bridge:
+  // bridges live in BRIDGE_X column.
+  // Clears the host's sub label (rate "X KB/s") so the trunk doesn't
+  // start touching the text. SUB_OFFSET_Y + ~8 px breathing room.
+  const hostTrunkStartY = hostY + RAD_HOST + SUB_OFFSET_Y + 12
+  if (bridgePos.length > 0) {
+    const last = bridgePos[bridgePos.length - 1]
+    linksStatic.push(`<path class="nf-link" d="M ${HOST_X} ${hostTrunkStartY} L ${HOST_X} ${last.cy}" stroke-width="2.5" />`)
+  }
+
+  // Per-bridge: host→bridge branch + sub-tree to guests.
+  bridgePos.forEach(({ b, cx, cy, r, guests, rate, sumRx, sumTx }) => {
+    // Host → bridge branch (elbow with Q corner) into bridge LEFT edge.
+    const branchHB = elbow(HOST_X, hostTrunkStartY, cx - r - 4, cy)
+    linksStatic.push(`<path class="nf-link" d="${branchHB}" stroke-width="2.5" />`)
+    if (rate > PULSE_THRESHOLD) {
+      if (sumRx > PULSE_THRESHOLD) linksPulse.push({ d: branchHB, type: "rx", strokeWidth: 3, key: `m-br-rx-${b.id}`, rate })
+      if (sumTx > PULSE_THRESHOLD) linksPulse.push({ d: branchHB, type: "tx", strokeWidth: 3, key: `m-br-tx-${b.id}`, rate })
+    }
+
+    // Bridge node — label/sub BELOW.
+    nodes.push(`<g data-node-id="${b.id}" data-node-kind="bridge" style="cursor:pointer">
+      <circle class="nf-circle" cx="${cx}" cy="${cy}" r="${r}" stroke="${COLORS.bridge}" />
+      ${svgIcon("bridge", cx, cy, 13, COLORS.bridge)}
+      <text class="nf-label" x="${cx}" y="${cy + r + LABEL_OFFSET_Y}" text-anchor="middle" style="font-size:12.5px">${b.id}</text>
+      <text class="nf-sub"   x="${cx}" y="${cy + r + SUB_OFFSET_Y}" text-anchor="middle" style="font-size:12.5px">${fmt(rate)}</text>
+    </g>`)
+
+    if (guests.length === 0) return
+
+    // Per-guest path: exits bridge.right, runs horizontal to SUB_TRUNK_X,
+    // Q-curves into the vertical spine, rises/falls to the guest's row,
+    // Q-curves into the guest. Every elbow is Q — no sharp corners.
+    // Multiple paths overlap on the vertical spine and visually read as
+    // one continuous line.
+    const spineEnterX = cx + r + 4
+    const spineX = SUB_TRUNK_X
+    guests.forEach(({ g, cx: gCx, cy: gCy, r: gR }) => {
+      const enterX = gCx - gR - 4
+      let d: string
+      if (Math.abs(gCy - cy) < 2) {
+        d = `M ${spineEnterX} ${cy} L ${enterX} ${gCy}`
+      } else {
+        const dy = gCy > cy ? 1 : -1
+        d = [
+          `M ${spineEnterX} ${cy}`,
+          `L ${spineX - CORNER_R} ${cy}`,
+          `Q ${spineX} ${cy} ${spineX} ${cy + dy * CORNER_R}`,
+          `L ${spineX} ${gCy - dy * CORNER_R}`,
+          `Q ${spineX} ${gCy} ${spineX + CORNER_R} ${gCy}`,
+          `L ${enterX} ${gCy}`,
+        ].join(" ")
+      }
+      linksStatic.push(`<path class="nf-link" d="${d}" stroke-width="2.5" />`)
+      const gRate = g.rx + g.tx
+      if (gRate > PULSE_THRESHOLD) {
+        if (g.rx > PULSE_THRESHOLD) linksPulse.push({ d, type: "rx", strokeWidth: 3, key: `m-g-rx-${b.id}-${g.id}`, rate: gRate })
+        if (g.tx > PULSE_THRESHOLD) linksPulse.push({ d, type: "tx", strokeWidth: 3, key: `m-g-tx-${b.id}-${g.id}`, rate: gRate })
+      }
+      const stroke = COLORS[g.kind] || COLORS.gray
+      const haloSVG = gRate >= 5
+        ? `<circle class="nf-guest-halo" cx="${gCx}" cy="${gCy}" r="${gR}" stroke="${stroke}" style="--halo-r0:${gR}px;--halo-r1:${gR + 12}px" />`
+        : ""
+      nodes.push(`<g data-node-id="${g.id}" data-node-kind="${g.kind}" style="cursor:pointer">
+        ${haloSVG}
+        <circle class="nf-circle" cx="${gCx}" cy="${gCy}" r="${gR}" stroke="${stroke}" />
+        ${svgIcon(g.kind, gCx, gCy, 13, stroke)}
+        <text class="nf-label" x="${gCx}" y="${gCy + gR + LABEL_OFFSET_Y}" text-anchor="middle" style="font-size:12.5px">${g.label}</text>
+        <text class="nf-sub"   x="${gCx}" y="${gCy + gR + SUB_OFFSET_Y}" text-anchor="middle" style="font-size:12.5px">${fmt(gRate)}</text>
+      </g>`)
+    })
+  })
+
+  const lastSlot = bridgePos[bridgePos.length - 1]
+  const lastBottomY = lastSlot
+    ? (lastSlot.guests.length
+        ? lastSlot.guests[lastSlot.guests.length - 1].cy + RAD_GUEST
+        : lastSlot.cy + RAD_BRIDGE)
+    : hostY + RAD_HOST
+  const H = lastBottomY + 36
+
+  return {
+    svg: linksStatic.join("") + nodes.join(""),
+    pulses: linksPulse,
+    height: H,
+    viewBox: `0 0 ${W} ${H}`,
+  }
+}
+
+// ─── React component ────────────────────────────────────────
+export function NetworkFlow({
+  data, onNodeClick,
+}: {
+  data: NetworkFlowData
+  // Fires when the user taps/clicks any circle in the diagram. The
+  // parent component looks up the matching NetworkInterface and
+  // opens the per-interface details modal.
+  onNodeClick?: (name: string, kind: "nic" | "host" | "bridge" | "lxc" | "vm") => void
+}) {
+  const ref = useRef<HTMLDivElement>(null)
+  const [width, setWidth] = useState(1320)
+  const [mode, setMode] = useState<"desktop" | "tablet" | "mobile">("desktop")
+
+  useEffect(() => {
+    const update = () => {
+      const w = ref.current?.offsetWidth || window.innerWidth
+      setWidth(w)
+      if (w < 700) setMode("mobile")
+      else if (w < 1100) setMode("tablet")
+      else setMode("desktop")
+    }
+    update()
+    window.addEventListener("resize", update)
+    return () => window.removeEventListener("resize", update)
+  }, [])
+
+  // Stable memo key: the SVG is regenerated ONLY when something
+  // structurally relevant changes (mode, width, who's online,
+  // who's linked where, or a rate crossed into a different speed
+  // bucket). Exact rate values are excluded so micro-fluctuations
+  // between polls don't tear down the whole SVG (which would
+  // restart every CSS animation — the "rebound/reset" effect).
+  const memoKey = useMemo(() => {
+    const SB = [0.3, 0.5, 0.75, 1.0, 1.4, 1.8, 2.5]
+    const bucket = (rate: number) => {
+      const raw = 1.8 / Math.log10(1 + Math.max(0, rate || 0) * 30)
+      if (!isFinite(raw) || raw >= 2.5) return 2.5
+      return SB.find((b) => b >= raw) ?? 2.5
+    }
+    const sig = (r: number) => (r > 0.005 ? 1 : 0)
+    const nics = data.nics.map((n) =>
+      `${n.id}:${n.status || ""}:${bucket(n.rx)}:${bucket(n.tx)}:${sig(n.rx)}:${sig(n.tx)}`
+    ).join("|")
+    const guests = data.consumers.map((c) =>
+      `${c.id}:${c.bridge}:${c.kind}:${c.offline ? 1 : 0}:${bucket(c.rx)}:${bucket(c.tx)}:${sig(c.rx)}:${sig(c.tx)}`
+    ).join("|")
+    const bridges = data.bridges.map((b) => `${b.id}:${b.parent || ""}`).join("|")
+    return `${mode}|${width}|${nics}||${guests}||${bridges}`
+  }, [data, mode, width])
+
+  const { svgContent, pulses, viewBox, height } = useMemo(() => {
+    if (mode === "mobile") {
+      const out = renderVertical(data)
+      return { svgContent: out.svg, pulses: out.pulses, viewBox: out.viewBox, height: out.height }
+    }
+    const W = mode === "tablet" ? 1100 : 1320
+    const out = renderHorizontal(data, W)
+    return { svgContent: out.svg, pulses: out.pulses, viewBox: `0 0 ${W} ${out.height}`, height: out.height }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [memoKey])
+
+  return (
+    <Card className="bg-card border-border">
+      <CardHeader>
+        <CardTitle className="text-foreground flex items-center text-base">
+          <Activity className="h-5 w-5 mr-2" />
+          Network Flow (PoC)
+        </CardTitle>
+      </CardHeader>
+      <CardContent>
+        <div ref={ref} className="nf-wrap">
+          <style>{`
+            .nf-wrap svg { width: 100%; display: block; }
+            .nf-circle { fill: #0d0d0d; stroke-width: 2; }
+            .nf-label  { fill: var(--foreground); font-family: ui-monospace, "SF Mono", monospace; font-size: 12.5px; text-anchor: middle; dominant-baseline: middle; stroke: hsl(var(--card)); stroke-width: 8; paint-order: stroke; }
+            .nf-sub    { fill: var(--muted-foreground); font-family: ui-monospace, monospace; font-size: 12.5px; text-anchor: middle; dominant-baseline: middle; stroke: hsl(var(--card)); stroke-width: 8; paint-order: stroke; }
+            .nf-icon   { fill: none; stroke-width: 1.6; stroke-linecap: round; stroke-linejoin: round; }
+            .nf-link   { fill: none; stroke: #2a2a2a; stroke-linecap: round; stroke-linejoin: round; stroke-opacity: 0.55; }
+            /* MODE: beam — comet-trail style. The visual is a
+               bright head followed by a softer, semi-transparent tail
+               that fades to nothing.
+               Implementation: THREE copies of the same dashed beam,
+               each one progressively DELAYED in the animation
+               (positive animation-delay makes the trail lag behind
+               the head in space) and with lower opacity. Stroke-linecap
+               round softens the tip of each segment for free.
+               pathLength="100" keeps beam length proportional to the
+               path so it doesn't vanish on short taps. */
+            .nf-beam-rx, .nf-beam-tx {
+              fill: none; stroke-linecap: round; stroke-linejoin: round;
+              stroke-dasharray: 18 100;
+              animation: nf-beam 1.5s linear infinite;
+            }
+            .nf-beam-rx { stroke: #10b981; }
+            .nf-beam-tx { stroke: #3b82f6; animation-direction: reverse; }
+            @keyframes nf-beam { to { stroke-dashoffset: -118; } }
+
+            /* The head — sharp, bright, with a subtle glow. */
+            .nf-beam-head-rx, .nf-beam-head-tx {
+              fill: none; stroke-linecap: round; stroke-linejoin: round;
+              stroke-dasharray: 8 110;
+              animation: nf-beam-head 1.5s linear infinite;
+              filter: drop-shadow(0 0 2.5px currentColor);
+            }
+            .nf-beam-head-rx { stroke: #34d399; color: #10b981; }
+            .nf-beam-head-tx { stroke: #60a5fa; color: #3b82f6; animation-direction: reverse; }
+            @keyframes nf-beam-head { to { stroke-dashoffset: -118; } }
+
+            /* Beam head intensity tiers — applied additively on top
+               of the base head when the guest's rate crosses a
+               threshold. "warm" softens the glow up; "hot" doubles
+               it for the heaviest consumers. */
+            .nf-beam-head-warm { filter: drop-shadow(0 0 4.5px currentColor); }
+            .nf-beam-head-hot  { filter: drop-shadow(0 0 6px currentColor) drop-shadow(0 0 12px currentColor); }
+
+            /* "Hot guest" halo — concentric ring radiating from the
+               guest circle when its rate is high. Pure visual signal:
+               you spot heavy consumers without reading the label. */
+            .nf-guest-halo {
+              fill: none;
+              stroke-width: 2;
+              opacity: 0;
+              animation: nf-halo 1.8s ease-out infinite;
+              transform-box: fill-box;
+              transform-origin: center;
+            }
+            @keyframes nf-halo {
+              0%   { opacity: 0.55; r: var(--halo-r0, 22); }
+              80%  { opacity: 0;    r: var(--halo-r1, 36); }
+              100% { opacity: 0;    r: var(--halo-r1, 36); }
+            }
+
+            /* Dim base under the beam — same color, low opacity. */
+            .nf-beam-base-rx { fill: none; stroke: #10b981; stroke-opacity: 0.18; stroke-linecap: round; stroke-linejoin: round; }
+            .nf-beam-base-tx { fill: none; stroke: #3b82f6; stroke-opacity: 0.18; stroke-linecap: round; stroke-linejoin: round; }
+          `}</style>
+          <div
+            className="relative"
+            style={{ width: "100%" }}
+            onClick={(e) => {
+              // Event delegation — nodes are rendered inside an
+              // innerHTML SVG string (not JSX), so React can't attach
+              // per-node handlers directly. Each clickable node carries
+              // data-node-id + data-node-kind; we find the closest one
+              // from the click target.
+              if (!onNodeClick) return
+              const t = e.target as Element
+              const hit = t.closest?.("[data-node-id]") as Element | null
+              if (!hit) return
+              const id = hit.getAttribute("data-node-id") || ""
+              const kind = (hit.getAttribute("data-node-kind") || "") as
+                "nic" | "host" | "bridge" | "lxc" | "vm"
+              if (id && kind) onNodeClick(id, kind)
+            }}
+          >
+            {/* Layer 1 — static structure + nodes + text labels.
+                Replaced via innerHTML; cheap and only refreshes on
+                structural/bucket changes (see memoKey). */}
+            <svg
+              viewBox={viewBox}
+              preserveAspectRatio="xMidYMin meet"
+              style={{ height: "auto", display: "block", width: "100%" }}
+              dangerouslySetInnerHTML={{ __html: svgContent }}
+            />
+            {/* Layer 2 — animated pulses, rendered as JSX so each
+                path keeps its DOM identity across re-renders. CSS
+                animations restart ONLY when this specific path's
+                animation-duration changes, not on every poll. */}
+            <svg
+              viewBox={viewBox}
+              preserveAspectRatio="xMidYMin meet"
+              style={{ position: "absolute", inset: 0, width: "100%", height: "100%", pointerEvents: "none" }}
+            >
+              {pulses.map((p) => {
+                // Comet trail: dim base + three trailing copies that
+                // progressively lag in space and fade out + bright
+                // head on top. POSITIVE animation-delay shifts each
+                // trail BEHIND the head by that fraction of the cycle.
+                // pathLength=100 normalises the beam length across
+                // all path sizes (so a short tap shows the same visible
+                // beam as a long trunk).
+                const baseClass = p.type === "rx" ? "nf-beam-base-rx" : "nf-beam-base-tx"
+                const tailClass = p.type === "rx" ? "nf-beam-rx" : "nf-beam-tx"
+                const headClass = p.type === "rx" ? "nf-beam-head-rx" : "nf-beam-head-tx"
+                const dur = p.animDur ?? 1.5
+                const t1 = `${(dur * 0.06).toFixed(3)}s`
+                const t2 = `${(dur * 0.13).toFixed(3)}s`
+                const t3 = `${(dur * 0.22).toFixed(3)}s`
+                // Head glow tier — escalates with the guest's rate.
+                const intensity = (p.rate || 0) >= 30
+                  ? "nf-beam-head-hot"
+                  : (p.rate || 0) >= 1 ? "nf-beam-head-warm" : ""
+                const headWidth = (p.rate || 0) >= 30 ? p.strokeWidth + 1 : p.strokeWidth
+                return (
+                  <g key={p.key}>
+                    <path className={baseClass} d={p.d} strokeWidth={p.strokeWidth} pathLength="100" />
+                    <path className={tailClass} d={p.d} strokeWidth={p.strokeWidth} pathLength="100"
+                          style={{ animationDuration: `${dur}s`, animationDelay: t3, opacity: 0.15 }} />
+                    <path className={tailClass} d={p.d} strokeWidth={p.strokeWidth} pathLength="100"
+                          style={{ animationDuration: `${dur}s`, animationDelay: t2, opacity: 0.35 }} />
+                    <path className={tailClass} d={p.d} strokeWidth={p.strokeWidth} pathLength="100"
+                          style={{ animationDuration: `${dur}s`, animationDelay: t1, opacity: 0.65 }} />
+                    <path className={`${headClass} ${intensity}`} d={p.d} strokeWidth={headWidth}
+                          pathLength="100" style={{ animationDuration: `${dur}s` }} />
+                  </g>
+                )
+              })}
+            </svg>
+          </div>
+        </div>
+      </CardContent>
+    </Card>
+  )
+}
diff --git a/AppImage/components/network-metrics.tsx b/AppImage/components/network-metrics.tsx
index fe70e1d9..162f4eb4 100644
--- a/AppImage/components/network-metrics.tsx
+++ b/AppImage/components/network-metrics.tsx
@@ -4,9 +4,10 @@ import { useEffect, useState } from "react"
 import { Card, CardContent, CardHeader, CardTitle } from "./ui/card"
 import { Badge } from "./ui/badge"
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from "./ui/dialog"
-import { Wifi, Activity, Network, Router, AlertCircle, Zap, Timer } from 'lucide-react'
+import { Wifi, Activity, Network, Router, AlertCircle, Zap, Timer, EthernetPort, ArrowDown, ArrowUp, Box, ChevronRight } from 'lucide-react'
 import useSWR from "swr"
 import { NetworkTrafficChart } from "./network-traffic-chart"
+import { NetworkFlow, type NetworkFlowData } from "./network-flow"
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
 import { fetchApi } from "../lib/api-config"
 import { formatNetworkTraffic, getNetworkUnit } from "../lib/format-network"
@@ -63,6 +64,20 @@ interface NetworkInterface {
   errors_out?: number
   drops_in?: number
   drops_out?: number
+  // Live rate (bytes/sec) computed by the backend as the delta
+  // between this poll and the previous one. Present from the second
+  // /api/network response onward; absent on the first call after the
+  // service starts or after a long pause.
+  rx_Bps?: number
+  tx_Bps?: number
+  // Hardware ceiling parsed from ethtool's "Supported link modes".
+  // The card shows "(max N Gbps)" next to the negotiated speed when
+  // the link is auto-negotiated below the NIC's max.
+  max_speed?: number
+  // Bridges that have this physical NIC as their underlying interface
+  // (directly, or as a bond slave). Surfaced in the card so the
+  // operator can see "this NIC → vmbr0" at a glance.
+  used_by_bridges?: string[]
   bond_mode?: string
   bond_slaves?: string[]
   bond_active_slave?: string | null
@@ -77,6 +92,231 @@ interface NetworkInterface {
   vm_status?: string
 }
 
+// Same dot-prefix tone the Storage cards use, so a "no errors" /
+// "errors present" cue reads identically across pages.
+const NetStatusDot = ({ tone }: { tone: "ok" | "warn" | "fail" }) => {
+  const cls =
+    tone === "ok" ? "bg-green-500" : tone === "warn" ? "bg-yellow-500" : "bg-red-500"
+  return <span className={`inline-block h-2 w-2 rounded-full shrink-0 ${cls}`} aria-hidden />
+}
+const netCounterTone = (n: number | null | undefined): "ok" | "warn" | "fail" => {
+  if (!n || n <= 0) return "ok"
+  if (n < 10) return "warn"
+  return "fail"
+}
+
+// Icon picker — defaults to the actual port type rather than a Wi-Fi
+// glyph for everything. Wireless interfaces (wl*/wifi*) keep the Wi-Fi
+// glyph; wired NICs use EthernetPort; bonds/bridges/vlans get more
+// specific icons so the operator can tell them apart at a glance.
+function getInterfaceIcon(iface: NetworkInterface): React.ComponentType<{ className?: string }> {
+  const name = (iface.name || "").toLowerCase()
+  const type = (iface.type || "").toLowerCase()
+  if (name.startsWith("wl") || name.startsWith("wifi")) return Wifi
+  if (type === "bridge") return Network
+  if (type === "bond") return Router
+  if (type === "vlan") return Activity
+  if (type === "vm_lxc" || type === "virtual") return Box
+  // Physical wired NIC (eth0, enp*, ens*, eno*, nic0, …) → ethernet port.
+  return EthernetPort
+}
+
+// Match the dark blue badge tone the Storage card uses for the disk
+// type chip, but mapped to the actual interface class.
+function getInterfaceTypeChip(type: string) {
+  switch ((type || "").toLowerCase()) {
+    case "physical":
+      return { className: "bg-blue-500/10 text-blue-400 border-blue-500/20", label: "Physical" }
+    case "bridge":
+      return { className: "bg-green-500/10 text-green-400 border-green-500/20", label: "Bridge" }
+    case "bond":
+      return { className: "bg-purple-500/10 text-purple-400 border-purple-500/20", label: "Bond" }
+    case "vlan":
+      return { className: "bg-cyan-500/10 text-cyan-400 border-cyan-500/20", label: "VLAN" }
+    case "vm_lxc":
+    case "virtual":
+      return { className: "bg-orange-500/10 text-orange-400 border-orange-500/20", label: "Virtual" }
+    default:
+      return { className: "bg-gray-500/10 text-gray-400 border-gray-500/20", label: type || "Unknown" }
+  }
+}
+
+// Per-interface card matching the Storage page's "Physical Disks"
+// pattern: 2-line header (identity / live state), horizontal divider,
+// vertical key→value stat block, footer with serial + arrow CTA.
+// Replaces the row-style block that was unchanged since 1.0.0.
+function renderPhysicalInterfaceCardV2(
+  iface: NetworkInterface,
+  onOpen: (iface: NetworkInterface) => void,
+) {
+  const Icon = getInterfaceIcon(iface)
+  const chip = getInterfaceTypeChip(iface.type)
+  const isUp = (iface.status || "").toLowerCase() === "up"
+  const firstAddr = iface.addresses?.[0]?.ip || ""
+  const extraAddrs = Math.max(0, (iface.addresses?.length || 0) - 1)
+  const speedStr = formatSpeed(iface.speed)
+  // Hardware max in Mbps from ethtool. Show only when it's different
+  // from the negotiated speed (avoids "1 Gbps (max 1 Gbps)" noise).
+  const maxSpeedStr =
+    iface.max_speed && iface.max_speed !== iface.speed
+      ? formatSpeed(iface.max_speed)
+      : ""
+  const bridgesUsing = iface.used_by_bridges || []
+  const errIn = iface.errors_in ?? 0
+  const errOut = iface.errors_out ?? 0
+  const dropIn = iface.drops_in ?? 0
+  const dropOut = iface.drops_out ?? 0
+  const totalErrors = errIn + errOut
+  const totalDrops = dropIn + dropOut
+
+  return (
+    <div
+      key={iface.name}
+      className="border border-white/10 rounded-lg p-5 cursor-pointer bg-card hover:bg-white/5 transition-colors flex flex-col"
+      onClick={() => onOpen(iface)}
+    >
+      {/* Header L1: identity (icon + name + type) | status. */}
+      <div className="flex items-start justify-between gap-3">
+        <div className="flex items-center gap-2 flex-wrap min-w-0">
+          <Icon className="h-5 w-5 text-muted-foreground shrink-0" />
+          <h3 className="font-mono font-bold text-base break-all">{iface.name}</h3>
+          <Badge variant="outline" className={chip.className}>{chip.label}</Badge>
+        </div>
+        <span
+          className={`flex items-center gap-1.5 text-sm font-semibold uppercase tracking-wide shrink-0 ${
+            isUp ? "text-green-500" : "text-red-400"
+          }`}
+        >
+          <NetStatusDot tone={isUp ? "ok" : "fail"} />
+          {iface.status || "?"}
+        </span>
+      </div>
+
+      {/* Header L2: speed + max (when negotiated < hw) | duplex. */}
+      <div className="flex items-center justify-between gap-3 mt-1 text-sm text-muted-foreground">
+        <span className="flex items-center gap-1.5">
+          <Zap className="h-3.5 w-3.5" />
+          {speedStr}
+          {maxSpeedStr && (
+            <span className="text-[11px] text-muted-foreground/70">
+              · max {maxSpeedStr}
+            </span>
+          )}
+        </span>
+        <span className="capitalize">{iface.duplex || "—"}</span>
+      </div>
+
+      {/* Separator. */}
+      <div className="border-t border-border/60 my-3" />
+
+      {/* Stats: key uppercase left · value right. */}
+      <div className="space-y-2 text-sm">
+        {firstAddr && (
+          <div className="flex items-baseline justify-between gap-3">
+            <span className="text-[11px] uppercase tracking-wider text-muted-foreground shrink-0">
+              IP
+            </span>
+            <span className="font-medium text-right truncate font-mono text-xs">
+              {firstAddr}{extraAddrs > 0 ? ` (+${extraAddrs})` : ""}
+            </span>
+          </div>
+        )}
+        <div className="flex items-baseline justify-between gap-3">
+          <span className="text-[11px] uppercase tracking-wider text-muted-foreground">MTU</span>
+          <span className="font-medium">{iface.mtu || "—"}</span>
+        </div>
+        {bridgesUsing.length > 0 && (
+          <div className="flex items-baseline justify-between gap-3">
+            <span className="text-[11px] uppercase tracking-wider text-muted-foreground shrink-0">
+              Bridge
+            </span>
+            <span className="font-medium text-right truncate font-mono text-xs text-cyan-400">
+              {bridgesUsing.map((b) => `→ ${b}`).join("  ")}
+            </span>
+          </div>
+        )}
+        {/* Live RX/TX rate. Same wording the Network Traffic chart
+            uses ("Received" / "Sent") and the same canonical colours
+            (green for Received, blue for Sent). Falls back to "—"
+            until the backend has a delta — first poll after start
+            has no previous sample to compute against. */}
+        <div className="flex items-baseline justify-between gap-3">
+          <span className="text-[11px] uppercase tracking-wider text-muted-foreground flex items-center gap-1">
+            <ArrowDown className="h-3 w-3 text-green-500" /> Received
+          </span>
+          <span className="font-medium text-green-500 tabular-nums">
+            {iface.rx_Bps !== undefined ? formatRate(iface.rx_Bps) : "—"}
+          </span>
+        </div>
+        <div className="flex items-baseline justify-between gap-3">
+          <span className="text-[11px] uppercase tracking-wider text-muted-foreground flex items-center gap-1">
+            <ArrowUp className="h-3 w-3 text-blue-400" /> Sent
+          </span>
+          <span className="font-medium text-blue-400 tabular-nums">
+            {iface.tx_Bps !== undefined ? formatRate(iface.tx_Bps) : "—"}
+          </span>
+        </div>
+        {(totalErrors > 0 || totalDrops > 0) && (
+          <>
+            {totalErrors > 0 && (
+              <div className="flex items-baseline justify-between gap-3">
+                <span className="text-[11px] uppercase tracking-wider text-muted-foreground">Errors</span>
+                <span
+                  className={`font-medium flex items-center gap-1.5 ${
+                    netCounterTone(totalErrors) === "ok"
+                      ? "text-green-500"
+                      : netCounterTone(totalErrors) === "warn"
+                        ? "text-yellow-500"
+                        : "text-red-500"
+                  }`}
+                >
+                  <NetStatusDot tone={netCounterTone(totalErrors)} />
+                  {totalErrors.toLocaleString()}
+                </span>
+              </div>
+            )}
+            {totalDrops > 0 && (
+              <div className="flex items-baseline justify-between gap-3">
+                <span className="text-[11px] uppercase tracking-wider text-muted-foreground">Drops</span>
+                <span
+                  className={`font-medium flex items-center gap-1.5 ${
+                    netCounterTone(totalDrops) === "ok"
+                      ? "text-green-500"
+                      : netCounterTone(totalDrops) === "warn"
+                        ? "text-yellow-500"
+                        : "text-red-500"
+                  }`}
+                >
+                  <NetStatusDot tone={netCounterTone(totalDrops)} />
+                  {totalDrops.toLocaleString()}
+                </span>
+              </div>
+            )}
+          </>
+        )}
+      </div>
+
+      {/* Footer: MAC (left, mono) + arrow CTA (right). */}
+      <div className="border-t border-border/60 mt-auto pt-3 flex items-center justify-between gap-3">
+        {iface.mac_address ? (
+          <span className="text-[11px] text-foreground font-mono truncate min-w-0">
+            <span className="text-muted-foreground">MAC:</span> {iface.mac_address}
+          </span>
+        ) : (
+          <span />
+        )}
+        <span
+          className="text-blue-400 hover:text-blue-300 transition-colors text-base leading-none shrink-0"
+          aria-label="View details"
+        >
+          →
+        </span>
+      </div>
+    </div>
+  )
+}
+
+
 const getInterfaceTypeBadge = (type: string) => {
   switch (type) {
     case "physical":
@@ -105,6 +345,19 @@ const getVMTypeBadge = (vmType: string | undefined) => {
   return { color: "bg-gray-500/10 text-gray-500 border-gray-500/20", label: "Unknown" }
 }
 
+// Format bytes/sec into the canonical network unit ladder.
+// Matches the convention used by the Network Traffic chart so the
+// rates on the per-interface cards and the chart read the same way.
+const formatRate = (bps: number | undefined): string => {
+  if (bps === undefined || bps === null || !Number.isFinite(bps)) return "—"
+  if (bps < 1) return "0 B/s"
+  const k = 1024
+  const sizes = ["B/s", "KB/s", "MB/s", "GB/s"]
+  const i = Math.min(sizes.length - 1, Math.floor(Math.log(bps) / Math.log(k)))
+  const v = bps / Math.pow(k, i)
+  return `${v >= 100 ? v.toFixed(0) : v.toFixed(v >= 10 ? 1 : 2)} ${sizes[i]}`
+}
+
 const formatBytes = (bytes: number | undefined): string => {
   if (!bytes || bytes === 0) return "0 B"
   const k = 1024
@@ -142,7 +395,10 @@ export function NetworkMetrics() {
     error,
     isLoading,
   } = useSWR<NetworkData>("/api/network", fetcher, {
-    refreshInterval: 15000,
+    // Was 15 s — too long for the Network Flow's pulse animation
+    // which needs near-live rates. 3 s gives the dashboard responsive
+    // updates without hammering the backend.
+    refreshInterval: 3000,
     revalidateOnFocus: true,
     revalidateOnReconnect: true,
   })
@@ -291,6 +547,25 @@ export function NetworkMetrics() {
     }
   }
 
+  // Compact form for inline header use. The full "24 Hours" gets noisy
+  // next to the title; "Past 24 h" keeps the same meaning in less space.
+  const getTimeframeShortLabel = () => {
+    switch (timeframe) {
+      case "hour":
+        return "Past 1 h"
+      case "day":
+        return "Past 24 h"
+      case "week":
+        return "Past 7 d"
+      case "month":
+        return "Past 30 d"
+      case "year":
+        return "Past 1 y"
+      default:
+        return "Past 24 h"
+    }
+  }
+
   const hostname = networkData.hostname || "N/A"
   const domain = networkData.domain || "N/A"
   const dnsServers = networkData.dns_servers || []
@@ -300,7 +575,7 @@ export function NetworkMetrics() {
   return (
     <div className="space-y-6">
       {/* Network Overview Cards */}
-      <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-3 lg:gap-6">
+      <div className="grid grid-cols-1 sm:grid-cols-2 xl:grid-cols-4 gap-3 xl:gap-6">
         {/* ── Network Traffic (preview restyle: Down/Up dual headline + stacked bar) ── */}
         {(() => {
           const downBytes = networkData.traffic.bytes_recv || 0
@@ -311,8 +586,11 @@ export function NetworkMetrics() {
           return (
             <Card className="bg-card border-border">
               <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
-                <CardTitle className="text-sm font-medium text-muted-foreground">Network Traffic</CardTitle>
-                <Activity className="h-4 w-4 text-muted-foreground" />
+                <div className="flex flex-col gap-0.5 min-w-0">
+                  <CardTitle className="text-sm font-medium text-muted-foreground">Network Traffic</CardTitle>
+                  <span className="text-[10px] text-muted-foreground/70 font-normal">{getTimeframeShortLabel()}</span>
+                </div>
+                <Activity className="h-4 w-4 text-muted-foreground flex-shrink-0" />
               </CardHeader>
               <CardContent>
                 <div className="grid grid-cols-2 gap-3 mb-3">
@@ -409,13 +687,16 @@ export function NetworkMetrics() {
         </Card>
 
         {/* Latency Card with Sparkline */}
-        <Card 
-          className="bg-card border-border cursor-pointer hover:bg-muted/50 transition-colors"
+        <Card
+          className="bg-card border-border cursor-pointer hover:bg-white/5 transition-colors"
           onClick={() => setLatencyModalOpen(true)}
         >
           <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
             <CardTitle className="text-sm font-medium text-muted-foreground">Network Latency</CardTitle>
-            <Timer className="h-4 w-4 text-muted-foreground" />
+            <div className="flex items-center gap-1 text-muted-foreground">
+              <Timer className="h-4 w-4" />
+              <ChevronRight className="h-4 w-4 opacity-60" />
+            </div>
           </CardHeader>
           <CardContent>
             <div className="flex items-center justify-between mb-2">
@@ -500,6 +781,87 @@ export function NetworkMetrics() {
         </CardContent>
       </Card>
 
+      {/* Network Flow — proof of concept. Lives next to Network Traffic
+          while the design is validated on a real host. Once approved,
+          this card replaces (or pairs with) the chart above. */}
+      {(() => {
+        const toMBps = (bps?: number) => (bps || 0) / (1024 * 1024)
+        const allIfaces = [
+          ...(networkData.physical_interfaces || []),
+          ...(networkData.bridge_interfaces || []),
+          ...(networkData.vm_lxc_interfaces || []),
+        ]
+        const flowData: NetworkFlowData = {
+          nics: (networkData.physical_interfaces || []).map((p) => ({
+            id: p.name,
+            link: formatSpeed(p.speed),
+            rx: toMBps(p.rx_Bps),
+            tx: toMBps(p.tx_Bps),
+            status: (p.status || "").toLowerCase() === "up" ? "up" : "down",
+          })),
+          bridges: (networkData.bridge_interfaces || []).map((b) => ({
+            id: b.name,
+            parent: b.bridge_physical_interface,
+          })),
+          consumers: [
+            (() => {
+              // PROXMOX node = sum of every running guest's rate.
+              // This stays consistent with each bridge's own label
+              // (which sums the same guest rates), and with the
+              // total trunk flow — no discrepancy between the host's
+              // displayed rate and the sum of its bridges.
+              const runningGuests = (networkData.vm_lxc_interfaces || []).filter(
+                (v) => v.vm_status !== "stopped"
+              )
+              return {
+                id: "host",
+                label: "host",
+                kind: "host" as const,
+                bridge: (networkData.bridge_interfaces?.[0]?.name) || "",
+                rx: runningGuests.reduce((a, v) => a + toMBps(v.rx_Bps), 0),
+                tx: runningGuests.reduce((a, v) => a + toMBps(v.tx_Bps), 0),
+              }
+            })(),
+            ...(networkData.vm_lxc_interfaces || []).map((v) => {
+              // Authoritative bridge from the kernel (read by the
+              // backend from /sys/class/net/<iface>/master). Fallback
+              // to bridge_members scan, then first bridge as last
+              // resort so we never silently drop a guest.
+              const ownerName =
+                (v as any).bridge_owner ||
+                (networkData.bridge_interfaces || []).find((b) =>
+                  (b.bridge_members || []).includes(v.name)
+                )?.name ||
+                (networkData.bridge_interfaces?.[0]?.name || "")
+              return {
+                id: v.name,
+                label: v.vm_name || v.name,
+                kind: (v.vm_type === "vm" ? "vm" : "lxc") as "vm" | "lxc",
+                bridge: ownerName,
+                rx: toMBps(v.rx_Bps),
+                tx: toMBps(v.tx_Bps),
+                offline: v.vm_status === "stopped",
+              }
+            }),
+          ],
+        }
+        return (
+          <NetworkFlow
+            data={flowData}
+            onNodeClick={(name) => {
+              // Map the clicked node back to a NetworkInterface and
+              // open the same details modal the cards below use. The
+              // virtual "host" id never matches a real interface, so
+              // it's a no-op — tapping the PROXMOX circle does nothing
+              // (there's no host-level modal in this view).
+              if (name === "host") return
+              const match = allIfaces.find((iface) => iface.name === name)
+              if (match) setSelectedInterface(match)
+            }}
+          />
+        )
+      })()}
+
       {/* Physical Interfaces section */}
       <Card className="bg-card border-border">
         <CardHeader>
@@ -512,76 +874,13 @@ export function NetworkMetrics() {
           </CardTitle>
         </CardHeader>
         <CardContent>
-          <div className="space-y-4">
-            {networkData.physical_interfaces.map((interface_, index) => {
-              const typeBadge = getInterfaceTypeBadge(interface_.type)
-
-              return (
-                <div
-                  key={index}
-                  className="flex flex-col gap-3 p-4 rounded-lg border border-white/10 bg-white/5 sm:bg-card sm:hover:bg-white/5 transition-colors cursor-pointer"
-                  onClick={() => setSelectedInterface(interface_)}
-                >
-                  {/* First row: Icon, Name, Type Badge, Status */}
-                  <div className="flex items-center gap-3 flex-wrap">
-                    <Wifi className="h-5 w-5 text-muted-foreground flex-shrink-0" />
-                    <div className="flex items-center gap-2 min-w-0 flex-1 flex-wrap">
-                      <div className="font-medium text-foreground">{interface_.name}</div>
-                      <Badge variant="outline" className={typeBadge.color}>
-                        {typeBadge.label}
-                      </Badge>
-                    </div>
-                    <Badge
-                      variant="outline"
-                      className={
-                        interface_.status === "up"
-                          ? "bg-green-500/10 text-green-500 border-green-500/20"
-                          : "bg-red-500/10 text-red-500 border-red-500/20"
-                      }
-                    >
-                      {interface_.status.toUpperCase()}
-                    </Badge>
-                  </div>
-
-                  {/* Second row: Details - Responsive layout */}
-                  <div className="grid grid-cols-2 md:grid-cols-4 gap-4 text-sm">
-                    <div>
-                      <div className="text-muted-foreground text-xs">IP Address</div>
-                      <div className="font-medium text-foreground font-mono text-sm truncate">
-                        {interface_.addresses.length > 0 ? interface_.addresses[0].ip : "N/A"}
-                      </div>
-                    </div>
-
-                    <div>
-                      <div className="text-muted-foreground text-xs">Speed</div>
-                      <div className="font-medium text-foreground flex items-center gap-1 text-xs">
-                        <Zap className="h-3 w-3" />
-                        {formatSpeed(interface_.speed)}
-                      </div>
-                    </div>
-
-                    <div>
-                      <div className="text-muted-foreground text-xs">Duplex</div>
-                      <div className="font-medium text-foreground text-xs capitalize">{interface_.duplex}</div>
-                    </div>
-
-                    <div>
-                      <div className="text-muted-foreground text-xs">MTU</div>
-                      <div className="font-medium text-foreground text-xs">{interface_.mtu}</div>
-                    </div>
-
-                    {interface_.mac_address && (
-                      <div className="col-span-2 md:col-span-4">
-                        <div className="text-muted-foreground text-xs">MAC</div>
-                        <div className="font-medium text-foreground font-mono text-xs truncate">
-                          {interface_.mac_address}
-                        </div>
-                      </div>
-                    )}
-                  </div>
-                </div>
-              )
-            })}
+          {/* Same responsive grid as the Storage page: 3 cols desktop,
+              2 cols tablet, 1 col mobile. Cards self-size so a row of
+              long interface names won't push others off-screen. */}
+          <div className="grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4">
+            {networkData.physical_interfaces.map((iface) =>
+              renderPhysicalInterfaceCardV2(iface, setSelectedInterface),
+            )}
           </div>
         </CardContent>
       </Card>
@@ -610,7 +909,7 @@ export function NetworkMetrics() {
                   >
                     {/* First row: Icon, Name, Type Badge, Physical Interface (responsive), Status */}
                     <div className="flex items-center gap-3 flex-wrap">
-                      <Wifi className="h-5 w-5 text-muted-foreground flex-shrink-0" />
+                      <Network className="h-5 w-5 text-muted-foreground flex-shrink-0" />
                       <div className="flex items-center gap-2 min-w-0 flex-1 flex-wrap">
                         <div className="font-medium text-foreground">{interface_.name}</div>
                         <Badge variant="outline" className={typeBadge.color}>
@@ -726,14 +1025,14 @@ export function NetworkMetrics() {
                   >
                     {/* First row: Icon, Name, VM/LXC Badge, VM Name, Status */}
                     <div className="flex items-center gap-3 flex-wrap">
-                      <Wifi className="h-5 w-5 text-muted-foreground flex-shrink-0" />
+                      <EthernetPort className="h-5 w-5 text-muted-foreground flex-shrink-0" />
                       <div className="flex items-center gap-2 min-w-0 flex-1 flex-wrap">
                         <div className="font-medium text-foreground">{interface_.name}</div>
                         <Badge variant="outline" className={vmTypeBadge.color}>
                           {vmTypeBadge.label}
                         </Badge>
                         {interface_.vm_name && (
-                          <div className="text-sm text-muted-foreground truncate">→ {interface_.vm_name}</div>
+                          <div className="text-sm text-orange-500 truncate">→ {interface_.vm_name}</div>
                         )}
                       </div>
                       <Badge
@@ -792,7 +1091,7 @@ export function NetworkMetrics() {
 
       {/* Interface Details Modal */}
       <Dialog open={!!selectedInterface} onOpenChange={() => setSelectedInterface(null)}>
-        <DialogContent className="max-w-4xl max-h-[90vh] overflow-y-auto">
+        <DialogContent className="max-w-4xl w-[calc(100vw-1rem)] sm:w-[95vw] max-h-[calc(100dvh-2rem)] sm:max-h-[90vh] overflow-y-auto overflow-x-hidden p-4 sm:p-6">
           <DialogHeader>
             <DialogTitle className="flex items-center gap-2">
               <Router className="h-5 w-5" />
diff --git a/AppImage/components/node-metrics-charts.tsx b/AppImage/components/node-metrics-charts.tsx
index 5f356223..104e59f0 100644
--- a/AppImage/components/node-metrics-charts.tsx
+++ b/AppImage/components/node-metrics-charts.tsx
@@ -66,11 +66,68 @@ const CustomMemoryTooltip = ({ active, payload, label }: any) => {
   return null
 }
 
+interface MetricsError {
+  headline: string
+  details?: string
+  suggestion?: string
+}
+
+// AVG / MAX / MIN chip row for the chart card headers. Values come
+// from the backend `period_stats` (calculated over the raw RRD points
+// BEFORE downsampling), not from the displayed chart points — that's
+// what makes a 1-minute CPU spike still appear in the 24h MAX even
+// though the chart shows 5-min bucket averages.
+//
+// Colour choice: all three values render in the same foreground tone.
+// The previous red(max)/green(min) scheme misread as severity (a
+// healthy 10 % CPU max showed in red and looked like an alert).
+//
+// Responsive: on ≥sm the chips sit to the right of the title; on
+// mobile they wrap below in their own row (the parent CardHeader uses
+// `flex-col sm:flex-row`). Smaller text + tabular-nums keeps the
+// chips compact enough that they don't crowd long titles.
+type PeriodStat = { avg: number; max: number; min: number } | null
+function ChartStatsHeader({
+  stats,
+  suffix = "",
+}: {
+  stats: PeriodStat
+  suffix?: string
+}) {
+  if (!stats) return null
+  const fmt = (n: number) => (n >= 100 ? n.toFixed(0) : n.toFixed(1))
+  return (
+    <div className="flex flex-wrap items-baseline gap-x-3 gap-y-1 text-sm tabular-nums">
+      <span>
+        <span className="font-semibold text-foreground">{fmt(stats.avg)}{suffix}</span>
+        <span className="ml-1 text-xs uppercase tracking-wide text-muted-foreground">avg</span>
+      </span>
+      <span>
+        <span className="font-semibold text-foreground">{fmt(stats.max)}{suffix}</span>
+        <span className="ml-1 text-xs uppercase tracking-wide text-muted-foreground">max</span>
+      </span>
+      <span>
+        <span className="font-semibold text-foreground">{fmt(stats.min)}{suffix}</span>
+        <span className="ml-1 text-xs uppercase tracking-wide text-muted-foreground">min</span>
+      </span>
+    </div>
+  )
+}
+
+
 export function NodeMetricsCharts() {
   const [timeframe, setTimeframe] = useState("day")
   const [data, setData] = useState<NodeMetricsData[]>([])
+  // period_stats from the backend — computed over the raw RRD points
+  // BEFORE the 5-min downsampling so the chart header's MAX/MIN
+  // captures real per-minute extremes (a 1-min CPU spike still shows
+  // up on the 24h view's MAX).
+  const [periodStats, setPeriodStats] = useState<{
+    cpu?: PeriodStat
+    memory_used?: PeriodStat
+  }>({})
   const [loading, setLoading] = useState(true)
-  const [error, setError] = useState<string | null>(null)
+  const [error, setError] = useState<MetricsError | null>(null)
   const isMobile = useIsMobile()
 
   const [visibleLines, setVisibleLines] = useState({
@@ -158,11 +215,19 @@ export function NodeMetricsCharts() {
       })
 
       setData(transformedData)
+      setPeriodStats(result.period_stats || {})
     } catch (err: any) {
       console.error("Error fetching node metrics:", err)
-      console.error("Error message:", err.message)
-      console.error("Error stack:", err.stack)
-      setError(err.message || "Error loading metrics")
+      // fetchApi attaches the parsed JSON body to err.body. The metrics
+      // endpoint enriches 503 responses with `details` (Proxmox-side
+      // diagnostic) and `suggestion` (how to fix). Pull them through so
+      // the user sees actionable text instead of a bare "503".
+      const body = err?.body
+      setError({
+        headline: body?.error || err?.message || "Error loading metrics",
+        details: body?.details,
+        suggestion: body?.suggestion,
+      })
     } finally {
       setLoading(false)
     }
@@ -231,24 +296,36 @@ export function NodeMetricsCharts() {
   }
 
   if (error) {
+    // Both panels carry the same error — render an identical card on
+    // each side. The headline is the short cause, the details block
+    // explains it's a Proxmox-host issue (not a Monitor bug), and the
+    // suggestion is the exact command the operator should run.
+    const errorCard = (
+      <Card className="bg-card border-border">
+        <CardContent className="p-6">
+          <div className="flex flex-col items-start justify-center h-[300px] gap-2 px-2 overflow-auto">
+            <p className="text-sm font-semibold text-red-400">{error.headline}</p>
+            {error.details && (
+              <p className="text-xs text-muted-foreground leading-relaxed">{error.details}</p>
+            )}
+            {error.suggestion && (
+              <div className="w-full mt-2">
+                <p className="text-[10px] uppercase tracking-wide text-muted-foreground mb-1">
+                  Suggested fix on the Proxmox host
+                </p>
+                <code className="block text-xs bg-background/60 border border-border rounded px-2 py-1.5 font-mono break-all">
+                  {error.suggestion}
+                </code>
+              </div>
+            )}
+          </div>
+        </CardContent>
+      </Card>
+    )
     return (
       <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
-        <Card className="bg-card border-border">
-          <CardContent className="p-6">
-            <div className="flex flex-col items-center justify-center h-[300px] gap-2">
-              <p className="text-muted-foreground text-sm">Metrics data not available yet</p>
-              <p className="text-xs text-red-500">{error}</p>
-            </div>
-          </CardContent>
-        </Card>
-        <Card className="bg-card border-border">
-          <CardContent className="p-6">
-            <div className="flex flex-col items-center justify-center h-[300px] gap-2">
-              <p className="text-muted-foreground text-sm">Metrics data not available yet</p>
-              <p className="text-xs text-red-500">{error}</p>
-            </div>
-          </CardContent>
-        </Card>
+        {errorCard}
+        {errorCard}
       </div>
     )
   }
@@ -298,10 +375,13 @@ export function NodeMetricsCharts() {
         {/* CPU Usage + Load Average Chart */}
         <Card className="bg-card border-border">
           <CardHeader className="px-4 md:px-6">
-            <CardTitle className="text-foreground flex items-center">
-              <TrendingUp className="h-5 w-5 mr-2" />
-              CPU Usage & Load Average
-            </CardTitle>
+            <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-2">
+              <CardTitle className="text-foreground flex items-center">
+                <TrendingUp className="h-5 w-5 mr-2" />
+                CPU Usage & Load Average
+              </CardTitle>
+              <ChartStatsHeader stats={periodStats.cpu ?? null} suffix="%" />
+            </div>
           </CardHeader>
           <CardContent className="px-0 md:px-6">
             <ResponsiveContainer width="100%" height={300}>
@@ -370,10 +450,13 @@ export function NodeMetricsCharts() {
         {/* Memory Usage Chart */}
         <Card className="bg-card border-border">
           <CardHeader className="px-4 md:px-6">
-            <CardTitle className="text-foreground flex items-center">
-              <MemoryStick className="h-5 w-5 mr-2" />
-              Memory Usage
-            </CardTitle>
+            <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-2">
+              <CardTitle className="text-foreground flex items-center">
+                <MemoryStick className="h-5 w-5 mr-2" />
+                Memory Usage
+              </CardTitle>
+              <ChartStatsHeader stats={periodStats.memory_used ?? null} suffix=" GB" />
+            </div>
           </CardHeader>
           <CardContent className="px-0 pr-2 md:px-6">
             <ResponsiveContainer width="100%" height={300}>
diff --git a/AppImage/components/notification-settings.tsx b/AppImage/components/notification-settings.tsx
index 5bcb54d6..68cfbc14 100644
--- a/AppImage/components/notification-settings.tsx
+++ b/AppImage/components/notification-settings.tsx
@@ -335,6 +335,12 @@ export function NotificationSettings() {
   const [showHistory, setShowHistory] = useState(false)
   const [showAdvanced, setShowAdvanced] = useState(false)
   const [showSecrets, setShowSecrets] = useState<Record<string, boolean>>({})
+  // Cleartext secrets cached only while the eye toggle is "on" for
+  // that field. Settings GET returns "************" for everything in
+  // SENSITIVE_KEYS; clicking eye fetches the real value via
+  // /api/notifications/reveal-secret and stores it here. Cleared when
+  // the user toggles eye off, or on every reload — never persists.
+  const [revealedSecrets, setRevealedSecrets] = useState<Record<string, string>>({})
   const [editMode, setEditMode] = useState(false)
   const [hasChanges, setHasChanges] = useState(false)
   const [expandedCategories, setExpandedCategories] = useState<Set<string>>(new Set())
@@ -1065,8 +1071,86 @@ export function NotificationSettings() {
     }
   }
 
-  const toggleSecret = (key: string) => {
-    setShowSecrets(prev => ({ ...prev, [key]: !prev[key] }))
+  // Maps each eye-button local key to the body shape the backend
+  // expects for /api/notifications/reveal-secret. Centralised here so
+  // the JSX call site stays a one-liner — `toggleSecret(key)`.
+  const SECRET_REVEAL_TARGETS: Record<string, Record<string, string>> = {
+    tg_token:    { channel: "telegram", field: "bot_token" },
+    gt_token:    { channel: "gotify",   field: "token" },
+    dc_hook:     { channel: "discord",  field: "webhook_url" },
+    em_pass:     { channel: "email",    field: "password" },
+    apprise_url: { channel: "apprise",  field: "url" },
+  }
+
+  const toggleSecret = async (key: string) => {
+    // Turning eye OFF — drop the cached cleartext immediately.
+    if (showSecrets[key]) {
+      setShowSecrets(prev => ({ ...prev, [key]: false }))
+      setRevealedSecrets(prev => {
+        const next = { ...prev }
+        delete next[key]
+        return next
+      })
+      return
+    }
+
+    // Turning eye ON — resolve the backend body. ai_key is dynamic
+    // (depends on current provider); the rest are static.
+    let body: Record<string, string> | null = null
+    if (key === "ai_key") {
+      const prov = (config.ai_provider || "").trim()
+      if (prov) body = { ai_provider: prov }
+    } else {
+      body = SECRET_REVEAL_TARGETS[key] || null
+    }
+
+    if (!body) {
+      // Unknown eye-toggle — flip state and let the input render
+      // whatever it already has. Never silently skip the UI feedback.
+      setShowSecrets(prev => ({ ...prev, [key]: true }))
+      return
+    }
+
+    try {
+      // Must go through `fetchApi` (not raw `fetch`) so the JWT
+      // Authorization header gets attached — the endpoint uses
+      // `@require_auth` and would reject a plain fetch with 401, which
+      // is exactly what produced the "still asterisks" behaviour seen
+      // on the first build.
+      const data = await fetchApi<{ value?: string }>("/api/notifications/reveal-secret", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      })
+      const value = typeof data?.value === "string" ? data.value : ""
+      setRevealedSecrets(prev => ({ ...prev, [key]: value }))
+    } catch {
+      // Network/auth failure → still flip the eye so the user sees
+      // the underlying input changing (and that it has the masked
+      // placeholder, which signals "not loaded"). Don't crash.
+    }
+    setShowSecrets(prev => ({ ...prev, [key]: true }))
+  }
+
+  // Sentinel the backend sends in place of any populated sensitive
+  // value (see SENSITIVE_PLACEHOLDER in notification_manager.py).
+  const SECRET_PLACEHOLDER = "************"
+
+  // Render value for a secret input:
+  // - if the eye is on AND the stored value is the masked placeholder
+  //   AND we have a revealed cleartext for this key → show cleartext.
+  // - otherwise show whatever the input already has (the placeholder
+  //   while masked, or the value the user is typing in editMode).
+  // This avoids overwriting an in-progress edit when the eye toggles.
+  const secretValue = (key: string, current: string): string => {
+    if (
+      showSecrets[key] &&
+      current === SECRET_PLACEHOLDER &&
+      revealedSecrets[key] !== undefined
+    ) {
+      return revealedSecrets[key]
+    }
+    return current
   }
 
   if (loading) {
@@ -1402,7 +1486,7 @@ export function NotificationSettings() {
                             type={showSecrets["tg_token"] ? "text" : "password"}
                             className={`h-7 text-xs font-mono ${!editMode ? "opacity-50" : ""}`}
                             placeholder="7595377878:AAGE6Fb2cy... (with or without 'bot' prefix)"
-                            value={config.channels.telegram?.bot_token || ""}
+                            value={secretValue("tg_token", config.channels.telegram?.bot_token || "")}
                             onChange={e => updateChannel("telegram", "bot_token", e.target.value)}
                             disabled={!editMode}
                           />
@@ -1519,7 +1603,7 @@ export function NotificationSettings() {
                             type={showSecrets["gt_token"] ? "text" : "password"}
                             className={`h-7 text-xs font-mono ${!editMode ? "opacity-50" : ""}`}
                             placeholder="A_valid_gotify_token"
-                            value={config.channels.gotify?.token || ""}
+                            value={secretValue("gt_token", config.channels.gotify?.token || "")}
                             onChange={e => updateChannel("gotify", "token", e.target.value)}
                             disabled={!editMode}
                           />
@@ -1597,7 +1681,7 @@ export function NotificationSettings() {
                             type={showSecrets["dc_hook"] ? "text" : "password"}
                             className={`h-7 text-xs font-mono ${!editMode ? "opacity-50" : ""}`}
                             placeholder="https://discord.com/api/webhooks/..."
-                            value={config.channels.discord?.webhook_url || ""}
+                            value={secretValue("dc_hook", config.channels.discord?.webhook_url || "")}
                             onChange={e => updateChannel("discord", "webhook_url", e.target.value)}
                             disabled={!editMode}
                           />
@@ -1729,7 +1813,7 @@ export function NotificationSettings() {
                               type={showSecrets["em_pass"] ? "text" : "password"}
                               className={`h-7 text-xs font-mono ${!editMode ? "opacity-50" : ""}`}
                               placeholder="App password"
-                              value={config.channels.email?.password || ""}
+                              value={secretValue("em_pass", config.channels.email?.password || "")}
                               onChange={e => updateChannel("email", "password", e.target.value)}
                               disabled={!editMode}
                             />
@@ -1840,14 +1924,14 @@ export function NotificationSettings() {
                             type={showSecrets["apprise_url"] ? "text" : "password"}
                             className={`h-7 text-xs font-mono min-w-0 flex-1 ${!editMode ? "opacity-50" : ""}`}
                             placeholder="tgram://bottoken/ChatID"
-                            value={config.channels.apprise?.url || ""}
+                            value={secretValue("apprise_url", config.channels.apprise?.url || "")}
                             onChange={e => updateChannel("apprise", "url", e.target.value)}
                             disabled={!editMode}
                           />
                           <button
                             type="button"
                             className="h-7 w-7 shrink-0 flex items-center justify-center rounded-md border border-border hover:bg-muted text-muted-foreground"
-                            onClick={() => setShowSecrets(s => ({ ...s, apprise_url: !s.apprise_url }))}
+                            onClick={() => toggleSecret("apprise_url")}
                             title={showSecrets["apprise_url"] ? "Hide URL" : "Show URL"}
                           >
                             {showSecrets["apprise_url"] ? <EyeOff className="h-3 w-3" /> : <Eye className="h-3 w-3" />}
@@ -2122,13 +2206,13 @@ export function NotificationSettings() {
                           type={showSecrets["ai_key"] ? "text" : "password"}
                           className="h-9 text-sm font-mono"
                           placeholder="sk-..."
-                          value={config.ai_api_keys?.[config.ai_provider] || ""}
-                          onChange={e => updateConfig(p => ({ 
-                            ...p, 
-                            ai_api_keys: { 
-                              ...p.ai_api_keys, 
-                              [p.ai_provider]: e.target.value 
-                            } 
+                          value={secretValue("ai_key", config.ai_api_keys?.[config.ai_provider] || "")}
+                          onChange={e => updateConfig(p => ({
+                            ...p,
+                            ai_api_keys: {
+                              ...p.ai_api_keys,
+                              [p.ai_provider]: e.target.value
+                            }
                           }))}
                           disabled={!editMode}
                         />
diff --git a/AppImage/components/process-detail-modal.tsx b/AppImage/components/process-detail-modal.tsx
new file mode 100644
index 00000000..36931de9
--- /dev/null
+++ b/AppImage/components/process-detail-modal.tsx
@@ -0,0 +1,279 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from "./ui/dialog"
+import { Input } from "./ui/input"
+import { ScrollArea } from "./ui/scroll-area"
+import { Cpu, MemoryStick, Search } from "lucide-react"
+import { fetchApi } from "@/lib/api-config"
+import { ProcessInfoModal } from "./process-info-modal"
+
+interface ProcessInfo {
+  pid: number
+  /** Parent process PID — equal to `pid` for process rows, different
+   *  for thread rows (CPU sort enumerates per-thread). The detail modal
+   *  always loads the parent, since /proc/<pid>/cmdline etc. only exist
+   *  at the process level. */
+  parent_pid?: number
+  user: string
+  cpu: number
+  /** CPU% averaged over the process's whole lifetime. Surfaces
+   *  long-running idle processes that consume a steady baseline but
+   *  don't spike during the 1-s sample window (an orphan `bash -s`
+   *  in a sleep-loop, a polling daemon, etc.). Only meaningful on
+   *  the CPU sort response. */
+  cpu_avg?: number
+  mem: number
+  rss_kb: number
+  command: string
+  /** Full command line. Used for filter matching and hover tooltips so
+   *  searching e.g. "proxmenux" finds a process whose short name is just
+   *  "python3" but whose cmdline is `python3 /.../proxmenux.py`. */
+  cmdline?: string
+}
+
+interface ProcessesResponse {
+  processes: ProcessInfo[]
+  sort: "cpu" | "mem"
+  captured_at: number
+}
+
+interface ProcessDetailModalProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  /** Which metric the parent card represents (drives default sort + emphasis) */
+  sort: "cpu" | "mem"
+}
+
+const REFRESH_MS = 3000
+// FETCH_LIMIT is how many rows the server returns. DISPLAY_LIMIT is what
+// the user actually sees when no filter is set. We over-fetch so the
+// filter can find processes that aren't in the top-N by metric — e.g.,
+// searching "proxmenux" in the Memory modal should find it even though
+// it's nowhere near the top 25 by RSS.
+const FETCH_LIMIT = 200
+const DISPLAY_LIMIT = 25
+
+const formatRss = (kb: number): string => {
+  if (kb >= 1024 * 1024) return `${(kb / 1024 / 1024).toFixed(2)} GB`
+  if (kb >= 1024) return `${(kb / 1024).toFixed(1)} MB`
+  return `${kb} KB`
+}
+
+export function ProcessDetailModal({ open, onOpenChange, sort }: ProcessDetailModalProps) {
+  const [data, setData] = useState<ProcessesResponse | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [loading, setLoading] = useState(false)
+  const [filter, setFilter] = useState("")
+  const [selectedPid, setSelectedPid] = useState<number | null>(null)
+
+  const fetchProcesses = async (silent = false) => {
+    if (!silent) setLoading(true)
+    setError(null)
+    try {
+      const res = await fetchApi<ProcessesResponse>(`/api/processes?sort=${sort}&limit=${FETCH_LIMIT}`)
+      setData(res)
+    } catch (e: any) {
+      setError(e?.message || "Failed to fetch processes")
+    } finally {
+      if (!silent) setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    if (!open) return
+    fetchProcesses()
+    const id = setInterval(() => fetchProcesses(true), REFRESH_MS)
+    return () => clearInterval(id)
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [open, sort])
+
+  // Reset filter when dialog closes
+  useEffect(() => {
+    if (!open) setFilter("")
+  }, [open])
+
+  // When no filter is set, the user just wants the top N by metric
+  // (CPU usage or memory). When they type a query, they want EVERY
+  // match — including processes that aren't in the top N — which is
+  // why we over-fetch on the server.
+  const allMatches = (data?.processes ?? []).filter((p) => {
+    if (!filter) return true
+    const q = filter.toLowerCase()
+    return (
+      p.command.toLowerCase().includes(q) ||
+      (p.cmdline?.toLowerCase().includes(q) ?? false) ||
+      p.user.toLowerCase().includes(q) ||
+      String(p.pid).includes(q)
+    )
+  })
+  const filtered = filter ? allMatches : allMatches.slice(0, DISPLAY_LIMIT)
+
+  const Icon = sort === "cpu" ? Cpu : MemoryStick
+  const title = sort === "cpu" ? "Top processes by CPU" : "Top processes by Memory"
+  const description =
+    sort === "cpu"
+      ? "Current CPU usage per process, as a fraction of the host's total CPU — same scale as the CPU Usage card above. Refreshes every 3 s while open."
+      : "Current resident memory per process. Refreshes every 3 s while open."
+
+  // Accent palette matched to the Overview cards: CPU Usage donut uses
+  // blue (#3b82f6), Memory cached uses rgba(99,102,241,0.55) — we keep
+  // the same hues so the modal feels like a continuation of the card.
+  const accent = sort === "cpu"
+    ? { dot: "#3b82f6", bar: "#3b82f6", text: "text-blue-500" }
+    : { dot: "#6366f1", bar: "#6366f1", text: "text-indigo-400" }
+
+  // Scale bars to the largest value in the (filtered) list so the visual
+  // ranking is preserved even when no process is near 100 %. CPU can
+  // exceed 100 % on multi-threaded apps — falling back to max=1 prevents
+  // a divide-by-zero when the list is empty.
+  const maxPrimary = Math.max(
+    1,
+    ...filtered.map((p) => (sort === "cpu" ? p.cpu : p.mem))
+  )
+
+  // Mobile drops PID + USER; desktop keeps the full 5-column layout.
+  // CPU and MEM columns are wider on desktop with a real gap between
+  // them so the two metrics don't feel glued together.
+  const gridCols =
+    "grid-cols-[minmax(0,1fr)_70px_90px] sm:grid-cols-[60px_96px_minmax(140px,1fr)_110px_120px]"
+
+  return (
+    <>
+      <Dialog open={open} onOpenChange={onOpenChange}>
+        <DialogContent
+          className="max-w-3xl"
+          /* Prevent Radix from focusing the search Input on open — the
+             auto-focus pops the on-screen keyboard on touch devices and
+             covers half the modal. The user can still tap the field to
+             start filtering. */
+          onOpenAutoFocus={(e) => e.preventDefault()}
+        >
+          <DialogHeader>
+            <DialogTitle className="flex items-center gap-2">
+              <Icon className={`h-5 w-5 ${accent.text}`} />
+              {title}
+            </DialogTitle>
+            <DialogDescription className="text-xs">{description}</DialogDescription>
+          </DialogHeader>
+
+          <div className="relative mb-2">
+            <Search className="absolute left-2 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground" />
+            <Input
+              placeholder="Filter by command line, user or PID..."
+              value={filter}
+              onChange={(e) => setFilter(e.target.value)}
+              className="pl-8 h-8 text-sm"
+            />
+          </div>
+
+          {error ? (
+            <div className="text-sm text-red-500 py-4">{error}</div>
+          ) : (
+            <ScrollArea className="h-[440px] border border-border rounded-md">
+              <div className="min-w-full">
+                {/* Sticky solid header so scrolled rows don't bleed through */}
+                <div
+                  className={`grid items-center gap-x-3 sm:gap-x-6 px-3 py-2 text-[10px] font-medium uppercase tracking-wider text-muted-foreground border-b border-border bg-card sticky top-0 z-10 ${gridCols}`}
+                >
+                  <div className="hidden sm:block">PID</div>
+                  <div className="hidden sm:block truncate">User</div>
+                  <div>Command</div>
+                  <div className={`text-right ${sort === "cpu" ? accent.text : ""}`}>CPU %</div>
+                  <div className={`text-right ${sort === "mem" ? accent.text : ""}`}>{sort === "mem" ? "Memory" : "Mem %"}</div>
+                </div>
+
+                {filtered.length === 0 && !loading ? (
+                  <div className="text-center py-8 text-sm text-muted-foreground">
+                    No processes match the filter
+                  </div>
+                ) : (
+                  filtered.map((p) => {
+                    const primary = sort === "cpu" ? p.cpu : p.mem
+                    const barPct = Math.min(100, (primary / maxPrimary) * 100)
+                    return (
+                      <button
+                        key={p.pid}
+                        type="button"
+                        onClick={() => setSelectedPid(p.parent_pid ?? p.pid)}
+                        className={`w-full text-left grid items-center gap-x-3 sm:gap-x-6 px-3 py-2 border-b border-border/40 hover:bg-white/5 transition-colors ${gridCols}`}
+                      >
+                        <div className="hidden sm:flex font-mono text-xs items-center gap-1.5 min-w-0">
+                          <span
+                            className="w-1.5 h-1.5 rounded-full flex-shrink-0"
+                            style={{ background: accent.dot }}
+                          />
+                          <span className="truncate">{p.pid}</span>
+                        </div>
+                        <div className="hidden sm:block font-mono text-xs truncate" title={p.user}>{p.user}</div>
+                        <div className="font-mono text-xs truncate min-w-0 flex items-center gap-1.5" title={p.cmdline || p.command}>
+                          {/* Mobile only: keep the accent dot since PID column is gone */}
+                          <span
+                            className="sm:hidden w-1.5 h-1.5 rounded-full flex-shrink-0"
+                            style={{ background: accent.dot }}
+                          />
+                          <span className="truncate">{p.command}</span>
+                        </div>
+
+                        {/* Primary metric: value + sized progress bar in the accent colour */}
+                        {sort === "cpu" ? (
+                          <div className="flex flex-col items-end gap-1 min-w-0">
+                            <span className={`font-mono text-sm font-semibold ${accent.text}`}>{p.cpu.toFixed(1)}</span>
+                            {/* Show lifetime average only when it
+                                materially differs from the live
+                                sample (process consumes a steady
+                                baseline but was idle at sample time
+                                — orphaned bash loop, polling daemon).
+                                The 0.5 / 1.5x thresholds skip cases
+                                where avg and now match within sampler
+                                noise. */}
+                            {typeof p.cpu_avg === "number" && p.cpu_avg >= 0.5 && p.cpu_avg > p.cpu * 1.5 && (
+                              <span className="font-mono text-[10px] text-amber-400" title="Average CPU% across this process's lifetime — useful for finding long-running idle baselines">
+                                avg {p.cpu_avg.toFixed(1)}
+                              </span>
+                            )}
+                            <div className="w-full h-1 bg-muted rounded-full overflow-hidden">
+                              <div className="h-full rounded-full" style={{ width: `${barPct}%`, background: accent.bar }} />
+                            </div>
+                          </div>
+                        ) : (
+                          <div className="font-mono text-xs text-right text-muted-foreground">{p.cpu.toFixed(1)}</div>
+                        )}
+
+                        {/* Secondary column: mem % when CPU is primary, RSS when memory is primary */}
+                        {sort === "cpu" ? (
+                          <div className="font-mono text-xs text-right text-muted-foreground">{p.mem.toFixed(1)}</div>
+                        ) : (
+                          <div className="flex flex-col items-end gap-1 min-w-0">
+                            <span className={`font-mono text-sm font-semibold ${accent.text}`}>{formatRss(p.rss_kb)}</span>
+                            <div className="w-full h-1 bg-muted rounded-full overflow-hidden">
+                              <div className="h-full rounded-full" style={{ width: `${barPct}%`, background: accent.bar }} />
+                            </div>
+                          </div>
+                        )}
+                      </button>
+                    )
+                  })
+                )}
+              </div>
+            </ScrollArea>
+          )}
+
+          {data?.captured_at && (
+            <div className="text-[10px] text-muted-foreground text-right mt-1">
+              Captured {new Date(data.captured_at * 1000).toLocaleTimeString()} · {filter
+                ? `${allMatches.length} match${allMatches.length === 1 ? '' : 'es'} of ${data.processes.length} processes`
+                : `Top ${filtered.length} of ${data.processes.length} processes`}
+            </div>
+          )}
+        </DialogContent>
+      </Dialog>
+
+      <ProcessInfoModal
+        pid={selectedPid}
+        accent={accent}
+        onClose={() => setSelectedPid(null)}
+      />
+    </>
+  )
+}
diff --git a/AppImage/components/process-info-modal.tsx b/AppImage/components/process-info-modal.tsx
new file mode 100644
index 00000000..11a83f33
--- /dev/null
+++ b/AppImage/components/process-info-modal.tsx
@@ -0,0 +1,259 @@
+"use client"
+
+import { useEffect, useRef, useState } from "react"
+import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from "./ui/dialog"
+import { ScrollArea } from "./ui/scroll-area"
+import { Activity, FileText, HardDrive, Clock, Info } from "lucide-react"
+import { fetchApi } from "@/lib/api-config"
+
+interface ProcessDetail {
+  pid: number
+  comm: string
+  cmdline: string
+  exe: string | null
+  cwd: string | null
+  state: string
+  ppid: number
+  parent_name: string | null
+  threads: number
+  vm_rss_kb: number
+  vm_size_kb: number
+  vm_swap_kb: number
+  user: string
+  group: string
+  uid: number
+  gid: number
+  start_time: string | null
+  elapsed: string | null
+  cpu: number
+  mem: number
+  io_read_bytes: number | null
+  io_write_bytes: number | null
+  fd_count: number | null
+  captured_at: number
+}
+
+interface ProcessInfoModalProps {
+  pid: number | null
+  accent: { dot: string; bar: string; text: string }
+  onClose: () => void
+}
+
+const REFRESH_MS = 3000
+
+const formatKb = (kb: number | null | undefined): string => {
+  if (kb == null) return "—"
+  if (kb >= 1024 * 1024) return `${(kb / 1024 / 1024).toFixed(2)} GB`
+  if (kb >= 1024) return `${(kb / 1024).toFixed(1)} MB`
+  return `${kb} KB`
+}
+
+const formatBytes = (b: number | null | undefined): string => {
+  if (b == null) return "—"
+  if (b >= 1024 * 1024 * 1024) return `${(b / 1024 / 1024 / 1024).toFixed(2)} GB`
+  if (b >= 1024 * 1024) return `${(b / 1024 / 1024).toFixed(1)} MB`
+  if (b >= 1024) return `${(b / 1024).toFixed(1)} KB`
+  return `${b} B`
+}
+
+// Linux process states from /proc/<pid>/status. The first char of `State:`
+// is the canonical letter — the rest of the field is a human label like
+// "(running)". We expand the bare letter to something readable.
+const stateLabel = (state: string): string => {
+  const letter = (state || "").trim().charAt(0).toUpperCase()
+  const map: Record<string, string> = {
+    R: "Running",
+    S: "Sleeping",
+    D: "Disk wait",
+    Z: "Zombie",
+    T: "Stopped",
+    t: "Tracing stop",
+    X: "Dead",
+    I: "Idle",
+  }
+  return map[letter] || state || "—"
+}
+
+export function ProcessInfoModal({ pid, accent, onClose }: ProcessInfoModalProps) {
+  const [data, setData] = useState<ProcessDetail | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [loading, setLoading] = useState(false)
+  const [exited, setExited] = useState(false)
+  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)
+  const open = pid != null
+
+  const stopPolling = () => {
+    if (intervalRef.current) {
+      clearInterval(intervalRef.current)
+      intervalRef.current = null
+    }
+  }
+
+  const fetchDetail = async (silent = false) => {
+    if (pid == null) return
+    if (!silent) setLoading(true)
+    setError(null)
+    try {
+      const res = await fetchApi<ProcessDetail>(`/api/processes/${pid}`)
+      setData(res)
+    } catch (e: any) {
+      // 404 = the process exited while the modal was open. Expected for
+      // short-lived helpers (pct exec, backup subprocesses, the `ps` snapshot
+      // itself). Keep the last good snapshot on screen, stop polling, and
+      // surface an info banner — NOT an error — so it doesn't look like a bug.
+      if (e?.message?.includes("404")) {
+        setExited(true)
+        stopPolling()
+      } else {
+        setError(e?.message || "Failed to fetch process")
+      }
+    } finally {
+      if (!silent) setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    if (pid == null) {
+      setData(null)
+      setError(null)
+      setExited(false)
+      stopPolling()
+      return
+    }
+    setExited(false)
+    fetchDetail()
+    intervalRef.current = setInterval(() => fetchDetail(true), REFRESH_MS)
+    return () => stopPolling()
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [pid])
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => { if (!v) onClose() }}>
+      <DialogContent className="max-w-2xl">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2 min-w-0">
+            <span
+              className="w-2 h-2 rounded-full flex-shrink-0"
+              style={{ background: accent.dot }}
+            />
+            <span className="truncate font-mono text-base">{data?.comm || "Process"}</span>
+            <span className="text-xs text-muted-foreground font-mono flex-shrink-0">PID {pid}</span>
+          </DialogTitle>
+          <DialogDescription className="text-xs">
+            {exited ? (
+              <>Last snapshot from <span className="font-mono">/proc/{pid}</span> before the process finished.</>
+            ) : (
+              <>Live snapshot from <span className="font-mono">/proc/{pid}</span>. Auto-refreshes every {REFRESH_MS / 1000} s while open.</>
+            )}
+          </DialogDescription>
+        </DialogHeader>
+
+        {/* Info banner when the process has finished. Amber, not red — this is
+            expected behavior for short-lived processes, not an error. */}
+        {exited && (
+          <div className="flex items-start gap-2 px-3 py-2 rounded-md border border-amber-500/30 bg-amber-500/10 text-xs text-amber-300">
+            <Info className="h-4 w-4 flex-shrink-0 mt-0.5" />
+            <div>
+              <div className="font-medium text-amber-200">This process has finished</div>
+              <div className="text-amber-300/80 mt-0.5">
+                It was likely a short-lived helper (a script, a <span className="font-mono">pct exec</span>, or a one-shot command) that completed while the modal was open. The data below is the last snapshot captured before it exited — not a stale or broken read.
+              </div>
+            </div>
+          </div>
+        )}
+
+        {error && !data ? (
+          <div className="text-sm text-red-500 py-4">{error}</div>
+        ) : !data ? (
+          <div className="text-sm text-muted-foreground py-8 text-center">
+            {loading ? "Loading…" : "—"}
+          </div>
+        ) : (
+          <ScrollArea className={`max-h-[480px] pr-2 ${exited ? "opacity-75" : ""}`}>
+            <div className="space-y-4">
+              {/* Overview */}
+              <Section icon={<Activity className="h-4 w-4 text-blue-400" />} title="Overview">
+                <Row label="State" value={exited ? "Exited" : stateLabel(data.state)} />
+                <Row label="Parent" value={data.parent_name ? `${data.parent_name} (PID ${data.ppid})` : `PID ${data.ppid}`} mono />
+                <Row label="Threads" value={String(data.threads)} mono />
+                <Row label="Open FDs" value={data.fd_count != null ? String(data.fd_count) : "—"} mono />
+                <Row label="User" value={`${data.user} (${data.uid})`} mono />
+                <Row label="Group" value={`${data.group} (${data.gid})`} mono />
+              </Section>
+
+              {/* Resources */}
+              <Section icon={<HardDrive className="h-4 w-4 text-amber-400" />} title="Resources">
+                <Row label="CPU" value={`${data.cpu.toFixed(1)} %`} mono valueClass={accent.text} />
+                <Row label="Memory" value={`${data.mem.toFixed(1)} %`} mono valueClass={accent.text} />
+                <Row label="Resident (RSS)" value={formatKb(data.vm_rss_kb)} mono />
+                <Row label="Virtual size" value={formatKb(data.vm_size_kb)} mono />
+                <Row label="Swap" value={formatKb(data.vm_swap_kb)} mono />
+                <Row label="I/O read" value={formatBytes(data.io_read_bytes)} mono />
+                <Row label="I/O write" value={formatBytes(data.io_write_bytes)} mono />
+              </Section>
+
+              {/* Command */}
+              <Section icon={<FileText className="h-4 w-4 text-purple-400" />} title="Command">
+                <Row label="Name" value={data.comm} mono />
+                <Row label="Command line" value={data.cmdline || data.comm} mono wrap />
+                <Row label="Executable" value={data.exe || "—"} mono wrap />
+                <Row label="Working dir" value={data.cwd || "—"} mono wrap />
+              </Section>
+
+              {/* Times */}
+              <Section icon={<Clock className="h-4 w-4 text-emerald-400" />} title="Lifetime">
+                <Row label="Started" value={data.start_time || "—"} mono />
+                <Row label="Running for" value={data.elapsed || "—"} mono />
+              </Section>
+            </div>
+          </ScrollArea>
+        )}
+
+        {data?.captured_at && (
+          <div className="text-[10px] text-muted-foreground text-right mt-1">
+            {exited ? "Last seen" : "Captured"} {new Date(data.captured_at * 1000).toLocaleTimeString()}
+            {error ? ` · ${error}` : ""}
+          </div>
+        )}
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+function Section({ icon, title, children }: { icon: React.ReactNode; title: string; children: React.ReactNode }) {
+  return (
+    <div className="border border-border rounded-md overflow-hidden">
+      <div className="flex items-center gap-2 px-3 py-2 bg-card text-xs font-medium uppercase tracking-wider text-muted-foreground border-b border-border">
+        {icon}
+        {title}
+      </div>
+      <div className="divide-y divide-border/40">{children}</div>
+    </div>
+  )
+}
+
+function Row({
+  label,
+  value,
+  mono,
+  wrap,
+  valueClass,
+}: {
+  label: string
+  value: string
+  mono?: boolean
+  wrap?: boolean
+  valueClass?: string
+}) {
+  return (
+    <div className="grid grid-cols-[110px_minmax(0,1fr)] gap-2 px-3 py-1.5 text-xs">
+      <div className="text-muted-foreground">{label}</div>
+      <div
+        className={`${mono ? "font-mono" : ""} ${wrap ? "break-all" : "truncate"} ${valueClass || ""}`}
+        title={value}
+      >
+        {value}
+      </div>
+    </div>
+  )
+}
diff --git a/AppImage/components/proxmox-dashboard.tsx b/AppImage/components/proxmox-dashboard.tsx
index e69e7140..41cebcb9 100644
--- a/AppImage/components/proxmox-dashboard.tsx
+++ b/AppImage/components/proxmox-dashboard.tsx
@@ -14,6 +14,7 @@ import { Settings } from "./settings"
 import { Security } from "./security"
 import { Profile } from "./profile"
 import { About } from "./about"
+import { HostBackup } from "./host-backup"
 import { OnboardingCarousel } from "./onboarding-carousel"
 import { HealthStatusModal } from "./health-status-modal"
 import { ReleaseNotesModal, useVersionCheck } from "./release-notes-modal"
@@ -30,17 +31,26 @@ import {
   LayoutDashboard,
   HardDrive,
   NetworkIcon,
-  Box,
+  Boxes,
   Cpu,
-  FileText,
+  ScrollText,
   SettingsIcon,
+  Settings2,
   Terminal,
   ShieldCheck,
   Info,
+  DatabaseBackup,
+  ChevronDown,
 } from "lucide-react"
 import Image from "next/image"
 import { ThemeToggle } from "./theme-toggle"
 import { Sheet, SheetContent, SheetTrigger } from "./ui/sheet"
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "./ui/dropdown-menu"
 
 interface SystemStatus {
   status: "healthy" | "warning" | "critical"
@@ -352,28 +362,19 @@ export function ProxmoxDashboard() {
 
   const getActiveTabLabel = () => {
     switch (activeTab) {
-      case "overview":
-        return "Overview"
-      case "storage":
-        return "Storage"
-      case "network":
-        return "Network"
-      case "vms":
-        return "VMs & LXCs"
-      case "hardware":
-        return "Hardware"
-      case "terminal":
-        return "Terminal"
-      case "logs":
-        return "System Logs"
-  case "security":
-  return "Security"
-  case "settings":
-  return "Settings"
-  case "profile":
-  return "Profile"
-      default:
-        return "Navigation Menu"
+      case "overview":  return "Overview"
+      case "vms":       return "VMs & LXCs"
+      case "storage":   return "Storage"
+      case "network":   return "Network"
+      case "hardware":  return "Hardware"
+      case "backup":    return "Backup"
+      case "terminal":  return "Terminal"
+      case "logs":      return "System Logs"
+      case "security":  return "Security"
+      case "settings":  return "Settings"
+      case "about":     return "About"
+      case "profile":   return "Profile"
+      default:          return "Navigation Menu"
     }
   }
 
@@ -565,71 +566,128 @@ export function ProxmoxDashboard() {
       >
         <div className="container mx-auto px-4 lg:px-6 pt-4 lg:pt-6">
           <Tabs value={activeTab} onValueChange={setActiveTab} className="space-y-0">
-            {/* Issue #191: 10 tabs after adding About. The grid wraps via
-                Tabs primitives so the extra column doesn't push the
-                triggers off-screen on common laptop widths. */}
-            <TabsList className="hidden lg:grid w-full grid-cols-10 bg-card border border-border">
-              <TabsTrigger
-                value="overview"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Overview
-              </TabsTrigger>
-              <TabsTrigger
-                value="storage"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Storage
-              </TabsTrigger>
-              <TabsTrigger
-                value="network"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Network
-              </TabsTrigger>
-              <TabsTrigger
-                value="vms"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                VMs & LXCs
-              </TabsTrigger>
-              <TabsTrigger
-                value="hardware"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Hardware
-              </TabsTrigger>
-              <TabsTrigger
-                value="logs"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                System Logs
-              </TabsTrigger>
-              <TabsTrigger
-                value="terminal"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Terminal
-              </TabsTrigger>
-              <TabsTrigger
-                value="security"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Security
-              </TabsTrigger>
-              <TabsTrigger
-                value="settings"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                Settings
-              </TabsTrigger>
-              <TabsTrigger
-                value="about"
-                className="data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
-              >
-                About
-              </TabsTrigger>
-            </TabsList>
+            {/* Sprint 13D nav redesign — 6 top-level slots in usage order:
+                Overview · VMs & LXCs · Node ⌄ · Backup · Terminal · Admin ⌄
+                Node groups Storage / Network / Hardware (3 sub-items).
+                Admin groups System Logs / Security / Settings / About
+                (will split when RBAC arrives in 1.5.0).
+                Backup is direct now (only Host Backup); becomes a dropdown
+                when VM/LXC centralised backup ships. */}
+            {(() => {
+              const triggerActiveClass =
+                "data-[state=active]:bg-blue-500 data-[state=active]:text-white data-[state=active]:rounded-md"
+              // Each dropdown lists its children in the order they
+              // render. When one of them is the active tab, the dropdown
+              // trigger swaps its label + icon to that child — same
+              // pattern macOS Settings uses inside a category: the
+              // crumb shows where you are, the chevron tells you the
+              // siblings are one click away.
+              const NODE_ITEMS = [
+                { value: "storage",  label: "Storage",  Icon: HardDrive,   default: false },
+                { value: "network",  label: "Network",  Icon: NetworkIcon, default: false },
+                { value: "hardware", label: "Hardware", Icon: Cpu,         default: false },
+              ]
+              const ADMIN_ITEMS = [
+                { value: "logs",     label: "System Logs", Icon: ScrollText,  default: false },
+                { value: "security", label: "Security",    Icon: ShieldCheck, default: false },
+                { value: "settings", label: "Settings",    Icon: SettingsIcon, default: false },
+                { value: "about",    label: "About",       Icon: Info,        default: false },
+              ]
+              const activeNodeItem  = NODE_ITEMS.find(i => i.value === activeTab)
+              const activeAdminItem = ADMIN_ITEMS.find(i => i.value === activeTab)
+              const isNodeActive    = activeNodeItem !== undefined
+              const isAdminActive   = activeAdminItem !== undefined
+              // The trigger label + icon shown on the bar. When a child
+              // is active we surface IT; otherwise the group default.
+              const NodeTriggerIcon  = activeNodeItem ? activeNodeItem.Icon  : Server
+              const NodeTriggerLabel = activeNodeItem ? activeNodeItem.label : "Node"
+              const AdminTriggerIcon  = activeAdminItem ? activeAdminItem.Icon  : Settings2
+              const AdminTriggerLabel = activeAdminItem ? activeAdminItem.label : "Admin"
+              // Dropdown trigger styling: parity with TabsTrigger so the
+              // parent visibly carries the "I'm the selected section"
+              // signal when any of its children is the active tab —
+              // same blue background + white text + rounded as a direct
+              // tab. Without this the user lands on Storage and the
+              // entire top bar looks idle.
+              const dropdownBtnClass = (active: boolean) =>
+                `inline-flex items-center justify-center whitespace-nowrap px-3 py-1.5 text-sm font-medium ring-offset-background transition-all focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 ${
+                  active
+                    ? "bg-blue-500 text-white rounded-md"
+                    : "text-muted-foreground hover:text-foreground rounded-sm"
+                }`
+
+              return (
+                <TabsList className="hidden lg:grid w-full grid-cols-6 bg-card border border-border">
+                  {/* Direct: Overview */}
+                  <TabsTrigger value="overview" className={triggerActiveClass}>
+                    <LayoutDashboard className="mr-2 h-4 w-4" />
+                    Overview
+                  </TabsTrigger>
+
+                  {/* Direct: VMs & LXCs — first-class because Proxmox IS
+                      a hypervisor; workloads belong at top level. */}
+                  <TabsTrigger value="vms" className={triggerActiveClass}>
+                    <Boxes className="mr-2 h-4 w-4" />
+                    VMs &amp; LXCs
+                  </TabsTrigger>
+
+                  {/* Dropdown: Node (Storage / Network / Hardware) */}
+                  <DropdownMenu>
+                    <DropdownMenuTrigger className={dropdownBtnClass(isNodeActive)}>
+                      <NodeTriggerIcon className="mr-2 h-4 w-4" />
+                      {NodeTriggerLabel}
+                      <ChevronDown className="ml-1.5 h-3 w-3 opacity-70" />
+                    </DropdownMenuTrigger>
+                    <DropdownMenuContent align="center" className="min-w-[180px]">
+                      {NODE_ITEMS.map(({ value, label, Icon }) => (
+                        <DropdownMenuItem
+                          key={value}
+                          onClick={() => setActiveTab(value)}
+                          className={activeTab === value ? "bg-blue-500/10 text-blue-500" : ""}
+                        >
+                          <Icon className="mr-2 h-4 w-4" />
+                          {label}
+                        </DropdownMenuItem>
+                      ))}
+                    </DropdownMenuContent>
+                  </DropdownMenu>
+
+                  {/* Direct: Backup (today: Host Backup only). When VM/LXC
+                      backup ships this becomes a dropdown. */}
+                  <TabsTrigger value="backup" className={triggerActiveClass}>
+                    <DatabaseBackup className="mr-2 h-4 w-4" />
+                    Backup
+                  </TabsTrigger>
+
+                  {/* Direct: Terminal */}
+                  <TabsTrigger value="terminal" className={triggerActiveClass}>
+                    <Terminal className="mr-2 h-4 w-4" />
+                    Terminal
+                  </TabsTrigger>
+
+                  {/* Dropdown: Admin (System Logs / Security / Settings / About) */}
+                  <DropdownMenu>
+                    <DropdownMenuTrigger className={dropdownBtnClass(isAdminActive)}>
+                      <AdminTriggerIcon className="mr-2 h-4 w-4" />
+                      {AdminTriggerLabel}
+                      <ChevronDown className="ml-1.5 h-3 w-3 opacity-70" />
+                    </DropdownMenuTrigger>
+                    <DropdownMenuContent align="center" className="min-w-[180px]">
+                      {ADMIN_ITEMS.map(({ value, label, Icon }) => (
+                        <DropdownMenuItem
+                          key={value}
+                          onClick={() => setActiveTab(value)}
+                          className={activeTab === value ? "bg-blue-500/10 text-blue-500" : ""}
+                        >
+                          <Icon className="mr-2 h-4 w-4" />
+                          {label}
+                        </DropdownMenuItem>
+                      ))}
+                    </DropdownMenuContent>
+                  </DropdownMenu>
+                </TabsList>
+              )
+            })()}
 
             <Sheet open={mobileMenuOpen} onOpenChange={setMobileMenuOpen}>
               <div className="lg:hidden">
@@ -646,158 +704,74 @@ export function ProxmoxDashboard() {
                 </SheetTrigger>
               </div>
               <SheetContent side="top" className="bg-card border-border">
-                <div className="flex flex-col gap-2 mt-4">
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("overview")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "overview"
+                {(() => {
+                  // Sheet items mirror the desktop layout: 6 sections,
+                  // with two of them (Node, Admin) collapsing into a
+                  // header + nested items. Direct tabs (Overview, VMs,
+                  // Backup, Terminal) sit at the top level.
+                  const select = (v: string) => {
+                    setActiveTab(v)
+                    setMobileMenuOpen(false)
+                  }
+                  const itemClass = (active: boolean) =>
+                    `w-full justify-start gap-3 ${
+                      active
                         ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
                         : ""
-                    }`}
-                  >
-                    <LayoutDashboard className="h-5 w-5" />
-                    <span>Overview</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("storage")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "storage"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <HardDrive className="h-5 w-5" />
-                    <span>Storage</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("network")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "network"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <NetworkIcon className="h-5 w-5" />
-                    <span>Network</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("vms")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "vms"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <Box className="h-5 w-5" />
-                    <span>VMs & LXCs</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("hardware")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "hardware"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <Cpu className="h-5 w-5" />
-                    <span>Hardware</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("logs")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "logs"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <FileText className="h-5 w-5" />
-                    <span>System Logs</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("terminal")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "terminal"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <Terminal className="h-5 w-5" />
-                    <span>Terminal</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("security")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "security"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <ShieldCheck className="h-5 w-5" />
-                    <span>Security</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("settings")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "settings"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <SettingsIcon className="h-5 w-5" />
-                    <span>Settings</span>
-                  </Button>
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setActiveTab("about")
-                      setMobileMenuOpen(false)
-                    }}
-                    className={`w-full justify-start gap-3 ${
-                      activeTab === "about"
-                        ? "bg-blue-500/10 text-blue-500 border-l-4 border-blue-500 rounded-l-none"
-                        : ""
-                    }`}
-                  >
-                    <Info className="h-5 w-5" />
-                    <span>About</span>
-                  </Button>
-                </div>
+                    }`
+                  // Mobile sheet is a flat list (no section headers).
+                  // The desktop layout uses dropdowns to express the
+                  // Node/Admin grouping; here we just enumerate items
+                  // in the same visual order.
+                  return (
+                    <div className="flex flex-col gap-1 mt-4">
+                      <Button variant="ghost" onClick={() => select("overview")} className={itemClass(activeTab === "overview")}>
+                        <LayoutDashboard className="h-5 w-5" />
+                        <span>Overview</span>
+                      </Button>
+                      <Button variant="ghost" onClick={() => select("vms")} className={itemClass(activeTab === "vms")}>
+                        <Boxes className="h-5 w-5" />
+                        <span>VMs &amp; LXCs</span>
+                      </Button>
+                      <Button variant="ghost" onClick={() => select("storage")} className={itemClass(activeTab === "storage")}>
+                        <HardDrive className="h-5 w-5" />
+                        <span>Storage</span>
+                      </Button>
+                      <Button variant="ghost" onClick={() => select("network")} className={itemClass(activeTab === "network")}>
+                        <NetworkIcon className="h-5 w-5" />
+                        <span>Network</span>
+                      </Button>
+                      <Button variant="ghost" onClick={() => select("hardware")} className={itemClass(activeTab === "hardware")}>
+                        <Cpu className="h-5 w-5" />
+                        <span>Hardware</span>
+                      </Button>
+                      <Button variant="ghost" onClick={() => select("backup")} className={itemClass(activeTab === "backup")}>
+                        <DatabaseBackup className="h-5 w-5" />
+                        <span>Backup</span>
+                      </Button>
+                      <Button variant="ghost" onClick={() => select("terminal")} className={itemClass(activeTab === "terminal")}>
+                        <Terminal className="h-5 w-5" />
+                        <span>Terminal</span>
+                      </Button>
+                      <Button variant="ghost" onClick={() => select("logs")} className={itemClass(activeTab === "logs")}>
+                        <ScrollText className="h-5 w-5" />
+                        <span>System Logs</span>
+                      </Button>
+                      <Button variant="ghost" onClick={() => select("security")} className={itemClass(activeTab === "security")}>
+                        <ShieldCheck className="h-5 w-5" />
+                        <span>Security</span>
+                      </Button>
+                      <Button variant="ghost" onClick={() => select("settings")} className={itemClass(activeTab === "settings")}>
+                        <SettingsIcon className="h-5 w-5" />
+                        <span>Settings</span>
+                      </Button>
+                      <Button variant="ghost" onClick={() => select("about")} className={itemClass(activeTab === "about")}>
+                        <Info className="h-5 w-5" />
+                        <span>About</span>
+                      </Button>
+                    </div>
+                  )
+                })()}
               </SheetContent>
             </Sheet>
           </Tabs>
@@ -830,6 +804,10 @@ export function ProxmoxDashboard() {
             <SystemLogs key={`logs-${componentKey}`} />
           </TabsContent>
 
+          <TabsContent value="backup" className="space-y-4 md:space-y-6 mt-0">
+            <HostBackup key={`backup-${componentKey}`} />
+          </TabsContent>
+
           <TabsContent value="terminal" className="mt-0">
             <TerminalPanel key={`terminal-${componentKey}`} />
           </TabsContent>
@@ -858,7 +836,7 @@ export function ProxmoxDashboard() {
         </Tabs>
 
         <footer className="mt-8 md:mt-12 pt-4 md:pt-6 border-t border-border text-center text-xs md:text-sm text-muted-foreground">
-          <p className="font-medium mb-2">ProxMenux Monitor v1.2.2.1-beta</p>
+          <p className="font-medium mb-2">ProxMenux Monitor v1.2.3</p>
           <p>
             <a
               href="https://ko-fi.com/macrimi"
diff --git a/AppImage/components/pwa-register.tsx b/AppImage/components/pwa-register.tsx
new file mode 100644
index 00000000..94196a59
--- /dev/null
+++ b/AppImage/components/pwa-register.tsx
@@ -0,0 +1,39 @@
+"use client"
+
+import { useEffect } from "react"
+
+// ===========================================================
+// PwaRegister
+// ===========================================================
+// Registers /sw.js once on mount. Chrome (Android) only
+// surfaces the "Install app" prompt when a service worker
+// is active, so even though the SW itself does nothing
+// (network-only, no caching), its mere presence flips the
+// PWA-installability check from no-to-yes.
+//
+// Mounted from app/layout.tsx so it runs on every route.
+// ===========================================================
+export function PwaRegister() {
+  useEffect(() => {
+    if (typeof window === "undefined") return
+    if (!("serviceWorker" in navigator)) return
+    // Wait for the load event to avoid competing with the
+    // initial render — the SW registration is not on the
+    // critical render path.
+    const register = () => {
+      navigator.serviceWorker
+        .register("/sw.js", { scope: "/" })
+        .catch((err) => {
+          // Surface the failure only in DevTools — silent in prod.
+          console.warn("[pwa] service worker registration failed:", err)
+        })
+    }
+    if (document.readyState === "complete") {
+      register()
+    } else {
+      window.addEventListener("load", register, { once: true })
+      return () => window.removeEventListener("load", register)
+    }
+  }, [])
+  return null
+}
diff --git a/AppImage/components/release-notes-modal.tsx b/AppImage/components/release-notes-modal.tsx
index 7b8a8ac6..518ca9a2 100644
--- a/AppImage/components/release-notes-modal.tsx
+++ b/AppImage/components/release-notes-modal.tsx
@@ -3,10 +3,10 @@
 import { useState, useEffect } from "react"
 import { Button } from "./ui/button"
 import { Dialog, DialogContent, DialogTitle } from "./ui/dialog"
-import { X, Sparkles, Thermometer, Activity, HardDrive, Shield, Globe, Cpu, Zap, Sliders, Wrench, RefreshCw, Server, BellOff, Bell } from "lucide-react"
+import { X, Sparkles, Thermometer, Activity, HardDrive, Shield, Globe, Cpu, Zap, Sliders, Wrench, RefreshCw, Server, BellOff, Bell, Calendar, DatabaseBackup } from "lucide-react"
 import { Checkbox } from "./ui/checkbox"
 
-const APP_VERSION = "1.2.2.1-beta" // Sync with AppImage/package.json
+const APP_VERSION = "1.2.3" // Sync with AppImage/package.json
 
 interface ReleaseNote {
   date: string
@@ -217,16 +217,28 @@ export const CHANGELOG: Record<string, ReleaseNote> = {
 
 const CURRENT_VERSION_FEATURES = [
   {
-    icon: <Activity className="h-5 w-5" />,
-    text: "Header Critical badge now respects dismissals (#228) - Permanently silencing every critical alert in a category used to leave the badge stuck on Critical even though the popup correctly reported 0 critical. The rollup that drives /api/system-info now runs a dismiss-aware pass over every category, so the badge, the popup and any API consumer all see the same view",
+    icon: <DatabaseBackup className="h-5 w-5" />,
+    text: "Backups integrated in the Monitor — a new first-class section to create, schedule and restore host backups against Local, PBS or Borg destinations from the Web dashboard. Jobs run on a proper systemd timer or attach to an existing PVE vzdump job with retention live-inherited from the parent. Encrypted PBS backups store a paired recovery blob next to each snapshot so a fresh install can always get the key back. After a reboot the tab shows a real-time restore progress card with milestones, per-component status (NVIDIA, Intel GPU tools, Coral, AMD tools), boot sanity warnings and a rollback delta listing anything on the host that wasn't in the backup.",
   },
   {
-    icon: <RefreshCw className="h-5 w-5" />,
-    text: "Auto-reconcile of stale alerts - Errors for resources that no longer exist now auto-clear within the regular cleanup cycle. New cases: a PVE storage removed via pvesm, an NFS/CIFS share whose mount target is no longer in /proc/mounts (the lazy-umount case reported in the field), and LXC mount-capacity alerts whose CT has been deleted",
+    icon: <Activity className="h-5 w-5" />,
+    text: "Network Flow diagram — a new live topology view on the Network tab showing NICs → host → bridges → LXCs / VMs with animated rx / tx pulses on every internal link, so the operator can see in real time how traffic distributes inside the host and which guests are pulling or pushing data.",
+  },
+  {
+    icon: <Sparkles className="h-5 w-5" />,
+    text: "Redesigned cards across Overview, VM / LXC, Storage and Network — layouts reworked for faster reading and denser, more practical information: key numbers surface at a glance, grouped by relevance, and the responsive grid now behaves cleanly from a phone up to an ultrawide.",
+  },
+  {
+    icon: <HardDrive className="h-5 w-5" />,
+    text: "Physical Disks and Physical Interfaces cards redesigned — clearer per-item presentation on the Storage and Network tabs. USB-NVMe / USB-SATA enclosures reporting removable=0 (ASMedia, JMicron, Realtek, ASM105x) now walk sysfs to detect USB attachment, so the -d snt* pass-through is tried and the drive's real model, serial, temperature, power-on hours and health surface — instead of the bridge's chatter.",
+  },
+  {
+    icon: <Sliders className="h-5 w-5" />,
+    text: "Health Monitor Thresholds — the Settings panel that controls per-category Warning and Critical levels (CPU, memory, temperature, storage, disks, ...) was reworked with clearer visual grouping and inline hints, so tuning a threshold now takes a couple of clicks instead of scrolling through a wall of numbers.",
   },
   {
     icon: <Bell className="h-5 w-5" />,
-    text: "Notification Send Test buttons unified (#226) - All five channel Send Test buttons (Telegram, Gotify, Discord, Email, Apprise) now sit on the left side and carry their channel's brand colour with white text, instead of Apprise being the right-aligned cyan outlier",
+    text: "Richer notifications out of the box — for users not running an AI agent, the templated body now identifies the affected object (which storage, which interface, which container), surfaces the top offenders with an \"…and N more\" tail when the list is long, and preserves the same identity in the recovery message. Users with AI enrichment enabled continue to get their tailored rewrite on top of this improved base.",
   },
 ]
 
diff --git a/AppImage/components/restore-progress-card.tsx b/AppImage/components/restore-progress-card.tsx
new file mode 100644
index 00000000..b57c06c8
--- /dev/null
+++ b/AppImage/components/restore-progress-card.tsx
@@ -0,0 +1,596 @@
+"use client"
+
+// Live inline card + detail modal for the post-boot restore.
+//
+// apply_cluster_postboot.sh writes /var/lib/proxmenux/restore-state.json
+// as it works through the milestones (apply cluster config, initramfs,
+// grub, per-component reinstalls, sanity check, finalize). The Flask
+// endpoints /api/host-backups/restore/{status,dismiss,history,log}
+// expose that state to this component. While the restore is running we
+// poll every 2s; once it's terminal (complete|failed) we back off to
+// 30s so the card can still be re-opened as a summary. Once the
+// operator hits Dismiss the card collapses and the History button
+// keeps the run browsable.
+
+import { useMemo, useState } from "react"
+import useSWR from "swr"
+import { Card, CardContent, CardHeader, CardTitle } from "./ui/card"
+import { Button } from "./ui/button"
+import { Badge } from "./ui/badge"
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+  DialogFooter,
+} from "./ui/dialog"
+import { ScrollArea } from "./ui/scroll-area"
+import {
+  Loader2,
+  CheckCircle2,
+  XCircle,
+  AlertTriangle,
+  History,
+  RotateCcw,
+  ChevronRight,
+  Cpu,
+  FileText,
+  ArrowDownAZ,
+  Filter,
+} from "lucide-react"
+import { fetchApi } from "../lib/api-config"
+
+// ── Shape contracts with the backend ──────────────────────────
+
+interface RestoreComponent {
+  name: string
+  status: "installing" | "ok" | "failed"
+  log: string
+  exit_code?: string
+}
+
+interface RestoreSummary {
+  hostname: string
+  guests: string
+  stubs: string
+  stale_nodes: string
+  components: string
+  duration: string
+}
+
+interface RestoreRollback {
+  vms_to_remove?: string[]
+  lxcs_to_remove?: string[]
+  components_to_uninstall?: string[]
+}
+
+interface RestoreState {
+  status: "running" | "complete" | "failed"
+  started_at: string
+  finished_at: string | null
+  current_step: string
+  steps_done: number
+  steps_total: number
+  log_path: string
+  components: RestoreComponent[]
+  rollback_delta: RestoreRollback
+  sanity_warnings: string[]
+  summary: RestoreSummary | null
+  acknowledged: boolean
+  duration?: string
+}
+
+interface HistoryEntry {
+  file: string
+  mtime: number
+  status: string
+  started_at: string | null
+  finished_at: string | null
+  duration: string | null
+}
+
+const fetcher = (url: string) => fetchApi(url)
+
+const COMPONENT_LABEL: Record<string, string> = {
+  nvidia_driver: "NVIDIA driver",
+  amdgpu_top: "amdgpu_top",
+  intel_gpu_tools: "Intel GPU tools",
+  coral_driver: "Google Coral TPU driver",
+}
+
+const formatComponent = (name: string) => COMPONENT_LABEL[name] ?? name
+
+const formatIso = (iso: string | null | undefined) => {
+  if (!iso) return "—"
+  try {
+    return new Date(iso).toLocaleString()
+  } catch {
+    return iso
+  }
+}
+
+const formatRelative = (iso: string) => {
+  try {
+    const then = new Date(iso).getTime()
+    const now = Date.now()
+    const diff = Math.max(0, Math.round((now - then) / 1000))
+    if (diff < 60) return `${diff}s ago`
+    if (diff < 3600) return `${Math.round(diff / 60)}m ago`
+    if (diff < 86400) return `${Math.round(diff / 3600)}h ago`
+    return `${Math.round(diff / 86400)}d ago`
+  } catch {
+    return iso
+  }
+}
+
+// Rough time-remaining estimate derived from steps_done + elapsed.
+// Best-effort: at step 0 there's no data yet, so it returns
+// "estimating time…". After the run is terminal, "—". The output is
+// a full phrase so the caller doesn't have to add suffix words that
+// only make sense on some branches.
+const computeEta = (state: RestoreState): string => {
+  if (state.status !== "running") return "—"
+  if (!state.steps_done || state.steps_done <= 0) return "estimating time…"
+  const elapsedSec = Math.max(1, Math.round((Date.now() - new Date(state.started_at).getTime()) / 1000))
+  const perStep = elapsedSec / state.steps_done
+  const remaining = Math.max(0, state.steps_total - state.steps_done)
+  const eta = Math.round(perStep * remaining)
+  if (eta < 60) return `~${eta}s left`
+  if (eta < 3600) return `~${Math.round(eta / 60)}m left`
+  return `~${Math.round(eta / 3600)}h left`
+}
+
+// ── Small building blocks ─────────────────────────────────────
+
+const StatusBadge: React.FC<{ status: string }> = ({ status }) => {
+  if (status === "running")
+    return (
+      <Badge className="bg-blue-500/10 border-blue-500/40 text-blue-300 gap-1">
+        <Loader2 className="h-3 w-3 animate-spin" />
+        Restore in progress
+      </Badge>
+    )
+  if (status === "complete")
+    return (
+      <Badge className="bg-emerald-500/10 border-emerald-500/40 text-emerald-400 gap-1">
+        <CheckCircle2 className="h-3 w-3" />
+        Restore complete
+      </Badge>
+    )
+  if (status === "failed")
+    return (
+      <Badge className="bg-red-500/10 border-red-500/40 text-red-400 gap-1">
+        <XCircle className="h-3 w-3" />
+        Restore failed
+      </Badge>
+    )
+  return <Badge variant="outline">{status}</Badge>
+}
+
+const ComponentStatusIcon: React.FC<{ status: string }> = ({ status }) => {
+  if (status === "installing")
+    return <Loader2 className="h-3.5 w-3.5 animate-spin text-blue-400" />
+  if (status === "ok")
+    return <CheckCircle2 className="h-3.5 w-3.5 text-emerald-400" />
+  return <XCircle className="h-3.5 w-3.5 text-red-400" />
+}
+
+// ── Log viewer ────────────────────────────────────────────────
+
+const LogViewer: React.FC<{ path: string | null; historyOnly?: boolean }> = ({ path, historyOnly }) => {
+  const [filter, setFilter] = useState<"all" | "issues">("all")
+  const swrKey = path
+    ? `/api/host-backups/restore/log?filter=${filter}&tail=600${historyOnly ? `&path=${encodeURIComponent(path)}` : ""}`
+    : null
+  const { data, isLoading } = useSWR<{ lines: string[]; total_lines: number; path: string | null }>(
+    swrKey,
+    fetcher,
+    { refreshInterval: historyOnly ? 0 : 4000 },
+  )
+
+  return (
+    <div className="space-y-2">
+      <div className="flex items-center justify-between text-xs">
+        <div className="flex items-center gap-1 text-muted-foreground">
+          <FileText className="h-3.5 w-3.5" />
+          {path ?? "no log yet"}
+        </div>
+        <div className="flex items-center gap-1">
+          <Button
+            size="sm"
+            variant={filter === "all" ? "default" : "outline"}
+            className="h-6 px-2 text-xs"
+            onClick={() => setFilter("all")}
+          >
+            <ArrowDownAZ className="h-3 w-3 mr-1" />
+            Full
+          </Button>
+          <Button
+            size="sm"
+            variant={filter === "issues" ? "default" : "outline"}
+            className="h-6 px-2 text-xs"
+            onClick={() => setFilter("issues")}
+          >
+            <Filter className="h-3 w-3 mr-1" />
+            Issues only
+          </Button>
+        </div>
+      </div>
+      <ScrollArea className="h-72 rounded-md border border-border bg-black/40">
+        <pre className="p-3 text-xs text-muted-foreground whitespace-pre-wrap font-mono leading-relaxed">
+          {isLoading ? "Loading…" : (data?.lines?.join("\n") || "(no output)")}
+        </pre>
+      </ScrollArea>
+    </div>
+  )
+}
+
+// ── Rollback delta widget ─────────────────────────────────────
+
+const RollbackDelta: React.FC<{ delta: RestoreRollback | undefined }> = ({ delta }) => {
+  const vms = delta?.vms_to_remove ?? []
+  const lxcs = delta?.lxcs_to_remove ?? []
+  const comps = delta?.components_to_uninstall ?? []
+  if (!vms.length && !lxcs.length && !comps.length) {
+    return (
+      <div className="text-xs text-muted-foreground">
+        No entries exist on this host that weren't in the restored backup.
+      </div>
+    )
+  }
+  const Row: React.FC<{ label: string; items: string[]; cmd: (id: string) => string }> = ({ label, items, cmd }) =>
+    items.length === 0 ? null : (
+      <div className="space-y-1">
+        <div className="text-xs font-medium text-muted-foreground">{label}</div>
+        <div className="flex flex-wrap gap-1.5">
+          {items.map((id) => (
+            <Badge key={id} variant="outline" className="font-mono text-xs">
+              {id}
+            </Badge>
+          ))}
+        </div>
+        {items.length > 0 && (
+          <details className="text-xs">
+            <summary className="cursor-pointer text-muted-foreground hover:text-foreground">
+              Show manual cleanup commands
+            </summary>
+            <pre className="mt-1 p-2 rounded-md bg-black/40 text-xs text-muted-foreground font-mono">
+              {items.map(cmd).join("\n")}
+            </pre>
+          </details>
+        )}
+      </div>
+    )
+
+  return (
+    <div className="space-y-3">
+      <div className="text-xs text-muted-foreground">
+        These entries exist on this host but were NOT in the restored backup. Review before removing.
+      </div>
+      <Row
+        label="VMs created after the backup"
+        items={vms}
+        cmd={(id) => `qm stop ${id} 2>/dev/null; qm destroy ${id} --purge`}
+      />
+      <Row
+        label="LXCs created after the backup"
+        items={lxcs}
+        cmd={(id) => `pct stop ${id} 2>/dev/null; pct destroy ${id} --purge`}
+      />
+      <Row
+        label="Components installed after the backup"
+        items={comps}
+        cmd={(name) => `# uninstall ${name} manually via ProxMenux → Hardware & GPU`}
+      />
+    </div>
+  )
+}
+
+// ── Detail modal ──────────────────────────────────────────────
+
+const RestoreDetailModal: React.FC<{
+  open: boolean
+  onClose: () => void
+  state: RestoreState
+  historyMode?: boolean
+}> = ({ open, onClose, state, historyMode }) => {
+  const progressPct = state.steps_total > 0 ? Math.round((state.steps_done / state.steps_total) * 100) : 0
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => !v && onClose()}>
+      <DialogContent className="max-w-3xl">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <RotateCcw className="h-5 w-5 text-blue-500" />
+            Post-restore progress
+            <StatusBadge status={state.status} />
+          </DialogTitle>
+          <DialogDescription>
+            Started {formatIso(state.started_at)}
+            {state.finished_at ? ` · finished ${formatIso(state.finished_at)}` : ""}
+            {state.summary?.duration ? ` · ${state.summary.duration}` : ""}
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-4">
+          <div className="space-y-1">
+            <div className="flex justify-between text-xs text-muted-foreground">
+              <span>{state.current_step || "—"}</span>
+              <span>
+                {state.steps_done}/{state.steps_total} steps
+                {state.status === "running" && ` · ${computeEta(state)}`}
+              </span>
+            </div>
+            <div className="h-2 rounded-full bg-muted overflow-hidden">
+              <div
+                className={`h-full transition-all duration-500 ${
+                  state.status === "failed" ? "bg-red-500" : state.status === "complete" ? "bg-emerald-500" : "bg-blue-500"
+                }`}
+                style={{ width: `${progressPct}%` }}
+              />
+            </div>
+          </div>
+
+          {state.components.length > 0 && (
+            <div className="space-y-2">
+              <div className="text-sm font-medium flex items-center gap-2">
+                <Cpu className="h-4 w-4" />
+                Components
+              </div>
+              <div className="space-y-1.5">
+                {state.components.map((c) => (
+                  <div
+                    key={c.name}
+                    className="flex items-center justify-between rounded-md border border-border bg-muted/30 px-3 py-2 text-xs"
+                  >
+                    <div className="flex items-center gap-2">
+                      <ComponentStatusIcon status={c.status} />
+                      <span className="font-medium">{formatComponent(c.name)}</span>
+                      <span className="text-muted-foreground">{c.status}</span>
+                      {c.exit_code && <span className="text-red-400">exit {c.exit_code}</span>}
+                    </div>
+                    {c.log && <span className="text-muted-foreground font-mono">{c.log}</span>}
+                  </div>
+                ))}
+              </div>
+            </div>
+          )}
+
+          {state.sanity_warnings.length > 0 && (
+            <div className="space-y-2">
+              <div className="text-sm font-medium flex items-center gap-2 text-amber-400">
+                <AlertTriangle className="h-4 w-4" />
+                Boot sanity warnings
+              </div>
+              <ul className="list-disc list-inside text-xs text-muted-foreground space-y-1">
+                {state.sanity_warnings.map((w) => (
+                  <li key={w}>{w}</li>
+                ))}
+              </ul>
+            </div>
+          )}
+
+          <div className="space-y-2">
+            <div className="text-sm font-medium">Rollback delta</div>
+            <RollbackDelta delta={state.rollback_delta} />
+          </div>
+
+          <div className="space-y-2">
+            <div className="text-sm font-medium">Log</div>
+            <LogViewer path={state.log_path} historyOnly={historyMode} />
+          </div>
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={onClose}>
+            Close
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+// ── History browser modal ─────────────────────────────────────
+
+const RestoreHistoryModal: React.FC<{ open: boolean; onClose: () => void }> = ({ open, onClose }) => {
+  const { data } = useSWR<{ entries: HistoryEntry[] }>(open ? "/api/host-backups/restore/history" : null, fetcher)
+  const [detailFile, setDetailFile] = useState<string | null>(null)
+  const { data: detailResp } = useSWR<{ state: RestoreState }>(
+    detailFile ? `/api/host-backups/restore/history?file=${encodeURIComponent(detailFile)}` : null,
+    fetcher,
+  )
+
+  return (
+    <>
+      <Dialog open={open} onOpenChange={(v) => !v && onClose()}>
+        <DialogContent className="max-w-2xl">
+          <DialogHeader>
+            <DialogTitle className="flex items-center gap-2">
+              <History className="h-5 w-5" />
+              Past restores
+            </DialogTitle>
+            <DialogDescription>
+              Restores archived by the post-boot dispatcher. The latest 20 are kept.
+            </DialogDescription>
+          </DialogHeader>
+
+          <ScrollArea className="h-96">
+            <div className="space-y-1.5">
+              {(data?.entries ?? []).length === 0 ? (
+                <div className="text-sm text-muted-foreground py-6 text-center">No past restores recorded.</div>
+              ) : (
+                (data?.entries ?? []).map((e) => (
+                  <button
+                    key={e.file}
+                    onClick={() => setDetailFile(e.file)}
+                    className="w-full flex items-center justify-between rounded-md border border-border bg-muted/30 hover:bg-muted px-3 py-2 text-xs text-left"
+                  >
+                    <div className="flex items-center gap-2">
+                      <StatusBadge status={e.status} />
+                      <span className="text-muted-foreground">
+                        {e.started_at ? formatIso(e.started_at) : formatIso(new Date(e.mtime * 1000).toISOString())}
+                      </span>
+                      {e.duration && <span className="text-muted-foreground">· {e.duration}</span>}
+                    </div>
+                    <ChevronRight className="h-4 w-4 text-muted-foreground" />
+                  </button>
+                ))
+              )}
+            </div>
+          </ScrollArea>
+
+          <DialogFooter>
+            <Button variant="outline" onClick={onClose}>
+              Close
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+
+      {detailFile && detailResp?.state && (
+        <RestoreDetailModal
+          open={!!detailFile}
+          onClose={() => setDetailFile(null)}
+          state={detailResp.state}
+          historyMode
+        />
+      )}
+    </>
+  )
+}
+
+// ── Main inline card ──────────────────────────────────────────
+
+export const RestoreProgressCard: React.FC = () => {
+  const { data, mutate } = useSWR<{ state: RestoreState | null }>(
+    "/api/host-backups/restore/status",
+    fetcher,
+    {
+      refreshInterval: (latest) => (latest?.state?.status === "running" ? 2000 : 30000),
+      revalidateOnFocus: true,
+    },
+  )
+  const [detailOpen, setDetailOpen] = useState(false)
+  const [historyOpen, setHistoryOpen] = useState(false)
+  const [dismissing, setDismissing] = useState(false)
+
+  const state = data?.state ?? null
+  const progressPct = useMemo(() => {
+    if (!state || state.steps_total <= 0) return 0
+    return Math.round((state.steps_done / state.steps_total) * 100)
+  }, [state])
+
+  const dismiss = async () => {
+    if (!state) return
+    setDismissing(true)
+    try {
+      await fetchApi("/api/host-backups/restore/dismiss", { method: "POST" })
+      await mutate()
+    } finally {
+      setDismissing(false)
+    }
+  }
+
+  // Hidden entirely when: no restore run has ever happened, OR the
+  // last run is terminal AND acknowledged. History button is still
+  // reachable from the main card header (rendered elsewhere).
+  if (!state) return null
+  if (state.status !== "running" && state.acknowledged) {
+    return (
+      <div className="flex justify-end">
+        <Button variant="ghost" size="sm" onClick={() => setHistoryOpen(true)}>
+          <History className="h-3.5 w-3.5 mr-1" />
+          Past restores
+        </Button>
+        <RestoreHistoryModal open={historyOpen} onClose={() => setHistoryOpen(false)} />
+      </div>
+    )
+  }
+
+  const hasWarnings = state.sanity_warnings.length > 0
+  const barColor =
+    state.status === "failed" ? "bg-red-500" : state.status === "complete" ? "bg-emerald-500" : "bg-blue-500"
+
+  return (
+    <>
+      <Card className="bg-card border-border">
+        <CardHeader className="pb-3">
+          <div className="flex flex-wrap items-center justify-between gap-2">
+            <CardTitle className="text-base font-semibold flex items-center gap-2">
+              <RotateCcw
+                className={`h-5 w-5 ${state.status === "running" ? "text-blue-500 animate-spin" : "text-blue-500"}`}
+              />
+              Post-restore progress
+              <StatusBadge status={state.status} />
+              {hasWarnings && (
+                <Badge variant="outline" className="text-amber-400 border-amber-500/40 bg-amber-500/10 gap-1">
+                  <AlertTriangle className="h-3 w-3" />
+                  {state.sanity_warnings.length} boot warning{state.sanity_warnings.length === 1 ? "" : "s"}
+                </Badge>
+              )}
+            </CardTitle>
+            <div className="flex items-center gap-2">
+              <Button size="sm" variant="outline" onClick={() => setDetailOpen(true)}>
+                Details
+              </Button>
+              <Button size="sm" variant="ghost" onClick={() => setHistoryOpen(true)}>
+                <History className="h-3.5 w-3.5 mr-1" />
+                History
+              </Button>
+              {state.status !== "running" && (
+                <Button size="sm" onClick={dismiss} disabled={dismissing}>
+                  {dismissing ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : "Dismiss"}
+                </Button>
+              )}
+            </div>
+          </div>
+        </CardHeader>
+        <CardContent className="space-y-3">
+          <div className="space-y-1">
+            <div className="flex justify-between text-xs text-muted-foreground">
+              <span className="truncate">
+                {state.current_step || "—"} · started {formatRelative(state.started_at)}
+              </span>
+              <span>
+                {state.steps_done}/{state.steps_total} steps
+                {state.status === "running" && ` · ${computeEta(state)}`}
+                {state.summary?.duration && state.status !== "running" && ` · ${state.summary.duration}`}
+              </span>
+            </div>
+            <div className="h-2 rounded-full bg-muted overflow-hidden">
+              <div className={`h-full transition-all duration-500 ${barColor}`} style={{ width: `${progressPct}%` }} />
+            </div>
+          </div>
+
+          {state.summary && (
+            <div className="grid grid-cols-2 md:grid-cols-4 gap-2 text-xs">
+              <div className="rounded-md border border-border bg-muted/30 px-2 py-1.5">
+                <div className="text-muted-foreground">Guests</div>
+                <div className="font-medium">{state.summary.guests}</div>
+              </div>
+              <div className="rounded-md border border-border bg-muted/30 px-2 py-1.5">
+                <div className="text-muted-foreground">Bind-mount stubs</div>
+                <div className="font-medium">{state.summary.stubs}</div>
+              </div>
+              <div className="rounded-md border border-border bg-muted/30 px-2 py-1.5">
+                <div className="text-muted-foreground">Stale nodes cleaned</div>
+                <div className="font-medium">{state.summary.stale_nodes}</div>
+              </div>
+              <div className="rounded-md border border-border bg-muted/30 px-2 py-1.5">
+                <div className="text-muted-foreground">Components</div>
+                <div className="font-medium">{state.summary.components}</div>
+              </div>
+            </div>
+          )}
+        </CardContent>
+      </Card>
+
+      <RestoreDetailModal open={detailOpen} onClose={() => setDetailOpen(false)} state={state} />
+      <RestoreHistoryModal open={historyOpen} onClose={() => setHistoryOpen(false)} />
+    </>
+  )
+}
+
+export default RestoreProgressCard
diff --git a/AppImage/components/script-terminal-modal.tsx b/AppImage/components/script-terminal-modal.tsx
index 59c67769..4929e63e 100644
--- a/AppImage/components/script-terminal-modal.tsx
+++ b/AppImage/components/script-terminal-modal.tsx
@@ -49,6 +49,12 @@ interface ScriptTerminalModalProps {
   description: string
   scriptName?: string
   params?: Record<string, string>
+  // Optional callback fired when the script's WebSocket closes
+  // (script_runner sends an exit code and then closes). Lets the
+  // parent auto-dismiss the modal — used by host-backup's Restore
+  // flow so "Press Enter to close" in the bash script actually
+  // closes the modal without an extra click. Other callers ignore.
+  onComplete?: () => void
 }
 
 export function ScriptTerminalModal({
@@ -58,6 +64,7 @@ export function ScriptTerminalModal({
   title,
   description,
   params = { EXECUTION_MODE: "web" },
+  onComplete,
 }: ScriptTerminalModalProps) {
   const termRef = useRef<any>(null)
   const wsRef = useRef<WebSocket | null>(null)
@@ -95,6 +102,13 @@ export function ScriptTerminalModal({
     paramsRef.current = params
   }, [params])
 
+  // Same trick for onComplete — we want the latest callback inside
+  // the ws.onclose handler without re-running the connection effect.
+  const onCompleteRef = useRef<(() => void) | undefined>(undefined)
+  useEffect(() => {
+    onCompleteRef.current = onComplete
+  }, [onComplete])
+
   const attemptReconnect = useCallback(() => {
     if (!isOpen || isComplete || reconnectAttemptsRef.current >= 3) {
       return
@@ -195,6 +209,7 @@ const initMessage = {
             reconnectTimeoutRef.current = setTimeout(attemptReconnect, 2000)
           } else {
             setIsComplete(true)
+            onCompleteRef.current?.()
           }
         }
       }
@@ -284,6 +299,11 @@ const initMessage = {
     setTimeout(() => {
       if (fitAddonRef.current && termRef.current) {
         fitAddonRef.current.fit()
+        // Send the keyboard to the xterm instance so any --yesno /
+        // --menu the script opens receives Enter / arrow keys
+        // directly. Without this the modal's Close button (or any
+        // other focusable descendant) intercepts the keystrokes.
+        termRef.current.focus()
       }
     }, 100)
 
@@ -382,6 +402,7 @@ const initMessage = {
 
       if (!isComplete) {
         setIsComplete(true)
+        onCompleteRef.current?.()
       }
     }
 
@@ -666,6 +687,13 @@ const initMessage = {
           }}
           onInteractOutside={(e) => e.preventDefault()}
           onEscapeKeyDown={(e) => e.preventDefault()}
+          // Radix defaults to focusing the first focusable descendant
+          // when a Dialog opens — that used to land on the Close button
+          // and every Enter/Space keystroke intended for the shell
+          // dialogs INSIDE the terminal would close the modal instead.
+          // Preempting the auto-focus lets the xterm focus() call in
+          // initializeTerminal below own the keyboard from the start.
+          onOpenAutoFocus={(e) => e.preventDefault()}
           hideClose
         >
           <DialogTitle className="sr-only">{title}</DialogTitle>
diff --git a/AppImage/components/storage-metrics.tsx b/AppImage/components/storage-metrics.tsx
index dc83f57b..0567ada8 100644
--- a/AppImage/components/storage-metrics.tsx
+++ b/AppImage/components/storage-metrics.tsx
@@ -108,7 +108,7 @@ export function StorageMetrics() {
   return (
     <div className="space-y-6">
       {/* Storage Overview Cards */}
-      <div className="grid grid-cols-2 lg:grid-cols-4 gap-3 lg:gap-6">
+      <div className="grid grid-cols-2 xl:grid-cols-4 gap-3 xl:gap-6">
         <Card className="bg-card border-border">
           <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
             <CardTitle className="text-sm font-medium text-muted-foreground">Total Storage</CardTitle>
diff --git a/AppImage/components/storage-overview.tsx b/AppImage/components/storage-overview.tsx
index 74ead9af..04071aa6 100644
--- a/AppImage/components/storage-overview.tsx
+++ b/AppImage/components/storage-overview.tsx
@@ -2,14 +2,16 @@
 
 import { useEffect, useState } from "react"
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card"
-import { HardDrive, Database, AlertTriangle, CheckCircle2, XCircle, Square, Thermometer, Archive, Info, Clock, Usb, Server, Activity, FileText, Play, Loader2, Download, Plus, Trash2, Settings } from "lucide-react"
+import { HardDrive, Database, AlertTriangle, CheckCircle2, XCircle, Square, Thermometer, Archive, Info, Clock, Usb, Server, Activity, FileText, Play, Loader2, Download, Plus, Trash2, Settings, Power } from "lucide-react"
 import { Badge } from "@/components/ui/badge"
 import { Progress } from "@/components/ui/progress"
 import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from "@/components/ui/dialog"
 import { Button } from "@/components/ui/button"
 import { fetchApi } from "../lib/api-config"
+import { formatStorage as sharedFormatStorage } from "../lib/utils"
 import { DiskTemperatureDetailModal } from "./disk-temperature-detail-modal"
 import { DiskTemperatureCard } from "./disk-temperature-card"
+import { getDiskType as resolveDiskType } from "../lib/disk-type"
 import {
   useDiskTempThresholds,
   loadDiskTempThresholds,
@@ -22,6 +24,11 @@ interface DiskInfo {
   size?: number // Changed from string to number (KB) for formatMemory()
   size_formatted?: string // Added formatted size string for display
   temperature: number
+  // True when the temperature poller's last smartctl exited with
+  // "device is in standby". The UI uses this to render a Standby
+  // badge AND to suppress the (stale) temperature value, so the
+  // operator understands the graph is frozen on purpose — issue #232.
+  standby?: boolean
   health: string
   power_on_hours?: number
   smart_status?: string
@@ -141,17 +148,9 @@ interface RemoteMountsData {
   error?: string
 }
 
-const formatStorage = (sizeInGB: number): string => {
-  if (sizeInGB < 1) {
-    // Less than 1 GB, show in MB
-    return `${(sizeInGB * 1024).toFixed(1)} MB`
-  } else if (sizeInGB > 999) {
-    return `${(sizeInGB / 1024).toFixed(2)} TB`
-  } else {
-    // Between 1 and 999 GB, show in GB
-    return `${sizeInGB.toFixed(2)} GB`
-  }
-}
+// Re-exported under the local name so the rest of this large file
+// stays untouched. Single source of truth lives in lib/utils.ts.
+const formatStorage = sharedFormatStorage
 
 // Translate the short ATA/SCSI error codes that appear inside `{ ... }`
 // in a raw kernel observation (e.g. `error: { IDNF }`) into a one-line
@@ -279,6 +278,301 @@ export function StorageOverview() {
     }
   }
 
+  // Tiny coloured dot that prefixes status / counter values. Adds
+  // accessibility-friendly redundancy (colour + position) to fields
+  // that today rely on colour alone, so an "all OK" disk reads as
+  // visually quiet and a degraded one as immediately noisy.
+  //
+  // Colour mapping:
+  //   - "ok"    → green (passed / 0 errors)
+  //   - "warn"  → amber (1+ errors but not critical)
+  //   - "fail"  → red (failed / many errors)
+  const StatusDot = ({ tone }: { tone: "ok" | "warn" | "fail" }) => {
+    const cls =
+      tone === "ok" ? "bg-green-500" : tone === "warn" ? "bg-yellow-500" : "bg-red-500"
+    return (
+      <span
+        className={`inline-block h-2 w-2 rounded-full shrink-0 ${cls}`}
+        aria-hidden
+      />
+    )
+  }
+  // Decide the tone for a counter where 0 is healthy. The "warn" /
+  // "fail" cutoffs are conservative — even a single reallocated
+  // sector is worth amber attention, and double digits start hinting
+  // at progressive failure (red).
+  const counterTone = (n: number | null | undefined): "ok" | "warn" | "fail" => {
+    if (!n || n <= 0) return "ok"
+    if (n < 10) return "warn"
+    return "fail"
+  }
+  const smartStatusTone = (s: string | undefined): "ok" | "warn" | "fail" => {
+    const v = (s || "").toLowerCase()
+    if (v === "passed" || v === "ok") return "ok"
+    if (v === "failed") return "fail"
+    return "warn"
+  }
+
+  // Renders either the live temperature or a "Standby" badge for a
+  // spun-down drive. Centralised here because the same pattern shows up
+  // in 4 different disk-list views (system / data / pool / other) and we
+  // want them all to behave identically — issue #232 fix.
+  const renderDiskTempOrStandby = (disk: DiskInfo) => {
+    if (disk.standby) {
+      return (
+        <Badge
+          className="bg-blue-500/10 text-blue-300 border-blue-500/30 gap-1"
+          title="Drive is in standby — smartctl skipped to keep it spun down"
+        >
+          <Power className="h-3 w-3" />
+          Standby
+        </Badge>
+      )
+    }
+    if (disk.temperature > 0) {
+      return (
+        <div className="flex items-center gap-1">
+          <Thermometer className={`h-4 w-4 ${getTempColor(disk.temperature, disk.name, disk.rotation_rate)}`} />
+          <span className={`text-sm font-medium ${getTempColor(disk.temperature, disk.name, disk.rotation_rate)}`}>
+            {disk.temperature}°C
+          </span>
+        </div>
+      )
+    }
+    return null
+  }
+
+  // ──────────────────────────────────────────────────────────────────
+  // Disk card layout (ghosthvj-style)
+  // ──────────────────────────────────────────────────────────────────
+  // Single card per disk, grid-arranged at the parent level. Two-line
+  // header (identity + status / size + temp), separator, vertical
+  // key→value stat list with WEAR LEVEL bar when available, and a
+  // footer with serial + "Ver detalles →". Replaces the previous
+  // duplicated mobile/desktop full-width rows.
+  const renderDiskCardV2 = (disk: DiskInfo) => {
+    const type = getDiskTypeBadge(disk.name, disk.rotation_rate)
+    // Pick the most relevant wear metric for the device class.
+    // NVMe uses `percentage_used` (0 = fresh, 100 = TBW spent).
+    // SSD may expose `media_wearout_indicator` (decreasing 100→0) or
+    // `ssd_life_left` (decreasing 100→0). Normalise both to a
+    // "percentage spent" so the bar always fills LEFT to RIGHT as the
+    // drive ages — visually consistent across vendors.
+    let wearPct: number | null = null
+    if (typeof disk.percentage_used === "number") wearPct = disk.percentage_used
+    else if (typeof disk.ssd_life_left === "number") wearPct = 100 - disk.ssd_life_left
+    else if (typeof disk.media_wearout_indicator === "number")
+      wearPct = 100 - disk.media_wearout_indicator
+    // Wear bar always uses the same blue as the modal's wear visual,
+    // even when the wear is high — the colour is the SECTION colour,
+    // not a severity signal. The percentage value itself (and the
+    // surrounding stats) already communicate health via the dot
+    // colours, so flipping the bar to amber/red here would just
+    // double-encode the same thing and break visual consistency
+    // with the detail modal.
+    const wearColor = wearPct === null ? "" : "bg-blue-500"
+    const cleanSerial = (disk.serial || "").replace(/\\x[0-9a-fA-F]{2}/g, "")
+
+    return (
+      <div
+        key={disk.name}
+        className="border border-white/10 rounded-lg p-5 cursor-pointer bg-card hover:bg-white/5 transition-colors flex flex-col"
+        onClick={() => handleDiskClick(disk)}
+      >
+        {/* Header line 1: identity + SMART status (right). */}
+        <div className="flex items-start justify-between gap-3">
+          <div className="flex items-center gap-2 flex-wrap min-w-0">
+            <h3 className="font-mono font-bold text-base break-all">/dev/{disk.name}</h3>
+            <Badge className={type.className}>{type.label}</Badge>
+            {disk.is_system_disk && (
+              <Badge className="bg-orange-500/10 text-orange-500 border-orange-500/20 gap-1">
+                <Server className="h-3 w-3" />
+                System
+              </Badge>
+            )}
+            {disk.connection_type === "usb" && (
+              <Badge className="bg-orange-500/10 text-orange-400 border-orange-500/20 gap-1">
+                <Usb className="h-3 w-3" />
+                USB
+              </Badge>
+            )}
+          </div>
+          {disk.smart_status && disk.smart_status !== "unknown" && (
+            <span
+              className={`flex items-center gap-1.5 text-sm font-semibold uppercase tracking-wide shrink-0 ${
+                smartStatusTone(disk.smart_status) === "ok"
+                  ? "text-green-500"
+                  : smartStatusTone(disk.smart_status) === "fail"
+                    ? "text-red-500"
+                    : "text-muted-foreground"
+              }`}
+            >
+              <StatusDot tone={smartStatusTone(disk.smart_status)} />
+              {disk.smart_status}
+            </span>
+          )}
+        </div>
+
+        {/* Header line 2: size + temperature/standby. */}
+        <div className="flex items-center justify-between gap-3 mt-1">
+          <span className="text-sm text-muted-foreground">{disk.size_formatted}</span>
+          {disk.standby ? (
+            <Badge
+              className="bg-blue-500/10 text-blue-300 border-blue-500/30 gap-1"
+              title="Drive is in standby — smartctl skipped to keep it spun down"
+            >
+              <Power className="h-3 w-3" />
+              Standby
+            </Badge>
+          ) : disk.temperature > 0 ? (
+            <span
+              className={`text-base font-semibold ${getTempColor(
+                disk.temperature,
+                disk.name,
+                disk.rotation_rate,
+              )}`}
+            >
+              {disk.temperature}°C
+            </span>
+          ) : null}
+        </div>
+
+        {/* I/O errors banner (preserved from the previous design). */}
+        {disk.io_errors && disk.io_errors.count > 0 && (
+          <div
+            className={`mt-3 flex items-start gap-2 p-2 rounded text-xs ${
+              disk.io_errors.severity === "CRITICAL"
+                ? "bg-red-500/10 text-red-400 border border-red-500/20"
+                : "bg-yellow-500/10 text-yellow-400 border border-yellow-500/20"
+            }`}
+          >
+            <AlertTriangle className="h-3.5 w-3.5 flex-shrink-0 mt-0.5" />
+            <span>
+              {disk.io_errors.error_type === "filesystem"
+                ? "Filesystem corruption detected"
+                : `${disk.io_errors.count} I/O error${
+                    disk.io_errors.count !== 1 ? "s" : ""
+                  } in 5 min`}
+            </span>
+          </div>
+        )}
+
+        {/* Separator. */}
+        <div className="border-t border-border/60 my-3" />
+
+        {/* Stats: vertical key→value list. Each row matches the
+            "uppercase label left · value right" pattern from ghosthvj. */}
+        <div className="space-y-2 text-sm">
+          {disk.model && disk.model !== "Unknown" && (
+            <div className="flex items-baseline justify-between gap-3">
+              <span className="text-[11px] uppercase tracking-wider text-muted-foreground shrink-0">
+                Model
+              </span>
+              <span className="font-medium text-right truncate font-mono text-xs">{disk.model}</span>
+            </div>
+          )}
+          {wearPct !== null && (
+            <div>
+              <div className="flex items-baseline justify-between gap-3 mb-1">
+                <span className="text-[11px] uppercase tracking-wider text-muted-foreground">
+                  Wear Level
+                </span>
+                <span className="font-medium">{wearPct}%</span>
+              </div>
+              <div className="h-1.5 rounded-full bg-muted/40 overflow-hidden">
+                <div
+                  className={`h-full ${wearColor}`}
+                  style={{ width: `${Math.min(100, Math.max(0, wearPct))}%` }}
+                />
+              </div>
+            </div>
+          )}
+          {disk.power_cycles !== undefined && disk.power_cycles > 0 && (
+            <div className="flex items-baseline justify-between gap-3">
+              <span className="text-[11px] uppercase tracking-wider text-muted-foreground">
+                Power Cycles
+              </span>
+              <span className="font-medium">{disk.power_cycles.toLocaleString()}</span>
+            </div>
+          )}
+          {disk.power_on_hours !== undefined && disk.power_on_hours > 0 && (
+            <div className="flex items-baseline justify-between gap-3">
+              <span className="text-[11px] uppercase tracking-wider text-muted-foreground">
+                Power On
+              </span>
+              <span className="font-medium">{formatHours(disk.power_on_hours)}</span>
+            </div>
+          )}
+          {disk.crc_errors !== undefined && (
+            <div className="flex items-baseline justify-between gap-3">
+              <span className="text-[11px] uppercase tracking-wider text-muted-foreground">
+                CRC Errors
+              </span>
+              <span
+                className={`font-medium flex items-center gap-1.5 ${
+                  counterTone(disk.crc_errors) === "ok"
+                    ? "text-green-500"
+                    : counterTone(disk.crc_errors) === "warn"
+                      ? "text-yellow-500"
+                      : "text-red-500"
+                }`}
+              >
+                <StatusDot tone={counterTone(disk.crc_errors)} />
+                {disk.crc_errors}
+              </span>
+            </div>
+          )}
+          {/* Reallocated only meaningful on rotating disks. */}
+          {disk.reallocated_sectors !== undefined && (disk.rotation_rate ?? 0) > 0 && (
+            <div className="flex items-baseline justify-between gap-3">
+              <span className="text-[11px] uppercase tracking-wider text-muted-foreground">
+                Realloc. Sectors
+              </span>
+              <span
+                className={`font-medium flex items-center gap-1.5 ${
+                  counterTone(disk.reallocated_sectors) === "ok"
+                    ? "text-green-500"
+                    : counterTone(disk.reallocated_sectors) === "warn"
+                      ? "text-yellow-500"
+                      : "text-red-500"
+                }`}
+              >
+                <StatusDot tone={counterTone(disk.reallocated_sectors)} />
+                {disk.reallocated_sectors}
+              </span>
+            </div>
+          )}
+        </div>
+
+        {/* Footer: serial (left, white mono for legibility) + observations
+            + arrow-only CTA (language-neutral, compact). */}
+        <div className="border-t border-border/60 mt-auto pt-3 flex items-center justify-between gap-3">
+          {cleanSerial && cleanSerial !== "Unknown" ? (
+            <span className="text-[11px] text-foreground font-mono truncate min-w-0">
+              <span className="text-muted-foreground">S/N:</span> {cleanSerial}
+            </span>
+          ) : (
+            <span />
+          )}
+          <div className="flex items-center gap-2 shrink-0">
+            {(disk.observations_count ?? 0) > 0 && (
+              <Badge className="bg-blue-500/10 text-blue-400 border-blue-500/20 gap-1 text-[10px]">
+                <Info className="h-3 w-3" />
+                {disk.observations_count}
+              </Badge>
+            )}
+            <span
+              className="text-blue-400 hover:text-blue-300 transition-colors text-base leading-none"
+              aria-label="View details"
+            >
+              →
+            </span>
+          </div>
+        </div>
+      </div>
+    )
+  }
+
   const getTempColor = (temp: number, diskName?: string, rotationRate?: number) => {
     if (temp === 0) return "text-gray-500"
 
@@ -299,12 +593,24 @@ export function StorageOverview() {
 
   const formatHours = (hours: number) => {
     if (hours === 0) return "N/A"
-    const years = Math.floor(hours / 8760)
-    const days = Math.floor((hours % 8760) / 24)
+    // Render in years + months when ≥1 year (e.g. "2y 6m" instead of
+    // "2y 189d" — months are easier to picture than triple-digit
+    // residual days). Months use 30.44 d/mo average to round cleanly.
+    // <30 days: keep days. 30 d–1 yr: months + residual days when both
+    // values are meaningful.
+    const totalDays = Math.floor(hours / 24)
+    if (totalDays < 30) return `${totalDays}d`
+    const years = Math.floor(totalDays / 365)
+    const remainingAfterYears = totalDays - years * 365
+    const months = Math.floor(remainingAfterYears / 30)
     if (years > 0) {
-      return `${years}y ${days}d`
+      return months > 0 ? `${years}y ${months}m` : `${years}y`
     }
-    return `${days}d`
+    // Sub-year: show months + residual days if both are non-trivial.
+    const residualDays = remainingAfterYears - months * 30
+    if (months > 0 && residualDays > 0) return `${months}m ${residualDays}d`
+    if (months > 0) return `${months}m`
+    return `${totalDays}d`
   }
 
   const formatRotationRate = (rpm: number | undefined) => {
@@ -312,21 +618,12 @@ export function StorageOverview() {
     return `${rpm.toLocaleString()} RPM`
   }
 
-  const getDiskType = (diskName: string, rotationRate: number | undefined): string => {
-    if (diskName.startsWith("nvme")) {
-      return "NVMe"
-    }
-    // rotation_rate = -1 means HDD but RPM is unknown (detected via kernel rotational flag)
-    // rotation_rate = 0 or undefined means SSD
-    // rotation_rate > 0 means HDD with known RPM
-    if (rotationRate === -1) {
-      return "HDD"
-    }
-    if (!rotationRate || rotationRate === 0) {
-      return "SSD"
-    }
-    return "HDD"
-  }
+  // Thin wrapper over the shared classifier so the rest of the file
+  // doesn't need to be touched. The actual rules live in
+  // lib/disk-type.ts (single source of truth across Storage page,
+  // Hardware page, and any future consumer).
+  const getDiskType = (diskName: string, rotationRate: number | undefined): string =>
+    resolveDiskType(diskName, rotationRate)
 
   const getDiskTypeBadge = (diskName: string, rotationRate: number | undefined) => {
     const diskType = getDiskType(diskName, rotationRate)
@@ -690,7 +987,7 @@ export function StorageOverview() {
   return (
     <div className="space-y-6">
       {/* Storage Summary */}
-      <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-3 lg:gap-6">
+      <div className="grid grid-cols-1 sm:grid-cols-2 xl:grid-cols-4 gap-3 xl:gap-6">
         {/* ── Total Storage (preview restyle: headline + stacked bar Local·Remote·Free) ── */}
         {(() => {
           const totalGB = (totalLocalCapacity || 0) + (totalRemoteCapacity || 0)
@@ -1345,206 +1642,10 @@ export function StorageOverview() {
           </CardTitle>
         </CardHeader>
         <CardContent>
-          <div className="space-y-4">
-            {storageData.disks.filter(d => d.connection_type !== 'usb').map((disk) => (
-              <div key={disk.name}>
-                <div
-                  className="sm:hidden border border-white/10 rounded-lg p-4 cursor-pointer bg-white/5 transition-colors"
-                  onClick={() => handleDiskClick(disk)}
-                >
-                  <div className="space-y-2 mb-3">
-                    {/* Row 1: Device name and type badge */}
-                    <div className="flex items-center gap-2 flex-wrap">
-                      <HardDrive className="h-5 w-5 text-muted-foreground flex-shrink-0" />
-                      <h3 className="font-semibold">/dev/{disk.name}</h3>
-                      <Badge className={getDiskTypeBadge(disk.name, disk.rotation_rate).className}>
-                        {getDiskTypeBadge(disk.name, disk.rotation_rate).label}
-                      </Badge>
-                      {disk.is_system_disk && (
-                        <Badge className="bg-orange-500/10 text-orange-500 border-orange-500/20 gap-1">
-                          <Server className="h-3 w-3" />
-                          System
-                        </Badge>
-                      )}
-                    </div>
-
-                    {/* Row 2: Model, temperature, and health status */}
-                    <div className="flex items-center justify-between gap-3 pl-7">
-                      {disk.model && disk.model !== "Unknown" && (
-                        <p className="text-sm text-muted-foreground truncate flex-1 min-w-0">{disk.model}</p>
-                      )}
-                      <div className="flex items-center gap-3 flex-shrink-0">
-                        {disk.temperature > 0 && (
-                          <div className="flex items-center gap-1">
-                            <Thermometer
-                              className={`h-4 w-4 ${getTempColor(disk.temperature, disk.name, disk.rotation_rate)}`}
-                            />
-                            <span
-                              className={`text-sm font-medium ${getTempColor(disk.temperature, disk.name, disk.rotation_rate)}`}
-                            >
-                              {disk.temperature}°C
-                            </span>
-                          </div>
-                        )}
-                        {(disk.observations_count ?? 0) > 0 && (
-                          <Badge className="bg-blue-500/10 text-blue-400 border-blue-500/20 gap-1">
-                            <Info className="h-3 w-3" />
-                            {disk.observations_count} obs.
-                          </Badge>
-                        )}
-                        {getHealthBadge(disk.health)}
-                      </div>
-                    </div>
-                  </div>
-
-                    {disk.io_errors && disk.io_errors.count > 0 && (
-                    <div className={`flex items-start gap-2 p-2 rounded text-xs ${
-                      disk.io_errors.severity === 'CRITICAL'
-                        ? 'bg-red-500/10 text-red-400 border border-red-500/20'
-                        : 'bg-yellow-500/10 text-yellow-400 border border-yellow-500/20'
-                    }`}>
-                      <AlertTriangle className="h-3.5 w-3.5 flex-shrink-0 mt-0.5" />
-                      <span>
-                        {disk.io_errors.error_type === 'filesystem'
-                          ? `Filesystem corruption detected`
-                          : `${disk.io_errors.count} I/O error${disk.io_errors.count !== 1 ? 's' : ''} in 5 min`}
-                      </span>
-                    </div>
-                    )}
-                    
-                    <div className="grid grid-cols-2 gap-4 text-sm">
-                      {disk.size_formatted && (
-                      <div>
-                        <p className="text-sm text-muted-foreground">Size</p>
-                        <p className="font-medium">{disk.size_formatted}</p>
-                      </div>
-                    )}
-                    {disk.smart_status && disk.smart_status !== "unknown" && (
-                      <div>
-                        <p className="text-sm text-muted-foreground">SMART Status</p>
-                        <p className="font-medium capitalize">{disk.smart_status}</p>
-                      </div>
-                    )}
-                    {disk.power_on_hours !== undefined && disk.power_on_hours > 0 && (
-                      <div>
-                        <p className="text-sm text-muted-foreground">Power On Time</p>
-                        <p className="font-medium">{formatHours(disk.power_on_hours)}</p>
-                      </div>
-                    )}
-                    {disk.serial && disk.serial !== "Unknown" && (
-                      <div>
-                        <p className="text-sm text-muted-foreground">Serial</p>
-                        <p className="font-medium text-xs">{disk.serial}</p>
-                      </div>
-                    )}
-                  </div>
-                </div>
-
-                <div
-                  className="hidden sm:block border border-white/10 rounded-lg p-4 cursor-pointer bg-card hover:bg-white/5 transition-colors"
-                  onClick={() => handleDiskClick(disk)}
-                >
-                  <div className="space-y-2 mb-3">
-                    {/* Row 1: Device name and type badge */}
-                    <div className="flex items-center gap-2">
-                      <HardDrive className="h-5 w-5 text-muted-foreground flex-shrink-0" />
-                      <h3 className="font-semibold">/dev/{disk.name}</h3>
-                      <Badge className={getDiskTypeBadge(disk.name, disk.rotation_rate).className}>
-                        {getDiskTypeBadge(disk.name, disk.rotation_rate).label}
-                      </Badge>
-                      {disk.is_system_disk && (
-                        <Badge className="bg-orange-500/10 text-orange-500 border-orange-500/20 gap-1">
-                          <Server className="h-3 w-3" />
-                          System
-                        </Badge>
-                      )}
-                    </div>
-
-                    {/* Row 2: Model, temperature, and health status */}
-                    <div className="flex items-center justify-between gap-3 pl-7">
-                      {disk.model && disk.model !== "Unknown" && (
-                        <p className="text-sm text-muted-foreground truncate flex-1 min-w-0">{disk.model}</p>
-                      )}
-                      <div className="flex items-center gap-3 flex-shrink-0">
-                        {disk.temperature > 0 && (
-                          <div className="flex items-center gap-1">
-                            <Thermometer
-                              className={`h-4 w-4 ${getTempColor(disk.temperature, disk.name, disk.rotation_rate)}`}
-                            />
-                            <span
-                              className={`text-sm font-medium ${getTempColor(disk.temperature, disk.name, disk.rotation_rate)}`}
-                            >
-                              {disk.temperature}°C
-                            </span>
-                          </div>
-                        )}
-                        {(disk.observations_count ?? 0) > 0 && (
-                          <Badge className="bg-blue-500/10 text-blue-400 border-blue-500/20 gap-1">
-                            <Info className="h-3 w-3" />
-                            {disk.observations_count} obs.
-                          </Badge>
-                        )}
-                        {getHealthBadge(disk.health)}
-                      </div>
-                    </div>
-                  </div>
-
-                  {disk.io_errors && disk.io_errors.count > 0 && (
-                    <div className={`flex items-start gap-2 p-2 rounded text-xs ${
-                      disk.io_errors.severity === 'CRITICAL'
-                        ? 'bg-red-500/10 text-red-400 border border-red-500/20'
-                        : 'bg-yellow-500/10 text-yellow-400 border border-yellow-500/20'
-                    }`}>
-                      <AlertTriangle className="h-3.5 w-3.5 flex-shrink-0 mt-0.5" />
-                      <div>
-                        {disk.io_errors.error_type === 'filesystem' ? (
-                          <>
-                            <span className="font-medium">Filesystem corruption detected</span>
-                            {disk.io_errors.reason && (
-                              <p className="mt-0.5 opacity-90 whitespace-pre-line">{disk.io_errors.reason}</p>
-                            )}
-                          </>
-                        ) : (
-                          <>
-                            <span className="font-medium">{disk.io_errors.count} I/O error{disk.io_errors.count !== 1 ? 's' : ''} in 5 min</span>
-                            {disk.io_errors.sample && (
-                              <p className="mt-0.5 opacity-80 font-mono truncate max-w-md">{disk.io_errors.sample}</p>
-                            )}
-                          </>
-                        )}
-                      </div>
-                    </div>
-                  )}
-
-                  <div className="grid grid-cols-2 md:grid-cols-4 gap-4 text-sm">
-                    {disk.size_formatted && (
-                      <div>
-                        <p className="text-sm text-muted-foreground">Size</p>
-                        <p className="font-medium">{disk.size_formatted}</p>
-                      </div>
-                    )}
-                    {disk.smart_status && disk.smart_status !== "unknown" && (
-                      <div>
-                        <p className="text-sm text-muted-foreground">SMART Status</p>
-                        <p className="font-medium capitalize">{disk.smart_status}</p>
-                      </div>
-                    )}
-                    {disk.power_on_hours !== undefined && disk.power_on_hours > 0 && (
-                      <div>
-                        <p className="text-sm text-muted-foreground">Power On Time</p>
-                        <p className="font-medium">{formatHours(disk.power_on_hours)}</p>
-                      </div>
-                    )}
-                    {disk.serial && disk.serial !== "Unknown" && (
-                      <div>
-                        <p className="text-sm text-muted-foreground">Serial</p>
-                        <p className="font-medium text-xs">{disk.serial.replace(/\\x[0-9a-fA-F]{2}/g, '')}</p>
-                      </div>
-                    )}
-                  </div>
-                </div>
-              </div>
-            ))}
+          <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
+            {storageData.disks
+              .filter((d) => d.connection_type !== 'usb')
+              .map((disk) => renderDiskCardV2(disk))}
           </div>
         </CardContent>
       </Card>
@@ -1559,162 +1660,17 @@ export function StorageOverview() {
             </CardTitle>
           </CardHeader>
           <CardContent>
-            <div className="space-y-4">
-              {storageData.disks.filter(d => d.connection_type === 'usb').map((disk) => (
-                <div key={disk.name}>
-                  {/* Mobile card */}
-                  <div
-                    className="sm:hidden border border-white/10 rounded-lg p-4 cursor-pointer bg-white/5 transition-colors"
-                    onClick={() => handleDiskClick(disk)}
-                  >
-                    <div className="space-y-2 mb-3">
-                      <div className="flex items-center gap-2">
-                        <Usb className="h-5 w-5 text-orange-400 flex-shrink-0" />
-                        <h3 className="font-semibold">/dev/{disk.name}</h3>
-                        <Badge className="bg-orange-500/10 text-orange-400 border-orange-500/20 text-[10px] px-1.5">USB</Badge>
-                      </div>
-                      <div className="flex items-center justify-between gap-3 pl-7">
-                        {disk.model && disk.model !== "Unknown" && (
-                          <p className="text-sm text-muted-foreground truncate flex-1 min-w-0">{disk.model}</p>
-                        )}
-                        <div className="flex items-center gap-3 flex-shrink-0">
-                          {disk.temperature > 0 && (
-                            <div className="flex items-center gap-1">
-                              <Thermometer className={`h-4 w-4 ${getTempColor(disk.temperature, disk.name, disk.rotation_rate)}`} />
-                              <span className={`text-sm font-medium ${getTempColor(disk.temperature, disk.name, disk.rotation_rate)}`}>
-                                {disk.temperature}°C
-                              </span>
-                            </div>
-                          )}
-                          {(disk.observations_count ?? 0) > 0 && (
-                            <Badge className="bg-blue-500/10 text-blue-400 border-blue-500/20 gap-1">
-                              <Info className="h-3 w-3" />
-                              {disk.observations_count}
-                            </Badge>
-                          )}
-                          {getHealthBadge(disk.health)}
-                        </div>
-                      </div>
-                    </div>
-                    
-                    {/* USB Mobile: Size, SMART, Serial grid */}
-                    <div className="grid grid-cols-2 gap-4 text-sm">
-                      {disk.size_formatted && (
-                        <div>
-                          <p className="text-sm text-muted-foreground">Size</p>
-                          <p className="font-medium">{disk.size_formatted}</p>
-                        </div>
-                      )}
-                      {disk.smart_status && disk.smart_status !== "unknown" && (
-                        <div>
-                          <p className="text-sm text-muted-foreground">SMART Status</p>
-                          <p className="font-medium capitalize">{disk.smart_status}</p>
-                        </div>
-                      )}
-{disk.serial && disk.serial !== "Unknown" && (
-                      <div>
-                        <p className="text-sm text-muted-foreground">Serial</p>
-                        <p className="font-medium text-xs">{disk.serial.replace(/\\x[0-9a-fA-F]{2}/g, '')}</p>
-                      </div>
-                    )}
-                    </div>
-                </div>
-
-                {/* Desktop */}
-                <div
-                  className="hidden sm:block border border-white/10 rounded-lg p-4 cursor-pointer hover:bg-white/5 transition-colors"
-                  onClick={() => handleDiskClick(disk)}
-                  >
-                    <div className="flex items-center justify-between mb-3">
-                      <div className="flex items-center gap-2">
-                        <Usb className="h-5 w-5 text-orange-400" />
-                        <h3 className="font-semibold">/dev/{disk.name}</h3>
-                        <Badge className="bg-orange-500/10 text-orange-400 border-orange-500/20 text-[10px] px-1.5">USB</Badge>
-                      </div>
-                      <div className="flex items-center gap-3">
-                        {disk.temperature > 0 && (
-                          <div className="flex items-center gap-1">
-                            <Thermometer className={`h-4 w-4 ${getTempColor(disk.temperature, disk.name, disk.rotation_rate)}`} />
-                            <span className={`text-sm font-medium ${getTempColor(disk.temperature, disk.name, disk.rotation_rate)}`}>
-                              {disk.temperature}°C
-                            </span>
-                          </div>
-                        )}
-                        {getHealthBadge(disk.health)}
-                        {(disk.observations_count ?? 0) > 0 && (
-                          <Badge className="bg-blue-500/10 text-blue-400 border-blue-500/20 gap-1">
-                            <Info className="h-3 w-3" />
-                            {disk.observations_count} obs.
-                          </Badge>
-                        )}
-                      </div>
-                    </div>
-                    {disk.model && disk.model !== "Unknown" && (
-                      <p className="text-sm text-muted-foreground mb-3 ml-7">{disk.model}</p>
-                    )}
-
-                    {disk.io_errors && disk.io_errors.count > 0 && (
-                      <div className={`flex items-start gap-2 p-2 rounded text-xs mb-3 ${
-                        disk.io_errors.severity === 'CRITICAL'
-                          ? 'bg-red-500/10 text-red-400 border border-red-500/20'
-                          : 'bg-yellow-500/10 text-yellow-400 border border-yellow-500/20'
-                      }`}>
-                        <AlertTriangle className="h-3.5 w-3.5 flex-shrink-0 mt-0.5" />
-                        <div>
-                          {disk.io_errors.error_type === 'filesystem' ? (
-                            <>
-                              <span className="font-medium">Filesystem corruption detected</span>
-                              {disk.io_errors.reason && (
-                                <p className="mt-0.5 opacity-90 whitespace-pre-line">{disk.io_errors.reason}</p>
-                              )}
-                            </>
-                          ) : (
-                            <>
-                              <span className="font-medium">{disk.io_errors.count} I/O error{disk.io_errors.count !== 1 ? 's' : ''} in 5 min</span>
-                              {disk.io_errors.sample && (
-                                <p className="mt-0.5 opacity-80 font-mono truncate max-w-md">{disk.io_errors.sample}</p>
-                              )}
-                            </>
-                          )}
-                        </div>
-                      </div>
-                    )}
-
-                    <div className="grid grid-cols-2 md:grid-cols-4 gap-4 text-sm">
-                      {disk.size_formatted && (
-                        <div>
-                          <p className="text-sm text-muted-foreground">Size</p>
-                          <p className="font-medium">{disk.size_formatted}</p>
-                        </div>
-                      )}
-                      {disk.smart_status && disk.smart_status !== "unknown" && (
-                        <div>
-                          <p className="text-sm text-muted-foreground">SMART Status</p>
-                          <p className="font-medium capitalize">{disk.smart_status}</p>
-                        </div>
-                      )}
-                      {disk.power_on_hours !== undefined && disk.power_on_hours > 0 && (
-                        <div>
-                          <p className="text-sm text-muted-foreground">Power On Time</p>
-                          <p className="font-medium">{formatHours(disk.power_on_hours)}</p>
-                        </div>
-                      )}
-                      {disk.serial && disk.serial !== "Unknown" && (
-                        <div>
-                          <p className="text-sm text-muted-foreground">Serial</p>
-                          <p className="font-medium text-xs">{disk.serial.replace(/\\x[0-9a-fA-F]{2}/g, '')}</p>
-                        </div>
-                      )}
-                    </div>
-                  </div>
-                </div>
-              ))}
+            <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
+              {storageData.disks
+                .filter((d) => d.connection_type === 'usb')
+                .map((disk) => renderDiskCardV2(disk))}
             </div>
           </CardContent>
         </Card>
       )}
 
-      {/* Disk Details Dialog */}
+      {/* Disk Details Dialog — wider on desktop so the SMART chart +
+          tabs have room without the right column hugging the edge. */}
       <Dialog open={detailsOpen} onOpenChange={(open) => {
         setDetailsOpen(open)
         if (!open) {
@@ -1722,7 +1678,7 @@ export function StorageOverview() {
           setSmartJsonData(null)
         }
       }}>
-        <DialogContent className="max-w-2xl max-h-[80vh] sm:max-h-[85vh] overflow-hidden flex flex-col p-0">
+        <DialogContent className="max-w-4xl max-h-[80vh] sm:max-h-[85vh] overflow-hidden flex flex-col p-0">
           <DialogHeader className="px-6 pt-6 pb-0">
             <DialogTitle className="flex items-center gap-2">
               {selectedDisk?.connection_type === 'usb' ? (
@@ -2047,29 +2003,53 @@ export function StorageOverview() {
                   </div>
                   <div>
                     <p className="text-sm text-muted-foreground">SMART Status</p>
-                    <p className="font-medium capitalize">{selectedDisk.smart_status}</p>
+                    <p className={`font-medium capitalize flex items-center gap-1.5 ${
+                      smartStatusTone(selectedDisk.smart_status) === "ok"
+                        ? "text-green-500"
+                        : smartStatusTone(selectedDisk.smart_status) === "fail"
+                          ? "text-red-500"
+                          : ""
+                    }`}>
+                      <StatusDot tone={smartStatusTone(selectedDisk.smart_status)} />
+                      {selectedDisk.smart_status}
+                    </p>
                   </div>
                   <div>
                     <p className="text-sm text-muted-foreground">Reallocated Sectors</p>
-                    <p
-                      className={`font-medium ${selectedDisk.reallocated_sectors && selectedDisk.reallocated_sectors > 0 ? "text-yellow-500" : ""}`}
-                    >
+                    <p className={`font-medium flex items-center gap-1.5 ${
+                      counterTone(selectedDisk.reallocated_sectors) === "ok"
+                        ? "text-green-500"
+                        : counterTone(selectedDisk.reallocated_sectors) === "warn"
+                          ? "text-yellow-500"
+                          : "text-red-500"
+                    }`}>
+                      <StatusDot tone={counterTone(selectedDisk.reallocated_sectors)} />
                       {selectedDisk.reallocated_sectors ?? 0}
                     </p>
                   </div>
                   <div>
                     <p className="text-sm text-muted-foreground">Pending Sectors</p>
-                    <p
-                      className={`font-medium ${selectedDisk.pending_sectors && selectedDisk.pending_sectors > 0 ? "text-yellow-500" : ""}`}
-                    >
+                    <p className={`font-medium flex items-center gap-1.5 ${
+                      counterTone(selectedDisk.pending_sectors) === "ok"
+                        ? "text-green-500"
+                        : counterTone(selectedDisk.pending_sectors) === "warn"
+                          ? "text-yellow-500"
+                          : "text-red-500"
+                    }`}>
+                      <StatusDot tone={counterTone(selectedDisk.pending_sectors)} />
                       {selectedDisk.pending_sectors ?? 0}
                     </p>
                   </div>
                   <div>
                     <p className="text-sm text-muted-foreground">CRC Errors</p>
-                    <p
-                      className={`font-medium ${selectedDisk.crc_errors && selectedDisk.crc_errors > 0 ? "text-yellow-500" : ""}`}
-                    >
+                    <p className={`font-medium flex items-center gap-1.5 ${
+                      counterTone(selectedDisk.crc_errors) === "ok"
+                        ? "text-green-500"
+                        : counterTone(selectedDisk.crc_errors) === "warn"
+                          ? "text-yellow-500"
+                          : "text-red-500"
+                    }`}>
+                      <StatusDot tone={counterTone(selectedDisk.crc_errors)} />
                       {selectedDisk.crc_errors ?? 0}
                     </p>
                   </div>
@@ -3737,7 +3717,7 @@ ${observationsHtml}
   <!-- Footer -->
 <div class="rpt-footer">
   <div>Report generated by ProxMenux Monitor</div>
-  <div>ProxMenux Monitor v1.2.2.1-beta</div>
+  <div>ProxMenux Monitor v1.2.3</div>
 </div>
 
 </body>
diff --git a/AppImage/components/system-logs.tsx b/AppImage/components/system-logs.tsx
index c7ad9646..9a709dca 100644
--- a/AppImage/components/system-logs.tsx
+++ b/AppImage/components/system-logs.tsx
@@ -591,7 +591,7 @@ export function SystemLogs() {
       )}
 
       {/* Statistics Cards */}
-      <div className="grid grid-cols-2 lg:grid-cols-4 gap-4 lg:gap-6">
+      <div className="grid grid-cols-2 xl:grid-cols-4 gap-4 xl:gap-6">
         <Card className="bg-card border-border">
           <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
             <CardTitle className="text-sm font-medium text-muted-foreground">Total Entries</CardTitle>
diff --git a/AppImage/components/system-overview.tsx b/AppImage/components/system-overview.tsx
index c5cc1e94..d6229a74 100644
--- a/AppImage/components/system-overview.tsx
+++ b/AppImage/components/system-overview.tsx
@@ -4,10 +4,11 @@ import { useState, useEffect } from "react"
 import { Card, CardContent, CardHeader, CardTitle } from "./ui/card"
 import { Progress } from "./ui/progress"
 import { Badge } from "./ui/badge"
-import { Cpu, MemoryStick, Thermometer, Server, Zap, AlertCircle, HardDrive, Network } from "lucide-react"
+import { Cpu, MemoryStick, Thermometer, Server, Zap, AlertCircle, HardDrive, Network, ChevronRight } from "lucide-react"
 import { NodeMetricsCharts } from "./node-metrics-charts"
 import { NetworkTrafficChart } from "./network-traffic-chart"
 import { TemperatureDetailModal } from "./temperature-detail-modal"
+import { ProcessDetailModal } from "./process-detail-modal"
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
 import { fetchApi } from "../lib/api-config"
 import { formatNetworkTraffic, getNetworkUnit } from "../lib/format-network"
@@ -187,6 +188,8 @@ export function SystemOverview() {
   const [networkTotals, setNetworkTotals] = useState<{ received: number; sent: number }>({ received: 0, sent: 0 })
   const [networkUnit, setNetworkUnit] = useState<"Bytes" | "Bits">("Bytes") // Added networkUnit state
   const [tempModalOpen, setTempModalOpen] = useState(false)
+  const [cpuProcModalOpen, setCpuProcModalOpen] = useState(false)
+  const [memProcModalOpen, setMemProcModalOpen] = useState(false)
 
   useEffect(() => {
     const fetchAllData = async () => {
@@ -398,12 +401,19 @@ export function SystemOverview() {
 
   return (
     <div className="space-y-6">
-      <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-3 lg:gap-6">
+      <div className="grid grid-cols-1 sm:grid-cols-2 xl:grid-cols-4 gap-3 xl:gap-6">
         {/* ── CPU Usage (preview restyle v2: tamaño igual a System Info, bars más anchas) ── */}
-        <Card className="bg-card border-border">
+        <Card
+          className="bg-card border-border cursor-pointer hover:bg-white/5 transition-colors"
+          onClick={() => setCpuProcModalOpen(true)}
+          title="View top processes by CPU"
+        >
           <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
             <CardTitle className="text-sm font-medium text-muted-foreground">CPU Usage</CardTitle>
-            <Cpu className="h-4 w-4 text-muted-foreground" />
+            <div className="flex items-center gap-1 text-muted-foreground">
+              <Cpu className="h-4 w-4" />
+              <ChevronRight className="h-4 w-4 opacity-60" />
+            </div>
           </CardHeader>
           <CardContent>
             <div className="flex items-center gap-4">
@@ -443,10 +453,17 @@ export function SystemOverview() {
         </Card>
 
         {/* ── Memory (preview restyle v2: tamaño igual a System Info, bars más anchas) ── */}
-        <Card className="bg-card border-border">
+        <Card
+          className="bg-card border-border cursor-pointer hover:bg-white/5 transition-colors"
+          onClick={() => setMemProcModalOpen(true)}
+          title="View top processes by memory"
+        >
           <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
             <CardTitle className="text-sm font-medium text-muted-foreground">Memory</CardTitle>
-            <MemoryStick className="h-4 w-4 text-muted-foreground" />
+            <div className="flex items-center gap-1 text-muted-foreground">
+              <MemoryStick className="h-4 w-4" />
+              <ChevronRight className="h-4 w-4 opacity-60" />
+            </div>
           </CardHeader>
           <CardContent>
             <div className="flex items-center gap-4">
@@ -524,7 +541,12 @@ export function SystemOverview() {
         >
           <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
             <CardTitle className="text-sm font-medium text-muted-foreground">Temperature</CardTitle>
-            <Thermometer className="h-4 w-4 text-muted-foreground" />
+            <div className="flex items-center gap-1 text-muted-foreground">
+              <Thermometer className="h-4 w-4" />
+              {systemData.temperature > 0 && (
+                <ChevronRight className="h-4 w-4 opacity-60" />
+              )}
+            </div>
           </CardHeader>
           <CardContent>
             <div className="flex items-center justify-between">
@@ -566,12 +588,24 @@ export function SystemOverview() {
         </Card>
       </div>
 
-      <TemperatureDetailModal 
-        open={tempModalOpen} 
+      <TemperatureDetailModal
+        open={tempModalOpen}
         onOpenChange={setTempModalOpen}
         liveTemperature={systemData.temperature}
       />
 
+      <ProcessDetailModal
+        open={cpuProcModalOpen}
+        onOpenChange={setCpuProcModalOpen}
+        sort="cpu"
+      />
+
+      <ProcessDetailModal
+        open={memProcModalOpen}
+        onOpenChange={setMemProcModalOpen}
+        sort="mem"
+      />
+
       <NodeMetricsCharts />
 
       <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
diff --git a/AppImage/components/temperature-detail-modal.tsx b/AppImage/components/temperature-detail-modal.tsx
index dc364175..5e5f0653 100644
--- a/AppImage/components/temperature-detail-modal.tsx
+++ b/AppImage/components/temperature-detail-modal.tsx
@@ -70,7 +70,10 @@ const getStatusInfo = (temp: number) => {
 }
 
 export function TemperatureDetailModal({ open, onOpenChange, liveTemperature }: TemperatureDetailModalProps) {
-  const [timeframe, setTimeframe] = useState("hour")
+  // Default to 24 h — matches the disk temperature modal and is the
+  // useful timeframe for spotting trends; the 1-h view rarely tells
+  // you anything that the live reading doesn't already show.
+  const [timeframe, setTimeframe] = useState("day")
   const [data, setData] = useState<TempHistoryPoint[]>([])
   const [stats, setStats] = useState<TempStats>({ min: 0, max: 0, avg: 0, current: 0 })
   const [loading, setLoading] = useState(true)
diff --git a/AppImage/components/two-factor-setup.tsx b/AppImage/components/two-factor-setup.tsx
index 15f649d6..a1325445 100644
--- a/AppImage/components/two-factor-setup.tsx
+++ b/AppImage/components/two-factor-setup.tsx
@@ -92,33 +92,59 @@ export function TwoFactorSetup({ open, onClose, onSuccess }: TwoFactorSetupProps
   const copyToClipboard = async (text: string, type: "secret" | "codes") => {
     let ok = false
 
-    // Preferred path (HTTPS / localhost). On plain HTTP the Promise rejects,
-    // so we catch and fall through to the textarea fallback.
+    // Path 1: modern Clipboard API. Only works on HTTPS / localhost.
     try {
-      if (navigator.clipboard && window.isSecureContext) {
+      if (navigator.clipboard?.writeText) {
         await navigator.clipboard.writeText(text)
         ok = true
       }
     } catch {
-      // fall through to execCommand fallback
+      // fall through
     }
 
+    // Path 2: legacy execCommand. Picky — some browsers (iOS Safari
+    // especially) refuse to copy from an element placed off-screen
+    // (`left: -9999px`), which is the previous version's mistake.
+    // Keep the textarea inside the viewport but visually invisible.
     if (!ok) {
+      const textarea = document.createElement("textarea")
+      textarea.value = text
+      textarea.style.position = "fixed"
+      textarea.style.top = "0"
+      textarea.style.left = "0"
+      textarea.style.width = "2em"
+      textarea.style.height = "2em"
+      textarea.style.padding = "0"
+      textarea.style.border = "none"
+      textarea.style.outline = "none"
+      textarea.style.boxShadow = "none"
+      textarea.style.background = "transparent"
+      textarea.style.opacity = "0"
+      textarea.setAttribute("readonly", "")
+      textarea.setAttribute("aria-hidden", "true")
+      document.body.appendChild(textarea)
       try {
-        const textarea = document.createElement("textarea")
-        textarea.value = text
-        textarea.style.position = "fixed"
-        textarea.style.left = "-9999px"
-        textarea.style.top = "-9999px"
-        textarea.style.opacity = "0"
-        textarea.readOnly = true
-        document.body.appendChild(textarea)
         textarea.focus()
         textarea.select()
+        textarea.setSelectionRange(0, text.length)
         ok = document.execCommand("copy")
-        document.body.removeChild(textarea)
       } catch {
         ok = false
+      } finally {
+        document.body.removeChild(textarea)
+      }
+    }
+
+    // Path 3: last-resort window.prompt — ugly but unblockable. The
+    // user can select+copy from the prompt manually. This guarantees
+    // they can finish the 2FA setup even on plain-HTTP Monitor where
+    // both the Clipboard API and execCommand may be locked down.
+    if (!ok) {
+      try {
+        window.prompt("Copy this value:", text)
+        ok = true
+      } catch {
+        // ignore
       }
     }
 
diff --git a/AppImage/components/ui/input.tsx b/AppImage/components/ui/input.tsx
index d32a72ed..0bc8c5de 100644
--- a/AppImage/components/ui/input.tsx
+++ b/AppImage/components/ui/input.tsx
@@ -9,7 +9,14 @@ const Input = React.forwardRef<HTMLInputElement, InputProps>(({ className, type,
     <input
       type={type}
       className={cn(
-        "flex h-10 w-full rounded-lg border border-input bg-background px-4 py-2 text-sm shadow-sm transition-all file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 hover:border-ring/50",
+        // The previous focus style was `ring-2 ring-ring ring-offset-2`, which
+        // painted a 2px white ring with a 2px gap outside the border. Inside a
+        // ScrollArea or any container with `overflow-hidden` the ring's left
+        // edge got clipped and the result looked broken. We replace it with a
+        // 1px blue ring + matching border so a focused input now sits at the
+        // same visual weight as the colored card selectors used elsewhere
+        // (Backend picker, etc.).
+        "flex h-10 w-full rounded-lg border border-input bg-background px-4 py-2 text-sm shadow-sm transition-all file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-blue-500 focus-visible:border-blue-500 disabled:cursor-not-allowed disabled:opacity-50 hover:border-ring/50",
         className,
       )}
       ref={ref}
diff --git a/AppImage/components/ui/switch.tsx b/AppImage/components/ui/switch.tsx
index ba1943e3..8adcaa7a 100644
--- a/AppImage/components/ui/switch.tsx
+++ b/AppImage/components/ui/switch.tsx
@@ -11,7 +11,7 @@ const Switch = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <SwitchPrimitives.Root
     className={cn(
-      "peer inline-flex h-5 w-9 shrink-0 cursor-pointer items-center rounded-full border-2 border-transparent shadow-sm transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=unchecked]:bg-input",
+      "peer inline-flex h-5 w-9 shrink-0 cursor-pointer items-center rounded-full border-2 border-transparent shadow-sm transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=unchecked]:bg-slate-300 dark:data-[state=unchecked]:bg-slate-600",
       className
     )}
     {...props}
diff --git a/AppImage/components/ui/textarea.tsx b/AppImage/components/ui/textarea.tsx
index 9f9a6dc5..1260ba68 100644
--- a/AppImage/components/ui/textarea.tsx
+++ b/AppImage/components/ui/textarea.tsx
@@ -10,7 +10,7 @@ const Textarea = React.forwardRef<HTMLTextAreaElement, TextareaProps>(
     return (
       <textarea
         className={cn(
-          "flex min-h-[80px] w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50",
+          "flex min-h-[80px] w-full rounded-md border border-input bg-background px-3 py-2 text-sm placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-blue-500 focus-visible:border-blue-500 disabled:cursor-not-allowed disabled:opacity-50",
           className
         )}
         ref={ref}
diff --git a/AppImage/components/virtual-machines.tsx b/AppImage/components/virtual-machines.tsx
index e5c2b070..a5b8f815 100644
--- a/AppImage/components/virtual-machines.tsx
+++ b/AppImage/components/virtual-machines.tsx
@@ -8,7 +8,7 @@ import { Badge } from "./ui/badge"
 import { Progress } from "./ui/progress"
 import { Button } from "./ui/button"
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogFooter, DialogDescription } from "./ui/dialog"
-import { Server, Play, Square, Cpu, MemoryStick, HardDrive, Network, Power, RotateCcw, StopCircle, Container, ChevronDown, ChevronUp, ChevronRight, Terminal, Archive, Plus, Loader2, Clock, Database, Shield, Bell, FileText, Settings2, Activity, Package, RefreshCw } from 'lucide-react'
+import { Server, Play, Square, Cpu, MemoryStick, HardDrive, Network, Power, RotateCcw, StopCircle, Container, ChevronDown, ChevronUp, ChevronRight, Terminal, Archive, Plus, Loader2, Clock, Database, Shield, Bell, FileText, Settings2, Activity, Package, RefreshCw, EthernetPort } from 'lucide-react'
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
 import { Checkbox } from "./ui/checkbox"
 import { Textarea } from "./ui/textarea"
@@ -1129,7 +1129,7 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
       .reduce((sum, vm) => sum + (vm.maxmem || 0), 0) / 1024 ** 3).toFixed(1)
   }, [safeVMData])
 
-  const { data: systemData } = useSWR<{ memory_total: number; memory_used: number; memory_usage: number }>(
+  const { data: systemData } = useSWR<{ memory_total: number; memory_used: number; memory_usage: number; cpu_cores?: number; cpu_threads?: number }>(
     "/api/system",
     fetcher,
     {
@@ -1301,7 +1301,7 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
         }
       `}</style>
 
-      <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-6">
+      <div className="grid grid-cols-1 sm:grid-cols-2 xl:grid-cols-4 gap-6">
         {/* ── Total VMs & LXCs (preview restyle: B-headline + pills, matching Overview) ── */}
         {(() => {
           const running = safeVMData.filter((vm) => vm.status === "running").length
@@ -1346,6 +1346,7 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
           const inUseVCPU = safeVMData
             .filter((vm) => vm.status === "running")
             .reduce((sum, vm) => sum + (vm.maxcpu || 0), 0)
+          const hostThreads = systemData?.cpu_threads ?? systemData?.cpu_cores ?? 0
           const stroke = allocPct >= 90 ? '#ef4444' : allocPct >= 75 ? '#f59e0b' : '#3b82f6'
           return (
             <Card className="bg-card border-border">
@@ -1374,11 +1375,11 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                     </div>
                     <div className="flex items-center justify-between text-sm">
                       <span className="text-muted-foreground">Configured</span>
-                      <span className="font-medium font-mono whitespace-nowrap">{configuredVCPU || '—'} vCPU</span>
+                      <span className="font-medium font-mono whitespace-nowrap">{configuredVCPU || '—'}{hostThreads ? ` / ${hostThreads}` : ''} vCPU</span>
                     </div>
                     <div className="flex items-center justify-between text-sm">
                       <span className="text-muted-foreground">In use</span>
-                      <span className="font-medium font-mono whitespace-nowrap">{inUseVCPU || '—'} vCPU</span>
+                      <span className="font-medium font-mono whitespace-nowrap">{inUseVCPU || '—'}{hostThreads ? ` / ${hostThreads}` : ''} vCPU</span>
                     </div>
                   </div>
                 </div>
@@ -1979,11 +1980,13 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                                 />
                               </div>
 
-                              {/* Disk I/O */}
+                              {/* Disk I/O — cumulative counters from Proxmox
+                                  API: bytes read/written since the VM/LXC
+                                  was last started, not a per-period rate. */}
                               <div>
                                 <div className="flex items-center gap-1.5 text-xs text-muted-foreground mb-2">
                                   <HardDrive className="h-3.5 w-3.5" />
-                                  <span>Disk I/O</span>
+                                  <span>Disk I/O <span className="text-[10px] opacity-70">(since boot)</span></span>
                                 </div>
                                 <div className="space-y-1">
                                   <div className="text-sm text-green-500 flex items-center gap-1">
@@ -1997,11 +2000,13 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                                 </div>
                               </div>
 
-                              {/* Network I/O */}
+                              {/* Network I/O — cumulative counters from
+                                  Proxmox API: bytes in/out since the VM/LXC
+                                  was last started. */}
                               <div>
                                 <div className="flex items-center gap-1.5 text-xs text-muted-foreground mb-2">
                                   <Network className="h-3.5 w-3.5" />
-                                  <span>Network I/O</span>
+                                  <span>Network I/O <span className="text-[10px] opacity-70">(since boot)</span></span>
                                 </div>
                                 <div className="space-y-1">
                                   <div className="text-sm text-green-500 flex items-center gap-1">
@@ -2468,71 +2473,144 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                                     </div>
                                   </div>
 
-                                  {/* Storage Section */}
-                                  <div>
-                                    <h4 className="flex items-center gap-2 text-sm font-semibold text-muted-foreground mb-3 uppercase tracking-wide">
-                                      <HardDrive className="h-4 w-4" />
-                                      Storage
-                                    </h4>
-                                    <div className="space-y-3">
-                                      {vmDetails.config.rootfs && (
-                                        <div key="rootfs">
-                                          <div className="text-xs text-muted-foreground mb-1">Root Filesystem</div>
-                                          <div className="font-medium text-foreground text-sm break-all font-mono bg-muted/50 p-2 rounded">
-                                            {vmDetails.config.rootfs}
+                                  {/* Storage Section — human-readable breakdown
+                                      per disk plus the raw config string in a
+                                      collapsible details block, mirroring the
+                                      Network section. */}
+                                  {(() => {
+                                    // Parse a Proxmox disk config string into
+                                    //   { storage, volume, path, options }
+                                    // Handles both LVM-style volumes
+                                    // "local-lvm:vm-101-disk-0,size=6G" and
+                                    // passthrough paths "/dev/disk/by-id/...".
+                                    const parseDisk = (raw: string) => {
+                                      const parts = raw.split(",")
+                                      const first = parts[0] || ""
+                                      const options: Record<string, string> = {}
+                                      parts.slice(1).forEach((p) => {
+                                        const eq = p.indexOf("=")
+                                        if (eq > 0) {
+                                          options[p.slice(0, eq).trim()] = p.slice(eq + 1).trim()
+                                        }
+                                      })
+                                      let storage = "", volume = "", path = ""
+                                      if (first.startsWith("/")) {
+                                        path = first
+                                      } else if (first.includes(":")) {
+                                        const [s, v] = first.split(":")
+                                        storage = s
+                                        volume = v
+                                      } else {
+                                        volume = first
+                                      }
+                                      return { storage, volume, path, options }
+                                    }
+                                    // Convert Proxmox size strings ("6G",
+                                    // "3907018584K", "40G", "4M") to a
+                                    // consistent GB/TB display.
+                                    const humanSize = (s: string): string => {
+                                      if (!s) return ""
+                                      const m = s.match(/^(\d+(?:\.\d+)?)([KMGT])?$/i)
+                                      if (!m) return s
+                                      const n = parseFloat(m[1])
+                                      const unit = (m[2] || "").toUpperCase()
+                                      const bytes =
+                                        unit === "K" ? n * 1024 :
+                                        unit === "M" ? n * 1024 ** 2 :
+                                        unit === "G" ? n * 1024 ** 3 :
+                                        unit === "T" ? n * 1024 ** 4 : n
+                                      if (bytes >= 1024 ** 4) return `${(bytes / 1024 ** 4).toFixed(2)} TB`
+                                      if (bytes >= 1024 ** 3) return `${(bytes / 1024 ** 3).toFixed(bytes < 10 * 1024 ** 3 ? 1 : 0)} GB`
+                                      if (bytes >= 1024 ** 2) return `${(bytes / 1024 ** 2).toFixed(0)} MB`
+                                      return s
+                                    }
+                                    const DField = ({ label, value, mono, className }:
+                                      { label: string; value: string; mono?: boolean; className?: string }) => (
+                                      <div className="flex flex-col gap-0.5">
+                                        <span className="text-[10px] uppercase tracking-wide text-muted-foreground">{label}</span>
+                                        <span className={`text-foreground ${mono ? "font-mono text-xs" : "text-sm"} ${className || ""}`}>{value}</span>
+                                      </div>
+                                    )
+                                    const renderDisk = (label: string, raw: string, keyId: string) => {
+                                      const d = parseDisk(raw)
+                                      return (
+                                        <div key={keyId} className="bg-muted/30 rounded-md p-3 space-y-3">
+                                          <div className="flex items-center gap-2 flex-wrap">
+                                            <HardDrive className="h-4 w-4 text-purple-500 flex-shrink-0" />
+                                            <span className="text-sm font-semibold text-foreground">{label}</span>
+                                            {d.storage && (
+                                              <span className="text-xs text-orange-500 font-mono">
+                                                {d.storage}
+                                              </span>
+                                            )}
+                                            {d.options.size && (
+                                              <span className="text-xs text-cyan-500 font-mono">
+                                                {humanSize(d.options.size)}
+                                              </span>
+                                            )}
                                           </div>
-                                        </div>
-                                      )}
-                                      {vmDetails.config.scsihw && (
-                                        <div key="scsihw">
-                                          <div className="text-xs text-muted-foreground mb-1">SCSI Controller</div>
-                                          <div className="font-medium text-foreground">{vmDetails.config.scsihw}</div>
-                                        </div>
-                                      )}
-                                      {/* Disk Storage with proper keys */}
-                                      {Object.keys(vmDetails.config)
-                                        .filter((key) => key.match(/^(scsi|sata|ide|virtio)\d+$/))
-                                        .map((diskKey) => (
-                                          <div key={`disk-${selectedVM.vmid}-${diskKey}`}>
-                                            <div className="text-xs text-muted-foreground mb-1">
-                                              {diskKey.toUpperCase().replace(/(\d+)/, " $1")}
+                                          <div className="grid grid-cols-2 sm:grid-cols-3 gap-x-4 gap-y-2">
+                                            {d.volume && <DField label="Volume" value={d.volume} mono />}
+                                            {d.path && <DField label="Path" value={d.path} mono className="break-all" />}
+                                            {d.options.ssd === "1" && <DField label="Media" value="SSD" />}
+                                            {d.options.discard && <DField label="Discard" value={d.options.discard} />}
+                                            {d.options.iothread === "1" && <DField label="IOThread" value="on" />}
+                                            {d.options.cache && <DField label="Cache" value={d.options.cache} />}
+                                            {d.options.aio && <DField label="AIO" value={d.options.aio} />}
+                                            {d.options.backup === "0" && <DField label="Backup" value="excluded" className="text-red-500" />}
+                                            {d.options.backup === "1" && <DField label="Backup" value="included" />}
+                                            {d.options.replicate === "0" && <DField label="Replicate" value="off" />}
+                                            {d.options.efitype && <DField label="EFI type" value={d.options.efitype} />}
+                                            {d.options.pre_enrolled_keys && <DField label="Pre-enrolled keys" value={d.options.pre_enrolled_keys} />}
+                                            {d.options.serial && <DField label="Serial" value={d.options.serial} mono />}
+                                            {d.options.mp && <DField label="Mount point" value={d.options.mp} mono />}
+                                            {d.options.acl && <DField label="ACL" value={d.options.acl} />}
+                                          </div>
+                                          <details className="text-xs">
+                                            <summary className="cursor-pointer text-muted-foreground hover:text-foreground">Raw config</summary>
+                                            <div className="mt-1 font-mono text-foreground break-all bg-background/50 p-2 rounded">
+                                              {raw}
                                             </div>
-                                            <div className="font-medium text-foreground text-sm break-all font-mono bg-muted/50 p-2 rounded">
-                                              {vmDetails.config[diskKey]}
-                                            </div>
-                                          </div>
-                                        ))}
-                                      {vmDetails.config.efidisk0 && (
-                                        <div key="efidisk0">
-                                          <div className="text-xs text-muted-foreground mb-1">EFI Disk</div>
-                                          <div className="font-medium text-foreground text-sm break-all font-mono bg-muted/50 p-2 rounded">
-                                            {vmDetails.config.efidisk0}
-                                          </div>
+                                          </details>
                                         </div>
-                                      )}
-                                      {vmDetails.config.tpmstate0 && (
-                                        <div key="tpmstate0">
-                                          <div className="text-xs text-muted-foreground mb-1">TPM State</div>
-                                          <div className="font-medium text-foreground text-sm break-all font-mono bg-muted/50 p-2 rounded">
-                                            {vmDetails.config.tpmstate0}
-                                          </div>
+                                      )
+                                    }
+                                    return (
+                                      <div>
+                                        <h4 className="flex items-center gap-2 text-sm font-semibold text-muted-foreground mb-3 uppercase tracking-wide">
+                                          <HardDrive className="h-4 w-4" />
+                                          Storage
+                                        </h4>
+                                        <div className="space-y-3">
+                                          {vmDetails.config.scsihw && (
+                                            <div className="flex items-center gap-2 text-sm">
+                                              <span className="text-xs uppercase tracking-wide text-muted-foreground">SCSI controller:</span>
+                                              <span className="font-mono text-foreground">{vmDetails.config.scsihw}</span>
+                                            </div>
+                                          )}
+                                          {vmDetails.config.rootfs && renderDisk("Root Filesystem", vmDetails.config.rootfs as string, "rootfs")}
+                                          {Object.keys(vmDetails.config)
+                                            .filter((key) => key.match(/^(scsi|sata|ide|virtio)\d+$/))
+                                            .sort()
+                                            .map((diskKey) => renderDisk(
+                                              diskKey.toUpperCase().replace(/(\d+)/, " $1"),
+                                              vmDetails.config[diskKey] as string,
+                                              `disk-${selectedVM.vmid}-${diskKey}`,
+                                            ))}
+                                          {vmDetails.config.efidisk0 && renderDisk("EFI Disk", vmDetails.config.efidisk0 as string, "efidisk0")}
+                                          {vmDetails.config.tpmstate0 && renderDisk("TPM State", vmDetails.config.tpmstate0 as string, "tpmstate0")}
+                                          {Object.keys(vmDetails.config)
+                                            .filter((key) => key.match(/^mp\d+$/))
+                                            .sort()
+                                            .map((mpKey) => renderDisk(
+                                              `Mount Point ${mpKey.replace("mp", "")}`,
+                                              vmDetails.config[mpKey] as string,
+                                              `mp-${selectedVM.vmid}-${mpKey}`,
+                                            ))}
                                         </div>
-                                      )}
-                                      {/* Mount Points with proper keys */}
-                                      {Object.keys(vmDetails.config)
-                                        .filter((key) => key.match(/^mp\d+$/))
-                                        .map((mpKey) => (
-                                          <div key={`mp-${selectedVM.vmid}-${mpKey}`}>
-                                            <div className="text-xs text-muted-foreground mb-1">
-                                              Mount Point {mpKey.replace("mp", "")}
-                                            </div>
-                                            <div className="font-medium text-foreground text-sm break-all font-mono bg-muted/50 p-2 rounded">
-                                              {vmDetails.config[mpKey]}
-                                            </div>
-                                          </div>
-                                        ))}
-                                    </div>
-                                  </div>
+                                      </div>
+                                    )
+                                  })()}
 
                                   {/* Network Section */}
                                   <div>
@@ -2541,19 +2619,86 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                                       Network
                                     </h4>
                                     <div className="space-y-3">
-                                      {/* Network Interfaces with proper keys */}
+                                      {/* Network Interfaces with proper keys.
+                                          Renders BOTH a human-readable
+                                          breakdown (bridge, IP, gw, MAC,
+                                          host iface) AND the raw config
+                                          string so power users still see
+                                          the underlying Proxmox config. */}
                                       {Object.keys(vmDetails.config)
                                         .filter((key) => key.match(/^net\d+$/))
-                                        .map((netKey) => (
-                                          <div key={`net-${selectedVM.vmid}-${netKey}`}>
-                                            <div className="text-xs text-muted-foreground mb-1">
-                                              Network Interface {netKey.replace("net", "")}
+                                        .map((netKey) => {
+                                          const raw = vmDetails.config[netKey] as string
+                                          // Parse "name=eth0,bridge=vmbr0,gw=1.2.3.4,..."
+                                          const parsed: Record<string, string> = {}
+                                          raw.split(",").forEach((pair) => {
+                                            const eq = pair.indexOf("=")
+                                            if (eq > 0) {
+                                              parsed[pair.slice(0, eq).trim()] =
+                                                pair.slice(eq + 1).trim()
+                                            } else if (pair && !parsed.model) {
+                                              // bare "virtio" / "e1000" → NIC model
+                                              parsed.model = pair.trim()
+                                            }
+                                          })
+                                          const idx = netKey.replace("net", "")
+                                          // For VMs, the host-side iface is
+                                          // tap<vmid>i<idx>; for LXC it's
+                                          // veth<vmid>i<idx>. Surface it so
+                                          // users can correlate with the
+                                          // "VM & LXC Network Interfaces"
+                                          // card on the network page.
+                                          const hostIface = selectedVM.type === "lxc"
+                                            ? `veth${selectedVM.vmid}i${idx}`
+                                            : `tap${selectedVM.vmid}i${idx}`
+                                          const Field = ({ label, value, mono }:
+                                            { label: string; value: string; mono?: boolean }) => (
+                                            <div className="flex flex-col gap-0.5">
+                                              <span className="text-[10px] uppercase tracking-wide text-muted-foreground">{label}</span>
+                                              <span className={`text-foreground ${mono ? "font-mono text-xs" : "text-sm"}`}>{value}</span>
                                             </div>
-                                            <div className="font-medium text-green-500 text-sm break-all font-mono bg-muted/50 p-2 rounded">
-                                              {vmDetails.config[netKey]}
+                                          )
+                                          return (
+                                            <div key={`net-${selectedVM.vmid}-${netKey}`}
+                                                 className="bg-muted/30 rounded-md p-3 space-y-3">
+                                              <div className="flex items-center gap-2 flex-wrap">
+                                                <EthernetPort className="h-4 w-4 text-green-500 flex-shrink-0" />
+                                                <span className="text-sm font-semibold text-foreground">
+                                                  Network Interface {idx}
+                                                </span>
+                                                {parsed.name && (
+                                                  <span className="text-xs text-muted-foreground font-mono">
+                                                    ({parsed.name})
+                                                  </span>
+                                                )}
+                                                <span className="text-xs text-orange-500 font-mono">
+                                                  host: {hostIface}
+                                                </span>
+                                              </div>
+                                              <div className="grid grid-cols-2 sm:grid-cols-3 gap-x-4 gap-y-2">
+                                                {parsed.bridge && <Field label="Bridge" value={parsed.bridge} mono />}
+                                                {parsed.ip && <Field label="IP" value={parsed.ip} mono />}
+                                                {parsed.ip6 && <Field label="IPv6" value={parsed.ip6} mono />}
+                                                {parsed.gw && <Field label="Gateway" value={parsed.gw} mono />}
+                                                {parsed.gw6 && <Field label="Gateway v6" value={parsed.gw6} mono />}
+                                                {parsed.hwaddr && <Field label="MAC" value={parsed.hwaddr.toUpperCase()} mono />}
+                                                {parsed.virtio && <Field label="MAC" value={parsed.virtio.toUpperCase()} mono />}
+                                                {parsed.e1000 && <Field label="MAC" value={parsed.e1000.toUpperCase()} mono />}
+                                                {parsed.type && <Field label="Type" value={parsed.type} mono />}
+                                                {parsed.tag && <Field label="VLAN" value={parsed.tag} mono />}
+                                                {parsed.mtu && <Field label="MTU" value={parsed.mtu} mono />}
+                                                {parsed.rate && <Field label="Rate limit" value={`${parsed.rate} MB/s`} mono />}
+                                                {parsed.firewall === "1" && <Field label="Firewall" value="enabled" />}
+                                              </div>
+                                              <details className="text-xs">
+                                                <summary className="cursor-pointer text-muted-foreground hover:text-foreground">Raw config</summary>
+                                                <div className="mt-1 font-mono text-green-500 break-all bg-background/50 p-2 rounded">
+                                                  {raw}
+                                                </div>
+                                              </details>
                                             </div>
-                                          </div>
-                                        ))}
+                                          )
+                                        })}
                                       <div className="grid grid-cols-1 lg:grid-cols-2 gap-3">
                                         {vmDetails.config.nameserver && (
                                           <div>
diff --git a/AppImage/config/verified_ai_models.json b/AppImage/config/verified_ai_models.json
index da915473..4472ea26 100644
--- a/AppImage/config/verified_ai_models.json
+++ b/AppImage/config/verified_ai_models.json
@@ -1,30 +1,31 @@
 {
   "_description": "Verified AI models for ProxMenux notifications. Only models listed here will be shown to users. Models are tested to work with the chat/completions API format.",
-  "_updated": "2026-04-19",
+  "_updated": "2026-07-14",
   "_verifier": "Refreshed with tools/ai-models-verifier (private). Re-run before each ProxMenux release to keep the list current. The verifier and ProxMenux share the same reasoning/thinking-model handlers so their verdicts stay aligned with runtime behaviour.",
 
   "groq": {
     "models": [
       "llama-3.3-70b-versatile",
-      "llama-3.1-70b-versatile",
       "llama-3.1-8b-instant",
-      "llama3-70b-8192",
-      "llama3-8b-8192",
-      "mixtral-8x7b-32768",
-      "gemma2-9b-it"
+      "meta-llama/llama-4-scout-17b-16e-instruct",
+      "openai/gpt-oss-120b",
+      "openai/gpt-oss-20b"
     ],
     "recommended": "llama-3.3-70b-versatile",
-    "_note": "Not yet re-verified in 2026-04 refresh — kept from previous curation. Run the verifier with a Groq key to prune deprecated entries."
+    "_note": "Verified functionally 2026-07-14 with the Groq API (15 models discovered, 9 passed). Legacy llama-3.1-70b-versatile / llama3-70b-8192 / llama3-8b-8192 / mixtral-8x7b-32768 / gemma2-9b-it removed (retired upstream). llama-4-scout added (current-gen Llama 4, 0.47s). openai/gpt-oss-120b / gpt-oss-20b confirmed. Passing but excluded: allam-2-7b (Arabic-focused), qwen/qwen3-32b (Chinese-first, unreliable Spanish output), openai/gpt-oss-safeguard-20b (safety-classifier variant), groq/compound-mini (agentic system, wrong fit for notification translation)."
   },
 
   "gemini": {
     "models": [
+      "gemini-flash-lite-latest",
       "gemini-2.5-flash-lite",
       "gemini-2.5-flash",
-      "gemini-3-flash-preview"
+      "gemini-3.1-flash-lite",
+      "gemini-3-flash-preview",
+      "gemini-3.5-flash"
     ],
     "recommended": "gemini-2.5-flash-lite",
-    "_note": "flash-lite / flash pass the verifier consistently; pro variants reject thinkingBudget=0 and are overkill for notification translation anyway. 'latest' aliases (gemini-flash-latest, gemini-flash-lite-latest) are intentionally omitted because they resolved to different models across runs and produced timeouts in some regions.",
+    "_note": "Verified 2026-07-13. gemini-flash-lite-latest now passes consistently (1.6s) and is fastest, but gemini-2.5-flash-lite remains recommended because 'latest' aliases can drift over time. gemini-3.1-flash-lite is the stable successor to 3-flash-preview. Pro variants continue to reject thinkingBudget=0 and are overkill for notification translation.",
     "_deprecated": ["gemini-2.0-flash", "gemini-2.0-flash-lite", "gemini-1.5-flash", "gemini-1.0-pro", "gemini-pro"]
   },
 
@@ -36,21 +37,23 @@
       "gpt-4.1",
       "gpt-4o",
       "gpt-5-chat-latest",
-      "gpt-5.4-nano",
-      "gpt-5.4-mini"
+      "gpt-5-nano"
     ],
     "recommended": "gpt-4.1-nano",
-    "_note": "Reasoning models (o-series, gpt-5/5.1/5.2 non-chat variants) are supported by openai_provider.py via max_completion_tokens + reasoning_effort=minimal, but not listed here by default: their latency is higher than the chat models and they do not improve translation quality for notifications. Add specific reasoning IDs to this list only if a user explicitly wants them."
+    "_note": "Verified 2026-07-13. gpt-5.4-nano / gpt-5.4-mini removed (HTTP 400 — provider params rejected). gpt-5-nano added (2.0s, current-gen fast). Reasoning models (o-series, gpt-5/5.1/5.2 non-chat variants) are supported by openai_provider.py via max_completion_tokens + reasoning_effort=minimal, but not listed here: their latency is higher and they do not improve translation quality for notifications. Add specific reasoning IDs to this list only if a user explicitly wants them."
   },
 
   "anthropic": {
     "models": [
-      "claude-3-5-haiku-latest",
-      "claude-3-5-sonnet-latest",
-      "claude-3-opus-latest"
+      "claude-haiku-4-5",
+      "claude-sonnet-5",
+      "claude-opus-4-8",
+      "claude-sonnet-4-6",
+      "claude-opus-4-6",
+      "claude-fable-5"
     ],
-    "recommended": "claude-3-5-haiku-latest",
-    "_note": "Not re-verified in 2026-04 refresh — kept from previous curation. Add claude-4.x / claude-4.5 / claude-4.6 / claude-4.7 variants after running the verifier with an Anthropic key."
+    "recommended": "claude-haiku-4-5",
+    "_note": "Verified 2026-07-13 with all 10 discovered models passing after aligning the verifier with anthropic_provider.py (temperature omitted — newest generations reject it with 'temperature is deprecated for this model'). Legacy claude-3-5-haiku-latest / claude-3-5-sonnet-latest / claude-3-opus-latest removed (deprecated upstream, not in the Models API). haiku-4-5 is the sweet spot for notification translation (3.6s, $1/$5 per MTok); sonnet-5 for slightly richer output (3.1s, $3/$15); opus-4-8 / fable-5 for demanding cases."
   },
 
   "openrouter": {
@@ -58,15 +61,16 @@
       "meta-llama/llama-3.3-70b-instruct",
       "meta-llama/llama-3.1-70b-instruct",
       "meta-llama/llama-3.1-8b-instruct",
-      "anthropic/claude-3.5-haiku",
-      "anthropic/claude-3.5-sonnet",
-      "google/gemini-flash-1.5",
+      "meta-llama/llama-4-scout",
+      "anthropic/claude-haiku-4.5",
+      "anthropic/claude-sonnet-4.6",
+      "google/gemini-2.5-flash-lite",
+      "google/gemini-2.5-flash",
       "openai/gpt-4o-mini",
-      "mistralai/mistral-7b-instruct",
-      "mistralai/mixtral-8x7b-instruct"
+      "mistralai/mistral-small-3.2-24b-instruct"
     ],
     "recommended": "meta-llama/llama-3.3-70b-instruct",
-    "_note": "Not re-verified in 2026-04 refresh. google/gemini-flash-2.5-flash-lite was malformed in the previous entry and has been replaced with google/gemini-flash-1.5."
+    "_note": "Verified functionally 2026-07-14 with the OpenRouter API — all 10 curated candidates pass the Spanish-translation notification test. Fastest: llama-4-scout (0.51s), gemini-2.5-flash-lite (1.14s), gemini-2.5-flash (1.94s), llama-3.3-70b-instruct (2.29s), claude-haiku-4.5 (2.71s). Legacy anthropic/claude-3.5-* / google/gemini-flash-1.5 / mistralai/mistral-7b-instruct / mixtral-8x7b-instruct removed (GONE from catalog). Modern replacements added: llama-4-scout (Meta's current gen — dramatically fastest), claude-haiku-4.5 / claude-sonnet-4.6, gemini-2.5-flash / flash-lite, mistral-small-3.2-24b. recommended kept as llama-3.3-70b for capability/latency balance; llama-4-scout is a faster alternative worth considering as recommended after a broader release."
   },
 
   "ollama": {
diff --git a/AppImage/lib/api-config.ts b/AppImage/lib/api-config.ts
index 527cc201..04af2cbf 100644
--- a/AppImage/lib/api-config.ts
+++ b/AppImage/lib/api-config.ts
@@ -138,6 +138,12 @@ export async function fetchApi<T>(endpoint: string, options?: RequestInit): Prom
       // return `{error: "..."}` on failure (e.g. /api/vms/<id>/control
       // includes the pvesh stderr — telling the user "no space left on
       // device" is infinitely more useful than the raw status text).
+      //
+      // We also attach the FULL parsed JSON body to the thrown Error
+      // as `.body` so callers that want the optional `details` /
+      // `suggestion` fields (e.g. /api/node/metrics) can render them
+      // without re-fetching. Callers that just read `err.message`
+      // keep working exactly as before.
       try {
         const ct = response.headers.get("content-type") || ""
         if (ct.includes("application/json")) {
@@ -145,14 +151,22 @@ export async function fetchApi<T>(endpoint: string, options?: RequestInit): Prom
           const detail =
             (body && (body.error || body.message)) || ""
           if (detail) {
-            throw new Error(detail)
+            const e: Error & { body?: unknown; status?: number } = new Error(detail)
+            e.body = body
+            e.status = response.status
+            throw e
           }
         }
       } catch (parseErr) {
-        if (parseErr instanceof Error && parseErr.message.includes("API request failed")) {
+        // Backend-supplied detail (the explicit `throw new Error(detail)`
+        // above) MUST propagate so the UI shows "path does not exist…"
+        // instead of the generic "API request failed: 400 BAD REQUEST".
+        // Only swallow when the JSON itself failed to parse — that's a
+        // real SyntaxError and falling through to the generic message
+        // is the right behaviour there.
+        if (!(parseErr instanceof SyntaxError)) {
           throw parseErr
         }
-        // JSON parse failed — fall through to the generic message.
       }
       throw new Error(`API request failed: ${response.status} ${response.statusText}`)
     }
diff --git a/AppImage/lib/disk-type.ts b/AppImage/lib/disk-type.ts
new file mode 100644
index 00000000..c6060110
--- /dev/null
+++ b/AppImage/lib/disk-type.ts
@@ -0,0 +1,30 @@
+// Shared classifier for physical-disk type. Lives here because the
+// Storage page and the Hardware page used to ship their own copies
+// and silently drifted — old SSDs (e.g. OCZ-SOLID2) that don't expose
+// a SMART rotation rate fell through Hardware's HDD-as-default branch
+// and got mislabelled, while the Storage page got it right.
+//
+// Backend convention for `rotation_rate`:
+//   undefined / null / 0  → SSD (no platters reported)
+//   -1                     → HDD detected via /sys rotational flag,
+//                            but the drive doesn't expose RPM
+//   > 0                    → HDD with known RPM
+//   string "Solid State"   → SSD (smartctl wording on a few vendors)
+
+export type DiskType = "NVMe" | "SSD" | "HDD"
+
+export function getDiskType(
+  diskName: string,
+  rotationRate: number | string | null | undefined,
+): DiskType {
+  if (diskName.startsWith("nvme")) return "NVMe"
+  if (rotationRate === -1) return "HDD"
+  if (typeof rotationRate === "string") {
+    if (rotationRate.includes("Solid State")) return "SSD"
+    const parsed = Number.parseInt(rotationRate, 10)
+    if (Number.isNaN(parsed) || parsed === 0) return "SSD"
+    return "HDD"
+  }
+  if (rotationRate == null || rotationRate === 0) return "SSD"
+  return "HDD"
+}
diff --git a/AppImage/lib/storage-usage-color.ts b/AppImage/lib/storage-usage-color.ts
new file mode 100644
index 00000000..16fa7ebc
--- /dev/null
+++ b/AppImage/lib/storage-usage-color.ts
@@ -0,0 +1,48 @@
+// Shared usage-bar palette for storage capacity widgets. Extracted
+// so the Storage page (overview cards + per-storage rows) and the
+// Backups page (Available Archives → per-archive capacity bar) flag
+// a full datastore with the same colour. Previously the Backups bar
+// was hard-coded to blue, so a 100%-full PBS-Cloud appeared in red
+// on Storage and in blue on Backups — same datastore, two different
+// signals.
+//
+// Thresholds: < 75 % blue (normal — no alert), 75–89 % amber,
+// ≥ 90 % red. Matches the Storage page palette: the normal state
+// stays on the project's brand blue and only switches to amber/red
+// when the operator should look at it. Green is reserved for OK
+// signals where green has meaning (SMART status, wear level), not
+// for ambient bars.
+
+export type UsageBarColor = {
+  /** Inline `background` value for SVG / style={} consumers. */
+  hex: string
+  /** Tailwind `bg-*` class for div consumers. */
+  bgClass: string
+  /** Tailwind `text-*` class for "Free" / counters that should
+   *  share the urgency signal. */
+  textClass: string
+}
+
+const BLUE: UsageBarColor = {
+  hex: "#3b82f6",
+  bgClass: "bg-blue-500",
+  // No text-blue override for the "Free" counter — at normal usage
+  // the foreground colour reads better than tinted text.
+  textClass: "",
+}
+const AMBER: UsageBarColor = {
+  hex: "#f59e0b",
+  bgClass: "bg-amber-500",
+  textClass: "text-amber-400",
+}
+const RED: UsageBarColor = {
+  hex: "#ef4444",
+  bgClass: "bg-red-500",
+  textClass: "text-red-400",
+}
+
+export function getStorageUsageColor(percent: number): UsageBarColor {
+  if (percent >= 90) return RED
+  if (percent >= 75) return AMBER
+  return BLUE
+}
diff --git a/AppImage/lib/utils.ts b/AppImage/lib/utils.ts
index 4024e486..b764a643 100644
--- a/AppImage/lib/utils.ts
+++ b/AppImage/lib/utils.ts
@@ -19,3 +19,20 @@ export function formatStorage(sizeInGB: number): string {
     return `${tb % 1 === 0 ? tb.toFixed(0) : tb.toFixed(1)} TB`
   }
 }
+
+// Byte-aware formatter. Scales B → KB → MB → GB → TB. Use when the
+// raw value comes in bytes (log file sizes from os.path.getsize(),
+// PBS / Borg datastore capacity reported by the backend in bytes).
+// The Backups page used to ship its own copy that capped at GB, so a
+// 7 TB datastore showed up as "7311.55 GB" — extracted here so it
+// can't drift again.
+export function formatBytes(n: number): string {
+  if (!Number.isFinite(n) || n < 0) return "—"
+  if (n < 1024) return `${n} B`
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`
+  if (n < 1024 * 1024 * 1024) return `${(n / (1024 * 1024)).toFixed(1)} MB`
+  if (n < 1024 * 1024 * 1024 * 1024) {
+    return `${(n / (1024 * 1024 * 1024)).toFixed(2)} GB`
+  }
+  return `${(n / (1024 * 1024 * 1024 * 1024)).toFixed(2)} TB`
+}
diff --git a/AppImage/package-lock.json b/AppImage/package-lock.json
index 09c4a51f..704683e5 100644
--- a/AppImage/package-lock.json
+++ b/AppImage/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "ProxMenux-Monitor",
-  "version": "1.2.2",
+  "version": "1.2.2.2-beta",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ProxMenux-Monitor",
-      "version": "1.2.2",
+      "version": "1.2.2.2-beta",
       "dependencies": {
         "@hookform/resolvers": "^3.10.0",
         "@radix-ui/react-accordion": "1.2.2",
diff --git a/AppImage/package.json b/AppImage/package.json
index 88150fad..f8d1e0d9 100644
--- a/AppImage/package.json
+++ b/AppImage/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ProxMenux-Monitor",
-  "version": "1.2.2.1-beta",
+  "version": "1.2.3",
   "description": "Proxmox System Monitoring Dashboard",
   "private": true,
   "scripts": {
diff --git a/AppImage/public/icons/icon-192.png b/AppImage/public/icons/icon-192.png
new file mode 100644
index 00000000..45e42f44
Binary files /dev/null and b/AppImage/public/icons/icon-192.png differ
diff --git a/AppImage/public/icons/icon-512.png b/AppImage/public/icons/icon-512.png
new file mode 100644
index 00000000..6d2513d1
Binary files /dev/null and b/AppImage/public/icons/icon-512.png differ
diff --git a/AppImage/public/icons/icon-maskable-512.png b/AppImage/public/icons/icon-maskable-512.png
new file mode 100644
index 00000000..eba5600a
Binary files /dev/null and b/AppImage/public/icons/icon-maskable-512.png differ
diff --git a/AppImage/public/logo.png b/AppImage/public/logo.png
new file mode 100644
index 00000000..905d971a
Binary files /dev/null and b/AppImage/public/logo.png differ
diff --git a/AppImage/public/manifest.json b/AppImage/public/manifest.json
index e033acf7..bd2e5aec 100644
--- a/AppImage/public/manifest.json
+++ b/AppImage/public/manifest.json
@@ -3,14 +3,29 @@
   "short_name": "ProxMenux",
   "description": "Proxmox System Dashboard and Monitor",
   "start_url": "/",
+  "scope": "/",
   "display": "standalone",
+  "orientation": "any",
   "background_color": "#2b2f36",
   "theme_color": "#2b2f36",
   "icons": [
     {
-      "src": "/images/proxmenux-logo.png",
-      "sizes": "256x256",
-      "type": "image/png"
+      "src": "/icons/icon-192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icons/icon-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icons/icon-maskable-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
     }
   ]
 }
diff --git a/AppImage/public/sw.js b/AppImage/public/sw.js
new file mode 100644
index 00000000..324873bf
--- /dev/null
+++ b/AppImage/public/sw.js
@@ -0,0 +1,40 @@
+// ==========================================================
+// ProxMenux Monitor — Service Worker
+// ==========================================================
+// Minimal SW whose only job is to make Chrome (Android) treat
+// the Monitor as an installable PWA. The Monitor lives on the
+// operator's LAN, hits a self-signed HTTPS endpoint and has
+// ZERO offline value (every page calls /api/* over the wire),
+// so we do NOT cache pages or API responses — caching them
+// would only cause stale-data bugs after an AppImage update.
+//
+// The install / activate handlers clean up old SW caches from
+// previous Monitor versions so a beta-to-stable upgrade never
+// strands the browser on a cached old shell.
+// ==========================================================
+
+const SW_VERSION = 'proxmenux-monitor-v1';
+
+self.addEventListener('install', (event) => {
+  // Take over as soon as installed; no skipWaiting handshake.
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil((async () => {
+    // Wipe any cache name that isn't ours — survives renames /
+    // version bumps without piling up stale entries.
+    const names = await caches.keys();
+    await Promise.all(
+      names.filter((n) => n !== SW_VERSION).map((n) => caches.delete(n))
+    );
+    await self.clients.claim();
+  })());
+});
+
+// Network-only fetch. The SW exists so Chrome marks the site as
+// installable; we deliberately do not serve cached responses.
+self.addEventListener('fetch', (event) => {
+  // Let the browser handle it normally — no respondWith → no cache.
+  return;
+});
diff --git a/AppImage/scripts/ai_providers/anthropic_provider.py b/AppImage/scripts/ai_providers/anthropic_provider.py
index 862bce06..99281a6a 100644
--- a/AppImage/scripts/ai_providers/anthropic_provider.py
+++ b/AppImage/scripts/ai_providers/anthropic_provider.py
@@ -15,12 +15,21 @@ class AnthropicProvider(AIProvider):
     API_URL = "https://api.anthropic.com/v1/messages"
     API_VERSION = "2023-06-01"
     
-    # Known stable model aliases (Anthropic doesn't have a public models list API)
-    # These use "-latest" which auto-updates to the newest version
+    # Anthropic model aliases that resolve to pinned snapshots (per docs
+    # at platform.claude.com/docs/en/docs/about-claude/models). Kept as a
+    # runtime fallback for the `/api/notifications/provider-models`
+    # intersection with `verified_ai_models.json`; the JSON is the
+    # authoritative UI-facing list. Refreshed 2026-07-13 to drop the
+    # deprecated claude-3-5-* aliases (retired upstream, no longer in the
+    # Models API response) and add the current-generation IDs. Ordered
+    # cheapest → most capable so the first entry is a safe default.
     KNOWN_MODELS = [
-        "claude-3-5-haiku-latest",
-        "claude-3-5-sonnet-latest", 
-        "claude-3-opus-latest",
+        "claude-haiku-4-5",
+        "claude-sonnet-5",
+        "claude-sonnet-4-6",
+        "claude-opus-4-8",
+        "claude-opus-4-6",
+        "claude-fable-5",
     ]
     
     def list_models(self) -> List[str]:
diff --git a/AppImage/scripts/build_appimage.sh b/AppImage/scripts/build_appimage.sh
index 1573b94a..fda15aa3 100644
--- a/AppImage/scripts/build_appimage.sh
+++ b/AppImage/scripts/build_appimage.sh
@@ -166,129 +166,54 @@ else
     echo "⚠️  config directory not found"
 fi
 
-echo "📋 Adding translation support..."
-cat > "$APP_DIR/usr/bin/translate_cli.py" << 'PYEOF'
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-"""
-ProxMenux translate CLI
-stdin JSON -> {"text":"...", "dest_lang":"es", "context":"...", "cache_file":"/usr/local/share/proxmenux/cache.json"}
-stdout JSON -> {"success":true,"text":"..."} or {"success":false,"error":"..."}
-"""
-import sys, json, re
-from pathlib import Path
+# Translation handling lives in scripts/utils.sh now. It reads
+# /usr/local/share/proxmenux/lang/<lang>.json (pre-built by the
+# build_translation_cache.py CI job) and falls back to the English
+# source string on miss. The Monitor AppImage no longer ships the
+# runtime translate_cli.py — the JSON files belong to the host install,
+# not to the Flask dashboard.
 
-# Ensure embedded site-packages are discoverable
-HERE = Path(__file__).resolve().parents[2]  # .../AppDir
-DIST = HERE / "usr" / "lib" / "python3" / "dist-packages"
-SITE = HERE / "usr" / "lib" / "python3" / "site-packages"
-for p in (str(DIST), str(SITE)):
-    if p not in sys.path:
-        sys.path.insert(0, p)
-
-# Python 3.13 compat: inline 'cgi' shim
-try:
-    import cgi
-except Exception:
-    import types, html
-    def _parse_header(value: str):
-        value = str(value or "")
-        parts = [p.strip() for p in value.split(";")]
-        if not parts:
-            return "", {}
-        key = parts[0].lower()
-        params = {}
-        for item in parts[1:]:
-            if not item:
-                continue
-            if "=" in item:
-                k, v = item.split("=", 1)
-                k = k.strip().lower()
-                v = v.strip().strip('"').strip("'")
-                params[k] = v
-            else:
-                params[item.strip().lower()] = ""
-        return key, params
-    cgi = types.SimpleNamespace(parse_header=_parse_header, escape=html.escape)
-
-try:
-    from googletrans import Translator
-except Exception as e:
-    print(json.dumps({"success": False, "error": f"ImportError: {e}"}))
-    sys.exit(0)
-
-def load_json_stdin():
-    try:
-        return json.load(sys.stdin)
-    except Exception as e:
-        print(json.dumps({"success": False, "error": f"Invalid JSON input: {e}"}))
-        sys.exit(0)
-
-def ensure_cache(path: Path):
-    try:
-        path.parent.mkdir(parents=True, exist_ok=True)
-        if not path.exists():
-            path.write_text("{}", encoding="utf-8")
-        json.loads(path.read_text(encoding="utf-8") or "{}")
-    except Exception:
-        path.write_text("{}", encoding="utf-8")
-
-def read_cache(path: Path):
-    try:
-        return json.loads(path.read_text(encoding="utf-8") or "{}")
-    except Exception:
-        return {}
-
-def write_cache(path: Path, cache: dict):
-    tmp = path.with_suffix(".tmp")
-    tmp.write_text(json.dumps(cache, ensure_ascii=False), encoding="utf-8")
-    tmp.replace(path)
-
-def clean_translated(s: str) -> str:
-    s = re.sub(r'^.*?(Translate:|Traducir:|Traduire:|Übersetzen:|Tradurre:|Traduzir:|翻译:|翻訳:)', '', s, flags=re.IGNORECASE | re.DOTALL).strip()
-    s = re.sub(r'^.*?(Context:|Contexto:|Contexte:|Kontext:|Contesto:|上下文：|コンテキスト：).*?:', '', s, flags=re.IGNORECASE | re.DOTALL).strip()
-    return s.strip()
-
-def main():
-    req = load_json_stdin()
-    text = req.get("text", "")
-    dest = req.get("dest_lang", "en") or "en"
-    context = req.get("context", "")
-    cache_file = Path(req.get("cache_file", "")) if req.get("cache_file") else None
-
-    if dest == "en":
-        print(json.dumps({"success": True, "text": text}))
-        return
-
-    cache = {}
-    if cache_file:
-        ensure_cache(cache_file)
-        cache = read_cache(cache_file)
-        if text in cache and (dest in cache[text] or "notranslate" in cache[text]):
-            found = cache[text].get(dest) or cache[text].get("notranslate")
-            print(json.dumps({"success": True, "text": found}))
-            return
-
-    try:
-        full = (context + " " + text).strip() if context else text
-        tr = Translator()
-        result = tr.translate(full, dest=dest).text
-        result = clean_translated(result)
-
-        if cache_file:
-            cache.setdefault(text, {})
-            cache[text][dest] = result
-            write_cache(cache_file, cache)
-
-        print(json.dumps({"success": True, "text": result}))
-    except Exception as e:
-        print(json.dumps({"success": False, "error": str(e)}))
-
-if __name__ == "__main__":
-    main()
-PYEOF
-
-chmod +x "$APP_DIR/usr/bin/translate_cli.py"
+# ── Borg standalone binary ─────────────────────────────────────────
+# Ship the official borg standalone binary inside the AppImage so the
+# host-backup / restore workflows can run without an internet round-trip
+# at install time. Pinned to the same version that proxmenux's
+# hb_ensure_borg used to download on demand — kept in lockstep so both
+# code paths see the same version semantics. SHA256 is the upstream
+# release checksum; bump both together.
+BORG_VERSION="1.2.8"
+BORG_URL="https://github.com/borgbackup/borg/releases/download/${BORG_VERSION}/borg-linux64"
+BORG_SHA256="cfa50fb704a93d3a4fa258120966345fddb394f960dca7c47fcb774d0172f40b"
+echo "📦 Downloading borg ${BORG_VERSION} into AppImage..."
+BORG_TARGET="$APP_DIR/usr/bin/borg"
+# GitHub releases serve borg-linux64 via a 302 redirect to a signed
+# release-assets.githubusercontent.com URL. wget -qO silently dropped
+# the redirect once during the 2026-06-15 build, killing the AppImage
+# pipeline. curl -L --retry 3 is more robust and falls back to wget
+# only when curl is missing.
+if command -v curl >/dev/null 2>&1; then
+    DOWNLOAD_OK=0
+    if curl -sSL --retry 3 --retry-delay 2 --max-time 120 -o "$BORG_TARGET" "$BORG_URL"; then
+        DOWNLOAD_OK=1
+    fi
+else
+    DOWNLOAD_OK=0
+    if wget -qO "$BORG_TARGET" "$BORG_URL"; then
+        DOWNLOAD_OK=1
+    fi
+fi
+if [ "$DOWNLOAD_OK" = "1" ]; then
+    if echo "${BORG_SHA256}  ${BORG_TARGET}" | sha256sum -c - >/dev/null 2>&1; then
+        chmod +x "$BORG_TARGET"
+        echo "✅ borg ${BORG_VERSION} bundled (sha256 verified)"
+    else
+        echo "❌ borg sha256 verification failed — removing"
+        rm -f "$BORG_TARGET"
+        exit 1
+    fi
+else
+    echo "❌ borg download failed from $BORG_URL"
+    exit 1
+fi
 
 # Copy Next.js build
 echo "📋 Copying web dashboard..."
@@ -332,7 +257,7 @@ cat > "$APP_DIR/proxmenux-monitor.desktop" << EOF
 [Desktop Entry]
 Type=Application
 Name=ProxMenux Monitor
-Comment=Proxmox System Monitoring Dashboard with Translation Support
+Comment=Proxmox System Monitoring Dashboard
 Exec=AppRun
 Icon=proxmenux-monitor
 Categories=System;Monitor;
@@ -361,14 +286,12 @@ if [ -f "$APP_DIR/proxmenux-monitor.png" ]; then
 fi
 
 echo "📦 Installing Python dependencies..."
-# Phase 1: Install googletrans with its old dependencies
-pip3 install --target "$APP_DIR/usr/lib/python3/dist-packages" \
-    googletrans==4.0.0-rc1 \
-    httpx==0.13.3 \
-    httpcore==0.9.1 \
-    h11==0.9.0 || true
-
-# Phase 2: Install modern Flask/WebSocket dependencies (will upgrade h11 and related packages)
+# Flask/WebSocket dependencies for the Monitor dashboard. The previous
+# Phase-1 (googletrans==4.0.0-rc1 + httpx 0.13.3 + httpcore 0.9.1 +
+# h11 0.9.0) is gone — translation is now a static-lookup feature on
+# the host, so the AppImage no longer needs any runtime translator.
+# Removing those pins also unblocks the h11>=0.14.0 family without the
+# conflict workaround we used to ship.
 # Note: cryptography removed due to Python version compatibility issues (PyO3 modules)
 pip3 install --target "$APP_DIR/usr/lib/python3/dist-packages" --upgrade --no-deps \
     flask \
@@ -380,7 +303,7 @@ pip3 install --target "$APP_DIR/usr/lib/python3/dist-packages" --upgrade --no-de
     segno \
     beautifulsoup4
 
-# Phase 3: Install WebSocket with newer h11
+# WebSocket with modern h11 (no need for the legacy pin anymore)
 pip3 install --target "$APP_DIR/usr/lib/python3/dist-packages" --upgrade \
     h11>=0.14.0 \
     wsproto>=1.2.0 \
diff --git a/AppImage/scripts/disk_temperature_history.py b/AppImage/scripts/disk_temperature_history.py
index e19d4d00..b5c3c336 100644
--- a/AppImage/scripts/disk_temperature_history.py
+++ b/AppImage/scripts/disk_temperature_history.py
@@ -237,22 +237,64 @@ def _list_target_disks() -> list[str]:
     return fresh
 
 
+def _is_disk_usb(disk_name: str) -> bool:
+    """True if the disk sits behind a USB bus, checked via the resolved
+    sysfs device path. USB-NVMe bridges (ASMedia, JMicron, Realtek) and
+    plain USB-HDDs both report `/sys/block/<disk>/removable = 0`, so the
+    older removable-flag heuristic missed them and the temperature
+    poller never tried the snt* driver variants that are the only way
+    to reach the NVMe controller behind those bridges."""
+    try:
+        base = disk_name[5:] if disk_name.startswith('/dev/') else disk_name
+        real = os.path.realpath(f'/sys/block/{base}')
+        return any(seg.startswith('usb') and (len(seg) == 3 or seg[3:].isdigit())
+                   for seg in real.split('/'))
+    except Exception:
+        return False
+
+
 def _smartctl_cmd_for(disk_name: str, probe: str) -> list[str]:
-    """Build the smartctl invocation for a given probe key."""
-    cmd = ["smartctl", "-A", "-j"]
+    """Build the smartctl invocation for a given probe key.
+
+    `-n standby` makes smartctl exit immediately with code 2 (no disk
+    I/O) when the drive is already in standby. Without it, this
+    once-a-minute poller was spinning HDDs back up on every cycle,
+    breaking NAS / SnapRAID setups that rely on hdparm-driven spin-down
+    (issue #232).
+    """
+    cmd = ["smartctl", "-n", "standby", "-A", "-j"]
     if probe != "auto":
         cmd.extend(["-d", probe])
     cmd.append(f"/dev/{disk_name}")
     return cmd
 
 
+# Sentinel returned by `_try_probe` when the drive is in standby. Distinct
+# from `None` (read failure / no temperature attribute), so the caller
+# can keep the last known reading instead of marking the disk as failing.
+_STANDBY = "standby"
+
+
 def _try_probe(disk_name: str, probe: str) -> Optional[float]:
-    """Run a single smartctl invocation and parse the temperature."""
+    """Run a single smartctl invocation and parse the temperature.
+
+    Returns:
+        * a float — current temperature in °C.
+        * the string ``_STANDBY`` — drive is in standby, NOT read.
+        * ``None`` — read failed for any other reason.
+    """
     try:
         proc = subprocess.run(
             _smartctl_cmd_for(disk_name, probe),
             capture_output=True, text=True, timeout=_SMARTCTL_TIMEOUT,
         )
+        # `-n standby` makes smartctl exit with code 2 when the drive is
+        # parked. We must not treat that as a read failure (would trigger
+        # the backoff and stop polling that drive forever) — surface it
+        # as the dedicated _STANDBY sentinel so the caller skips the
+        # update cleanly.
+        if proc.returncode == 2:
+            return _STANDBY  # type: ignore[return-value]
         # smartctl returns non-zero on warnings (bit 0x40 etc.) even when
         # JSON is fully populated. Don't gate on returncode — parse the
         # body regardless.
@@ -264,8 +306,24 @@ def _try_probe(disk_name: str, probe: str) -> Optional[float]:
         return None
 
 
+# Disks that returned "standby" on their last poll. Used by the
+# /api/storage/disks endpoint to render a Standby badge so the operator
+# understands why the temperature graph for that drive is frozen — the
+# disk really is parked, not the monitor that's broken.
+_standby_state: dict[str, float] = {}  # disk_name -> last-seen timestamp
+_STANDBY_TTL = 600  # treat as stale after 10 min of no observation
+
+
+def is_disk_in_standby(disk_name: str) -> bool:
+    """True if our last smartctl poll for this disk hit a standby spindle.
+    Falls back to False when the cached observation is older than the
+    TTL — the drive may have woken up between polls."""
+    ts = _standby_state.get(disk_name)
+    return ts is not None and (time.time() - ts) < _STANDBY_TTL
+
+
 def _read_temperature(disk_name: str) -> Optional[float]:
-    """Pull the current temperature from ``smartctl -A -j``.
+    """Pull the current temperature from ``smartctl -n standby -A -j``.
 
     Caching strategy:
       * If we've previously found a working probe for this disk we go
@@ -275,6 +333,9 @@ def _read_temperature(disk_name: str) -> Optional[float]:
         and update the cache with whatever does work.
       * Disks that never report a temperature get rate-limited via the
         backoff table so we don't smartctl them every minute forever.
+      * Disks in standby return ``None`` but DON'T count toward the
+        failure backoff — they're not broken, they're just parked.
+        The standby state is recorded so the UI can show a badge.
     """
     now = time.time()
 
@@ -285,10 +346,23 @@ def _read_temperature(disk_name: str) -> Optional[float]:
     if retry_at > now:
         return None
 
+    def _handle(result):
+        """Clear failure state + record standby observation. Returns the
+        numeric temperature if the result is one (else None / standby)."""
+        if result == _STANDBY:
+            _standby_state[disk_name] = time.time()
+            return _STANDBY
+        if isinstance(result, (int, float)) and result > 0:
+            _standby_state.pop(disk_name, None)
+            return result
+        return None
+
     # Fast path: cached probe.
     if cached_probe is not None:
-        temp = _try_probe(disk_name, cached_probe)
-        if temp is not None and temp > 0:
+        temp = _handle(_try_probe(disk_name, cached_probe))
+        if temp == _STANDBY:
+            return None  # parked — skip update, don't penalise
+        if temp is not None:
             with _cache_lock:
                 _disk_fail_counts.pop(disk_name, None)
                 _disk_fail_backoff.pop(disk_name, None)
@@ -296,19 +370,29 @@ def _read_temperature(disk_name: str) -> Optional[float]:
         # Cached probe stopped working — fall through and re-detect.
 
     # Slow path: try every probe and remember the first one that works.
-    for probe in ("auto", "nvme", "ata", "sat"):
+    # For USB-attached disks we prepend the three snt* driver variants —
+    # USB-NVMe bridges (ASMedia / JMicron / Realtek) don't answer the
+    # plain probes with real SMART; only snt* passes through to the NVMe
+    # controller so temperature actually comes back. Non-USB disks skip
+    # them, so this adds zero overhead on internal drives.
+    probes: tuple[str, ...] = ("auto", "nvme", "ata", "sat")
+    if _is_disk_usb(disk_name):
+        probes = ("sntasmedia", "sntjmicron", "sntrealtek") + probes
+    for probe in probes:
         if probe == cached_probe:
             continue  # already tried above
-        temp = _try_probe(disk_name, probe)
-        if temp is not None and temp > 0:
+        temp = _handle(_try_probe(disk_name, probe))
+        if temp == _STANDBY:
+            return None
+        if temp is not None:
             with _cache_lock:
                 _disk_probe_cache[disk_name] = probe
                 _disk_fail_counts.pop(disk_name, None)
                 _disk_fail_backoff.pop(disk_name, None)
             return temp
 
-    # All probes failed. Bump the failure counter and trip the backoff
-    # if we've crossed the threshold.
+    # All probes failed (none returned a temperature OR standby). Bump
+    # the failure counter and trip the backoff if threshold crossed.
     with _cache_lock:
         n = _disk_fail_counts.get(disk_name, 0) + 1
         _disk_fail_counts[disk_name] = n
diff --git a/AppImage/scripts/flask_notification_routes.py b/AppImage/scripts/flask_notification_routes.py
index 0e822ada..940ebeda 100644
--- a/AppImage/scripts/flask_notification_routes.py
+++ b/AppImage/scripts/flask_notification_routes.py
@@ -266,6 +266,74 @@ def save_notification_settings():
         return jsonify({'error': f'Internal error ({type(e).__name__})'}), 500
 
 
+@notification_bp.route('/api/notifications/reveal-secret', methods=['POST'])
+@require_auth
+def reveal_notification_secret():
+    """Return one sensitive config value in cleartext.
+
+    Backs the "eye" toggle in the Settings UI. The settings GET masks
+    every entry in SENSITIVE_KEYS with `'************'` so the secret
+    never leaves the server just because someone loaded the page; this
+    endpoint lets an authenticated operator explicitly request the
+    real value for a single key when they need to inspect it.
+
+    Body schema (one of):
+        {"ai_provider": "groq" | "anthropic" | …}
+        {"channel": "telegram", "field": "bot_token"}
+        {"key": "webhook_secret"}
+
+    Returns ``{"value": "<cleartext>"}`` or 404 when nothing is stored.
+    400 on a malformed request, 403 if the requested key isn't on the
+    whitelist (i.e. the UI is asking for something we never agreed to
+    expose — defence against a future bug binding the eye to a
+    non-secret field).
+    """
+    try:
+        from notification_manager import SENSITIVE_KEYS
+        nm = notification_manager  # singleton already imported at module top
+
+        payload = request.get_json(silent=True) or {}
+
+        # Resolve the requested config key from the three accepted
+        # body shapes. Whitelist-checked below before we touch the DB.
+        cfg_key = None
+        provider = (payload.get('ai_provider') or '').strip().lower()
+        channel = (payload.get('channel') or '').strip().lower()
+        field = (payload.get('field') or '').strip().lower()
+        raw_key = (payload.get('key') or '').strip()
+
+        if provider:
+            cfg_key = f'ai_api_key_{provider}'
+        elif channel and field:
+            cfg_key = f'{channel}.{field}'
+        elif raw_key:
+            cfg_key = raw_key
+
+        if not cfg_key:
+            return jsonify({'error': 'missing_target'}), 400
+
+        # Whitelist enforcement — never reveal a value the rest of the
+        # system doesn't recognise as a secret. Stops a hypothetical
+        # future bug where the UI passes a non-secret config key and
+        # we hand back something we shouldn't.
+        if cfg_key not in SENSITIVE_KEYS:
+            return jsonify({'error': 'forbidden_key'}), 403
+
+        # Read the raw value through notification_manager (loads + caches
+        # the config). Mask placeholder is the same string the GET would
+        # return — treat that as "not stored" so we don't echo it back.
+        if not nm._config:
+            nm._load_config()
+        value = nm._config.get(cfg_key, '') or ''
+        if not value or value == '************':
+            return jsonify({'value': ''}), 200
+
+        return jsonify({'value': value}), 200
+    except Exception as e:
+        print(f"[notification_routes] {request.path} failed: {type(e).__name__}: {e}")
+        return jsonify({'error': f'Internal error ({type(e).__name__})'}), 500
+
+
 @notification_bp.route('/api/notifications/test', methods=['POST'])
 @require_auth
 def test_notification():
@@ -721,23 +789,108 @@ _PVE_OUR_HEADERS = {
 }
 
 
-def _pve_webhook_url() -> str:
-    """Return http:// or https:// based on the current SSL config.
+def _ssl_cert_hostname(cert_path: str) -> str:
+    """Pull the most useful hostname out of an x509 cert.
 
-    Hardcoded `http://...` previously broke webhook delivery whenever the
-    user enabled SSL — Flask only listened on HTTPS, so PVE got connection
-    refused and notifications stopped. Issue #194. PVE may still need
-    `update-ca-certificates` if the cert is self-signed; that's a doc
-    step on the user side.
+    Preference order: first DNS SAN → CN. Returns '' on any failure.
+    Used to build a webhook URL that won't fail PVE's TLS verification
+    (issue #239 — PVE has no `--insecure` flag and the user's ACME cert
+    is bound to a hostname, not to `127.0.0.1`).
+    """
+    try:
+        import subprocess
+        out = subprocess.run(
+            ['openssl', 'x509', '-in', cert_path, '-noout',
+             '-ext', 'subjectAltName', '-subject'],
+            capture_output=True, text=True, timeout=5,
+        )
+        if out.returncode != 0:
+            return ''
+        text = out.stdout or ''
+        # SAN line example: "    DNS:pve.example.com, DNS:pve, IP Address:..."
+        import re
+        for line in text.splitlines():
+            m = re.search(r'DNS:([A-Za-z0-9.\-]+)', line)
+            if m:
+                return m.group(1)
+        # CN fallback. "subject= CN = pve.example.com" or "...CN=pve.example.com"
+        m = re.search(r'CN\s*=\s*([A-Za-z0-9.\-]+)', text)
+        if m:
+            return m.group(1)
+    except Exception:
+        pass
+    return ''
+
+
+def _hostname_resolves_locally(hostname: str) -> bool:
+    """True when `hostname` resolves to one of this host's own IPs.
+
+    Anti-misconfig: refuse to build a webhook URL that points
+    elsewhere (a stale DNS entry pointing at the previous host, a CN
+    that names a different node in the cluster, etc.). PVE delivers
+    webhooks from the same node, so the URL has to round-trip to
+    ourselves.
+    """
+    try:
+        import socket
+        import ipaddress
+        target_ips = set()
+        for info in socket.getaddrinfo(hostname, None):
+            ip = info[4][0]
+            target_ips.add(ipaddress.ip_address(ip).compressed)
+        # Collect our own IPs from /proc/net/fib_trie isn't portable; use
+        # psutil if available, otherwise fall back to socket on the
+        # hostname itself.
+        local_ips = {'127.0.0.1', '::1'}
+        try:
+            import psutil
+            for _iface, addrs in psutil.net_if_addrs().items():
+                for a in addrs:
+                    if a.family in (socket.AF_INET, socket.AF_INET6):
+                        local_ips.add(ipaddress.ip_address(a.address.split('%')[0]).compressed)
+        except Exception:
+            pass
+        return bool(target_ips & local_ips)
+    except Exception:
+        return False
+
+
+def _pve_webhook_url() -> str:
+    """Return the URL we register with PVE as our webhook target.
+
+    Three branches:
+      1. SSL off → http://127.0.0.1:8008 (always works, no cert).
+      2. SSL on + cert hostname extractable and resolves locally →
+         https://<cert-hostname>:8008. This is what PVE's TLS layer
+         actually validates against. Without this, PVE rejects the
+         self/ACME cert with "IP address mismatch" (issue #239).
+      3. SSL on but hostname extraction/check failed → fall back to
+         https://127.0.0.1:8008 and accept that the user may still
+         hit the cert-mismatch error. We log so the operator can
+         diagnose. Better than silently emitting a wrong URL.
     """
     try:
         from auth_manager import load_ssl_config
         cfg = load_ssl_config() or {}
-        if cfg.get('enabled'):
-            return 'https://127.0.0.1:8008/api/notifications/webhook'
+        if not cfg.get('enabled'):
+            return 'http://127.0.0.1:8008/api/notifications/webhook'
+
+        cert_path = cfg.get('cert_path') or ''
+        if cert_path:
+            host = _ssl_cert_hostname(cert_path)
+            if host and _hostname_resolves_locally(host):
+                return f'https://{host}:8008/api/notifications/webhook'
+            if host:
+                print(
+                    f"[ProxMenux] webhook URL fallback to 127.0.0.1: "
+                    f"cert hostname '{host}' does not resolve to a local "
+                    f"IP — PVE will likely report a TLS verification "
+                    f"error. Fix by ensuring the FQDN resolves on this "
+                    f"host (e.g. /etc/hosts entry)."
+                )
+        return 'https://127.0.0.1:8008/api/notifications/webhook'
     except Exception:
-        pass
-    return 'http://127.0.0.1:8008/api/notifications/webhook'
+        return 'http://127.0.0.1:8008/api/notifications/webhook'
 
 
 # Backward-compat alias for callers that read this at import time. Most
@@ -1407,3 +1560,72 @@ def internal_shutdown_event():
         return jsonify({'success': True, 'event_type': event_type}), 200
     except Exception as e:
         return jsonify({'error': 'internal_error', 'detail': str(e)}), 500
+
+
+# ─── Internal Restore Event Endpoint ─────────────────────────────
+
+@notification_bp.route('/api/internal/restore-event', methods=['POST'])
+def internal_restore_event():
+    """
+    Internal endpoint called by apply_cluster_postboot.sh when the post-boot
+    dispatcher finishes. Tells the user the backgrounded restore tasks
+    (DKMS compile, apt installs, cluster apply, ...) are done so commands
+    like nvidia-smi now work.
+
+    Only accepts requests from localhost (127.0.0.1) for security.
+    """
+    # Flask bound to 0.0.0.0 receives loopback connections as the
+    # IPv4-mapped IPv6 form (`::ffff:127.0.0.1`) on dual-stack hosts,
+    # not as bare `127.0.0.1`. Unwrap the mapped IPv4 before asking the
+    # stdlib classifier so every loopback representation (v4, v6,
+    # IPv4-mapped) is accepted.
+    remote_addr = request.remote_addr or ''
+    try:
+        import ipaddress
+        addr = ipaddress.ip_address(remote_addr.split('%')[0])
+        if isinstance(addr, ipaddress.IPv6Address) and addr.ipv4_mapped is not None:
+            addr = addr.ipv4_mapped
+        is_loopback = addr.is_loopback
+    except (ValueError, TypeError):
+        is_loopback = remote_addr in ('127.0.0.1', '::1', 'localhost')
+    if not is_loopback:
+        return jsonify({'error': 'forbidden', 'detail': 'localhost only'}), 403
+
+    try:
+        data = request.get_json(silent=True) or {}
+        hostname = data.get('hostname', 'unknown')
+        guests = data.get('guests', '0')
+        stubs = data.get('stubs', '0')
+        stale_nodes = data.get('stale_nodes', '0')
+        components = data.get('components', 'none')
+        duration = data.get('duration', 'unknown')
+        # Boot sanity-check warnings surfaced by apply_cluster_postboot.sh.
+        # Empty on a clean restore; populated on the cross-version path
+        # when the sanity check found something the operator should know
+        # about (missing /lib/modules for the default kernel, no ESP
+        # configured, dangling /vmlinuz, ...).
+        warnings = data.get('warnings', '').strip()
+        severity = 'WARNING' if warnings else 'INFO'
+        warnings_block = f'\n⚠️  Boot sanity: {warnings}\n' if warnings else ''
+
+        notification_manager.emit_event(
+            event_type='system_restore_completed',
+            severity=severity,
+            data={
+                'hostname': hostname,
+                'guests': guests,
+                'stubs': stubs,
+                'stale_nodes': stale_nodes,
+                'components': components,
+                'duration': duration,
+                'warnings': warnings,
+                'warnings_block': warnings_block,
+            },
+            source='proxmenux',
+            entity='node',
+            entity_id='',
+        )
+
+        return jsonify({'success': True, 'event_type': 'system_restore_completed'}), 200
+    except Exception as e:
+        return jsonify({'error': 'internal_error', 'detail': str(e)}), 500
diff --git a/AppImage/scripts/flask_proxmenux_routes.py b/AppImage/scripts/flask_proxmenux_routes.py
index 88be68ca..df081f9b 100644
--- a/AppImage/scripts/flask_proxmenux_routes.py
+++ b/AppImage/scripts/flask_proxmenux_routes.py
@@ -40,6 +40,12 @@ TOOL_METADATA = {
     'vfio_iommu':           {'name': 'VFIO/IOMMU Passthrough',                'function': 'enable_vfio_iommu',            'version': '1.0'},
     'lvm_repair':           {'name': 'LVM PV Headers Repair',                 'function': 'repair_lvm_headers',           'version': '1.0'},
     'repo_cleanup':         {'name': 'Repository Cleanup',                    'function': 'cleanup_repos',                'version': '1.0'},
+    # 1.1 = setup_proxmox_repositories now re-applies chmod 0644 to existing
+    # .sources/.list files. Legacy users (repos created with old 0640 perms
+    # but no entry in installed_tools.json) are surfaced as v1.0 via the
+    # legacy detector in get_installed_tools() below, so the Settings page
+    # shows them an "Update available" they can apply without touching apt.
+    'proxmox_repos':        {'name': 'Proxmox APT Repositories',              'function': 'setup_proxmox_repositories',   'version': '1.1'},
     # ── Legacy / Deprecated entries ──
     # These optimizations were applied by previous ProxMenux versions but are
     # no longer needed or have been removed from the current scripts. We still
@@ -226,8 +232,15 @@ def get_installed_tools():
                 'message': 'No ProxMenux optimizations installed yet'
             })
 
-        with open(installed_tools_path, 'r') as f:
-            raw = json.load(f)
+        # Use the shared loader so both update detection and this
+        # endpoint see the same set of entries — including any
+        # synthetic v1.0 entries injected by `_apply_legacy_detectors`
+        # for tools that the host has configured but were never
+        # recorded in installed_tools.json (e.g. `proxmox_repos` on a
+        # pre-1.2.2 install). Without this, the update detector would
+        # surface a fix as available but the Settings endpoint
+        # wouldn't list the row, leaving the user nothing to click.
+        loaded = post_install_versions.load_installed_tools()
 
         # Sprint 12A: index update list by tool key for has_update lookup.
         try:
@@ -237,20 +250,11 @@ def get_installed_tools():
         update_by_key = {u['key']: u for u in piv_snapshot.get('updates', [])}
 
         tools = []
-        for tool_key, value in raw.items():
-            # Normalize legacy bool vs new structured entry.
-            if isinstance(value, bool):
-                if not value:
-                    continue
-                installed_version = '1.0'
-                source = ''
-            elif isinstance(value, dict):
-                if not value.get('installed', False):
-                    continue
-                installed_version = str(value.get('version', '1.0')) or '1.0'
-                source = str(value.get('source', '') or '')
-            else:
+        for tool_key, value in loaded.items():
+            if not value.get('installed', False):
                 continue
+            installed_version = str(value.get('version', '1.0')) or '1.0'
+            source = str(value.get('source', '') or '')
 
             # Hard-coded display metadata (display name, deprecated flag).
             meta = TOOL_METADATA.get(tool_key, {})
diff --git a/AppImage/scripts/flask_server.py b/AppImage/scripts/flask_server.py
index 60bd4667..4a484a20 100644
--- a/AppImage/scripts/flask_server.py
+++ b/AppImage/scripts/flask_server.py
@@ -40,11 +40,13 @@ import os
 import platform
 import re
 import select
+import shlex
 import shutil
 import socket
 import sqlite3
 import subprocess
 import sys
+import tempfile
 import time
 import threading
 import urllib.parse
@@ -57,7 +59,7 @@ from pathlib import Path
 
 import jwt
 import psutil
-from flask import Flask, jsonify, request, send_file, send_from_directory, Response
+from flask import Flask, jsonify, request, send_file, send_from_directory, Response, after_this_request
 from flask_cors import CORS
 
 # Ensure local imports work even if working directory changes
@@ -77,7 +79,7 @@ from flask_notification_routes import notification_bp  # noqa: E402
 from flask_oci_routes import oci_bp  # noqa: E402
 from notification_manager import notification_manager  # noqa: E402
 import post_install_versions  # noqa: E402  — Sprint 12A: detect post-install function updates
-from jwt_middleware import require_auth  # noqa: E402
+from jwt_middleware import require_auth, require_auth_or_ticket  # noqa: E402
 import auth_manager  # noqa: E402
 
 # -------------------------------------------------------------------
@@ -1253,6 +1255,12 @@ def _health_collector_loop():
                             'category': cat_name,
                             'status': cur_status,
                             'reason': reason,
+                            # `entity` lets the notification title name the
+                            # actual affected object ("Storage Tuxis") instead
+                            # of the bare category ("Storage"). Populated by
+                            # `_check_XXX` in health_monitor when a single
+                            # entity dominates; empty otherwise.
+                            'entity': cat_data.get('entity', ''),
                         })
                 
                 _prev_statuses[cat_key] = cur_status
@@ -1272,13 +1280,32 @@ def _health_collector_loop():
                 
                 if len(degraded) == 1:
                     d = degraded[0]
-                    title = f"{hostname}: Health {d['status']} - {d['category']}"
+                    # Prefer the specific entity in the title so the reader
+                    # sees WHICH object failed without opening the app.
+                    # Falls back to the category label when the check didn't
+                    # provide one (aggregate-only reasons).
+                    if d.get('entity'):
+                        title = f"{hostname}: {d['category']} {d['status']} — {d['entity']}"
+                    else:
+                        title = f"{hostname}: Health {d['status']} - {d['category']}"
                     body = d['reason']
                     severity = d['status']
                 else:
-                    # Multiple categories degraded at once -- group them
+                    # Multiple categories degraded at once -- group them.
+                    # Title lists the categories + first entity per category
+                    # so the reader can distinguish "storage + network"
+                    # from "cpu + memory" at a glance.
                     max_sev = max(degraded, key=lambda x: _SEV_RANK.get(x['status'], 0))['status']
-                    title = f"{hostname}: {len(degraded)} health checks degraded"
+                    cat_labels = []
+                    for d in degraded:
+                        label = d['category']
+                        if d.get('entity'):
+                            label = f"{label} ({d['entity']})"
+                        cat_labels.append(label)
+                    title = f"{hostname}: {len(degraded)} health checks degraded — {', '.join(cat_labels)}"
+                    # Cap title if the join went long
+                    if len(title) > 200:
+                        title = title[:197] + '…'
                     lines = []
                     for d in degraded:
                         lines.append(f"  [{d['status']}] {d['category']}: {d['reason']}")
@@ -2657,6 +2684,29 @@ def is_disk_removable(disk_name):
         return False
 
 
+def is_disk_usb(disk_name):
+    """Return True if the disk is attached via USB, using the sysfs device
+    path. Reliable for USB-attached HDDs and USB-NVMe bridges (which
+    both report `/sys/block/<disk>/removable = 0` even though they ARE
+    USB) — the previous heuristic based on the removable flag missed
+    them entirely, so snt* pass-through was never attempted and the
+    bridge's own identity + missing temperature/hours were cached.
+
+    Uses `os.path.realpath` (no subprocess) so it's cheap enough to be
+    called on every SMART probe.
+    """
+    try:
+        real = os.path.realpath(f'/sys/block/{disk_name}')
+        # sysfs path segment like `usb1`, `usb2`, ... always precedes a
+        # USB-attached block device. Match on the segment prefix rather
+        # than a substring so a directory happening to contain "usb" in
+        # its literal name can't false-positive.
+        return any(seg.startswith('usb') and (len(seg) == 3 or seg[3:].isdigit())
+                   for seg in real.split('/'))
+    except Exception:
+        return False
+
+
 def _is_system_mount(mountpoint):
     """Check if mountpoint is a critical system path (matching bash scripts logic)."""
     system_mounts = ('/', '/boot', '/boot/efi', '/efi', '/usr', '/var', '/etc', 
@@ -2988,12 +3038,25 @@ def get_storage_info():
                         is_system_disk = sys_info.get('is_system', False)
                         system_usage = sys_info.get('usage', [])
                         
+                        # `standby` reflects what the temperature poller
+                        # last observed (smartctl -n standby exit code 2).
+                        # Surfaced here so the UI can paint a "Standby"
+                        # badge and tell the operator that a frozen
+                        # temperature graph isn't a monitor bug — the
+                        # disk is parked. See issue #232.
+                        in_standby = False
+                        try:
+                            import disk_temperature_history as _dth
+                            in_standby = _dth.is_disk_in_standby(disk_name)
+                        except Exception:
+                            pass
                         physical_disks[disk_name] = {
                             'name': disk_name,
                             'size': disk_size_kb,  # In KB for formatMemory() in Storage Summary
                             'size_formatted': size_str,  # Added formatted size string for Storage section
                             'size_bytes': disk_size_bytes,
                             'temperature': smart_data.get('temperature', 0),
+                            'standby': in_standby,
                             'health': smart_data.get('health', 'unknown'),
                             'power_on_hours': smart_data.get('power_on_hours', 0),
                             'smart_status': smart_data.get('smart_status', 'unknown'),
@@ -3567,6 +3630,15 @@ def _smart_default_payload() -> dict:
         'family': None,
         'sata_version': None,
         'form_factor': None,
+        # Internal flag — True if smartctl confirmed the disk type
+        # (HDD with RPM, or SSD via "Solid State Device" / JSON
+        # rotation_rate=0). Stripped before the dict reaches the API.
+        # Drives the kernel /sys/.../rotational fallback: that path is
+        # only safe when smartctl had NO opinion, because USB-SATA
+        # enclosures (ASM105x etc.) advertise rotational=1 to the
+        # kernel even when the drive behind them is an SSD that
+        # smartctl can correctly identify via SAT passthrough.
+        '_rotation_known': False,
     }
 
 
@@ -3646,6 +3718,28 @@ def _get_smart_data_uncached(disk_name):
             ['smartctl', '-a', '-d', 'sat,16', f'/dev/{disk_name}'],  # Text SAT with 16-byte commands
         ]
 
+        # USB-NVMe bridges (ASMedia ASM2362/ASM2464PD, JMicron JMS583/JMS586,
+        # Realtek RTL9210): the plain `-a` variant answers with the *bridge*
+        # identity (e.g. "ASMT 2462 NVME") and no temperature, because the
+        # bridge exposes itself as generic USB storage. Only `-d snt*`
+        # passes through to the actual NVMe controller and returns real
+        # model, serial, temperature and health.
+        #
+        # For USB-attached disks we prepend the three snt* variants so
+        # the cascade tries them FIRST — otherwise the plain variant
+        # "succeeds" (>50 chars of bridge chatter), the probe cache locks
+        # it in, and temperature is never seen. USB detection is by sysfs
+        # path (`is_disk_usb`) rather than the `removable` flag: USB-NVMe
+        # bridges and USB-HDDs both report `removable=0` even though they
+        # ARE USB, so the older `is_disk_removable` check missed them.
+        # For internal SATA/NVMe the cascade is unchanged (zero regression).
+        if is_disk_usb(disk_name) or is_disk_removable(disk_name):
+            all_commands = [
+                ['smartctl', '-a', '-j', '-d', 'sntasmedia', f'/dev/{disk_name}'],
+                ['smartctl', '-a', '-j', '-d', 'sntjmicron', f'/dev/{disk_name}'],
+                ['smartctl', '-a', '-j', '-d', 'sntrealtek', f'/dev/{disk_name}'],
+            ] + all_commands
+
         # Probe-cache: if we already know which command works for this
         # disk, try that first. The fallback chain is still kept after
         # in case the cached probe stops working (kernel upgrade swapped
@@ -3702,6 +3796,7 @@ def _get_smart_data_uncached(disk_name):
                             
                             if 'rotation_rate' in data:
                                 smart_data['rotation_rate'] = data['rotation_rate']
+                                smart_data['_rotation_known'] = True
 
                             
                             # Extract SMART status
@@ -3895,19 +3990,17 @@ def _get_smart_data_uncached(disk_name):
                                 # print(f"[v0] Found serial: {smart_data['serial']}")
                                 pass
                             
-                            elif line.startswith('Rotation Rate:') and smart_data['rotation_rate'] == 0:
+                            elif line.startswith('Rotation Rate:') and not smart_data['_rotation_known']:
                                 rate_str = line.split(':', 1)[1].strip()
                                 if 'rpm' in rate_str.lower():
                                     try:
                                         smart_data['rotation_rate'] = int(rate_str.split()[0])
-                                        # print(f"[v0] Found rotation rate: {smart_data['rotation_rate']} RPM")
-                                        pass
+                                        smart_data['_rotation_known'] = True
                                     except (ValueError, IndexError):
                                         pass
                                 elif 'Solid State Device' in rate_str:
                                     smart_data['rotation_rate'] = 0  # SSD
-                                    # print(f"[v0] Found SSD (no rotation)")
-                                    pass
+                                    smart_data['_rotation_known'] = True
                             
                             # SMART status detection
                             elif 'SMART overall-health self-assessment test result:' in line:
@@ -4118,21 +4211,27 @@ def _get_smart_data_uncached(disk_name):
             elif temp > warn:
                 smart_data['health'] = 'warning'
 
-        # CHANGE: Use -1 to indicate HDD with unknown RPM instead of inventing 7200 RPM
-        # Fallback: Check kernel's rotational flag if smartctl didn't provide rotation_rate
-        # This fixes detection for older disks that don't report RPM via smartctl
-        if smart_data['rotation_rate'] == 0:
+        # Fallback: ask the kernel only when smartctl had no opinion.
+        # USB-SATA enclosures (ASM105x family etc.) advertise
+        # rotational=1 to the kernel even when there's an SSD behind
+        # them, so trusting /sys here without first checking what
+        # smartctl said would flip a correctly-identified SSD back to
+        # HDD. The previous condition (`rotation_rate == 0`) couldn't
+        # tell "smartctl confirmed SSD" from "smartctl never spoke",
+        # which is what bit the OCZ-SOLID2 behind an ASM105x dock on
+        # the lab host (sdd showed as HDD in the UI while smartctl
+        # was reporting it as SSD).
+        if not smart_data['_rotation_known']:
             try:
                 rotational_path = f"/sys/block/{disk_name}/queue/rotational"
                 if os.path.exists(rotational_path):
                     with open(rotational_path, 'r') as f:
                         rotational = int(f.read().strip())
                         if rotational == 1:
-                            # Disk is rotational (HDD), use -1 to indicate "HDD but RPM unknown"
-                            smart_data['rotation_rate'] = -1
-                        # If rotational == 0, it's an SSD, keep rotation_rate as 0
-            except Exception as e:
-                pass  # If we can't read the file, leave rotation_rate as is
+                            smart_data['rotation_rate'] = -1  # HDD, RPM unknown
+            except Exception:
+                pass
+        smart_data.pop('_rotation_known', None)
 
             
     except FileNotFoundError:
@@ -4407,6 +4506,212 @@ def api_storage_observations():
     except Exception as e:
         return jsonify({'observations': [], 'error': str(e)}), 500
 
+# ─── Background sampler ────────────────────────────────────────
+# A daemon thread polls psutil every 2 s and feeds the per-NIC rate
+# cache. This way the very first /api/network HTTP request after a
+# page load already has enough history to return a rate — no more
+# 15-20 s "waiting for data" on the Network Flow card.
+def _net_rate_sampler_loop():
+    # Fast bootstrap: take TWO samples 1 s apart so the very first
+    # /api/network response (which may arrive in under a second of the
+    # service starting) already has a valid delta to derive rates
+    # from. After that, normal 2 s cadence.
+    try:
+        io = psutil.net_io_counters(pernic=True)
+        _compute_per_nic_rates_live(io)
+        time.sleep(1.0)
+        io = psutil.net_io_counters(pernic=True)
+        _compute_per_nic_rates_live(io)
+    except Exception:
+        pass
+    while True:
+        try:
+            io = psutil.net_io_counters(pernic=True)
+            _compute_per_nic_rates_live(io)
+        except Exception:
+            pass
+        time.sleep(2.0)
+
+_NET_RATE_SAMPLER_STARTED = False
+def _ensure_net_rate_sampler():
+    global _NET_RATE_SAMPLER_STARTED
+    if _NET_RATE_SAMPLER_STARTED:
+        return
+    _NET_RATE_SAMPLER_STARTED = True
+    t = _net_threading.Thread(target=_net_rate_sampler_loop, daemon=True)
+    t.start()
+
+
+# Start the sampler immediately at module load — the dashboard can
+# now ask for rates from its very first poll, instead of waiting for
+# its own request to bootstrap the cache.
+try:
+    _ensure_net_rate_sampler()
+except Exception:
+    pass
+
+
+# ─── Per-NIC live rate (moving window) ──────────────────────────
+# Keep the last ~30s of byte counters and derive the rate from the
+# oldest-vs-newest sample. This is robust against bursty traffic
+# (where a single poll may see 0 bytes between packets) — the window
+# spans multiple poll periods so the rate stays above zero as long
+# as traffic flowed at any point inside it.
+import threading as _net_threading
+_NET_RATE_LOCK = _net_threading.Lock()
+_NET_RATE_HISTORY = {}        # iface → list[(t, rx_bytes, tx_bytes)]
+_NET_RATE_WINDOW_TARGET_S = 5.0    # rate is averaged over this many seconds
+                                   # — short window = near-instant feedback
+                                   # so a Network Flow display matches what
+                                   # the guest itself reports in real time.
+_NET_RATE_WINDOW_MAX_S = 60.0      # samples older than this are discarded
+_NET_RATE_MAX_SAMPLES = 60
+_NET_RATE_STICKY = {}              # iface → {rx: last_nonzero_rx, tx, t}
+_NET_RATE_STICKY_TTL_S = 3600.0    # 1 h — effectively keep the last seen
+                                   # non-zero rate visible until the iface
+                                   # disappears (VM stopped) or 1 h passes.
+                                   # The Network Flow card must NEVER show
+                                   # a "live" guest dropping to 0 just
+                                   # because there's a brief silence.
+
+def _compute_per_nic_rates_live(net_io_per_nic):
+    """Return ``{iface: {rx_Bps, tx_Bps}}`` averaged over ~30 s of
+    history. If the calculated rate dips to 0 but we saw nonzero
+    traffic within the last STICKY_TTL seconds, return that recent
+    value instead — bursty NICs (especially the WAN uplink) flicker
+    between bursts and we don't want the diagram blinking to 0.
+    """
+    now = time.time()
+    rates = {}
+    with _NET_RATE_LOCK:
+        for iface, io in net_io_per_nic.items():
+            hist = _NET_RATE_HISTORY.setdefault(iface, [])
+            cutoff = now - _NET_RATE_WINDOW_MAX_S
+            hist = [s for s in hist if s[0] >= cutoff]
+            hist.append((now, io.bytes_recv, io.bytes_sent))
+            if len(hist) > _NET_RATE_MAX_SAMPLES:
+                hist = hist[-_NET_RATE_MAX_SAMPLES:]
+            _NET_RATE_HISTORY[iface] = hist
+            if len(hist) < 2:
+                continue
+            # Find the first sample that is at least WINDOW_TARGET_S
+            # old. If none exist (e.g. service just restarted, history
+            # is still warming up), fall back to the OLDEST available
+            # sample — gives the widest possible window so the rate is
+            # still computable instead of yielding window=0.
+            #
+            # Bug fix: the previous loop set ``oldest = s`` on EVERY
+            # iteration, so when no sample qualified it ended up
+            # pointing to the newest one — window=0 → continue → no
+            # rate ever published until 30 s of history accumulated.
+            # Result: visible "drops to 0" each time the cache thinned.
+            oldest = hist[0]
+            for s in hist:
+                if now - s[0] >= _NET_RATE_WINDOW_TARGET_S:
+                    oldest = s
+                    break
+            window = now - oldest[0]
+            if window <= 0:
+                continue
+            rx_rate = max(0, io.bytes_recv - oldest[1]) / window
+            tx_rate = max(0, io.bytes_sent - oldest[2]) / window
+            # Sticky last-nonzero values to avoid 0-flicker.
+            sticky = _NET_RATE_STICKY.setdefault(iface, {'rx': 0.0, 'tx': 0.0, 't': 0.0})
+            if rx_rate > 0:
+                sticky['rx'] = rx_rate
+                sticky['t'] = now
+            elif now - sticky['t'] < _NET_RATE_STICKY_TTL_S and sticky['rx'] > 0:
+                rx_rate = sticky['rx']
+            if tx_rate > 0:
+                sticky['tx'] = tx_rate
+                sticky['t'] = now
+            elif now - sticky['t'] < _NET_RATE_STICKY_TTL_S and sticky['tx'] > 0:
+                tx_rate = sticky['tx']
+            rates[iface] = {
+                'rx_Bps': round(rx_rate, 2),
+                'tx_Bps': round(tx_rate, 2),
+            }
+    return rates
+
+
+# ─── Resolve the bridge each interface belongs to ─────────────
+# /sys/class/net/<iface>/master is a symlink pointing to the master
+# device (bridge or bond). This is the kernel's authoritative source.
+def _iface_master(iface_name):
+    try:
+        master_path = f'/sys/class/net/{iface_name}/master'
+        if os.path.islink(master_path):
+            return os.path.basename(os.readlink(master_path))
+    except Exception:
+        pass
+    return None
+
+
+# Walks through Proxmox firewall bridges (fwbrXXX) to reach the real
+# vmbr. With firewall on, a VM's veth100i0 lands on fwbr100i0; the
+# real vmbr is reached via the matching fwpr100p0 sitting in vmbr0.
+# Chain: veth/tap → fwbr (intermediate) → fwpr (peer) → vmbr (real).
+def _resolve_bridge_owner(iface_name):
+    import re
+    master = _iface_master(iface_name)
+    if not master:
+        return None
+    if master.startswith('fwbr'):
+        fwpr = re.sub(r'^fwbr', 'fwpr', master)
+        fwpr = re.sub(r'i(\d+)$', r'p\1', fwpr)
+        try:
+            if os.path.exists(f'/sys/class/net/{fwpr}'):
+                real = _iface_master(fwpr)
+                if real:
+                    return real
+        except Exception:
+            pass
+    return master
+
+
+# ─── ethtool: max link speed per NIC ────────────────────────────
+# Parses "Supported link modes:" — the highest baseT value is the
+# hardware ceiling. Cached per-iface because subprocess + parse runs
+# ~150-500 ms per NIC, and Supported link modes essentially never
+# changes for a given NIC at runtime.
+_ETHTOOL_MAX_CACHE = {}
+def _ethtool_max_speed(iface_name):
+    if iface_name in _ETHTOOL_MAX_CACHE:
+        return _ETHTOOL_MAX_CACHE[iface_name]
+    try:
+        import subprocess, re
+        result = subprocess.run(
+            ['ethtool', iface_name],
+            capture_output=True, text=True, timeout=2,
+        )
+        if result.returncode != 0:
+            _ETHTOOL_MAX_CACHE[iface_name] = 0
+            return 0
+        max_speed = 0
+        in_supported = False
+        for line in result.stdout.splitlines():
+            stripped = line.strip()
+            if 'Supported link modes' in stripped:
+                in_supported = True
+                tail = stripped.split(':', 1)[1].strip() if ':' in stripped else ''
+                tokens = tail.split()
+            elif in_supported and line.startswith((' ', '\t')) and ':' not in stripped:
+                tokens = stripped.split()
+            else:
+                in_supported = False
+                tokens = []
+            for tok in tokens:
+                m = re.match(r'(\d+)base', tok)
+                if m:
+                    val = int(m.group(1))
+                    if val > max_speed:
+                        max_speed = val
+        _ETHTOOL_MAX_CACHE[iface_name] = max_speed
+        return max_speed
+    except Exception:
+        return 0
+
+
 def get_interface_type(interface_name):
     """Detect the type of network interface"""
     try:
@@ -4609,6 +4914,15 @@ def get_network_info():
             # print(f"[v0] Error getting per-NIC stats: {e}")
             pass
             net_io_per_nic = {}
+
+        # Per-interface live rate (bytes/sec) computed from delta vs the
+        # previous call to this endpoint. The dashboard polls /api/network
+        # on a fixed cadence, so the delta between two polls is the rate
+        # the user actually wants to see — no extra sleep needed.
+        # Cache lives at module scope; staleness is bounded so a paused
+        # tab + late refresh doesn't return absurd jumps as "rate".
+        _ensure_net_rate_sampler()
+        per_nic_rates = _compute_per_nic_rates_live(net_io_per_nic)
         
         physical_active_count = 0
         physical_total_count = 0
@@ -4695,7 +5009,37 @@ def get_network_info():
                 interface_info['errors_out'] = io_stats.errout
                 interface_info['drops_in'] = io_stats.dropin
                 interface_info['drops_out'] = io_stats.dropout
+
+                # Live rate (B/s) from delta-since-last-call. Same
+                # vm_lxc-orientation flip as the cumulative bytes
+                # above — the host sees a VM's "send" as the bridge's
+                # "receive", so we invert when surfacing the rate from
+                # the VM's perspective.
+                rate = per_nic_rates.get(interface_name)
+                if rate:
+                    if interface_type == 'vm_lxc':
+                        interface_info['rx_Bps'] = rate['tx_Bps']
+                        interface_info['tx_Bps'] = rate['rx_Bps']
+                    else:
+                        interface_info['rx_Bps'] = rate['rx_Bps']
+                        interface_info['tx_Bps'] = rate['tx_Bps']
             
+            if interface_type == 'physical':
+                # Hardware ceiling from ethtool; UI shows it next to the
+                # negotiated speed when the two differ.
+                max_speed = _ethtool_max_speed(interface_name)
+                if max_speed:
+                    interface_info['max_speed'] = max_speed
+
+            # Master device (bridge or bond) — for tap*/veth*/bond
+            # interfaces this is the bridge they're enslaved to.
+            # We walk through any intermediate fwbr to reach the real
+            # vmbr so a guest behind the Proxmox firewall still lands
+            # under its true bridge in the Network Flow diagram.
+            master = _resolve_bridge_owner(interface_name)
+            if master:
+                interface_info['bridge_owner'] = master
+
             if interface_type == 'bond':
                 bond_info = get_bond_info(interface_name)
                 interface_info['bond_mode'] = bond_info['mode']
@@ -4728,6 +5072,24 @@ def get_network_info():
         network_data['bridge_total_count'] = bridge_total_count
         network_data['vm_lxc_active_count'] = vm_lxc_active_count
         network_data['vm_lxc_total_count'] = vm_lxc_total_count
+
+        # Map physical NICs ↔ bridges using them. For a bridge with a
+        # direct NIC parent, that NIC gets the bridge in its list. For
+        # bridges sitting on top of a bond, every bond slave gets the
+        # bridge listed too.
+        bridges_per_nic = {}
+        for bridge in network_data['bridge_interfaces']:
+            phys = bridge.get('bridge_physical_interface') or ''
+            if not phys:
+                continue
+            if phys.startswith('bond'):
+                for slave in bridge.get('bridge_bond_slaves') or []:
+                    bridges_per_nic.setdefault(slave, []).append(bridge['name'])
+            else:
+                bridges_per_nic.setdefault(phys, []).append(bridge['name'])
+        for phy in network_data['physical_interfaces']:
+            if phy['name'] in bridges_per_nic:
+                phy['used_by_bridges'] = bridges_per_nic[phy['name']]
         
         # print(f"[v0] Physical interfaces: {physical_active_count} active out of {physical_total_count} total")
         pass
@@ -7715,6 +8077,418 @@ def api_system():
         pass
         return jsonify({'error': str(e)}), 500
 
+@app.route('/api/processes', methods=['GET'])
+@require_auth
+def api_processes():
+    """Top processes for the CPU Usage / Memory "more info" modals.
+
+    Reads /proc/<pid>/stat (and friends) directly with two passes 1 s
+    apart for CPU delta. Per-process aggregation (one row per process —
+    a multi-vCPU VM shows the sum of its kvm threads under one PID).
+
+    Skipping the psutil object layer cuts the endpoint's own CPU cost
+    roughly 5×, so when the monitor process appears in the list it
+    reports a much more honest reading of its real impact instead of
+    the inflated value the heavier psutil iteration was producing.
+
+    Query: sort=cpu|mem, limit=1..100 (default 20).
+    """
+    try:
+        sort = request.args.get('sort', 'cpu')
+        if sort not in ('cpu', 'mem'):
+            sort = 'cpu'
+        try:
+            # Cap raised to 500 so the modal can over-fetch and let the
+            # client-side filter find processes that aren't in the top-N
+            # by metric (e.g., searching "proxmenux" in the Memory modal
+            # finds it even though its RSS is far from the top).
+            limit = max(1, min(int(request.args.get('limit', 20)), 500))
+        except (TypeError, ValueError):
+            limit = 20
+
+        import pwd
+
+        SC_CLK_TCK = os.sysconf('SC_CLK_TCK') or 100
+        try:
+            PAGE_SIZE_KB = os.sysconf('SC_PAGE_SIZE') // 1024 or 4
+        except (ValueError, OSError):
+            PAGE_SIZE_KB = 4
+        # We normalize CPU% to the host total (matches the CPU Usage card
+        # on the dashboard, so users can compare the two directly without
+        # thinking about per-core vs whole-system scales).
+        NCPU = os.cpu_count() or 1
+
+        # Total memory (kB) — denominator for mem_pct
+        total_kb = 0
+        try:
+            with open('/proc/meminfo') as f:
+                for line in f:
+                    if line.startswith('MemTotal:'):
+                        total_kb = int(line.split()[1])
+                        break
+        except OSError:
+            pass
+
+        user_cache = {}
+        def _user_name(uid):
+            if uid in user_cache:
+                return user_cache[uid]
+            try:
+                name = pwd.getpwuid(uid).pw_name
+            except KeyError:
+                name = str(uid)
+            user_cache[uid] = name
+            return name
+
+        def _list_pids():
+            try:
+                for entry in os.listdir('/proc'):
+                    if entry.isdigit():
+                        yield int(entry)
+            except OSError:
+                return
+
+        def _read_cpu_time(pid):
+            """Just utime+stime in clock ticks. Cheapest possible read."""
+            try:
+                with open(f'/proc/{pid}/stat', 'rb') as f:
+                    line = f.read()
+            except (OSError, FileNotFoundError):
+                return None
+            rpar = line.rfind(b')')
+            if rpar < 0:
+                return None
+            rest = line[rpar + 2:].split()
+            try:
+                return int(rest[11]) + int(rest[12])
+            except (IndexError, ValueError):
+                return None
+
+        def _read_meta(pid):
+            """Returns (comm, ppid, num_threads, rss_kb, uid, cmdline) or None."""
+            try:
+                with open(f'/proc/{pid}/stat', 'rb') as f:
+                    line = f.read()
+            except (OSError, FileNotFoundError):
+                return None
+            lpar = line.find(b'(')
+            rpar = line.rfind(b')')
+            if lpar < 0 or rpar < 0:
+                return None
+            comm = line[lpar + 1:rpar].decode('utf-8', 'replace')
+            rest = line[rpar + 2:].split()
+            try:
+                ppid = int(rest[1])
+            except (IndexError, ValueError):
+                ppid = 0
+
+            rss_kb = 0
+            try:
+                with open(f'/proc/{pid}/statm') as f:
+                    rss_kb = int(f.read().split()[1]) * PAGE_SIZE_KB
+            except (OSError, FileNotFoundError, IndexError, ValueError):
+                pass
+
+            uid = 0
+            try:
+                with open(f'/proc/{pid}/status') as f:
+                    for ln in f:
+                        if ln.startswith('Uid:'):
+                            uid = int(ln.split()[1])
+                            break
+            except (OSError, FileNotFoundError, IndexError, ValueError):
+                pass
+
+            cmdline = ''
+            try:
+                with open(f'/proc/{pid}/cmdline', 'rb') as f:
+                    raw = f.read()
+                if raw:
+                    cmdline = raw.replace(b'\x00', b' ').strip().decode('utf-8', 'replace')
+            except (OSError, FileNotFoundError):
+                pass
+
+            return (comm, ppid, rss_kb, uid, cmdline)
+
+        if sort == 'cpu':
+            # System uptime — denominator for cpu_avg (CPU% averaged
+            # over the entire lifetime of the process). Used to
+            # surface long-running idle processes that don't show up
+            # in the 1-s delta (e.g. an orphaned `bash -s` that loops
+            # with `sleep 5` between iterations — averaged it's 4 %
+            # of one core for weeks, instantaneously it samples 0).
+            try:
+                with open('/proc/uptime') as f:
+                    host_uptime_sec = float(f.read().split()[0])
+            except (OSError, ValueError):
+                host_uptime_sec = 0.0
+
+            # Pass 1: snapshot CPU time for every running PID.
+            snap1 = {pid: _read_cpu_time(pid) for pid in _list_pids()}
+            snap1 = {k: v for k, v in snap1.items() if v is not None}
+
+            time.sleep(1.0)
+
+            # Pass 2: re-read CPU time, compute delta, plus metadata.
+            results = []
+            for pid in _list_pids():
+                now = _read_cpu_time(pid)
+                if now is None:
+                    continue
+                prior = snap1.get(pid)
+                if prior is None:
+                    # Process started during the sample window — skip
+                    # (no baseline to delta against).
+                    continue
+                meta = _read_meta(pid)
+                if meta is None:
+                    continue
+                comm, _ppid, rss_kb, uid, cmdline = meta
+                delta_jiffies = max(0, now - prior)
+                # delta_jiffies / clock_tps = CPU seconds used in the 1 s
+                # window. Dividing by NCPU expresses it as a fraction of
+                # the whole host (so values line up with the CPU Usage
+                # card — 1 % in the modal == 1 % of the host total).
+                cpu_pct = round((delta_jiffies / SC_CLK_TCK) * 100 / NCPU, 1)
+
+                # cpu_avg — proportion of host CPU this process has
+                # consumed across its entire lifetime. Read the
+                # per-process start time from /proc/<pid>/stat (field
+                # 21, in ticks since boot) and turn it into seconds via
+                # host_uptime - start_seconds. Falls back to 0.0 when
+                # start time isn't readable (kernel threads, perms).
+                cpu_avg = 0.0
+                try:
+                    with open(f'/proc/{pid}/stat', 'rb') as f:
+                        st_line = f.read()
+                    st_rpar = st_line.rfind(b')')
+                    st_rest = st_line[st_rpar + 2:].split()
+                    starttime_ticks = int(st_rest[19])  # field 22 minus the 2 skipped after comm
+                    proc_uptime_sec = max(1.0, host_uptime_sec - (starttime_ticks / SC_CLK_TCK))
+                    cpu_avg = round((now / SC_CLK_TCK) * 100 / NCPU / proc_uptime_sec, 1)
+                except (OSError, FileNotFoundError, IndexError, ValueError):
+                    pass
+
+                mem_pct = round((rss_kb / total_kb * 100) if total_kb else 0.0, 1)
+                results.append({
+                    'pid': pid,
+                    'parent_pid': pid,
+                    'user': _user_name(uid),
+                    'cpu': cpu_pct,
+                    'cpu_avg': cpu_avg,
+                    'mem': mem_pct,
+                    'rss_kb': rss_kb,
+                    'command': comm,
+                    'cmdline': cmdline or comm,
+                })
+
+            # Sort by the larger of (now, avg) so a process is
+            # captured whether it's spiking right now OR running an
+            # always-on baseline. Without this an orphan bash loop
+            # never made the top-N and the operator had no UI
+            # surface to find it.
+            results.sort(key=lambda r: max(r['cpu'], r.get('cpu_avg', 0.0)), reverse=True)
+            processes = results[:limit]
+
+        else:
+            # Memory sort: single pass, no delta needed.
+            results = []
+            for pid in _list_pids():
+                meta = _read_meta(pid)
+                if meta is None:
+                    continue
+                comm, _ppid, rss_kb, uid, cmdline = meta
+                mem_pct = round((rss_kb / total_kb * 100) if total_kb else 0.0, 1)
+                results.append({
+                    'pid': pid,
+                    'parent_pid': pid,
+                    'user': _user_name(uid),
+                    'cpu': 0.0,
+                    'mem': mem_pct,
+                    'rss_kb': rss_kb,
+                    'command': comm,
+                    'cmdline': cmdline or comm,
+                })
+            results.sort(key=lambda r: r['mem'], reverse=True)
+            processes = results[:limit]
+
+        return jsonify({
+            'processes': processes,
+            'sort': sort,
+            'captured_at': int(time.time()),
+        })
+    except Exception as e:
+        return jsonify({'error': str(e)}), 500
+
+
+@app.route('/api/processes/<int:pid>', methods=['GET'])
+@require_auth
+def api_process_detail(pid):
+    """Detailed info for a single process read from /proc/<pid>/.
+
+    Called from the Top-process row-click → detail modal. Lazy: only
+    hit when the user explicitly clicks a row, then refreshed inside
+    the modal every few seconds while it's open.
+    """
+    import pwd, grp
+    try:
+        proc_path = f'/proc/{pid}'
+        if not os.path.isdir(proc_path):
+            return jsonify({'error': 'Process not found', 'pid': pid}), 404
+
+        info = {'pid': pid}
+
+        # Short name + full argv
+        try:
+            with open(f'{proc_path}/comm') as f:
+                info['comm'] = f.read().strip()
+        except Exception:
+            info['comm'] = None
+        try:
+            with open(f'{proc_path}/cmdline', 'rb') as f:
+                raw = f.read()
+            # argv null-byte separated; drop trailing null
+            info['cmdline'] = raw.replace(b'\0', b' ').strip().decode('utf-8', 'replace')
+        except Exception:
+            info['cmdline'] = None
+
+        # Symlinks (may EACCES for kernel threads / other namespaces)
+        try:
+            info['exe'] = os.readlink(f'{proc_path}/exe')
+        except (OSError, PermissionError):
+            info['exe'] = None
+        try:
+            info['cwd'] = os.readlink(f'{proc_path}/cwd')
+        except (OSError, PermissionError):
+            info['cwd'] = None
+
+        # /proc/<pid>/status (Vm* sizes, State, PPid, Threads, Uid, Gid)
+        status = {}
+        try:
+            with open(f'{proc_path}/status') as f:
+                for line in f:
+                    if ':' in line:
+                        k, v = line.split(':', 1)
+                        status[k.strip()] = v.strip()
+        except Exception:
+            pass
+
+        info['state'] = status.get('State', '')
+        try:
+            info['ppid'] = int(status.get('PPid', '0'))
+        except (ValueError, TypeError):
+            info['ppid'] = 0
+        try:
+            info['threads'] = int(status.get('Threads', '0'))
+        except (ValueError, TypeError):
+            info['threads'] = 0
+
+        def _kb(field):
+            try:
+                return int(status.get(field, '0').split()[0])
+            except (ValueError, IndexError, AttributeError):
+                return 0
+        info['vm_rss_kb'] = _kb('VmRSS')
+        info['vm_size_kb'] = _kb('VmSize')
+        info['vm_swap_kb'] = _kb('VmSwap')
+
+        # Uid → user name; Gid → group name
+        try:
+            uid = int(status.get('Uid', '0').split()[0])
+            info['uid'] = uid
+            try:
+                info['user'] = pwd.getpwuid(uid).pw_name
+            except KeyError:
+                info['user'] = str(uid)
+        except Exception:
+            info['uid'] = None
+            info['user'] = None
+        try:
+            gid = int(status.get('Gid', '0').split()[0])
+            info['gid'] = gid
+            try:
+                info['group'] = grp.getgrgid(gid).gr_name
+            except KeyError:
+                info['group'] = str(gid)
+        except Exception:
+            info['gid'] = None
+            info['group'] = None
+
+        # Parent process short name (for the "started by" line)
+        info['parent_name'] = None
+        if info['ppid']:
+            try:
+                with open(f'/proc/{info["ppid"]}/comm') as f:
+                    info['parent_name'] = f.read().strip()
+            except Exception:
+                pass
+
+        # Start time + elapsed runtime from `ps` — /proc/<pid>/stat exposes
+        # raw clock ticks; `ps` formats them as the human-friendly strings
+        # we want (lstart: "Wed Jun 4 17:12:23 2026"; etime: "2h59m").
+        try:
+            ps_out = subprocess.run(
+                ['ps', '-o', 'lstart=,etime=', '-p', str(pid)],
+                capture_output=True, text=True, timeout=2
+            )
+            if ps_out.returncode == 0:
+                line = ps_out.stdout.strip()
+                if line:
+                    # lstart is 5 whitespace-separated tokens, etime is 1
+                    # token after, so we split off the trailing field from
+                    # the right.
+                    parts = line.rsplit(None, 1)
+                    if len(parts) == 2:
+                        info['start_time'] = parts[0]
+                        info['elapsed'] = parts[1]
+        except Exception:
+            pass
+
+        # CPU% / MEM% from psutil with delta sampling. CPU is normalized
+        # to the host total (divided by cpu_count) so values match what
+        # the parent list and the CPU Usage card show.
+        info['cpu'] = 0.0
+        info['mem'] = 0.0
+        try:
+            p_proc = psutil.Process(pid)
+            ncpu = os.cpu_count() or 1
+            info['cpu'] = round(p_proc.cpu_percent(interval=1.0) / ncpu, 1)
+            try:
+                info['mem'] = round(p_proc.memory_percent(), 1)
+            except psutil.NoSuchProcess:
+                pass
+        except (psutil.NoSuchProcess, psutil.AccessDenied):
+            pass
+
+        # I/O accounting (kernel requires CONFIG_TASK_IO_ACCOUNTING; also EACCES for non-self)
+        try:
+            io = {}
+            with open(f'{proc_path}/io') as f:
+                for line in f:
+                    if ':' in line:
+                        k, v = line.split(':', 1)
+                        try:
+                            io[k.strip()] = int(v.strip())
+                        except ValueError:
+                            pass
+            info['io_read_bytes'] = io.get('read_bytes')
+            info['io_write_bytes'] = io.get('write_bytes')
+        except (OSError, PermissionError):
+            info['io_read_bytes'] = None
+            info['io_write_bytes'] = None
+
+        # Open FDs
+        try:
+            info['fd_count'] = len(os.listdir(f'{proc_path}/fd'))
+        except (OSError, PermissionError):
+            info['fd_count'] = None
+
+        info['captured_at'] = int(time.time())
+        return jsonify(info)
+    except Exception as e:
+        return jsonify({'error': str(e)}), 500
+
+
 @app.route('/api/temperature/history', methods=['GET'])
 @require_auth
 def api_temperature_history():
@@ -8873,7 +9647,10 @@ def api_smart_run_test(disk_name):
                 capture_output=True, text=True, timeout=10
             )
             if check_proc.returncode != 0:
-                return jsonify({'error': f'Cannot access NVMe device: {check_proc.stderr.strip() or "Device not responding"}'}), 500
+                # Device-level failure, not a server bug — return 400 so
+                # the UI surfaces the real stderr instead of a generic
+                # "500 INTERNAL SERVER ERROR".
+                return jsonify({'error': f'Cannot access NVMe device: {check_proc.stderr.strip() or "Device not responding"}'}), 400
             
             # Check if device supports self-test by looking at OACS field
             # OACS bit 4 (0x10) indicates Device Self-test support
@@ -8913,8 +9690,8 @@ def api_smart_run_test(disk_name):
                 # Check for permission errors
                 if 'permission' in error_msg.lower() or 'operation not permitted' in error_msg.lower():
                     return jsonify({'error': f'Permission denied. Run as root: {error_msg}'}), 403
-                return jsonify({'error': f'Failed to start test: {error_msg}'}), 500
-            
+                return jsonify({'error': f'Failed to start test: {error_msg}'}), 400
+
             # Start background monitor to save JSON when test completes
             # Check 'Current Device Self-Test Operation' field - if > 0, test is running
             sleep_interval = 10 if test_type == 'short' else 60
@@ -8945,7 +9722,21 @@ def api_smart_run_test(disk_name):
             )
             
             if proc.returncode not in (0, 4):  # 4 = test started successfully
-                return jsonify({'error': f'Failed to start test: {proc.stderr}'}), 500
+                # smartctl scribbles the useful diagnostic on stderr for
+                # most failures but some device-level errors (USB SATA
+                # bridges that reject the SMART command, drives whose
+                # ATA passthrough is broken, ...) print the reason on
+                # stdout instead. Concatenate both so the operator sees
+                # the real reason in the toast rather than an opaque
+                # "500 INTERNAL SERVER ERROR". Status is 400: the smartctl
+                # process ran fine, the device is what rejected the test.
+                err_detail = (proc.stderr or '').strip()
+                out_detail = (proc.stdout or '').strip()
+                combined = err_detail
+                if out_detail and out_detail not in err_detail:
+                    combined = f'{err_detail}\n{out_detail}' if err_detail else out_detail
+                combined = combined or f'smartctl exited with code {proc.returncode}'
+                return jsonify({'error': f'Failed to start test: {combined}'}), 400
             
             # Start background monitor to save JSON when test completes
             sleep_interval = 10 if test_type == 'short' else 60
@@ -9039,7 +9830,13 @@ def _update_smart_cron():
         test_type = schedule.get('test_type', 'short')
         retention = schedule.get('retention', 10)
         
-        cmd = f'/usr/local/share/proxmenux/scripts/smart-scheduled-test.sh --schedule-id {schedule_id} --test-type {test_type} --retention {retention}'
+        # The installer keeps the storage helpers under
+        # /usr/local/share/proxmenux/scripts/storage/, mirroring the
+        # repo layout. The previous path (without /storage/) generated
+        # cron lines that pointed at a non-existent file, so the timer
+        # fired, cron logged nothing, and the operator saw "no
+        # scheduled tests in history" with no obvious clue why.
+        cmd = f'/usr/local/share/proxmenux/scripts/storage/smart-scheduled-test.sh --schedule-id {schedule_id} --test-type {test_type} --retention {retention}'
         if disks != ['all']:
             cmd += f" --disks '{','.join(disks)}'"
         
@@ -9282,45 +10079,40 @@ def api_network_summary():
         bridge_interfaces = []
         
         for interface_name, stats in net_if_stats.items():
-            # Skip loopback and special interfaces
-            if interface_name in ['lo', 'docker0'] or interface_name.startswith(('veth', 'tap', 'fw')):
+            # Delegate classification to the shared helper so this endpoint
+            # matches the full /api/network path. The inline prefix-based
+            # check that lived here missed operator-renamed NICs (e.g.
+            # `nic0` via systemd .link rules) and reported 0 physical
+            # interfaces even when the host clearly had one — surfaces as
+            # "Network Interfaces: N/A" on the System Overview card.
+            iface_type = get_interface_type(interface_name)
+            if iface_type not in ('physical', 'bridge'):
                 continue
-            
+
             is_up = stats.isup
-            
-            # Classify interface type
-            if interface_name.startswith(('enp', 'eth', 'eno', 'ens', 'wlan', 'wlp')):
+            addresses = []
+            if interface_name in net_if_addrs:
+                for addr in net_if_addrs[interface_name]:
+                    if addr.family == socket.AF_INET:
+                        addresses.append({'ip': addr.address, 'netmask': addr.netmask})
+
+            if iface_type == 'physical':
                 physical_total += 1
                 if is_up:
                     physical_active += 1
-                    # Get IP addresses
-                    addresses = []
-                    if interface_name in net_if_addrs:
-                        for addr in net_if_addrs[interface_name]:
-                            if addr.family == socket.AF_INET:
-                                addresses.append({'ip': addr.address, 'netmask': addr.netmask})
-                    
                     physical_interfaces.append({
                         'name': interface_name,
-                        'status': 'up' if is_up else 'down',
-                        'addresses': addresses
+                        'status': 'up',
+                        'addresses': addresses,
                     })
-            
-            elif interface_name.startswith(('vmbr', 'br')):
+            else:  # bridge
                 bridge_total += 1
                 if is_up:
                     bridge_active += 1
-                    # Get IP addresses
-                    addresses = []
-                    if interface_name in net_if_addrs:
-                        for addr in net_if_addrs[interface_name]:
-                            if addr.family == socket.AF_INET:
-                                addresses.append({'ip': addr.address, 'netmask': addr.netmask})
-                    
                     bridge_interfaces.append({
                         'name': interface_name,
-                        'status': 'up' if is_up else 'down',
-                        'addresses': addresses
+                        'status': 'up',
+                        'addresses': addresses,
                     })
         
         return jsonify({
@@ -9623,14 +10415,149 @@ def api_node_metrics():
                                     '--timeframe', timeframe, '--output-format', 'json'],
                                    capture_output=True, text=True, timeout=10)
         
+        # Detect well-known Proxmox-side failures BEFORE trying to parse
+        # the JSON. These are PVE host problems (rrdcached down, RRD file
+        # corrupt, node-name mismatch). None of them are caused by the
+        # Monitor itself — surface a specific message so the operator
+        # doesn't blame ProxMenux for a Proxmox-host data-store issue.
+        if rrd_result.returncode != 0:
+            stderr_str = (rrd_result.stderr or '') + (rrd_result.stdout or '')
+            stderr_lower = stderr_str.lower()
+            if 'mmaping file' in stderr_lower and 'invalid argument' in stderr_lower:
+                # Corrupt RRD file on disk. Operator must recreate it.
+                return jsonify({
+                    'error': 'Proxmox RRD database is corrupt',
+                    'details': (
+                        'The host metrics file Proxmox keeps under '
+                        '/var/lib/rrdcached/db/pve-node-9.0/ failed to '
+                        'memory-map (Invalid argument). This is a Proxmox-side '
+                        'data-store issue, not a Monitor bug.'
+                    ),
+                    'suggestion': (
+                        'Stop pvestatd + pve-cluster + rrdcached, move the '
+                        'broken RRD aside, restart the services. Proxmox will '
+                        'rebuild the RRD from scratch (history is lost).'
+                    ),
+                    'raw': stderr_str.strip()[:500],
+                }), 503
+            if 'no such file' in stderr_lower or 'no such node' in stderr_lower or 'does not exist' in stderr_lower:
+                return jsonify({
+                    'error': 'Proxmox node name mismatch',
+                    'details': (
+                        f"pvesh could not find node '{local_node}'. The "
+                        'usual cause is that the host was renamed after '
+                        'Proxmox was installed, so /etc/pve/nodes/ still '
+                        'carries the old name. This is a Proxmox-side '
+                        'config issue, not a Monitor bug.'
+                    ),
+                    'suggestion': 'Compare `hostname` with `ls /etc/pve/nodes/` — they must match.',
+                    'raw': stderr_str.strip()[:500],
+                }), 503
+            if 'rrd' in stderr_lower or 'empty' in stderr_lower:
+                return jsonify({
+                    'error': 'Proxmox RRD data not available',
+                    'details': 'The RRD database appears empty. Proxmox may not have collected metrics yet (fresh install) or rrdcached was down at boot.',
+                    'suggestion': 'systemctl restart rrdcached pvestatd ; wait ~5 min and reload this page.',
+                    'raw': stderr_str.strip()[:500],
+                }), 503
+            return jsonify({
+                'error': 'Proxmox metrics command failed',
+                'details': 'pvesh exited non-zero. Check Proxmox host status.',
+                'raw': stderr_str.strip()[:500],
+            }), 503
+
         if rrd_result.returncode == 0:
             rrd_data = json.loads(rrd_result.stdout)
 
-            if zfs_arc_size > 0:
-                for item in rrd_data:
-                    # If zfsarc field is missing or 0, add current value
-                    if 'zfsarc' not in item or item.get('zfsarc', 0) == 0:
-                        item['zfsarc'] = zfs_arc_size
+            # PVE 9.x exposes the actual ARC history as `arcsize` in RRD;
+            # the previous code ignored it and stamped every point with
+            # the live ARC size, producing a flat band at the current
+            # value (issue: ZFS ARC line painted full-bar). Use the real
+            # series when present so the chart matches Proxmox's own
+            # Summary view. On older PVE that doesn't expose `arcsize`,
+            # fall back to the live value as a constant placeholder.
+            for item in rrd_data:
+                if 'arcsize' in item:
+                    item['zfsarc'] = item['arcsize']
+                elif zfs_arc_size > 0 and ('zfsarc' not in item or item.get('zfsarc', 0) == 0):
+                    item['zfsarc'] = zfs_arc_size
+
+            # Period stats — computed BEFORE downsampling so the
+            # AVG/MAX/MIN header in the chart reflects real per-minute
+            # extremes instead of averages.
+            #
+            # Three sources depending on the timeframe:
+            #
+            #   - hour/day  → PVE returns 1-min raw points. AVG/MAX/MIN
+            #     of the in-memory list IS the truth.
+            #
+            #   - week/month → PVE already downsamples to 30-min /
+            #     ~1-hour points using consolidation function AVG, so
+            #     the in-memory points are already averages. Taking
+            #     max() of them gives "max of averages", NOT the real
+            #     peak. We issue two extra pvesh calls per request
+            #     (`--cf MAX` and `--cf MIN`) to recover the real
+            #     extremes from PVE's own RRD consolidation. The
+            #     extra calls add ~150 ms — only on week/month and
+            #     only when the chart loads, so the overhead is small.
+            def _values_from(items, field_key, scale=1.0):
+                return [item[field_key] * scale for item in items
+                        if isinstance(item.get(field_key), (int, float))
+                        and not isinstance(item[field_key], bool)
+                        and item[field_key] is not None]
+
+            def _stats_native(field_key, scale=1.0):
+                values = _values_from(rrd_data, field_key, scale)
+                if not values:
+                    return None
+                return {
+                    'avg': sum(values) / len(values),
+                    'max': max(values),
+                    'min': min(values),
+                }
+
+            def _pvesh_rrd(cf):
+                """One extra pvesh call with a non-default CF.
+                Returns the parsed list or None on any failure — caller
+                falls back to the AVG-based numbers."""
+                try:
+                    extra = subprocess.run(
+                        ['pvesh', 'get', f'/nodes/{local_node}/rrddata',
+                         '--timeframe', timeframe, '--cf', cf,
+                         '--output-format', 'json'],
+                        capture_output=True, text=True, timeout=10,
+                    )
+                    if extra.returncode == 0 and extra.stdout:
+                        return json.loads(extra.stdout)
+                except (subprocess.SubprocessError, json.JSONDecodeError, OSError):
+                    pass
+                return None
+
+            def _build_stats(field_key, scale=1.0):
+                native = _stats_native(field_key, scale)
+                if native is None:
+                    return None
+                # On week/month, the points we already have are AVG.
+                # Try to upgrade max/min to the real RRD extremes.
+                if timeframe in ('week', 'month'):
+                    cf_max = _pvesh_rrd('MAX')
+                    if cf_max:
+                        vals = _values_from(cf_max, field_key, scale)
+                        if vals:
+                            native['max'] = max(vals)
+                    cf_min = _pvesh_rrd('MIN')
+                    if cf_min:
+                        vals = _values_from(cf_min, field_key, scale)
+                        if vals:
+                            native['min'] = min(vals)
+                return native
+
+            period_stats = {
+                # cpu: RRD stores fraction 0-1, surface as %.
+                'cpu': _build_stats('cpu', scale=100.0),
+                # memory_used: bytes → GB so units match the chart.
+                'memory_used': _build_stats('memused', scale=1 / (1024 ** 3)),
+            }
 
             # 24h downsampling: RRD returns ~1440 minute-level points which
             # plots as a dense thicket of vertical spikes. Group into 5-min
@@ -9664,30 +10591,27 @@ def api_node_metrics():
             payload = {
                 'node': local_node,
                 'timeframe': timeframe,
-                'data': rrd_data
+                'data': rrd_data,
+                # AVG/MAX/MIN computed over the raw (pre-downsampling)
+                # points so the chart header captures real per-minute
+                # extremes even on multi-day timeframes.
+                'period_stats': period_stats,
             }
             _node_metrics_cache_set(timeframe, payload)
             return jsonify(payload)
-        else:
-            # Check if RRD file is empty or corrupted
-            stderr_lower = rrd_result.stderr.lower() if rrd_result.stderr else ''
-            if 'rrd' in stderr_lower or 'no such file' in stderr_lower or 'empty' in stderr_lower:
-                return jsonify({
-                    'error': 'RRD data not available',
-                    'details': 'The RRD database file may be empty or corrupted. This can happen if rrdcached was not running properly after Proxmox installation.',
-                    'suggestion': 'Try restarting rrdcached: systemctl restart rrdcached'
-                }), 503  # Service Unavailable - more appropriate than 500
-            return jsonify({'error': f'Failed to get RRD data: {rrd_result.stderr}'}), 500
-            
+        # Note: the old `else` branch that handled rrd_result.returncode != 0
+        # was removed — the early-return block above now catches every
+        # non-zero exit BEFORE we ever attempt json.loads(), so reaching
+        # this point with returncode != 0 is impossible.
+
     except json.JSONDecodeError:
         # pvesh returned invalid JSON - likely empty RRD
         return jsonify({
-            'error': 'RRD data not available',
-            'details': 'Unable to parse metrics data. The RRD database may be empty or corrupted.',
-            'suggestion': 'Try restarting rrdcached: systemctl restart rrdcached'
+            'error': 'Proxmox RRD data not available',
+            'details': 'pvesh returned non-JSON output. The RRD database is likely empty (fresh install where pvestatd has not run yet) or the rrdcached daemon is down.',
+            'suggestion': 'systemctl restart rrdcached pvestatd ; wait ~5 min and reload.',
         }), 503
     except Exception as e:
-
         return jsonify({'error': str(e)}), 500
 
 @app.route('/api/logs/counts', methods=['GET'])
@@ -11753,9 +12677,5701 @@ def stream_script_logs(session_id):
         return jsonify({'success': False, 'error': str(e)}), 500
 
 
+# ── Host Backup (Sprint 13D, 1.3.0 preview) ──────────────────
+# These endpoints surface the host-backup pipeline implemented in
+# scripts/backup_restore/ (collectors + restore tooling). They:
+#   - list configured scheduled jobs (from /var/lib/proxmenux/backup-jobs/)
+#   - list backup archives present on disk for local_tar destinations
+#   - extract the manifest from an archive (uses parse_manifest.sh)
+#   - run the dry-run preflight report (uses run_restore.sh)
+# Mutating actions (run-now, create-job, --apply restore) stay on CLI for
+# now — UI surface for those lands later in the 1.3.x cycle.
+
+_PROXMENUX_SCRIPTS_DIR = '/usr/local/share/proxmenux/scripts'
+_BACKUP_JOBS_DIR = '/var/lib/proxmenux/backup-jobs'
+_BACKUP_LOG_DIR = '/var/log/proxmenux/backup-jobs'
+# Always scan PVE's default dump directory in addition to per-job
+# DEST_DIRs — manual backups from backup_host.sh (options 1-6) land
+# there without ever creating a job env file.
+_BACKUP_DEFAULT_DUMP_DIRS = ('/var/lib/vz/dump',)
+# Filenames produced by ProxMenux host backups:
+#   manual  (backup_host.sh line 253):  hostcfg-<HOSTNAME>-YYYYMMDD_HHMMSS.tar.zst
+#   scheduled (run_scheduled_backup.sh): <JOB_ID>-YYYYMMDD_HHMMSS.<ext>
+# This regex matches both; we then cross-check against the known job_ids
+# (everything else, like PVE's vzdump-lxc-*, gets dropped).
+_BACKUP_FILENAME_RE = re.compile(r'^([A-Za-z0-9._-]+)-(\d{8}_\d{6})\.tar(\.zst|\.gz)?$')
+
+
+def _parse_job_env(file_path: str) -> dict:
+    """Parse a /var/lib/proxmenux/backup-jobs/*.env file (shell KEY=value
+    format with optional quoting) into a Python dict. Returns {} on any
+    I/O or parse error so callers can just .get() with defaults."""
+    out: dict = {}
+    try:
+        with open(file_path) as f:
+            for raw in f:
+                line = raw.strip()
+                if not line or line.startswith('#') or '=' not in line:
+                    continue
+                key, val = line.split('=', 1)
+                key = key.strip()
+                val = val.strip()
+                # Strip shell quoting if balanced
+                if len(val) >= 2 and val[0] == val[-1] and val[0] in ('"', "'"):
+                    val = val[1:-1]
+                out[key] = val
+    except OSError:
+        pass
+    return out
+
+
+def _collect_backup_scan_dirs():
+    """Build the de-duplicated list of directories we scan for host
+    backup archives. Sources, in priority order:
+      - PVE default dump dirs (/var/lib/vz/dump et al.)
+      - The configured local target (local-target.conf)
+      - Every job .env that targets a local backend
+      - Every USB partition mounted under our naming convention
+    Returns directories that actually exist on disk."""
+    import glob
+    dirs = []
+    seen = set()
+    def _add(d):
+        if d and d not in seen and os.path.isdir(d):
+            seen.add(d)
+            dirs.append(d)
+    for d in _BACKUP_DEFAULT_DUMP_DIRS:
+        _add(d)
+
+    # Configured local target
+    try:
+        _add(_get_local_target().get('configured'))
+    except Exception:
+        pass
+
+    # Per-job local destinations — handle both the legacy field names
+    # (METHOD, DEST_DIR, DEST) and the current ones (BACKEND, LOCAL_DEST_DIR).
+    try:
+        env_files = sorted(glob.glob(f'{_BACKUP_JOBS_DIR}/*.env'))
+    except OSError:
+        env_files = []
+    for env_file in env_files:
+        job = _parse_job_env(env_file)
+        backend = (job.get('BACKEND') or job.get('METHOD') or '').lower()
+        if backend not in ('local', 'local_tar'):
+            continue
+        _add(job.get('LOCAL_DEST_DIR') or job.get('DEST_DIR') or job.get('DEST'))
+
+    # Mounted USB partitions — anything under /mnt/proxmenux-backup-* and
+    # /media/* gets included since those are where hb_mount_usb_partition
+    # parks them. Defensive: only existing mountpoints.
+    try:
+        for mp_glob in ('/mnt/proxmenux-backup-*', '/media/*'):
+            for mp in glob.glob(mp_glob):
+                _add(mp)
+    except OSError:
+        pass
+
+    return dirs
+
+
+def _known_job_ids():
+    """Set of job_ids that have a .env file on disk — used to associate
+    a scheduled archive (<job_id>-<ts>.tar*) with its job."""
+    import glob
+    try:
+        env_files = glob.glob(f'{_BACKUP_JOBS_DIR}/*.env')
+    except OSError:
+        return set()
+    return {os.path.basename(p)[:-len('.env')] for p in env_files}
+
+
+# In-process cache for the tar-peek fallback so we don't re-decompress
+# every archive on every Monitor refresh. Keyed by absolute archive
+# path; the cached tuple is (size, mtime, is_proxmenux_backup_bool).
+# Invalidated automatically whenever size or mtime changes.
+_BACKUP_PEEK_CACHE: dict = {}
+
+
+def _read_archive_sidecar(archive_path):
+    """Read and parse the <archive>.proxmenux.json sidecar if present.
+    Returns the parsed dict on success, or None if the sidecar is
+    missing or unreadable. A corrupted sidecar drops back to the next
+    detection path (peek) rather than masking the archive entirely."""
+    sidecar = archive_path + '.proxmenux.json'
+    if not os.path.isfile(sidecar):
+        return None
+    try:
+        with open(sidecar) as f:
+            data = json.load(f)
+    except (OSError, json.JSONDecodeError):
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def _peek_host_backup_marker(archive_path, st):
+    """Check whether the archive contains 'metadata/run_info.env' — the
+    in-tar marker that every ProxMenux host backup ships with. Used as
+    a fallback when no sidecar is present (legacy archives, or archives
+    copied in from elsewhere). Result is cached by (size, mtime) so a
+    second call within the same process is free.
+
+    Implementation: stream `tar -atf` (auto-detect compression by
+    extension; GNU tar 1.30+) line by line and short-circuit as soon as
+    we hit the marker. The marker lives in the first ~10-20 entries of
+    every ProxMenux archive, so we cap the scan at 500 entries — well
+    above the real archive's TOC depth but bounded enough that a
+    pathological archive can't keep the worker tied up.
+    """
+    cached = _BACKUP_PEEK_CACHE.get(archive_path)
+    if cached and cached[0] == st.st_size and cached[1] == int(st.st_mtime):
+        return cached[2]
+
+    is_pmx = False
+    proc = None
+    try:
+        proc = subprocess.Popen(
+            ['tar', '-atf', archive_path],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
+            text=True,
+        )
+        assert proc.stdout is not None
+        for i, line in enumerate(proc.stdout):
+            if i > 500:
+                break
+            entry = line.strip()
+            if entry.startswith('./'):
+                entry = entry[2:]
+            entry = entry.rstrip('/')
+            if entry == 'metadata/run_info.env':
+                is_pmx = True
+                break
+    except OSError:
+        is_pmx = False
+    finally:
+        if proc is not None:
+            try:
+                proc.kill()
+            except OSError:
+                pass
+            try:
+                proc.wait(timeout=2)
+            except (subprocess.TimeoutExpired, OSError):
+                pass
+
+    _BACKUP_PEEK_CACHE[archive_path] = (st.st_size, int(st.st_mtime), is_pmx)
+    return is_pmx
+
+
+def _identify_host_backup(archive_path, st, hostname, job_ids):
+    """Return a dict of {kind, job_id, profile, source_hostname,
+    detected_via} if this archive is a ProxMenux host backup, or None
+    if it isn't (or we can't tell).
+
+    Order of confidence (best → worst):
+      1. <archive>.proxmenux.json sidecar — definitive, written by the
+         backup script when the archive completes.
+      2. Filename matches a known scheduled job_id (.env still on disk).
+      3. Filename starts with 'hostcfg-' — the convention for manual
+         and the recommended convention for scheduled jobs.
+      4. Tar-peek for metadata/run_info.env — the universal marker that
+         every ProxMenux backup carries inside. Caches by mtime/size so
+         repeat calls are free.
+    """
+    sc = _read_archive_sidecar(archive_path)
+    if sc is not None:
+        return {
+            'kind': sc.get('kind') or 'manual',
+            'job_id': sc.get('job_id'),
+            'profile': sc.get('profile'),
+            'source_hostname': sc.get('hostname'),
+            'detected_via': 'sidecar',
+        }
+
+    name = os.path.basename(archive_path)
+    m = _BACKUP_FILENAME_RE.match(name)
+    stem = m.group(1) if m else None
+
+    if stem and stem in job_ids:
+        return {
+            'kind': 'scheduled', 'job_id': stem,
+            'profile': None, 'source_hostname': None,
+            'detected_via': 'job_id_match',
+        }
+
+    if stem == f'hostcfg-{hostname}':
+        return {
+            'kind': 'manual', 'job_id': None,
+            'profile': None, 'source_hostname': hostname,
+            'detected_via': 'hostcfg_prefix',
+        }
+
+    if stem and stem.startswith('hostcfg-'):
+        return {
+            'kind': 'manual', 'job_id': None,
+            'profile': None, 'source_hostname': None,
+            'detected_via': 'hostcfg_prefix',
+        }
+
+    if _peek_host_backup_marker(archive_path, st):
+        return {
+            'kind': 'legacy', 'job_id': None,
+            'profile': None, 'source_hostname': None,
+            'detected_via': 'tar_peek',
+        }
+    return None
+
+
+def _find_backup_archive_path(archive_id):
+    """Resolve an archive_id (basename) to an absolute path by checking
+    every directory we scan for backups (PVE default + per-job DEST_DIRs).
+    Returns None if the file isn't found anywhere we know about, or if
+    the resolved file isn't identifiable as a ProxMenux backup. This is
+    a deliberate allow-list: callers can't request arbitrary host paths
+    via the API even if they hit the inspect/preflight URLs directly."""
+    if '/' in archive_id or archive_id in ('.', '..') or archive_id.startswith('.'):
+        return None  # don't let basename traversal sneak through
+    if not archive_id.endswith(_BACKUP_TAR_SUFFIXES):
+        return None  # we only handle the tar family
+    hostname = socket.gethostname()
+    job_ids = _known_job_ids()
+    for d in _collect_backup_scan_dirs():
+        candidate = os.path.join(d, archive_id)
+        if not os.path.isfile(candidate):
+            continue
+        try:
+            st = os.stat(candidate)
+        except OSError:
+            continue
+        if _identify_host_backup(candidate, st, hostname, job_ids) is None:
+            continue  # exists but isn't a ProxMenux backup — reject
+        return candidate
+    return None
+
+
+_JOB_ID_RE = re.compile(r'^[a-zA-Z0-9_-]+$')
+_BACKUP_RUNNER = '/usr/local/share/proxmenux/scripts/backup_restore/run_scheduled_backup.sh'
+
+
+def _backup_job_summary(env_file: str) -> dict:
+    """Build the UI summary for one job .env, reading the actual fields
+    produced by the current scheduler (BACKEND, LOCAL_DEST_DIR,
+    PBS_REPOSITORY, BORG_REPO, KEEP_*, PVE_STORAGE, ENABLED)."""
+    job_id = os.path.basename(env_file)[:-len('.env')]
+    job = _parse_job_env(env_file)
+
+    backend = (job.get('BACKEND') or job.get('METHOD') or 'unknown').lower()
+    attached = bool(job.get('PVE_STORAGE'))
+    pve_storage = job.get('PVE_STORAGE') or None
+
+    if backend == 'pbs':
+        destination = job.get('PBS_REPOSITORY') or ''
+        bid = job.get('PBS_BACKUP_ID')
+        if bid:
+            destination = f'{destination} :: host/{bid}'
+    elif backend == 'local':
+        destination = (job.get('LOCAL_DEST_DIR') or job.get('DEST_DIR')
+                       or job.get('DEST') or '')
+    elif backend == 'borg':
+        destination = job.get('BORG_REPO') or ''
+    else:
+        destination = (job.get('DEST_DIR') or job.get('DEST')
+                       or job.get('PBS_REPO') or job.get('BORG_REPO') or '')
+
+    keep_parts = []
+    for k_key, label in (
+        ('KEEP_LAST', 'last'),
+        ('KEEP_HOURLY', 'hourly'),
+        ('KEEP_DAILY', 'daily'),
+        ('KEEP_WEEKLY', 'weekly'),
+        ('KEEP_MONTHLY', 'monthly'),
+        ('KEEP_YEARLY', 'yearly'),
+    ):
+        v = job.get(k_key)
+        if v and v != '0':
+            keep_parts.append(f'{label}={v}')
+    retention = ', '.join(keep_parts) or job.get('RETENTION') or ''
+
+    if attached:
+        enabled = (job.get('ENABLED', '1') == '1')
+        schedule = f'attached → storage:{pve_storage}' if pve_storage else 'attached'
+        timer_enabled = False
+        next_run = None
+    else:
+        timer_unit = f'proxmenux-backup-{job_id}.timer'
+        timer_enabled = subprocess.run(
+            ['systemctl', 'is-enabled', '--quiet', timer_unit],
+            capture_output=True
+        ).returncode == 0
+        enabled = timer_enabled
+        schedule = job.get('ON_CALENDAR') or 'manual'
+        next_run = None
+        try:
+            r = subprocess.run(
+                ['systemctl', 'list-timers', '--no-pager', '--output=json', timer_unit],
+                capture_output=True, text=True, timeout=5
+            )
+            if r.returncode == 0 and r.stdout.strip():
+                rows = json.loads(r.stdout)
+                if rows and isinstance(rows, list):
+                    # systemd's list-timers --output=json emits `next`
+                    # as MICROSECONDS since the unix epoch (uint64).
+                    # Passing that raw to `new Date(…)` in the browser
+                    # was interpreting it as milliseconds → year 58433.
+                    # Normalize it to an ISO 8601 timestamp here so the
+                    # frontend just calls `new Date(iso).toLocaleString()`.
+                    next_us = rows[0].get('next')
+                    if isinstance(next_us, (int, float)) and next_us > 0:
+                        from datetime import datetime as _dt
+                        next_run = _dt.fromtimestamp(next_us / 1_000_000).isoformat()
+        except (subprocess.TimeoutExpired, json.JSONDecodeError, ValueError, OSError):
+            pass
+
+    last_status = None
+    last_status_file = f'{_BACKUP_LOG_DIR}/{job_id}-last.status'
+    if os.path.exists(last_status_file):
+        try:
+            with open(last_status_file) as f:
+                last_status = f.read().strip()
+        except OSError:
+            pass
+
+    return {
+        'id': job_id,
+        'destination': destination,
+        'method': backend,
+        'on_calendar': schedule,
+        'retention': retention,
+        'timer_enabled': timer_enabled,
+        'enabled': enabled,
+        'attached': attached,
+        'pve_storage': pve_storage,
+        'profile_mode': job.get('PROFILE_MODE') or 'default',
+        'manual': job.get('MANUAL_RUN') == '1',
+        'last_status': last_status,
+        'next_run': next_run,
+        # `encrypted` is a per-job flag — for PBS it's "has a keyfile
+        # assigned", for Borg "the destination's encryption is on".
+        # Used by the UI to render the lock badge consistently.
+        'encrypted': (
+            bool(job.get('PBS_KEYFILE')) if backend == 'pbs'
+            else (job.get('BORG_ENCRYPT_MODE') or 'none') != 'none' if backend == 'borg'
+            else False
+        ),
+    }
+
+
+@app.route('/api/host-backups/jobs', methods=['GET'])
+@require_auth
+def api_host_backups_jobs():
+    """List scheduled host-backup jobs created via the backup_scheduler
+    CLI. Reports both timer-based and PVE-attached jobs."""
+    import glob
+    try:
+        env_files = sorted(glob.glob(f'{_BACKUP_JOBS_DIR}/*.env'))
+    except OSError:
+        env_files = []
+    return jsonify({'jobs': [_backup_job_summary(f) for f in env_files]})
+
+
+@app.route('/api/host-backups/jobs/<job_id>/run', methods=['POST'])
+@require_auth
+def api_host_backups_job_run(job_id):
+    """Trigger a scheduled host backup job immediately (background).
+    The runner writes its own log + .status file; the UI polls /jobs to
+    pick up the new status."""
+    if not _JOB_ID_RE.match(job_id):
+        return jsonify({'error': 'invalid job id'}), 400
+    env_file = f'{_BACKUP_JOBS_DIR}/{job_id}.env'
+    if not os.path.exists(env_file):
+        return jsonify({'error': 'job not found'}), 404
+    if not os.path.exists(_BACKUP_RUNNER):
+        return jsonify({'error': 'runner script not installed'}), 500
+    try:
+        subprocess.Popen(
+            ['bash', _BACKUP_RUNNER, job_id],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            stdin=subprocess.DEVNULL,
+            close_fds=True,
+            start_new_session=True,
+        )
+    except OSError as e:
+        return jsonify({'error': f'failed to start: {e}'}), 500
+    return jsonify({'status': 'started', 'job_id': job_id}), 202
+
+
+@app.route('/api/host-backups/jobs/<job_id>/toggle', methods=['POST'])
+@require_auth
+def api_host_backups_job_toggle(job_id):
+    """Flip enabled/disabled. Attached jobs are toggled by rewriting
+    ENABLED= in the .env (no timer exists). Timer-based jobs use
+    systemctl --now enable/disable. Body may include {"enabled": bool}
+    to set an explicit target; otherwise the current state is inverted."""
+    if not _JOB_ID_RE.match(job_id):
+        return jsonify({'error': 'invalid job id'}), 400
+    env_file = f'{_BACKUP_JOBS_DIR}/{job_id}.env'
+    if not os.path.exists(env_file):
+        return jsonify({'error': 'job not found'}), 404
+
+    job = _parse_job_env(env_file)
+    is_attached = bool(job.get('PVE_STORAGE'))
+
+    payload = request.get_json(silent=True) or {}
+    target = payload.get('enabled')
+
+    if is_attached:
+        current = (job.get('ENABLED', '1') == '1')
+        new_state = (not current) if target is None else bool(target)
+        new_val = '1' if new_state else '0'
+        try:
+            with open(env_file, 'r') as f:
+                lines = f.readlines()
+            tmp_path = f'{env_file}.tmp.{os.getpid()}'
+            with open(tmp_path, 'w') as tmp:
+                found = False
+                for line in lines:
+                    if line.startswith('ENABLED='):
+                        tmp.write(f'ENABLED={new_val}\n')
+                        found = True
+                    else:
+                        tmp.write(line)
+                if not found:
+                    tmp.write(f'ENABLED={new_val}\n')
+            os.replace(tmp_path, env_file)
+            os.chmod(env_file, 0o600)
+        except OSError as e:
+            return jsonify({'error': f'could not update .env: {e}'}), 500
+        return jsonify({'status': 'ok', 'enabled': new_state, 'attached': True})
+
+    timer_unit = f'proxmenux-backup-{job_id}.timer'
+    current = subprocess.run(
+        ['systemctl', 'is-enabled', '--quiet', timer_unit],
+        capture_output=True
+    ).returncode == 0
+    new_state = (not current) if target is None else bool(target)
+    cmd = ['systemctl', '--now', 'enable' if new_state else 'disable', timer_unit]
+    r = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
+    if r.returncode != 0:
+        return jsonify({'error': f'systemctl failed: {r.stderr.strip()}'}), 500
+    return jsonify({'status': 'ok', 'enabled': new_state, 'attached': False})
+
+
+@app.route('/api/host-backups/jobs/<job_id>', methods=['DELETE'])
+@require_auth
+def api_host_backups_job_delete(job_id):
+    """Remove a scheduled host backup job. Mirrors _job_delete in
+    backup_scheduler.sh: for attached jobs we only drop the .env/.paths
+    (the PVE vzdump job stays intact); for timer-based jobs we also
+    stop+disable the timer, remove the unit files and reload systemd."""
+    if not _JOB_ID_RE.match(job_id):
+        return jsonify({'error': 'invalid job id'}), 400
+    env_file = f'{_BACKUP_JOBS_DIR}/{job_id}.env'
+    if not os.path.exists(env_file):
+        return jsonify({'error': 'job not found'}), 404
+
+    job = _parse_job_env(env_file)
+    is_attached = bool(job.get('PVE_STORAGE'))
+
+    paths_file = f'{_BACKUP_JOBS_DIR}/{job_id}.paths'
+    service_file = f'/etc/systemd/system/proxmenux-backup-{job_id}.service'
+    timer_file = f'/etc/systemd/system/proxmenux-backup-{job_id}.timer'
+
+    if not is_attached:
+        timer_unit = f'proxmenux-backup-{job_id}.timer'
+        subprocess.run(
+            ['systemctl', '--now', 'disable', timer_unit],
+            capture_output=True, timeout=10
+        )
+
+    removed = []
+    for f in (env_file, paths_file, service_file, timer_file):
+        try:
+            if os.path.exists(f):
+                os.remove(f)
+                removed.append(os.path.basename(f))
+        except OSError:
+            pass
+
+    # Drop all runner logs for this job — when the job is gone there's
+    # no archive these logs belong to. Keeps /var/log/proxmenux clean.
+    import glob as _glob
+    log_removed = 0
+    for log_f in _glob.glob(f'{_BACKUP_LOG_DIR}/{job_id}-*.log') + \
+                 _glob.glob(f'{_BACKUP_LOG_DIR}/{job_id}-last.status'):
+        try:
+            os.remove(log_f)
+            log_removed += 1
+        except OSError:
+            pass
+
+    if not is_attached:
+        subprocess.run(['systemctl', 'daemon-reload'], capture_output=True, timeout=10)
+
+    return jsonify({
+        'status': 'ok',
+        'job_id': job_id,
+        'attached': is_attached,
+        'removed': removed,
+        'log_files_removed': log_removed,
+    })
+
+
+_BACKUP_LIB_SH = '/usr/local/share/proxmenux/scripts/backup_restore/lib_host_backup_common.sh'
+_BACKUP_STATE_DIR = '/usr/local/share/proxmenux'
+_PVE_LOCAL_STORAGE_TYPES = ('dir', 'nfs', 'cifs', 'lvm', 'lvmthin', 'btrfs', 'zfs', 'zfspool')
+
+
+def _pve_storage_types_map() -> dict:
+    """Parse /etc/pve/storage.cfg into {storage_id: type}."""
+    result: dict = {}
+    cfg_path = '/etc/pve/storage.cfg'
+    if not os.path.exists(cfg_path):
+        return result
+    try:
+        with open(cfg_path) as f:
+            for raw in f:
+                line = raw.rstrip()
+                if not line or line.startswith('#'):
+                    continue
+                m = re.match(r'^([a-z]+):\s+(\S+)', line)
+                if m:
+                    result[m.group(2)] = m.group(1)
+    except OSError:
+        pass
+    return result
+
+
+def _list_pve_vzdump_jobs() -> list:
+    """Parse /etc/pve/jobs.cfg into a list of dicts. Same fields as
+    hb_pve_list_vzdump_jobs in lib_host_backup_common.sh, plus the
+    storage type resolved from storage.cfg."""
+    cfg_path = '/etc/pve/jobs.cfg'
+    if not os.path.exists(cfg_path):
+        return []
+    storage_types = _pve_storage_types_map()
+    jobs: list = []
+    current: dict | None = None
+    try:
+        with open(cfg_path) as f:
+            for raw in f:
+                line = raw.rstrip('\n')
+                if not line.strip():
+                    continue
+                if line.startswith('vzdump:'):
+                    if current:
+                        jobs.append(current)
+                    current = {
+                        'id': line.split(':', 1)[1].strip(),
+                        'storage': None,
+                        'storage_type': None,
+                        'schedule': None,
+                        'prune': None,
+                        'enabled': True,
+                    }
+                    continue
+                if re.match(r'^[a-z]+:', line) and current is not None:
+                    # Different block type encountered → close current
+                    jobs.append(current)
+                    current = None
+                    continue
+                if current is None:
+                    continue
+                m = re.match(r'^\s+(\S+)\s+(.*)$', line)
+                if not m:
+                    continue
+                key, val = m.group(1), m.group(2).strip()
+                if key == 'storage':
+                    current['storage'] = val
+                    current['storage_type'] = storage_types.get(val)
+                elif key == 'schedule':
+                    current['schedule'] = val
+                elif key == 'prune-backups':
+                    current['prune'] = val
+                elif key == 'enabled':
+                    current['enabled'] = (val == '1')
+        if current:
+            jobs.append(current)
+    except OSError:
+        pass
+    return jobs
+
+
+@app.route('/api/host-backups/pve-vzdump-jobs', methods=['GET'])
+@require_auth
+def api_host_backups_pve_vzdump_jobs():
+    """List PVE vzdump jobs the operator can attach a host backup to.
+    Optional ?backend=pbs|local filters by storage family."""
+    backend = (request.args.get('backend') or '').strip().lower()
+    jobs = _list_pve_vzdump_jobs()
+    if backend == 'pbs':
+        jobs = [j for j in jobs if j.get('storage_type') == 'pbs']
+    elif backend == 'local':
+        jobs = [j for j in jobs if j.get('storage_type') in _PVE_LOCAL_STORAGE_TYPES]
+    return jsonify({'jobs': jobs})
+
+
+@app.route('/api/host-backups/default-paths', methods=['GET'])
+@require_auth
+def api_host_backups_default_paths():
+    """Return the default backup profile path list, sourced from
+    lib_host_backup_common.sh so there is one source of truth."""
+    if not os.path.exists(_BACKUP_LIB_SH):
+        return jsonify({'paths': []})
+    try:
+        r = subprocess.run(
+            ['bash', '-c',
+             f'source {_BACKUP_LIB_SH}; declare -a paths=(); '
+             f'hb_select_profile_paths default paths >/dev/null 2>&1; '
+             f'printf "%s\\n" "${{paths[@]}}"'],
+            capture_output=True, text=True, timeout=10
+        )
+        if r.returncode != 0:
+            return jsonify({'paths': [], 'error': r.stderr.strip()}), 500
+        paths = [p for p in r.stdout.splitlines() if p.strip()]
+        return jsonify({'paths': paths})
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return jsonify({'paths': [], 'error': str(e)}), 500
+
+
+def _list_pbs_destinations() -> list:
+    """PBS repos available: from /etc/pve/storage.cfg + the proxmenux
+    manual list ($HB_STATE_DIR/pbs-manual-configs.txt). Same layout
+    hb_collect_pbs_configs uses."""
+    repos: list = []
+    seen: set = set()
+
+    # From PVE storage.cfg
+    cfg_path = '/etc/pve/storage.cfg'
+    if os.path.exists(cfg_path):
+        try:
+            with open(cfg_path) as f:
+                current_name = None
+                current_type = None
+                current_server = None
+                current_datastore = None
+                current_username = None
+                current_fingerprint = None
+                for raw in f:
+                    line = raw.rstrip('\n')
+                    m = re.match(r'^([a-z]+):\s+(\S+)', line)
+                    if m:
+                        if current_type == 'pbs' and current_name:
+                            repo = f"{current_username or 'root@pam'}@{current_server}:{current_datastore}"
+                            if (current_name, repo) not in seen:
+                                repos.append({
+                                    'name': current_name,
+                                    'repository': repo,
+                                    'fingerprint': current_fingerprint,
+                                    'source': 'proxmox',
+                                })
+                                seen.add((current_name, repo))
+                        current_type = m.group(1)
+                        current_name = m.group(2) if current_type == 'pbs' else None
+                        current_server = current_datastore = current_username = current_fingerprint = None
+                        continue
+                    if current_type != 'pbs' or current_name is None:
+                        continue
+                    sm = re.match(r'^\s+(\S+)\s+(.*)$', line)
+                    if not sm:
+                        continue
+                    key, val = sm.group(1), sm.group(2).strip()
+                    if key == 'server':
+                        current_server = val
+                    elif key == 'datastore':
+                        current_datastore = val
+                    elif key == 'username':
+                        current_username = val
+                    elif key == 'fingerprint':
+                        current_fingerprint = val
+                if current_type == 'pbs' and current_name and current_server and current_datastore:
+                    repo = f"{current_username or 'root@pam'}@{current_server}:{current_datastore}"
+                    if (current_name, repo) not in seen:
+                        repos.append({
+                            'name': current_name,
+                            'repository': repo,
+                            'fingerprint': current_fingerprint,
+                            'source': 'proxmox',
+                        })
+                        seen.add((current_name, repo))
+        except OSError:
+            pass
+
+    # From proxmenux manual list
+    manual_path = f'{_BACKUP_STATE_DIR}/pbs-manual-configs.txt'
+    if os.path.exists(manual_path):
+        try:
+            with open(manual_path) as f:
+                for raw in f:
+                    line = raw.strip()
+                    if not line or '|' not in line:
+                        continue
+                    name, repo = line.split('|', 1)
+                    if (name, repo) not in seen:
+                        repos.append({
+                            'name': name,
+                            'repository': repo,
+                            'fingerprint': None,
+                            'source': 'manual',
+                        })
+                        seen.add((name, repo))
+        except OSError:
+            pass
+    # Annotate each repo with the jobs that currently depend on it so
+    # the UI can warn before deleting a destination that's in use.
+    for r in repos:
+        r['jobs_using'] = _jobs_using_pbs(r['repository'])
+    return repos
+
+
+def _list_borg_destinations() -> list:
+    """borg-targets.txt has 4 pipe-separated fields per line:
+    name|repo|ssh_key|encrypt_mode
+
+    Legacy lines from the shell installer only carry the first three
+    fields — those targets default to `repokey` (what the shell wizard
+    has always written). `has_passphrase` reports whether a sibling
+    `borg-pass-<name>.txt` exists, so the UI can skip the passphrase
+    prompt when the credential is already saved server-side."""
+    targets: list = []
+    cfg = f'{_BACKUP_STATE_DIR}/borg-targets.txt'
+    if not os.path.exists(cfg):
+        return targets
+    try:
+        with open(cfg) as f:
+            for raw in f:
+                line = raw.strip()
+                if not line or '|' not in line:
+                    continue
+                parts = line.split('|', 3)
+                name = parts[0]
+                repo = parts[1] if len(parts) > 1 else ''
+                ssh_key = parts[2] if len(parts) > 2 else ''
+                encrypt_mode = (parts[3] if len(parts) > 3 else '').strip() or 'repokey'
+                pass_file = f'{_BACKUP_STATE_DIR}/borg-pass-{name}.txt'
+                has_passphrase = os.path.isfile(pass_file)
+                targets.append({
+                    'name': name,
+                    'repository': repo,
+                    'ssh_key': ssh_key,
+                    'ssh_key_path': ssh_key,
+                    'encrypt_mode': encrypt_mode,
+                    'has_passphrase': has_passphrase,
+                    'jobs_using': _jobs_using_borg(repo),
+                })
+    except OSError:
+        pass
+    return targets
+
+
+def _resolve_borg_passphrase(name: str) -> str:
+    """Return the passphrase saved for borg destination `name`, or ''."""
+    if not name:
+        return ''
+    pf = f'{_BACKUP_STATE_DIR}/borg-pass-{name}.txt'
+    if not os.path.isfile(pf):
+        return ''
+    try:
+        with open(pf) as f:
+            return f.read().strip()
+    except OSError:
+        return ''
+
+
+def _delete_job_internal(job_id: str) -> None:
+    """Tear down a backup job — used both by the individual DELETE
+    endpoint and by the cascade when removing a destination. Drops
+    .env / .paths / systemd unit + timer (with disable + reload),
+    plus all of the job's logs and status sidecar. Idempotent:
+    missing files are silently skipped."""
+    if not _JOB_ID_RE.match(job_id):
+        return
+    env_file = f'{_BACKUP_JOBS_DIR}/{job_id}.env'
+    if not os.path.exists(env_file):
+        return
+    try:
+        job = _parse_job_env(env_file)
+    except OSError:
+        job = {}
+    is_attached = bool(job.get('PVE_STORAGE'))
+    paths_file = f'{_BACKUP_JOBS_DIR}/{job_id}.paths'
+    service_file = f'/etc/systemd/system/proxmenux-backup-{job_id}.service'
+    timer_file = f'/etc/systemd/system/proxmenux-backup-{job_id}.timer'
+    if not is_attached:
+        try:
+            subprocess.run(
+                ['systemctl', '--now', 'disable', f'proxmenux-backup-{job_id}.timer'],
+                capture_output=True, timeout=10,
+            )
+        except (subprocess.TimeoutExpired, OSError):
+            pass
+    for f in (env_file, paths_file, service_file, timer_file):
+        try:
+            if os.path.exists(f):
+                os.remove(f)
+        except OSError:
+            pass
+    if not is_attached:
+        try:
+            subprocess.run(['systemctl', 'daemon-reload'], capture_output=True, timeout=10)
+        except (subprocess.TimeoutExpired, OSError):
+            pass
+    import glob as _glob
+    for log_f in _glob.glob(f'{_BACKUP_LOG_DIR}/{job_id}-*.log') + \
+                 _glob.glob(f'{_BACKUP_LOG_DIR}/{job_id}-last.status'):
+        try:
+            os.remove(log_f)
+        except OSError:
+            pass
+
+
+def _jobs_using_pbs(repo: str) -> list:
+    """Return the list of job_ids whose .env points at this PBS
+    repository. Used by the DELETE-destination confirm flow so the
+    operator sees what gets cascade-removed."""
+    if not repo or not os.path.isdir(_BACKUP_JOBS_DIR):
+        return []
+    out: list = []
+    for fname in os.listdir(_BACKUP_JOBS_DIR):
+        if not fname.endswith('.env'):
+            continue
+        try:
+            env = _parse_job_env(f'{_BACKUP_JOBS_DIR}/{fname}')
+        except OSError:
+            continue
+        if env.get('BACKEND') == 'pbs' and env.get('PBS_REPOSITORY') == repo:
+            out.append(fname[:-4])
+    return out
+
+
+def _jobs_using_borg(repo: str) -> list:
+    """Same as _jobs_using_pbs but for Borg destinations."""
+    if not repo or not os.path.isdir(_BACKUP_JOBS_DIR):
+        return []
+    out: list = []
+    for fname in os.listdir(_BACKUP_JOBS_DIR):
+        if not fname.endswith('.env'):
+            continue
+        try:
+            env = _parse_job_env(f'{_BACKUP_JOBS_DIR}/{fname}')
+        except OSError:
+            continue
+        if env.get('BACKEND') == 'borg' and env.get('BORG_REPO') == repo:
+            out.append(fname[:-4])
+    return out
+
+
+def _jobs_using_local(path: str) -> list:
+    """Jobs whose LOCAL_DEST_DIR is this local destination path."""
+    if not path or not os.path.isdir(_BACKUP_JOBS_DIR):
+        return []
+    out: list = []
+    target = path.rstrip('/')
+    for fname in os.listdir(_BACKUP_JOBS_DIR):
+        if not fname.endswith('.env'):
+            continue
+        try:
+            env = _parse_job_env(f'{_BACKUP_JOBS_DIR}/{fname}')
+        except OSError:
+            continue
+        if env.get('BACKEND') == 'local' and (env.get('LOCAL_DEST_DIR') or '').rstrip('/') == target:
+            out.append(fname[:-4])
+    return out
+
+
+def _resolve_borg_destination_for_repo(repo: str) -> dict | None:
+    """Find the borg destination dict (from _list_borg_destinations)
+    whose `repository` matches. Used to inherit passphrase + encryption
+    from the destination when a job/manual-run doesn't provide them."""
+    if not repo:
+        return None
+    for d in _list_borg_destinations():
+        if d.get('repository') == repo:
+            return d
+    return None
+
+
+_LOCAL_DEFAULT_PATH = '/var/lib/vz/dump'
+
+
+def _read_local_target_paths() -> list:
+    """Read the operator-configured local backup paths from
+    local-target.conf. The file is one path per line — historically it
+    only ever held one entry, but the new multi-path UI lets the
+    operator stack several. Empty lines and duplicates are dropped."""
+    cfg = f'{_BACKUP_STATE_DIR}/local-target.conf'
+    out: list = []
+    if not os.path.exists(cfg):
+        return out
+    seen: set = set()
+    try:
+        with open(cfg) as f:
+            for raw in f:
+                p = raw.strip()
+                if not p or p.startswith('#'):
+                    continue
+                if p in seen:
+                    continue
+                seen.add(p)
+                out.append(p)
+    except OSError:
+        pass
+    return out
+
+
+def _list_local_targets() -> list:
+    """One entry per local destination the operator can target. The
+    /var/lib/vz/dump default is always present and not removable; any
+    custom path stacked by the operator gets source=custom + removable.
+    Each entry carries `jobs_using` so the UI can warn before delete."""
+    entries: list = [{
+        'path': _LOCAL_DEFAULT_PATH,
+        'source': 'default',
+        'removable': False,
+        'jobs_using': _jobs_using_local(_LOCAL_DEFAULT_PATH),
+    }]
+    for p in _read_local_target_paths():
+        if p == _LOCAL_DEFAULT_PATH:
+            # Operator re-added the default — collapse silently.
+            continue
+        entries.append({
+            'path': p,
+            'source': 'custom',
+            'removable': True,
+            'jobs_using': _jobs_using_local(p),
+        })
+    return entries
+
+
+def _get_local_target() -> dict:
+    """Backwards-compatible accessor used by the scheduler runner +
+    the historical single-path UI. `effective` is the first custom
+    path if any, otherwise the default — matching the previous
+    behavior. New code should call _list_local_targets() instead."""
+    customs = _read_local_target_paths()
+    configured = customs[0] if customs else None
+    return {
+        'configured': configured,
+        'default': _LOCAL_DEFAULT_PATH,
+        'effective': configured or _LOCAL_DEFAULT_PATH,
+        'entries': _list_local_targets(),
+    }
+
+
+@app.route('/api/host-backups/destinations', methods=['GET'])
+@require_auth
+def api_host_backups_destinations():
+    """Pre-configured backup destinations the operator picks from when
+    creating a new job: PBS repos, Borg targets, and the local target
+    list (always includes the /var/lib/vz/dump default plus any custom
+    paths the operator stacked on top)."""
+    return jsonify({
+        'pbs': _list_pbs_destinations(),
+        'borg': _list_borg_destinations(),
+        'local': _get_local_target(),
+    })
+
+
+def _is_usb_mount(path: str) -> bool:
+    """Heuristic: true if `path` lives under one of the typical USB
+    mount roots ProxMenux uses for backup media. The naming pattern
+    `/mnt/proxmenux-backup-disk-*` is set by the USB drive section
+    of the host-backup UI; we also detect anything mounted in
+    /media/. Used only to display a `USB` badge — not for any
+    permissions decision."""
+    if not path:
+        return False
+    p = os.path.abspath(path)
+    if p.startswith('/mnt/proxmenux-backup-disk-'):
+        return True
+    if p.startswith('/media/'):
+        return True
+    return False
+
+
+def _capacity_local(path: str) -> dict:
+    """Capacity via statvfs(path). Walks up the path tree until it
+    finds an existing directory so we can answer even for a
+    destination dir that hasn't been created yet."""
+    if not path or not path.startswith('/'):
+        return {'error': 'invalid path'}
+    probe = path
+    while probe and not os.path.exists(probe):
+        parent = os.path.dirname(probe)
+        if parent == probe:
+            break
+        probe = parent
+    if not probe or not os.path.exists(probe):
+        return {'error': 'path not found'}
+    try:
+        st = os.statvfs(probe)
+    except OSError as e:
+        return {'error': str(e)}
+    block = st.f_frsize
+    total = st.f_blocks * block
+    avail = st.f_bavail * block
+    used = total - (st.f_bfree * block)
+    return {
+        'total': total,
+        'available': avail,
+        'used': used,
+        'is_usb': _is_usb_mount(path),
+    }
+
+
+def _capacity_borg_ssh(host: str, user: str, remote_path: str, key_path: str = '') -> dict:
+    """Run `df -B1 --output=size,used,avail` over ssh against the
+    remote borg repo path. Times out fast — failure is just rendered
+    as a missing capacity badge in the UI, not a hard error."""
+    if not host or not user or not remote_path:
+        return {'error': 'incomplete ssh target'}
+    ssh_target = f'{user}@{host}'
+    cmd = ['ssh', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=5',
+           '-o', 'StrictHostKeyChecking=accept-new']
+    if key_path:
+        cmd += ['-i', key_path]
+    cmd += [ssh_target, f'df -B1 --output=size,used,avail {shlex.quote(remote_path)}']
+    try:
+        r = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return {'error': f'ssh timed out: {e}'}
+    if r.returncode != 0:
+        return {'error': (r.stderr.strip().splitlines()[-1] if r.stderr.strip() else 'df failed')[:200]}
+    lines = [ln.strip() for ln in r.stdout.splitlines() if ln.strip()]
+    if len(lines) < 2:
+        return {'error': 'unexpected df output'}
+    cols = lines[-1].split()
+    if len(cols) < 3:
+        return {'error': 'unexpected df output'}
+    try:
+        total = int(cols[0])
+        used = int(cols[1])
+        avail = int(cols[2])
+    except ValueError:
+        return {'error': 'unparseable df output'}
+    return {'total': total, 'used': used, 'available': avail, 'remote': True}
+
+
+# Shared PBS encryption keyfile — mirrors the shell flow's single
+# `$HB_STATE_DIR/pbs-key.conf`. One host-wide keyfile reused across
+# every encrypted PBS backup. chmod 0600 is the protection (no KDF
+# passphrase, matching `proxmox-backup-client key create --kdf none`).
+_PBS_KEYFILE_PATH = f'{_BACKUP_STATE_DIR}/pbs-key.conf'
+# Optional escrow: an openssl-encrypted copy of the keyfile that the
+# runner uploads to every PBS backup. Lets the operator recover the
+# keyfile on a fresh host using just the passphrase. Mirrors the
+# shell's hb_pbs_setup_recovery flow byte-for-byte (AES-256-CBC +
+# PBKDF2 600k iterations).
+_PBS_RECOVERY_ENC_PATH = f'{_BACKUP_STATE_DIR}/pbs-key.recovery.enc'
+# Passphrase used to unlock the keyfile itself when it was created with
+# `--kdf scrypt`. Written by the "Import existing keyfile" flow when
+# the operator provides one; empty file (or missing) means the keyfile
+# is kdf=none and no passphrase is needed. Read at backup time by the
+# runner and exported as PBS_ENCRYPTION_PASSWORD so
+# proxmox-backup-client can decrypt the key without prompting.
+# Same trust boundary as the keyfile itself: chmod 600, next to it.
+_PBS_KEYFILE_PASS_PATH = f'{_BACKUP_STATE_DIR}/pbs-key.pass'
+# Escrow-mode state file: one line, 'none'|'local'|'full'. Mirrors the
+# shell's $HB_STATE_DIR/pbs-key.mode. Missing file = legacy install =
+# 'full' (the pre-3-mode behaviour) so upgrades are silent.
+_PBS_ESCROW_MODE_PATH = f'{_BACKUP_STATE_DIR}/pbs-key.mode'
+_PBS_ESCROW_MODES = ('none', 'local', 'full')
+# PVE stores per-storage encryption keyfiles here when the operator
+# enables `encryption-key` on a PBS storage entry. Same JSON keyfile
+# format as `proxmox-backup-client key create --kdf none` — usable
+# verbatim with --keyfile. Reusing it avoids duplicating a secret
+# across the PVE config and ProxMenux state.
+_PVE_STORAGE_KEY_DIR = '/etc/pve/priv/storage'
+_PVE_STORAGE_CFG = '/etc/pve/storage.cfg'
+
+
+def _pbs_read_escrow_mode() -> str:
+    """Read the current escrow mode ('none'|'local'|'full'). Falls back
+    to 'full' for legacy installs where the mode file doesn't exist —
+    that matches the pre-feature behaviour."""
+    try:
+        with open(_PBS_ESCROW_MODE_PATH, 'r') as f:
+            v = f.read(32).strip()
+        if v in _PBS_ESCROW_MODES:
+            return v
+    except OSError:
+        pass
+    return 'full'
+
+
+def _pbs_write_escrow_mode(mode: str) -> bool:
+    if mode not in _PBS_ESCROW_MODES:
+        return False
+    try:
+        os.makedirs(_BACKUP_STATE_DIR, exist_ok=True)
+        fd = os.open(
+            _PBS_ESCROW_MODE_PATH,
+            os.O_WRONLY | os.O_CREAT | os.O_TRUNC,
+            0o600,
+        )
+        with os.fdopen(fd, 'w') as f:
+            f.write(mode + '\n')
+    except OSError:
+        return False
+    return True
+
+
+def _pbs_discover_pve_keyfiles() -> list:
+    """List PVE-managed PBS storage entries that carry an encryption
+    keyfile at /etc/pve/priv/storage/<NAME>.enc. Returns
+    [{name, server, datastore, path}] for each matching entry. Empty
+    list on any read error — this is best-effort discovery.
+    """
+    if not (os.path.isfile(_PVE_STORAGE_CFG) and os.path.isdir(_PVE_STORAGE_KEY_DIR)):
+        return []
+    entries = []
+    current = None
+    try:
+        with open(_PVE_STORAGE_CFG, 'r') as f:
+            for raw_line in f:
+                line = raw_line.rstrip('\n')
+                if not line.strip():
+                    continue
+                # Non-indented block start: "<type>: <name>"
+                if not line[0].isspace():
+                    if current and current.get('type') == 'pbs':
+                        entries.append(current)
+                    stripped = line.strip()
+                    if ':' in stripped:
+                        typ, _, name = stripped.partition(':')
+                        name = name.strip()
+                        current = {'type': typ.strip(), 'name': name}
+                    else:
+                        current = None
+                    continue
+                # Indented body line: "    key value"
+                if current is None:
+                    continue
+                parts = line.strip().split(None, 1)
+                if len(parts) == 2:
+                    current[parts[0]] = parts[1]
+        if current and current.get('type') == 'pbs':
+            entries.append(current)
+    except OSError:
+        return []
+
+    result = []
+    for e in entries:
+        name = e.get('name') or ''
+        if not name:
+            continue
+        kf = os.path.join(_PVE_STORAGE_KEY_DIR, f'{name}.enc')
+        if not os.path.isfile(kf):
+            continue
+        result.append({
+            'name': name,
+            'server': e.get('server', ''),
+            'datastore': e.get('datastore', ''),
+            'path': kf,
+        })
+    return result
+
+
+def _pbs_pve_keyfile_for_repository(repository: str) -> dict:
+    """Given a PBS repository string 'user@realm@host:datastore', return
+    the matching PVE-storage keyfile entry (dict) or {} if none matches.
+    """
+    if not repository or ':' not in repository or '@' not in repository:
+        return {}
+    # Split repo on last '@' and last ':' — user/realm may contain '@'
+    # in the token form.
+    host_and_ds = repository.rsplit('@', 1)[-1]
+    host, _, datastore = host_and_ds.rpartition(':')
+    if not host or not datastore:
+        return {}
+    for e in _pbs_discover_pve_keyfiles():
+        if e.get('server') == host and e.get('datastore') == datastore:
+            return e
+    return {}
+
+
+def _pbs_do_finalize_recovery(passphrase: str, mode: str) -> tuple:
+    """Wrap the on-disk keyfile with the operator's passphrase (writes
+    _PBS_RECOVERY_ENC_PATH) and persist the escrow mode. Called by
+    both import and set-mode flows.
+
+    - mode 'full' or 'local' → envelope written + mode file updated.
+    - mode 'none' should never reach here — the caller must skip the
+      call entirely. Guarded by an assert for safety.
+
+    Every artefact ProxMenux writes lives under _BACKUP_STATE_DIR
+    (usually /usr/local/share/proxmenux/). No copies leak into /root/
+    — the operator uses the Monitor's Download button when they want
+    the keyfile offsite. Returns (ok, '') — the second slot is kept
+    for API compatibility with older callers that expected an offsite
+    path there.
+    """
+    assert mode in ('local', 'full'), 'finalize_recovery called with invalid mode'
+    if not shutil.which('openssl'):
+        return False, ''
+    if not os.path.isfile(_PBS_KEYFILE_PATH):
+        return False, ''
+    if not _pbs_recovery_encrypt(passphrase, _PBS_KEYFILE_PATH, _PBS_RECOVERY_ENC_PATH):
+        return False, ''
+    _pbs_write_escrow_mode(mode)
+    return True, ''
+
+
+def _pbs_install_pve_keyfile(src_path: str) -> bool:
+    """Copy a PVE-storage keyfile into the ProxMenux canonical location.
+    Atomic: writes to a temp path in the same directory, chmods, then
+    renames. Returns True on success."""
+    if not (src_path and os.path.isfile(src_path)):
+        return False
+    try:
+        os.makedirs(_BACKUP_STATE_DIR, exist_ok=True)
+        fd, tmp = tempfile.mkstemp(
+            prefix='pbs-key.', suffix='.pve', dir=_BACKUP_STATE_DIR,
+        )
+        try:
+            with os.fdopen(fd, 'wb') as fout, open(src_path, 'rb') as fin:
+                fout.write(fin.read())
+            os.chmod(tmp, 0o600)
+            os.replace(tmp, _PBS_KEYFILE_PATH)
+        except OSError:
+            try:
+                os.remove(tmp)
+            except OSError:
+                pass
+            return False
+    except OSError:
+        return False
+    return True
+
+
+def _pbs_keyfile_get_or_create(create_if_missing: bool = True) -> str:
+    """Return the path to the shared PBS keyfile, generating it on
+    demand if requested. Returns "" when no keyfile exists and the
+    caller didn't ask to create one."""
+    if os.path.isfile(_PBS_KEYFILE_PATH):
+        return _PBS_KEYFILE_PATH
+    if not create_if_missing:
+        return ''
+    try:
+        os.makedirs(_BACKUP_STATE_DIR, exist_ok=True)
+        r = subprocess.run(
+            ['proxmox-backup-client', 'key', 'create', '--kdf', 'none', _PBS_KEYFILE_PATH],
+            capture_output=True, text=True, timeout=15,
+        )
+        if r.returncode != 0 or not os.path.isfile(_PBS_KEYFILE_PATH):
+            return ''
+        os.chmod(_PBS_KEYFILE_PATH, 0o600)
+        return _PBS_KEYFILE_PATH
+    except (OSError, subprocess.TimeoutExpired):
+        return ''
+
+
+def _pbs_keyfile_fingerprint(path: str = '') -> str:
+    """Return the fingerprint of a PBS keyfile as reported by
+    `proxmox-backup-client key info`, or '' if the file is missing or
+    the tool is unavailable. Fingerprints look like
+    `AA:BB:CC:DD:EE:FF:GG:HH` and identify the exact key used to encrypt
+    a backup — displaying them next to a manifest's expected fingerprint
+    is what tells an operator whether they have the right key or a
+    different-but-similar one."""
+    kf = path or _PBS_KEYFILE_PATH
+    if not os.path.isfile(kf) or not shutil.which('proxmox-backup-client'):
+        return ''
+    try:
+        r = subprocess.run(
+            ['proxmox-backup-client', 'key', 'show', '--output-format', 'json', kf],
+            capture_output=True, text=True, timeout=10,
+        )
+        if r.returncode != 0 or not r.stdout:
+            return ''
+        info = json.loads(r.stdout)
+        return (info.get('fingerprint') or '').strip()
+    except (subprocess.TimeoutExpired, OSError, json.JSONDecodeError, ValueError):
+        return ''
+
+
+def _pbs_recovery_encrypt(passphrase: str, in_path: str, out_path: str) -> bool:
+    """openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt < passphrase.
+    Mirrors hb_pbs_encrypt_recovery in the shell so a blob produced
+    here can be decrypted by the shell's restore flow, and vice versa."""
+    if not os.path.isfile(in_path) or not passphrase:
+        return False
+    try:
+        r = subprocess.run(
+            ['openssl', 'enc', '-aes-256-cbc', '-pbkdf2', '-iter', '600000',
+             '-salt', '-in', in_path, '-out', out_path, '-pass', 'stdin'],
+            input=passphrase, text=True,
+            capture_output=True, timeout=30,
+        )
+    except (subprocess.TimeoutExpired, OSError):
+        return False
+    if r.returncode != 0 or not os.path.isfile(out_path):
+        return False
+    try:
+        os.chmod(out_path, 0o600)
+    except OSError:
+        pass
+    return True
+
+
+def _pbs_recovery_decrypt(passphrase: str, in_path: str, out_path: str) -> bool:
+    """Inverse of _pbs_recovery_encrypt. Used by the restore flow when
+    the operator has lost the local keyfile and wants to pull it back
+    from a PBS escrow snapshot."""
+    if not os.path.isfile(in_path) or not passphrase:
+        return False
+    try:
+        r = subprocess.run(
+            ['openssl', 'enc', '-d', '-aes-256-cbc', '-pbkdf2', '-iter', '600000',
+             '-in', in_path, '-out', out_path, '-pass', 'stdin'],
+            input=passphrase, text=True,
+            capture_output=True, timeout=30,
+        )
+    except (subprocess.TimeoutExpired, OSError):
+        return False
+    if r.returncode != 0 or not os.path.isfile(out_path):
+        return False
+    try:
+        os.chmod(out_path, 0o600)
+    except OSError:
+        pass
+    return True
+
+
+@app.route('/api/host-backups/pbs-encryption/keyfile-info', methods=['GET'])
+@require_auth
+def api_pbs_encryption_keyfile_info():
+    """Snapshot of the installed keyfile for the "Manage keyfile" panel.
+    Extends /pbs-recovery/status with metadata that only makes sense
+    when a keyfile is actually installed (installed_at, kdf hint).
+    Returns 200 with `installed: false` when no keyfile is present so
+    the panel can render a neutral empty state without special-casing
+    404s in the caller."""
+    installed = os.path.isfile(_PBS_KEYFILE_PATH)
+    if not installed:
+        return jsonify({
+            'installed': False,
+            'path': _PBS_KEYFILE_PATH,
+        })
+    installed_at = ''
+    try:
+        installed_at = time.strftime(
+            '%Y-%m-%dT%H:%M:%SZ',
+            time.gmtime(os.path.getmtime(_PBS_KEYFILE_PATH)),
+        )
+    except OSError:
+        pass
+    # Best-effort KDF hint from the JSON keyfile body itself. `key info`
+    # would be the authoritative source but refuses scrypt keyfiles
+    # without their passphrase, so parsing the JSON manually gives us
+    # a hint even for imported scrypt keys the operator brought their
+    # own passphrase for.
+    # KDF detection covers all three shapes proxmox-backup-client
+    # writes across versions:
+    #   - modern kdf=none  → JSON `null`  → Python None
+    #   - legacy kdf=none  → string "None"
+    #   - kdf=scrypt       → object {"Scrypt": {...}}
+    kdf_hint = 'unknown'
+    try:
+        with open(_PBS_KEYFILE_PATH, 'r') as f:
+            raw = f.read(4096)
+        body = json.loads(raw)
+        # `body.get('kdf', 'MISSING')` distinguishes "field explicitly
+        # null" (present with JSON null → we want 'none') from "field
+        # absent" (unlikely but treat as unknown to be safe).
+        _sentinel = object()
+        kdf_raw = body.get('kdf', _sentinel)
+        if kdf_raw is None:
+            kdf_hint = 'none'
+        elif isinstance(kdf_raw, str):
+            # "None" → "none", any other string mirrors verbatim.
+            kdf_hint = kdf_raw.lower()
+        elif isinstance(kdf_raw, dict):
+            kdf_hint = next(iter(kdf_raw)).lower() if kdf_raw else 'unknown'
+    except (OSError, json.JSONDecodeError, ValueError, StopIteration):
+        pass
+    return jsonify({
+        'installed': True,
+        'path': _PBS_KEYFILE_PATH,
+        'fingerprint': _pbs_keyfile_fingerprint(),
+        'kdf_hint': kdf_hint,
+        'installed_at': installed_at,
+        'has_keyfile_passphrase': (
+            os.path.isfile(_PBS_KEYFILE_PASS_PATH)
+            and os.path.getsize(_PBS_KEYFILE_PASS_PATH) > 0
+        ),
+        'has_recovery': os.path.isfile(_PBS_RECOVERY_ENC_PATH),
+        'escrow_mode': _pbs_read_escrow_mode(),
+    })
+
+
+@app.route('/api/host-backups/pbs-encryption/remove', methods=['POST'])
+@require_auth
+def api_pbs_encryption_remove():
+    """Remove the installed keyfile + its paired local artifacts
+    (passphrase file, recovery blob). Optionally backs the three up to
+    /root under a timestamped prefix so the operator can still decrypt
+    or rebuild them later. Never touches the recovery blob(s) already
+    uploaded to PBS — those stay recoverable with their original
+    passphrase and are the safe way to reach any pre-existing backup
+    encrypted with the removed key.
+
+    Deleting is destructive and unconditional — the operator is
+    expected to click Download first if they want a copy. ProxMenux
+    never scatters files under /root/ any more.
+    """
+    if not os.path.isfile(_PBS_KEYFILE_PATH):
+        return jsonify({'error': 'no keyfile installed'}), 404
+
+    backed_up: list = []
+
+    # Wipe order: recovery blob first so a mid-flight failure leaves us
+    # in a clean, backup-still-decryptable-with-blob state. The escrow
+    # mode file goes last because it's the smallest side-effect and
+    # missing = 'full' (legacy default), which is a safe fallback.
+    removed = []
+    for path in (
+        _PBS_RECOVERY_ENC_PATH,
+        _PBS_KEYFILE_PASS_PATH,
+        _PBS_KEYFILE_PATH,
+        _PBS_ESCROW_MODE_PATH,
+    ):
+        try:
+            os.remove(path)
+            removed.append(path)
+        except FileNotFoundError:
+            pass
+        except OSError as e:
+            return jsonify({
+                'error': f'remove failed for {path}: {e}',
+                'backed_up': backed_up,
+                'removed': removed,
+            }), 500
+    return jsonify({
+        'status': 'ok',
+        'backed_up': backed_up,
+        'removed': removed,
+    })
+
+
+@app.route('/api/host-backups/pbs-encryption/passphrase', methods=['POST'])
+@require_auth
+def api_pbs_encryption_passphrase():
+    """Update ONLY the stored keyfile passphrase (pbs-key.pass) without
+    touching the keyfile itself. Useful when the operator rotates the
+    passphrase on their own PBS setup and needs ProxMenux to catch up.
+    Body: `{new_passphrase}`. Empty value wipes the file — the runner
+    then treats the keyfile as kdf=none.
+    """
+    payload = request.get_json(silent=True) or {}
+    new_pass = payload.get('new_passphrase') or ''
+    if not os.path.isfile(_PBS_KEYFILE_PATH):
+        return jsonify({'error': 'no keyfile installed'}), 404
+    if not new_pass:
+        try:
+            os.remove(_PBS_KEYFILE_PASS_PATH)
+        except FileNotFoundError:
+            pass
+        except OSError as e:
+            return jsonify({'error': f'cannot remove passphrase file: {e}'}), 500
+        return jsonify({'status': 'ok', 'has_keyfile_passphrase': False})
+    try:
+        fd = os.open(_PBS_KEYFILE_PASS_PATH,
+                     os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        with os.fdopen(fd, 'w') as f:
+            f.write(new_pass)
+    except OSError as e:
+        return jsonify({'error': f'cannot write passphrase file: {e}'}), 500
+    return jsonify({'status': 'ok', 'has_keyfile_passphrase': True})
+
+
+@app.route('/api/host-backups/pbs-recovery/status', methods=['GET'])
+@require_auth
+def api_pbs_recovery_status():
+    """Whether the host has a PBS keyfile + whether an escrow blob is
+    saved alongside it. Used by the wizard to decide whether to show
+    the 'set recovery passphrase' input."""
+    return jsonify({
+        'has_keyfile': os.path.isfile(_PBS_KEYFILE_PATH),
+        'has_recovery': os.path.isfile(_PBS_RECOVERY_ENC_PATH),
+        # True only when a non-empty passphrase file exists next to the
+        # keyfile. Lets the UI skip re-prompting the operator for the
+        # scrypt-unlock passphrase during subsequent job creations.
+        'has_keyfile_passphrase': (
+            os.path.isfile(_PBS_KEYFILE_PASS_PATH)
+            and os.path.getsize(_PBS_KEYFILE_PASS_PATH) > 0
+        ),
+        'keyfile_path': _PBS_KEYFILE_PATH,
+        'recovery_path': _PBS_RECOVERY_ENC_PATH,
+        # Fingerprint of the installed keyfile — empty when no keyfile
+        # is present. Exposed so the Web UI can render it next to the
+        # manifest's expected fingerprint after a download error
+        # ("missing key — manifest was created with key XX:XX:...").
+        'keyfile_fingerprint': _pbs_keyfile_fingerprint(),
+        # Current escrow model: 'none' | 'local' | 'full'. Missing on
+        # legacy hosts (pre-3-mode feature) — the reader falls back to
+        # 'full' silently, matching the pre-feature behaviour.
+        'escrow_mode': _pbs_read_escrow_mode(),
+    })
+
+
+# ─── Restore progress state (written by apply_cluster_postboot.sh) ──
+# The postboot script maintains /var/lib/proxmenux/restore-state.json
+# with a `running|complete|failed` status plus milestone counters,
+# per-component results, sanity warnings and a rollback delta. The
+# Backups tab polls status() to render a live card while the restore
+# is running and a summary once it's done; dismiss() flips the
+# `acknowledged` flag so the card collapses; history() lists archived
+# runs; log() returns a filtered tail of the postboot log.
+
+_RESTORE_STATE_FILE = '/var/lib/proxmenux/restore-state.json'
+_RESTORE_HISTORY_DIR = '/var/lib/proxmenux/restore-history'
+_RESTORE_LOG_DIR = '/var/log/proxmenux'
+
+
+def _read_restore_state(path):
+    try:
+        with open(path, 'r') as f:
+            return json.load(f)
+    except (FileNotFoundError, json.JSONDecodeError, OSError):
+        return None
+
+
+@app.route('/api/host-backups/restore/status', methods=['GET'])
+@require_auth
+def api_host_backups_restore_status():
+    """Current restore-state.json content — empty response means no
+    restore has ever run on this host (or the state dir is missing)."""
+    state = _read_restore_state(_RESTORE_STATE_FILE)
+    if state is None:
+        return jsonify({'state': None})
+    return jsonify({'state': state})
+
+
+@app.route('/api/host-backups/restore/dismiss', methods=['POST'])
+@require_auth
+def api_host_backups_restore_dismiss():
+    """Flip acknowledged=true on the current state file so the Backups
+    tab card collapses. The state file itself is preserved until the
+    next restore overwrites it — the operator can still open the
+    history modal to review this run's details later."""
+    state = _read_restore_state(_RESTORE_STATE_FILE)
+    if state is None:
+        return jsonify({'error': 'no restore state to dismiss'}), 404
+    state['acknowledged'] = True
+    try:
+        tmp = _RESTORE_STATE_FILE + '.tmp'
+        with open(tmp, 'w') as f:
+            json.dump(state, f)
+        os.replace(tmp, _RESTORE_STATE_FILE)
+    except OSError as e:
+        return jsonify({'error': f'cannot persist state: {e}'}), 500
+    return jsonify({'status': 'ok'})
+
+
+@app.route('/api/host-backups/restore/history', methods=['GET'])
+@require_auth
+def api_host_backups_restore_history():
+    """List archived restore runs (newest first). Each entry carries
+    just the summary metadata; the detail modal fetches the full
+    payload on demand via ?file=<name>."""
+    file_arg = request.args.get('file')
+    if file_arg:
+        # Reject anything that could climb out of the history dir.
+        # Filenames are always <YYYYmmdd_HHMMSS>-<complete|failed>.json.
+        if '/' in file_arg or '..' in file_arg or not file_arg.endswith('.json'):
+            return jsonify({'error': 'invalid file name'}), 400
+        full = os.path.join(_RESTORE_HISTORY_DIR, file_arg)
+        payload = _read_restore_state(full)
+        if payload is None:
+            return jsonify({'error': 'not found'}), 404
+        return jsonify({'state': payload})
+
+    entries = []
+    try:
+        for name in os.listdir(_RESTORE_HISTORY_DIR):
+            if not name.endswith('.json'):
+                continue
+            full = os.path.join(_RESTORE_HISTORY_DIR, name)
+            try:
+                mtime = os.stat(full).st_mtime
+            except OSError:
+                continue
+            payload = _read_restore_state(full) or {}
+            entries.append({
+                'file': name,
+                'mtime': mtime,
+                'status': payload.get('status', 'unknown'),
+                'started_at': payload.get('started_at'),
+                'finished_at': payload.get('finished_at'),
+                'duration': (payload.get('summary') or {}).get('duration'),
+            })
+    except FileNotFoundError:
+        pass
+    entries.sort(key=lambda e: e['mtime'], reverse=True)
+    return jsonify({'entries': entries})
+
+
+@app.route('/api/host-backups/restore/log', methods=['GET'])
+@require_auth
+def api_host_backups_restore_log():
+    """Return a tail of the postboot log — optionally filtered to just
+    error/warning lines. Path is taken from the state file's log_path
+    (or from ?path=… for a history entry) and validated to live under
+    /var/log/proxmenux so an operator can't read arbitrary files."""
+    path = request.args.get('path')
+    filter_mode = request.args.get('filter', 'all')  # all | issues
+    try:
+        tail_lines = min(int(request.args.get('tail', '400')), 4000)
+    except ValueError:
+        tail_lines = 400
+
+    if not path:
+        state = _read_restore_state(_RESTORE_STATE_FILE) or {}
+        path = state.get('log_path')
+    if not path:
+        return jsonify({'lines': [], 'path': None})
+
+    # Resolve to guard against traversal; the log MUST live inside
+    # /var/log/proxmenux for the endpoint to expose it.
+    real = os.path.realpath(path)
+    if not real.startswith(_RESTORE_LOG_DIR + os.sep) and real != _RESTORE_LOG_DIR:
+        return jsonify({'error': 'log path outside allowed directory'}), 400
+    if not os.path.isfile(real):
+        return jsonify({'lines': [], 'path': path}), 200
+
+    try:
+        with open(real, 'r', errors='replace') as f:
+            # Simple tail: read the whole file (postboot logs are
+            # small — a few hundred KB at worst) and slice.
+            data = f.readlines()
+    except OSError as e:
+        return jsonify({'error': f'cannot read log: {e}'}), 500
+
+    if filter_mode == 'issues':
+        needle = re.compile(r'(error|warning|failed|✗|✘|traceback)', re.IGNORECASE)
+        data = [ln for ln in data if needle.search(ln)]
+
+    return jsonify({
+        'path': path,
+        'total_lines': len(data),
+        'lines': [ln.rstrip('\n') for ln in data[-tail_lines:]],
+        'filter': filter_mode,
+    })
+
+
+@app.route('/api/host-backups/pbs-encryption/import', methods=['POST'])
+@require_auth
+def api_pbs_encryption_import():
+    """Install a PBS keyfile at the canonical shared path and set the
+    escrow mode in one atomic step.
+
+    Body (all fields optional except as noted):
+
+        source: "content" (default) | "pve-storage"
+        content_b64: <base64 bytes>          # source=content
+        pve_storage_name: "<storage-name>"   # source=pve-storage
+        keyfile_passphrase: <scrypt kdf>     # source=content only
+        escrow_mode: "none" | "local" | "full"   # default "full"
+        escrow_passphrase: <str>             # required unless escrow_mode='none'
+
+    Behaviour by escrow_mode:
+      - none:  keyfile installed, no envelope, no /root copy, no upload
+      - local: envelope written + copied to /root, no PBS upload
+      - full:  envelope written + copied to /root, runner uploads to PBS
+
+    Any prior recovery blob at the canonical path is dropped — it was
+    encrypted for the old key. The escrow mode file is updated to
+    reflect the new choice; downstream runs (both shell and runner)
+    read it back.
+    """
+    payload = request.get_json(silent=True) or {}
+    source = (payload.get('source') or 'content').strip().lower()
+    if source not in ('content', 'pve-storage', 'generate', 'path'):
+        return jsonify({'error': "source must be 'content', 'pve-storage', 'generate' or 'path'"}), 400
+
+    escrow_mode = (payload.get('escrow_mode') or 'full').strip().lower()
+    if escrow_mode not in _PBS_ESCROW_MODES:
+        return jsonify({'error': f'escrow_mode must be one of {_PBS_ESCROW_MODES}'}), 400
+    escrow_pass = payload.get('escrow_passphrase') or ''
+    if escrow_mode != 'none' and not escrow_pass:
+        return jsonify({'error': 'escrow_passphrase is required when escrow_mode is not "none"'}), 400
+    if escrow_mode != 'none' and not shutil.which('openssl'):
+        return jsonify({'error': 'openssl is not installed; cannot build the recovery envelope'}), 500
+
+    if not shutil.which('proxmox-backup-client'):
+        return jsonify({'error': 'proxmox-backup-client is not installed on this host'}), 500
+
+    try:
+        os.makedirs(_BACKUP_STATE_DIR, exist_ok=True)
+    except OSError as e:
+        return jsonify({'error': f'cannot create state directory: {e}'}), 500
+
+    # ── Resolve the keyfile bytes based on source ──────────────────
+    keyfile_pass = ''
+    if source == 'generate':
+        # Fresh keyfile generated server-side via proxmox-backup-client.
+        # We short-circuit the "load bytes → atomic install" pipeline
+        # below because the tool already writes the file at the
+        # canonical path.
+        stale_recovery = _PBS_RECOVERY_ENC_PATH
+        try:
+            os.remove(stale_recovery)
+        except FileNotFoundError:
+            pass
+        except OSError:
+            pass
+        # Wipe any zero-byte residue so the "already installed" branch
+        # in _pbs_keyfile_get_or_create doesn't misfire.
+        try:
+            if os.path.isfile(_PBS_KEYFILE_PATH) and os.path.getsize(_PBS_KEYFILE_PATH) == 0:
+                os.remove(_PBS_KEYFILE_PATH)
+        except OSError:
+            pass
+        # If a keyfile is already present the operator must remove it
+        # first — silent replacement here would drop backups they still
+        # need to decrypt.
+        if os.path.isfile(_PBS_KEYFILE_PATH):
+            return jsonify({
+                'error': "a keyfile is already installed at "
+                         f"{_PBS_KEYFILE_PATH}. Remove it first via /pbs-encryption/remove.",
+            }), 409
+        if not _pbs_keyfile_get_or_create(True):
+            return jsonify({'error': 'failed to generate the encryption keyfile'}), 500
+        keyfile_pass = ''
+        offsite_copy = ''
+        if escrow_mode == 'none':
+            _pbs_write_escrow_mode('none')
+        else:
+            ok, offsite_copy = _pbs_do_finalize_recovery(escrow_pass, escrow_mode)
+            if not ok:
+                return jsonify({'error': 'openssl encryption of the recovery envelope failed'}), 500
+        return jsonify({
+            'status': 'ok',
+            'source': 'generate',
+            'keyfile_path': _PBS_KEYFILE_PATH,
+            'keyfile_pass_stored': False,
+            'escrow_mode': escrow_mode,
+            'recovery_ready': escrow_mode != 'none',
+            'offsite_copy': offsite_copy,
+        })
+
+    if source == 'path':
+        # Read a keyfile from an absolute path on this host. Mirrors
+        # the shell wizard's "import from path" branch — the operator
+        # dropped the file somewhere on disk (via scp, USB, etc.) and
+        # types the path. Same size cap + BOM strip as source=content.
+        src_path = (payload.get('keyfile_path') or '').strip()
+        if not src_path:
+            return jsonify({'error': "keyfile_path is required when source is 'path'"}), 400
+        if not os.path.isabs(src_path):
+            return jsonify({'error': 'keyfile_path must be an absolute path'}), 400
+        if not os.path.isfile(src_path):
+            return jsonify({'error': f'no file at {src_path}'}), 404
+        try:
+            with open(src_path, 'rb') as f:
+                content = f.read(8192 + 1)
+        except OSError as e:
+            return jsonify({'error': f'cannot read {src_path}: {e}'}), 500
+        if not content or len(content) > 8192:
+            return jsonify({'error': 'keyfile size out of expected range (1..8192 bytes)'}), 400
+        if content.startswith(b'\xef\xbb\xbf'):
+            content = content[3:]
+        keyfile_pass = ''  # keyfile passphrase never used by this branch
+
+    elif source == 'content':
+        content_b64 = payload.get('content_b64') or ''
+        if not content_b64:
+            return jsonify({'error': "content_b64 is required when source is 'content'"}), 400
+        import base64
+        try:
+            content = base64.b64decode(content_b64, validate=True)
+        except Exception:
+            return jsonify({'error': 'content_b64 is not valid base64'}), 400
+        if not content or len(content) > 8192:
+            return jsonify({'error': 'keyfile size out of expected range (1..8192 bytes)'}), 400
+        # Strip a leading UTF-8 BOM if the operator's editor added one.
+        if content.startswith(b'\xef\xbb\xbf'):
+            content = content[3:]
+        # Optional keyfile passphrase (scrypt KDF).
+        keyfile_pass = payload.get('keyfile_passphrase') or ''
+    else:
+        # source == 'pve-storage'
+        pve_name = (payload.get('pve_storage_name') or '').strip()
+        if not pve_name:
+            return jsonify({'error': "pve_storage_name is required when source is 'pve-storage'"}), 400
+        pve_path = os.path.join(_PVE_STORAGE_KEY_DIR, f'{pve_name}.enc')
+        if not os.path.isfile(pve_path):
+            return jsonify({
+                'error': f'no PVE-managed keyfile at {pve_path}',
+            }), 404
+        try:
+            with open(pve_path, 'rb') as f:
+                content = f.read(8192 + 1)
+        except OSError as e:
+            return jsonify({'error': f'cannot read PVE keyfile: {e}'}), 500
+        if not content or len(content) > 8192:
+            return jsonify({'error': 'PVE keyfile out of expected size range (1..8192 bytes)'}), 400
+        # PVE-managed keyfiles are always --kdf none by construction.
+        keyfile_pass = ''
+
+    # ── Atomic install to _PBS_KEYFILE_PATH ────────────────────────
+    tmp_fd, tmp_path = tempfile.mkstemp(prefix='pbs-key.import.', dir=_BACKUP_STATE_DIR)
+    try:
+        try:
+            with os.fdopen(tmp_fd, 'wb') as f:
+                f.write(content)
+            os.chmod(tmp_path, 0o600)
+        except OSError as e:
+            return jsonify({'error': f'cannot write tmp keyfile: {e}'}), 500
+
+        # The old recovery blob was encrypted with the old key — drop it.
+        # The paired passphrase file goes too; the new source drives it.
+        for stale in (_PBS_RECOVERY_ENC_PATH, _PBS_KEYFILE_PASS_PATH):
+            try:
+                os.remove(stale)
+            except FileNotFoundError:
+                pass
+            except OSError:
+                pass
+
+        try:
+            os.replace(tmp_path, _PBS_KEYFILE_PATH)
+            os.chmod(_PBS_KEYFILE_PATH, 0o600)
+        except OSError as e:
+            return jsonify({'error': f'cannot promote keyfile: {e}'}), 500
+
+        # Persist the keyfile passphrase (if any). Same trust boundary
+        # as the keyfile itself.
+        if keyfile_pass:
+            try:
+                fd = os.open(_PBS_KEYFILE_PASS_PATH,
+                             os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+                with os.fdopen(fd, 'w') as f:
+                    f.write(keyfile_pass)
+            except OSError as e:
+                return jsonify({'error': f'cannot store keyfile passphrase: {e}'}), 500
+
+        # ── Finalize per escrow mode ───────────────────────────────
+        offsite_copy = ''
+        if escrow_mode == 'none':
+            _pbs_write_escrow_mode('none')
+        else:
+            ok, offsite_copy = _pbs_do_finalize_recovery(escrow_pass, escrow_mode)
+            if not ok:
+                return jsonify({'error': 'openssl encryption of the recovery envelope failed'}), 500
+
+        return jsonify({
+            'status': 'ok',
+            'source': source,
+            'keyfile_path': _PBS_KEYFILE_PATH,
+            'keyfile_pass_stored': bool(keyfile_pass),
+            'escrow_mode': escrow_mode,
+            'recovery_ready': escrow_mode != 'none',
+            'offsite_copy': offsite_copy,
+        })
+    finally:
+        try:
+            if os.path.exists(tmp_path) and tmp_path != _PBS_KEYFILE_PATH:
+                os.remove(tmp_path)
+        except OSError:
+            pass
+
+
+@app.route('/api/host-backups/pbs-encryption/download-keyfile', methods=['GET'])
+@require_auth
+def api_pbs_encryption_download_keyfile():
+    """Send the installed PBS keyfile as a downloadable attachment.
+    This is how the operator gets an offsite copy without exposing
+    the file over shell — they hit Download, save it somewhere safe
+    (USB, password manager, another host), and can later re-import
+    it on a reinstalled host via the same Import flow. Returns 404
+    when no keyfile is installed."""
+    if not os.path.isfile(_PBS_KEYFILE_PATH):
+        return jsonify({'error': 'no keyfile installed'}), 404
+    filename = f'pbs-key.conf'
+    try:
+        # send_file handles the streaming + Content-Disposition header;
+        # forcing as_attachment makes the browser show a save dialog
+        # instead of rendering the JSON inline.
+        return send_file(
+            _PBS_KEYFILE_PATH,
+            mimetype='application/octet-stream',
+            as_attachment=True,
+            download_name=filename,
+        )
+    except OSError as e:
+        return jsonify({'error': f'cannot read keyfile: {e}'}), 500
+
+
+@app.route('/api/host-backups/pbs-encryption/discover-pve-keyfiles', methods=['GET'])
+@require_auth
+def api_pbs_discover_pve_keyfiles():
+    """List PBS storage entries in /etc/pve/storage.cfg that carry an
+    encryption keyfile at /etc/pve/priv/storage/<NAME>.enc. When a
+    `repository` query param is provided, the entry (if any) whose
+    server + datastore match that repository is flagged with
+    `matches_repository: true` so the frontend can pre-select it as
+    the recommended import source.
+
+    Response:
+        {
+          entries: [
+            {name, server, datastore, path, matches_repository (bool)}
+          ]
+        }
+    """
+    repo = (request.args.get('repository') or '').strip()
+    matched = _pbs_pve_keyfile_for_repository(repo) if repo else {}
+    matched_path = matched.get('path', '') if matched else ''
+    entries = []
+    for e in _pbs_discover_pve_keyfiles():
+        entries.append({
+            **e,
+            'matches_repository': (bool(matched_path) and e['path'] == matched_path),
+        })
+    return jsonify({'entries': entries})
+
+
+@app.route('/api/host-backups/pbs-encryption/set-escrow-mode', methods=['POST'])
+@require_auth
+def api_pbs_set_escrow_mode():
+    """Change the escrow mode for an already-installed keyfile without
+    touching the keyfile itself.
+
+    Body:
+        escrow_mode: "none" | "local" | "full"
+        escrow_passphrase: <str>     # required when going to local/full
+                                     # or when current mode is 'none'
+
+    Transitions:
+      any → none:  drops the local envelope + /root offsite copy;
+                   writes mode='none'. Uploaded PBS envelopes are NOT
+                   touched (they stay recoverable with their original
+                   passphrase).
+      any → local/full:  encrypts a fresh envelope from the current
+                         keyfile with the provided passphrase. When
+                         going from 'none' the passphrase is mandatory;
+                         when just switching between local/full it is
+                         also required because we always rebuild the
+                         envelope so both modes stay consistent.
+    """
+    if not os.path.isfile(_PBS_KEYFILE_PATH):
+        return jsonify({'error': 'no keyfile installed'}), 404
+    payload = request.get_json(silent=True) or {}
+    new_mode = (payload.get('escrow_mode') or '').strip().lower()
+    if new_mode not in _PBS_ESCROW_MODES:
+        return jsonify({'error': f'escrow_mode must be one of {_PBS_ESCROW_MODES}'}), 400
+
+    if new_mode == 'none':
+        # Wipe local envelope + best-effort /root copies. Uploaded PBS
+        # blobs stay — the operator may still recover the old key via
+        # its old passphrase using the keyrecovery snapshot group.
+        for p in (_PBS_RECOVERY_ENC_PATH,):
+            try:
+                os.remove(p)
+            except FileNotFoundError:
+                pass
+            except OSError as e:
+                return jsonify({'error': f'cannot remove {p}: {e}'}), 500
+        _pbs_write_escrow_mode('none')
+        return jsonify({
+            'status': 'ok',
+            'escrow_mode': 'none',
+            'recovery_ready': False,
+        })
+
+    # new_mode is 'local' or 'full' → rebuild the envelope from scratch.
+    passphrase = payload.get('escrow_passphrase') or ''
+    if not passphrase:
+        return jsonify({'error': 'escrow_passphrase is required for local/full modes'}), 400
+    ok, offsite = _pbs_do_finalize_recovery(passphrase, new_mode)
+    if not ok:
+        return jsonify({'error': 'openssl encryption of the recovery envelope failed'}), 500
+    return jsonify({
+        'status': 'ok',
+        'escrow_mode': new_mode,
+        'recovery_ready': True,
+        'offsite_copy': offsite,
+    })
+
+
+@app.route('/api/host-backups/pbs-recovery/setup', methods=['POST'])
+@require_auth
+def api_pbs_recovery_setup():
+    """Create the escrow blob from the host keyfile, encrypted with
+    the operator's recovery passphrase. Body: {passphrase}. Idempotent
+    — re-running it with a new passphrase replaces the escrow.
+
+    If no keyfile is installed yet, one is generated on the spot before
+    the escrow is built. This lets the Create-job / Manual-backup Web
+    flow call this endpoint the moment the operator confirms the
+    passphrase (prompt-first, matching the CLI wizard): keyfile plus
+    recovery blob are both created atomically, so a valid job can be
+    stored right after with pbs_encrypt_mode='existing'. Previously
+    the endpoint 400'd with 'no PBS keyfile present' because the
+    keyfile was only materialised later, during job creation.
+
+    The blob is uploaded to PBS by the runner after every successful
+    encrypted backup (see _sb_run_pbs / hb_pbs_upload_recovery_blob),
+    so the operator can rebuild the keyfile from any host with just
+    the passphrase."""
+    payload = request.get_json(silent=True) or {}
+    passphrase = payload.get('passphrase') or ''
+    if not passphrase:
+        return jsonify({'error': 'passphrase is required'}), 400
+    if not shutil.which('openssl'):
+        return jsonify({'error': 'openssl is not installed; cannot create recovery blob'}), 500
+
+    # Materialise the keyfile if it isn't already there. A pre-existing
+    # keyfile is trusted and reused — we never rotate it silently.
+    if not os.path.isfile(_PBS_KEYFILE_PATH):
+        if not shutil.which('proxmox-backup-client'):
+            return jsonify({'error': 'proxmox-backup-client is not installed on this host'}), 500
+        if not _pbs_keyfile_get_or_create(True):
+            return jsonify({'error': 'failed to create PBS encryption keyfile'}), 500
+
+    if not _pbs_recovery_encrypt(passphrase, _PBS_KEYFILE_PATH, _PBS_RECOVERY_ENC_PATH):
+        return jsonify({'error': 'openssl encryption failed'}), 500
+    # Legacy setup implies the operator wants the full escrow behaviour
+    # (envelope uploaded to PBS by the runner). New callers should use
+    # /pbs-encryption/set-escrow-mode with an explicit mode, but this
+    # endpoint remains for compatibility with older Monitor builds.
+    _pbs_write_escrow_mode('full')
+    return jsonify({'status': 'ok', 'recovery_path': _PBS_RECOVERY_ENC_PATH})
+
+
+def _is_pbs_keyrecovery_backup_id(bid: str) -> bool:
+    """Match both the current `hostcfg-<host>-keyrecovery` naming
+    and the legacy `proxmenux-keyrecovery-<host>` naming so escrow
+    blobs uploaded by pre-1.2.2.2 builds remain discoverable and
+    stay hidden from the main host-backup list."""
+    if not bid:
+        return False
+    if bid.startswith('proxmenux-keyrecovery-'):
+        return True
+    return bid.startswith('hostcfg-') and bid.endswith('-keyrecovery')
+
+
+def _pbs_keyrecovery_source_host(bid: str) -> str:
+    """Extract the source hostname from either keyrecovery naming."""
+    if bid.startswith('hostcfg-') and bid.endswith('-keyrecovery'):
+        return bid[len('hostcfg-'):-len('-keyrecovery')]
+    if bid.startswith('proxmenux-keyrecovery-'):
+        return bid[len('proxmenux-keyrecovery-'):]
+    return bid
+
+
+@app.route('/api/host-backups/pbs-recovery/available', methods=['GET'])
+@require_auth
+def api_pbs_recovery_available():
+    """List keyrecovery backup groups across every configured PBS
+    repository. Two naming patterns are surfaced: the current
+    `hostcfg-<host>-keyrecovery` (paired with the main backup group
+    for visual adjacency in the PBS UI) and the legacy
+    `proxmenux-keyrecovery-<host>` used by pre-1.2.2.2 builds. The
+    restore flow uses this when the local keyfile is missing — the
+    operator picks a backup, types the recovery passphrase, and the
+    keyfile is rebuilt from the decrypted blob. Returns the freshest
+    backup per backup-id + repo so multi-host environments don't
+    bury each other."""
+    out: list = []
+    errors: list = []
+    for repo in _list_pbs_destinations():
+        pwd = _resolve_pbs_password(repo['name'])
+        if not pwd:
+            errors.append({'repo_name': repo['name'], 'error': 'no password available'})
+            continue
+        env = dict(os.environ)
+        env['PBS_PASSWORD'] = pwd
+        fp = _resolve_pbs_fingerprint(repo['name'])
+        if fp:
+            env['PBS_FINGERPRINT'] = fp
+        try:
+            r = subprocess.run(
+                ['proxmox-backup-client', 'snapshot', 'list',
+                 '--repository', repo['repository'], '--output-format', 'json'],
+                capture_output=True, text=True, timeout=30, env=env,
+            )
+        except (subprocess.TimeoutExpired, OSError) as e:
+            errors.append({'repo_name': repo['name'], 'error': str(e)})
+            continue
+        if r.returncode != 0:
+            errors.append({'repo_name': repo['name'], 'error': (r.stderr.strip() or r.stdout.strip())[:200]})
+            continue
+        try:
+            items = json.loads(r.stdout)
+        except (json.JSONDecodeError, ValueError):
+            continue
+        # Group by backup-id (per source host) and keep the newest.
+        latest: dict = {}
+        for it in items:
+            if it.get('backup-type') != 'host':
+                continue
+            bid = it.get('backup-id') or ''
+            if not _is_pbs_keyrecovery_backup_id(bid):
+                continue
+            t = it.get('backup-time', 0)
+            # ISO timestamp — proxmox-backup-client rejects the
+            # raw epoch with "unable to parse backup snapshot path".
+            from datetime import datetime, timezone
+            try:
+                iso = datetime.fromtimestamp(int(t), tz=timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ')
+            except (ValueError, OSError):
+                iso = str(t)
+            if bid not in latest or t > latest[bid]['backup_time']:
+                latest[bid] = {
+                    'repo_name': repo['name'],
+                    'repo_repository': repo['repository'],
+                    'backup_id': bid,
+                    'source_host': _pbs_keyrecovery_source_host(bid),
+                    'backup_time': t,
+                    'snapshot': f"host/{bid}/{iso}",
+                }
+        out.extend(latest.values())
+    out.sort(key=lambda x: x['backup_time'], reverse=True)
+    return jsonify({'snapshots': out, 'errors': errors})
+
+
+@app.route('/api/host-backups/pbs-recovery/restore', methods=['POST'])
+@require_auth
+def api_pbs_recovery_restore():
+    """Download a keyrecovery blob, decrypt with the operator's
+    passphrase, write the resulting key to /usr/local/share/proxmenux/
+    pbs-key.conf (chmod 0600). Body: {repo_name, snapshot, passphrase}.
+    Symmetric with the shell's hb_pbs_try_keyfile_recovery."""
+    payload = request.get_json(silent=True) or {}
+    repo_name = (payload.get('repo_name') or '').strip()
+    snapshot = (payload.get('snapshot') or '').strip()
+    passphrase = payload.get('passphrase') or ''
+    if not repo_name or not snapshot or not passphrase:
+        return jsonify({'error': 'repo_name, snapshot and passphrase are required'}), 400
+    if not shutil.which('openssl'):
+        return jsonify({'error': 'openssl is not installed'}), 500
+    # Resolve the PBS repository entry
+    repo = None
+    for r in _list_pbs_destinations():
+        if r.get('name') == repo_name:
+            repo = r
+            break
+    if not repo:
+        return jsonify({'error': f'PBS repository "{repo_name}" not found'}), 404
+    pwd = _resolve_pbs_password(repo_name)
+    if not pwd:
+        return jsonify({'error': f'no password available for PBS "{repo_name}"'}), 400
+    env = dict(os.environ)
+    env['PBS_PASSWORD'] = pwd
+    fp = _resolve_pbs_fingerprint(repo_name)
+    if fp:
+        env['PBS_FINGERPRINT'] = fp
+    # Download the blob to a temp file (NOT --keyfile; the blob is
+    # openssl-encrypted, not chunk-encrypted with PBS keyfile).
+    import tempfile
+    tmp_dir = tempfile.mkdtemp(prefix='pmnx_keyrec_')
+    blob_path = os.path.join(tmp_dir, 'keyrecovery.enc')
+    try:
+        r = subprocess.run(
+            ['proxmox-backup-client', 'restore', snapshot,
+             'keyrecovery.conf', blob_path,
+             '--repository', repo['repository']],
+            capture_output=True, text=True, timeout=60, env=env,
+        )
+        if r.returncode != 0:
+            return jsonify({'error': f'PBS restore failed: {(r.stderr.strip() or r.stdout.strip())[:200]}'}), 500
+        if not os.path.isfile(blob_path):
+            return jsonify({'error': 'PBS restore did not produce a blob'}), 500
+        # Decrypt to a temp file first; only rename onto the real
+        # keyfile path once decryption succeeds, so a failed attempt
+        # never overwrites a working keyfile.
+        tmp_key = os.path.join(tmp_dir, 'pbs-key.conf')
+        if not _pbs_recovery_decrypt(passphrase, blob_path, tmp_key):
+            return jsonify({'error': 'decryption failed — wrong passphrase, or the blob is corrupt'}), 400
+        try:
+            os.makedirs(_BACKUP_STATE_DIR, exist_ok=True)
+            shutil.move(tmp_key, _PBS_KEYFILE_PATH)
+            os.chmod(_PBS_KEYFILE_PATH, 0o600)
+        except OSError as e:
+            return jsonify({'error': f'failed to persist keyfile: {e}'}), 500
+        # Also re-create the local recovery blob so the operator
+        # doesn't immediately end up in the same state if they wipe
+        # this host again — the existing passphrase is reused.
+        _pbs_recovery_encrypt(passphrase, _PBS_KEYFILE_PATH, _PBS_RECOVERY_ENC_PATH)
+        return jsonify({'status': 'ok', 'keyfile_path': _PBS_KEYFILE_PATH})
+    finally:
+        try:
+            shutil.rmtree(tmp_dir, ignore_errors=True)
+        except OSError:
+            pass
+
+
+@app.route('/api/host-backups/pbs-recovery/setup', methods=['DELETE'])
+@require_auth
+def api_pbs_recovery_teardown():
+    """Drop the local escrow blob. Doesn't touch the copies already
+    uploaded to PBS — those stay until the operator prunes them on
+    the server side."""
+    if os.path.isfile(_PBS_RECOVERY_ENC_PATH):
+        try:
+            os.remove(_PBS_RECOVERY_ENC_PATH)
+        except OSError as e:
+            return jsonify({'error': str(e)}), 500
+    return jsonify({'status': 'ok'})
+
+
+def _resolve_pbs_password(repo_name: str) -> str:
+    """Return the PBS password for `repo_name`, looking in both the
+    proxmenux manual sidecar (`pbs-pass-<name>.txt`) and Proxmox's
+    own per-storage password file (`/etc/pve/priv/storage/<name>.pw`).
+
+    Manual configs win because they're explicitly typed by the operator;
+    Proxmox-managed PBS storages fall back to the second location which
+    is where `pvesm` and `pbs-client` write the credential for an
+    auto-discovered repo. Returns "" if neither file exists."""
+    sidecar = f'{_BACKUP_STATE_DIR}/pbs-pass-{repo_name}.txt'
+    if os.path.isfile(sidecar):
+        try:
+            with open(sidecar) as f:
+                pw = f.read().strip()
+                if pw:
+                    return pw
+        except OSError:
+            pass
+    pve_pw = f'/etc/pve/priv/storage/{repo_name}.pw'
+    if os.path.isfile(pve_pw):
+        try:
+            with open(pve_pw) as f:
+                return f.read().strip()
+        except OSError:
+            pass
+    return ''
+
+
+def _resolve_pbs_fingerprint(repo_name: str) -> str:
+    """Return the PBS fingerprint for `repo_name`. Symmetric to
+    _resolve_pbs_password: first the proxmenux manual sidecar
+    (`pbs-fingerprint-<name>.txt`), then the `fingerprint` line in
+    the matching `pbs:` block of /etc/pve/storage.cfg. Without this
+    fallback, `proxmox-backup-client` rejects the TLS handshake for
+    auto-discovered PBS storages with "Certificate fingerprint was
+    not confirmed."""
+    sidecar = f'{_BACKUP_STATE_DIR}/pbs-fingerprint-{repo_name}.txt'
+    if os.path.isfile(sidecar):
+        try:
+            with open(sidecar) as f:
+                fp = f.read().strip()
+                if fp:
+                    return fp
+        except OSError:
+            pass
+    # Walk storage.cfg looking for a `pbs: <repo_name>` block.
+    cfg_path = '/etc/pve/storage.cfg'
+    if not os.path.isfile(cfg_path):
+        return ''
+    try:
+        with open(cfg_path) as f:
+            in_block = False
+            for raw in f:
+                line = raw.rstrip('\n')
+                m = re.match(r'^([a-z]+):\s+(\S+)', line)
+                if m:
+                    in_block = (m.group(1) == 'pbs' and m.group(2) == repo_name)
+                    continue
+                if not in_block:
+                    continue
+                fm = re.match(r'^\s+fingerprint\s+(\S+)', line)
+                if fm:
+                    return fm.group(1).strip()
+    except OSError:
+        pass
+    return ''
+
+
+def _capacity_pbs(repo_name: str, repository: str) -> dict:
+    """`proxmox-backup-client status --output-format json` against the
+    datastore. Password resolution walks both the proxmenux sidecar
+    AND Proxmox's own `/etc/pve/priv/storage/<name>.pw` so PBS storages
+    auto-discovered from the Datacenter work out of the box."""
+    if not repository:
+        return {'error': 'no repository'}
+    env = dict(os.environ)
+    pw = _resolve_pbs_password(repo_name)
+    if pw:
+        env['PBS_PASSWORD'] = pw
+    fp = _resolve_pbs_fingerprint(repo_name)
+    if fp:
+        env['PBS_FINGERPRINT'] = fp
+    try:
+        # 30 s — `proxmox-backup-client status` is consistently fast
+        # against a healthy datastore but can stall on TLS handshake
+        # when the PBS server is under heavy GC / verify load. We'd
+        # rather make the operator wait than report a false "client
+        # error (Connect)" the way a tight 15 s timeout did.
+        r = subprocess.run(
+            ['proxmox-backup-client', 'status',
+             '--repository', repository, '--output-format', 'json'],
+            capture_output=True, text=True, timeout=30, env=env,
+        )
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return {'error': f'pbs status: {e}'}
+    if r.returncode != 0:
+        msg = (r.stderr.strip() or r.stdout.strip()).splitlines()
+        return {'error': (msg[-1] if msg else 'pbs status failed')[:200]}
+    try:
+        data = json.loads(r.stdout)
+    except (json.JSONDecodeError, ValueError):
+        return {'error': 'pbs json parse failed'}
+    total = data.get('total')
+    used = data.get('used')
+    avail = data.get('avail')
+    if not isinstance(total, (int, float)):
+        return {'error': 'pbs status missing fields'}
+    return {
+        'total': int(total),
+        'used': int(used) if isinstance(used, (int, float)) else None,
+        'available': int(avail) if isinstance(avail, (int, float)) else None,
+        'remote': True,
+    }
+
+
+@app.route('/api/host-backups/destinations/capacity', methods=['POST'])
+@require_auth
+def api_host_backups_dest_capacity():
+    """Capacity probe for a batch of destinations. Body:
+    {
+      targets: [
+        {id, kind: "local",      path},
+        {id, kind: "borg-local", path},
+        {id, kind: "borg-ssh",   host, user, remote_path, key_path?},
+        {id, kind: "pbs",        name, repository},
+      ]
+    }
+    Returns the same `id` back paired with the capacity payload so the
+    UI doesn't need to figure out which entry maps to which result.
+
+    Failures per-entry are not 500s — the whole call still returns 200
+    with `{error: "..."}` for the entries we couldn't measure."""
+    payload = request.get_json(silent=True) or {}
+    targets = payload.get('targets') or []
+    if not isinstance(targets, list):
+        return jsonify({'error': 'targets must be a list'}), 400
+    results: list = []
+    for t in targets:
+        if not isinstance(t, dict):
+            continue
+        tid = t.get('id')
+        kind = (t.get('kind') or '').strip()
+        cap: dict
+        if kind == 'local' or kind == 'borg-local':
+            cap = _capacity_local((t.get('path') or '').strip())
+        elif kind == 'borg-ssh':
+            cap = _capacity_borg_ssh(
+                (t.get('host') or '').strip(),
+                (t.get('user') or '').strip(),
+                (t.get('remote_path') or '').strip(),
+                (t.get('key_path') or '').strip(),
+            )
+        elif kind == 'pbs':
+            cap = _capacity_pbs(
+                (t.get('name') or '').strip(),
+                (t.get('repository') or '').strip(),
+            )
+        else:
+            cap = {'error': f'unknown kind: {kind}'}
+        results.append({'id': tid, **cap})
+    return jsonify({'results': results})
+
+
+@app.route('/api/host-backups/calendar-preview', methods=['POST'])
+@require_auth
+def api_host_backups_calendar_preview():
+    """Validate a systemd OnCalendar expression and return its
+    normalized form + next elapse, so the operator gets live feedback
+    while building the schedule in the UI."""
+    payload = request.get_json(silent=True) or {}
+    expr = (payload.get('expr') or '').strip()
+    if not expr:
+        return jsonify({'valid': False, 'error': 'empty expression'}), 200
+    try:
+        r = subprocess.run(
+            ['systemd-analyze', 'calendar', '--iterations=1', expr],
+            capture_output=True, text=True, timeout=5
+        )
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return jsonify({'valid': False, 'error': str(e)}), 200
+    if r.returncode != 0:
+        return jsonify({
+            'valid': False,
+            'error': (r.stderr.strip() or r.stdout.strip() or 'invalid expression'),
+        }), 200
+    normalized: str | None = None
+    next_elapse: str | None = None
+    from_now: str | None = None
+    for line in r.stdout.splitlines():
+        line = line.strip()
+        if line.startswith('Normalized form:'):
+            normalized = line.split(':', 1)[1].strip()
+        elif line.startswith('Next elapse:'):
+            next_elapse = line.split(':', 1)[1].strip()
+        elif line.startswith('From now:'):
+            from_now = line.split(':', 1)[1].strip()
+    return jsonify({
+        'valid': True,
+        'normalized': normalized,
+        'next_elapse': next_elapse,
+        'from_now': from_now,
+    }), 200
+
+
+_KEEP_FIELD_MAP = {
+    'keep_last': 'KEEP_LAST',
+    'keep_hourly': 'KEEP_HOURLY',
+    'keep_daily': 'KEEP_DAILY',
+    'keep_weekly': 'KEEP_WEEKLY',
+    'keep_monthly': 'KEEP_MONTHLY',
+    'keep_yearly': 'KEEP_YEARLY',
+}
+
+
+def _validate_on_calendar(expr: str) -> str | None:
+    """Validate a systemd OnCalendar expression. Returns None on success
+    or an error message describing why systemd rejected it."""
+    if not expr:
+        return 'on_calendar is required'
+    try:
+        r = subprocess.run(
+            ['systemd-analyze', 'calendar', expr],
+            capture_output=True, text=True, timeout=5
+        )
+        if r.returncode != 0:
+            return r.stderr.strip() or r.stdout.strip() or 'invalid OnCalendar expression'
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return f'systemd-analyze failed: {e}'
+    return None
+
+
+def _write_systemd_units(job_id: str, on_calendar: str) -> tuple[bool, str]:
+    """Write the .service + .timer units exactly as _write_job_units in
+    backup_scheduler.sh does, then daemon-reload. Returns (ok, error)."""
+    service_path = f'/etc/systemd/system/proxmenux-backup-{job_id}.service'
+    timer_path = f'/etc/systemd/system/proxmenux-backup-{job_id}.timer'
+    try:
+        with open(service_path, 'w') as f:
+            f.write(
+                f'[Unit]\n'
+                f'Description=ProxMenux Scheduled Backup Job ({job_id})\n'
+                f'After=network-online.target\n'
+                f'Wants=network-online.target\n'
+                f'\n'
+                f'[Service]\n'
+                f'Type=oneshot\n'
+                f'ExecStart={_BACKUP_RUNNER} {job_id}\n'
+                f'Nice=10\n'
+                f'IOSchedulingClass=best-effort\n'
+                f'IOSchedulingPriority=7\n'
+            )
+        with open(timer_path, 'w') as f:
+            f.write(
+                f'[Unit]\n'
+                f'Description=ProxMenux Scheduled Backup Timer ({job_id})\n'
+                f'\n'
+                f'[Timer]\n'
+                f'OnCalendar={on_calendar}\n'
+                f'Persistent=true\n'
+                f'RandomizedDelaySec=120\n'
+                f'Unit=proxmenux-backup-{job_id}.service\n'
+                f'\n'
+                f'[Install]\n'
+                f'WantedBy=timers.target\n'
+            )
+        subprocess.run(['systemctl', 'daemon-reload'], capture_output=True, timeout=10)
+        return True, ''
+    except OSError as e:
+        return False, str(e)
+
+
+@app.route('/api/host-backups/jobs', methods=['POST'])
+@require_auth
+def api_host_backups_job_create():
+    """Create a new host backup job. Supports both modes that
+    backup_scheduler.sh exposes:
+      - attached=true → inherits schedule + retention from a PVE
+        vzdump parent, no own timer (the vzdump hook fires it).
+      - attached=false → standalone systemd timer with the operator's
+        own OnCalendar + retention, runs via the same runner script."""
+    payload = request.get_json(silent=True) or {}
+
+    job_id = (payload.get('id') or '').strip()
+    backend = (payload.get('backend') or '').strip().lower()
+    attached = bool(payload.get('attached'))
+    profile_mode = (payload.get('profile_mode') or 'default').strip().lower()
+    paths = payload.get('paths') or []
+    enabled = payload.get('enabled')
+    if enabled is None:
+        enabled = True
+
+    if not _JOB_ID_RE.match(job_id):
+        return jsonify({'error': 'invalid id (use letters, digits, _ or -)'}), 400
+    if backend not in ('pbs', 'local', 'borg'):
+        return jsonify({'error': 'backend must be pbs, local or borg'}), 400
+    if profile_mode not in ('default', 'custom'):
+        return jsonify({'error': 'profile_mode must be default or custom'}), 400
+    if attached and backend == 'borg':
+        return jsonify({'error': 'borg is not a valid backend for attached jobs (PVE vzdump only writes to pbs/local storages)'}), 400
+
+    env_file = f'{_BACKUP_JOBS_DIR}/{job_id}.env'
+    if os.path.exists(env_file):
+        return jsonify({'error': f'job already exists: {job_id}'}), 409
+
+    # Mode-specific required fields
+    pve_parent = pve_storage = ''
+    on_calendar = ''
+    if attached:
+        pve_parent = (payload.get('pve_parent_job_id') or '').strip()
+        pve_storage = (payload.get('pve_storage') or '').strip()
+        if not pve_parent or not pve_storage:
+            return jsonify({'error': 'pve_parent_job_id and pve_storage are required for attached'}), 400
+    else:
+        on_calendar = (payload.get('on_calendar') or '').strip()
+        calendar_err = _validate_on_calendar(on_calendar)
+        if calendar_err:
+            return jsonify({'error': f'invalid on_calendar: {calendar_err}'}), 400
+
+    parent: dict | None = None
+    if attached:
+        # Verify the PVE job exists and matches the declared storage
+        pve_jobs = _list_pve_vzdump_jobs()
+        parent = next((j for j in pve_jobs if j['id'] == pve_parent), None)
+        if not parent:
+            return jsonify({'error': f'PVE vzdump job not found: {pve_parent}'}), 404
+        if parent.get('storage') != pve_storage:
+            return jsonify({'error': f"PVE job storage mismatch (job uses {parent.get('storage')}, payload says {pve_storage})"}), 400
+
+    # Resolve custom paths if requested, otherwise pull the default list
+    # from the shell so there is one source of truth.
+    if profile_mode == 'custom':
+        if not isinstance(paths, list) or not all(isinstance(p, str) and p.startswith('/') for p in paths):
+            return jsonify({'error': 'paths must be a list of absolute paths'}), 400
+        if not paths:
+            return jsonify({'error': 'custom profile needs at least one path'}), 400
+        resolved_paths = paths
+    else:
+        try:
+            r = subprocess.run(
+                ['bash', '-c',
+                 f'source {_BACKUP_LIB_SH}; declare -a paths=(); '
+                 f'hb_select_profile_paths default paths >/dev/null 2>&1; '
+                 f'printf "%s\\n" "${{paths[@]}}"'],
+                capture_output=True, text=True, timeout=10
+            )
+            resolved_paths = [p for p in r.stdout.splitlines() if p.strip()]
+        except (subprocess.TimeoutExpired, OSError):
+            resolved_paths = []
+        if not resolved_paths:
+            return jsonify({'error': 'could not resolve default profile paths'}), 500
+
+    # Build the canonical .env (same field names as backup_scheduler.sh)
+    lines = [
+        f'JOB_ID={job_id}',
+        f'BACKEND={backend}',
+    ]
+    if attached:
+        lines.append(f'PVE_PARENT_JOB={pve_parent}')
+        lines.append(f'PVE_STORAGE={pve_storage}')
+    else:
+        lines.append(f'ON_CALENDAR={on_calendar}')
+    lines.append(f'PROFILE_MODE={profile_mode}')
+    lines.append(f'ENABLED={"1" if enabled else "0"}')
+
+    # Retention
+    if attached:
+        # Inherited from the parent PVE job's prune-backups string
+        if parent and parent.get('prune'):
+            shell_mapping = {
+                'keep-last': 'KEEP_LAST',
+                'keep-hourly': 'KEEP_HOURLY',
+                'keep-daily': 'KEEP_DAILY',
+                'keep-weekly': 'KEEP_WEEKLY',
+                'keep-monthly': 'KEEP_MONTHLY',
+                'keep-yearly': 'KEEP_YEARLY',
+            }
+            for part in parent['prune'].split(','):
+                part = part.strip()
+                if '=' not in part:
+                    continue
+                k, v = part.split('=', 1)
+                if k in shell_mapping:
+                    lines.append(f'{shell_mapping[k]}={v}')
+    else:
+        # From operator-supplied retention object {keep_last, keep_daily, ...}
+        retention = payload.get('retention') or {}
+        if not isinstance(retention, dict):
+            return jsonify({'error': 'retention must be an object'}), 400
+        for key, env_key in _KEEP_FIELD_MAP.items():
+            v = retention.get(key)
+            if v is None or v == '':
+                continue
+            try:
+                n = int(v)
+            except (TypeError, ValueError):
+                return jsonify({'error': f'retention.{key} must be an integer'}), 400
+            if n < 0:
+                return jsonify({'error': f'retention.{key} must be non-negative'}), 400
+            if n > 0:
+                lines.append(f'{env_key}={n}')
+
+    # Backend-specific fields
+    if backend == 'pbs':
+        pbs_repo = (payload.get('pbs_repository') or '').strip()
+        pbs_pass = payload.get('pbs_password') or ''
+        if not pbs_repo:
+            return jsonify({'error': 'pbs_repository is required'}), 400
+        # When the operator picked an existing PBS destination from the
+        # dropdown the password isn't typed again — auto-resolve it from
+        # the saved configs (proxmenux manual sidecar OR /etc/pve/priv/
+        # storage/<name>.pw for PVE-managed PBS storages). Without this
+        # the runner ends up calling proxmox-backup-client with no
+        # PBS_PASSWORD and dies with "no password input mechanism".
+        if not pbs_pass:
+            for dest in _list_pbs_destinations():
+                if dest.get('repository') == pbs_repo:
+                    pbs_pass = _resolve_pbs_password(dest.get('name') or '')
+                    if pbs_pass:
+                        break
+        pbs_backup_id = (payload.get('pbs_backup_id') or '').strip()
+        if not pbs_backup_id:
+            import socket
+            pbs_backup_id = f'hostcfg-{socket.gethostname()}'
+        pbs_fingerprint = (payload.get('pbs_fingerprint') or '').strip()
+        # Client-side encryption. Three modes:
+        #   - "none"     — no --keyfile flag, plain backup
+        #   - "new"      — generate a fresh per-host keyfile (default,
+        #                  matches legacy `pbs_encrypt: true`)
+        #   - "existing" — reuse whatever keyfile is already installed
+        #                  at _PBS_KEYFILE_PATH (typical after the
+        #                  operator uploaded their own via
+        #                  /api/host-backups/pbs-encryption/import)
+        # Legacy compat: a truthy `pbs_encrypt` bool with no
+        # `pbs_encrypt_mode` maps to "new".
+        pbs_encrypt_mode = (payload.get('pbs_encrypt_mode') or '').strip().lower()
+        if not pbs_encrypt_mode:
+            pbs_encrypt_mode = 'new' if bool(payload.get('pbs_encrypt')) else 'none'
+        if pbs_encrypt_mode not in ('none', 'new', 'existing'):
+            return jsonify({'error': "pbs_encrypt_mode must be 'none', 'new' or 'existing'"}), 400
+
+        lines.append(f'PBS_REPOSITORY={pbs_repo}')
+        lines.append(f'PBS_PASSWORD={pbs_pass}')
+        lines.append(f'PBS_BACKUP_ID={pbs_backup_id}')
+        if pbs_fingerprint:
+            lines.append(f'PBS_FINGERPRINT={pbs_fingerprint}')
+
+        if pbs_encrypt_mode == 'new':
+            kf = _pbs_keyfile_get_or_create(True)
+            if not kf:
+                return jsonify({'error': 'failed to create PBS encryption keyfile (is proxmox-backup-client installed?)'}), 500
+            lines.append(f'PBS_KEYFILE={kf}')
+        elif pbs_encrypt_mode == 'existing':
+            # The keyfile must already be present — either from a
+            # previous run or from a fresh import via the dedicated
+            # endpoint. Fail loudly rather than silently generating
+            # a new one that would leave the user's own key unused.
+            if not os.path.isfile(_PBS_KEYFILE_PATH):
+                return jsonify({
+                    'error': (
+                        "pbs_encrypt_mode='existing' but no keyfile is installed at "
+                        f"{_PBS_KEYFILE_PATH} — import one first with "
+                        "POST /api/host-backups/pbs-encryption/import"
+                    ),
+                }), 400
+            lines.append(f'PBS_KEYFILE={_PBS_KEYFILE_PATH}')
+    elif backend == 'local':
+        explicit = (payload.get('local_dest_dir') or '').strip()
+        if explicit:
+            dest_dir = explicit.rstrip('/')
+        elif attached:
+            # Derive from the parent PVE storage path
+            dest_dir = None
+            try:
+                with open('/etc/pve/storage.cfg') as f:
+                    in_block = False
+                    for raw in f:
+                        line = raw.rstrip('\n')
+                        if re.match(rf'^[a-z]+:\s+{re.escape(pve_storage)}\s*$', line):
+                            in_block = True
+                            continue
+                        if in_block:
+                            if re.match(r'^[a-z]+:', line):
+                                break
+                            sp = re.match(r'^\s+path\s+(.+)$', line)
+                            if sp:
+                                dest_dir = f'{sp.group(1).rstrip("/")}/dump'
+                                break
+            except OSError:
+                pass
+            if not dest_dir:
+                dest_dir = '/var/lib/vz/dump'
+        else:
+            # Standalone: use the configured single local target
+            dest_dir = _get_local_target()['effective']
+        archive_ext = (payload.get('local_archive_ext') or 'tar.zst').strip()
+        lines.append(f'LOCAL_DEST_DIR={dest_dir}')
+        lines.append(f'LOCAL_ARCHIVE_EXT={archive_ext}')
+    elif backend == 'borg':
+        # Borg is timer-only — the attached check earlier rejected this combo.
+        # Passphrase + encrypt_mode now live on the destination: when the
+        # operator picks a saved borg destination, we inherit both from it
+        # instead of asking again per-job. The body can still override
+        # (typed-in passphrase / explicit encrypt_mode) for the case where
+        # the destination doesn't have those saved yet.
+        borg_repo = (payload.get('borg_repo') or '').strip()
+        if not borg_repo:
+            return jsonify({'error': 'borg_repo is required'}), 400
+        dest = _resolve_borg_destination_for_repo(borg_repo)
+        borg_pass = payload.get('borg_passphrase') or ''
+        if not borg_pass and dest:
+            borg_pass = _resolve_borg_passphrase(dest.get('name') or '')
+        borg_encrypt_raw = payload.get('borg_encrypt_mode')
+        if borg_encrypt_raw is None or borg_encrypt_raw == '':
+            borg_encrypt = (dest.get('encrypt_mode') if dest else None) or 'none'
+        else:
+            borg_encrypt = borg_encrypt_raw.strip().lower()
+        if borg_encrypt not in ('none', 'repokey', 'keyfile', 'authenticated'):
+            return jsonify({'error': 'borg_encrypt_mode must be one of: none, repokey, keyfile, authenticated'}), 400
+        if borg_encrypt != 'none' and not borg_pass:
+            return jsonify({'error': 'borg_passphrase is required when encryption is enabled (save it on the destination or pass one in the request)'}), 400
+        lines.append(f'BORG_REPO={borg_repo}')
+        lines.append(f'BORG_PASSPHRASE={borg_pass}')
+        lines.append(f'BORG_ENCRYPT_MODE={borg_encrypt}')
+
+    # Persist .env (rwx --- ---) and .paths
+    try:
+        os.makedirs(_BACKUP_JOBS_DIR, exist_ok=True)
+        with open(env_file, 'w') as f:
+            for ln in lines:
+                f.write(ln + '\n')
+        os.chmod(env_file, 0o600)
+        with open(f'{_BACKUP_JOBS_DIR}/{job_id}.paths', 'w') as f:
+            for p in resolved_paths:
+                f.write(p + '\n')
+        os.chmod(f'{_BACKUP_JOBS_DIR}/{job_id}.paths', 0o644)
+    except OSError as e:
+        return jsonify({'error': f'failed to write job files: {e}'}), 500
+
+    if attached:
+        # Idempotent hook install — preserves any pre-existing third-party hook.
+        if os.path.exists(_BACKUP_LIB_SH):
+            try:
+                subprocess.run(
+                    ['bash', '-c',
+                     f'source {_BACKUP_LIB_SH}; hb_install_vzdump_hook'],
+                    capture_output=True, timeout=10
+                )
+            except (subprocess.TimeoutExpired, OSError):
+                pass
+    else:
+        # Standalone timer: write units, daemon-reload, and enable the timer
+        # if the operator asked for it.
+        ok, err = _write_systemd_units(job_id, on_calendar)
+        if not ok:
+            try:
+                os.remove(env_file)
+                os.remove(f'{_BACKUP_JOBS_DIR}/{job_id}.paths')
+            except OSError:
+                pass
+            return jsonify({'error': f'failed to write systemd units: {err}'}), 500
+        if enabled:
+            r = subprocess.run(
+                ['systemctl', '--now', 'enable', f'proxmenux-backup-{job_id}.timer'],
+                capture_output=True, text=True, timeout=10
+            )
+            if r.returncode != 0:
+                return jsonify({
+                    'status': 'created-but-not-enabled',
+                    'job': _backup_job_summary(env_file),
+                    'warning': f'systemctl enable failed: {r.stderr.strip()}',
+                }), 201
+
+    return jsonify({
+        'status': 'ok',
+        'job': _backup_job_summary(env_file),
+    }), 201
+
+
+_BACKUP_SENSITIVE_FIELDS = ('PBS_PASSWORD', 'BORG_PASSPHRASE')
+
+
+def _backup_job_detail(env_file: str) -> dict:
+    """Full job info for the Edit dialog. Returns everything in the
+    .env (passwords censored as `has_password: bool`) plus the paths
+    listed in the matching .paths file. Mirrors what the CreateJob
+    wizard needs to pre-populate every field."""
+    summary = _backup_job_summary(env_file)
+    raw = _parse_job_env(env_file)
+    job_id = summary['id']
+
+    paths_file = f'{_BACKUP_JOBS_DIR}/{job_id}.paths'
+    paths: list = []
+    if os.path.exists(paths_file):
+        try:
+            with open(paths_file) as f:
+                paths = [ln.strip() for ln in f if ln.strip()]
+        except OSError:
+            pass
+
+    retention = {
+        'keep_last': raw.get('KEEP_LAST'),
+        'keep_hourly': raw.get('KEEP_HOURLY'),
+        'keep_daily': raw.get('KEEP_DAILY'),
+        'keep_weekly': raw.get('KEEP_WEEKLY'),
+        'keep_monthly': raw.get('KEEP_MONTHLY'),
+        'keep_yearly': raw.get('KEEP_YEARLY'),
+    }
+    # Find the most recent log for this job + a short tail. The runner
+    # writes per-run logs as `<job_id>-<ts>.log`. The Job detail modal
+    # needs the tail so the operator can see *why* a run failed without
+    # having to ssh into the host.
+    import glob as _glob
+    last_log_path: str | None = None
+    last_log_tail: list = []
+    last_log_size: int = 0
+    try:
+        candidates = sorted(
+            _glob.glob(f'{_BACKUP_LOG_DIR}/{job_id}-*.log'),
+            key=os.path.getmtime, reverse=True,
+        )
+        if candidates:
+            last_log_path = candidates[0]
+            last_log_size = os.path.getsize(last_log_path)
+            with open(last_log_path, 'r', errors='replace') as f:
+                lines = f.read().splitlines()
+            last_log_tail = lines[-80:]
+    except OSError:
+        pass
+
+    # Pull the canonical RESULT / RUN_AT out of the .status sidecar so
+    # the UI doesn't have to parse `last_status` itself just to show a
+    # green/red dot.
+    last_result: str | None = None
+    last_run_at: str | None = None
+    if summary.get('last_status'):
+        for ln in (summary['last_status'] or '').splitlines():
+            if ln.startswith('RESULT='):
+                last_result = ln.split('=', 1)[1].strip() or None
+            elif ln.startswith('RUN_AT='):
+                last_run_at = ln.split('=', 1)[1].strip() or None
+
+    detail = {
+        **summary,
+        'paths': paths,
+        'on_calendar_raw': raw.get('ON_CALENDAR') or None,
+        'pve_parent_job_id': raw.get('PVE_PARENT_JOB') or None,
+        'retention': {k: v for k, v in retention.items() if v is not None},
+        'pbs_repository': raw.get('PBS_REPOSITORY') or None,
+        'pbs_backup_id': raw.get('PBS_BACKUP_ID') or None,
+        'pbs_fingerprint': raw.get('PBS_FINGERPRINT') or None,
+        'has_pbs_password': bool(raw.get('PBS_PASSWORD')),
+        'pbs_encrypt': bool(raw.get('PBS_KEYFILE')),
+        # New: mode used the last time the job was created / edited.
+        # The .env only stores PBS_KEYFILE=<path>, so we can't tell
+        # "new" from "existing" after the fact — the edit flow just
+        # sees "encrypted" and defaults to "new" if the operator
+        # decides to reconfigure. Sending "new" whenever a keyfile is
+        # present matches the legacy pbs_encrypt bool: an edit that
+        # doesn't touch the mode dropdown produces the same .env.
+        'pbs_encrypt_mode': ('new' if raw.get('PBS_KEYFILE') else 'none'),
+        'local_dest_dir': raw.get('LOCAL_DEST_DIR') or None,
+        'local_archive_ext': raw.get('LOCAL_ARCHIVE_EXT') or None,
+        'borg_repo': raw.get('BORG_REPO') or None,
+        'borg_encrypt_mode': raw.get('BORG_ENCRYPT_MODE') or 'none',
+        'has_borg_passphrase': bool(raw.get('BORG_PASSPHRASE')),
+        'last_result': last_result,
+        'last_run_at': last_run_at,
+        'last_log_path': last_log_path,
+        'last_log_size': last_log_size,
+        'last_log_tail': last_log_tail,
+    }
+    return detail
+
+
+@app.route('/api/host-backups/jobs/<job_id>', methods=['GET'])
+@require_auth
+def api_host_backups_job_get(job_id):
+    """Fetch one job with all fields needed by the Edit dialog (paths,
+    full retention, backend-specific config). Passwords are NOT
+    returned; the UI only sees `has_pbs_password` / `has_borg_passphrase`
+    flags so the operator can choose to keep or replace them."""
+    if not _JOB_ID_RE.match(job_id):
+        return jsonify({'error': 'invalid job id'}), 400
+    env_file = f'{_BACKUP_JOBS_DIR}/{job_id}.env'
+    if not os.path.exists(env_file):
+        return jsonify({'error': 'job not found'}), 404
+    return jsonify(_backup_job_detail(env_file))
+
+
+@app.route('/api/host-backups/jobs/<job_id>/log', methods=['GET'])
+@require_auth
+def api_host_backups_job_log(job_id):
+    """Return the full log of the most recent run for this job. The
+    detail endpoint already ships an 80-line tail; this one is for the
+    operator who needs the whole thing (debugging a fail). Accepts
+    ?path=<override> to read a non-default log path so the same handler
+    can serve the running-task log polled by the Run flow."""
+    if not _JOB_ID_RE.match(job_id):
+        return jsonify({'error': 'invalid job id'}), 400
+    env_file = f'{_BACKUP_JOBS_DIR}/{job_id}.env'
+    if not os.path.exists(env_file):
+        return jsonify({'error': 'job not found'}), 404
+
+    override = (request.args.get('path') or '').strip()
+    log_path: str | None = None
+    if override:
+        # Constrain to /var/log/proxmenux to keep this from being an
+        # arbitrary-file-read primitive.
+        abs_o = os.path.abspath(override)
+        if abs_o.startswith('/var/log/proxmenux/') and os.path.isfile(abs_o):
+            log_path = abs_o
+    if not log_path:
+        import glob as _glob
+        cands = sorted(
+            _glob.glob(f'{_BACKUP_LOG_DIR}/{job_id}-*.log'),
+            key=os.path.getmtime, reverse=True,
+        )
+        if cands:
+            log_path = cands[0]
+    if not log_path:
+        return jsonify({'error': 'no log available for this job yet', 'log_path': None, 'content': ''})
+
+    try:
+        with open(log_path, 'r', errors='replace') as f:
+            content = f.read()
+    except OSError as e:
+        return jsonify({'error': str(e)}), 500
+    return jsonify({
+        'log_path': log_path,
+        'size': len(content),
+        'content': content,
+    })
+
+
+@app.route('/api/host-backups/jobs/<job_id>', methods=['PUT'])
+@require_auth
+def api_host_backups_job_update(job_id):
+    """Edit an existing job. The job id and attached/standalone mode
+    are immutable (operator must delete + recreate to change them).
+    Backend-specific passwords are kept if the payload omits them or
+    sends an empty string."""
+    if not _JOB_ID_RE.match(job_id):
+        return jsonify({'error': 'invalid job id'}), 400
+    env_file = f'{_BACKUP_JOBS_DIR}/{job_id}.env'
+    if not os.path.exists(env_file):
+        return jsonify({'error': 'job not found'}), 404
+
+    payload = request.get_json(silent=True) or {}
+    existing = _parse_job_env(env_file)
+    existing_attached = bool(existing.get('PVE_STORAGE'))
+    existing_backend = (existing.get('BACKEND') or '').lower()
+
+    # The only truly immutable field is the job id — it's the name of
+    # the .env, the systemd unit, and how the operator refers to the
+    # job everywhere. Backend (pbs/local/borg) and mode (attached vs
+    # standalone) can be switched on an existing job; the writer below
+    # builds the .env from scratch and reconciles unit files / hook.
+    if 'id' in payload and payload['id'] != job_id:
+        return jsonify({'error': 'job name cannot be changed (delete + recreate to rename)'}), 400
+
+    requested_backend = (payload.get('backend') or existing_backend).lower()
+    if requested_backend not in ('pbs', 'local', 'borg'):
+        return jsonify({'error': 'backend must be pbs, local or borg'}), 400
+    requested_attached = bool(payload['attached']) if 'attached' in payload else existing_attached
+    if requested_attached and requested_backend == 'borg':
+        return jsonify({'error': 'borg cannot be attached (PVE vzdump only writes to pbs/local storages)'}), 400
+
+    backend = requested_backend
+    attached = requested_attached
+    profile_mode = (payload.get('profile_mode') or existing.get('PROFILE_MODE') or 'default').strip().lower()
+    if profile_mode not in ('default', 'custom'):
+        return jsonify({'error': 'profile_mode must be default or custom'}), 400
+
+    enabled_raw = payload.get('enabled')
+    enabled = bool(enabled_raw) if enabled_raw is not None else (existing.get('ENABLED', '1') == '1')
+
+    on_calendar = ''
+    parent: dict | None = None
+    if attached:
+        pve_parent = (payload.get('pve_parent_job_id') or existing.get('PVE_PARENT_JOB') or '').strip()
+        pve_storage = (payload.get('pve_storage') or existing.get('PVE_STORAGE') or '').strip()
+        if not pve_parent or not pve_storage:
+            return jsonify({'error': 'pve_parent_job_id and pve_storage are required for attached'}), 400
+        pve_jobs = _list_pve_vzdump_jobs()
+        parent = next((j for j in pve_jobs if j['id'] == pve_parent), None)
+        if not parent:
+            return jsonify({'error': f'PVE vzdump job not found: {pve_parent}'}), 404
+        if parent.get('storage') != pve_storage:
+            return jsonify({'error': f"PVE job storage mismatch (job uses {parent.get('storage')}, payload says {pve_storage})"}), 400
+    else:
+        on_calendar = (payload.get('on_calendar') or existing.get('ON_CALENDAR') or '').strip()
+        calendar_err = _validate_on_calendar(on_calendar)
+        if calendar_err:
+            return jsonify({'error': f'invalid on_calendar: {calendar_err}'}), 400
+
+    # Resolve paths (same shape as POST)
+    paths = payload.get('paths')
+    if profile_mode == 'custom':
+        if paths is not None:
+            if not isinstance(paths, list) or not all(isinstance(p, str) and p.startswith('/') for p in paths):
+                return jsonify({'error': 'paths must be a list of absolute paths'}), 400
+            if not paths:
+                return jsonify({'error': 'custom profile needs at least one path'}), 400
+            resolved_paths = paths
+        else:
+            paths_file = f'{_BACKUP_JOBS_DIR}/{job_id}.paths'
+            if os.path.exists(paths_file):
+                try:
+                    with open(paths_file) as f:
+                        resolved_paths = [ln.strip() for ln in f if ln.strip()]
+                except OSError:
+                    resolved_paths = []
+            else:
+                resolved_paths = []
+            if not resolved_paths:
+                return jsonify({'error': 'custom profile needs at least one path'}), 400
+    else:
+        try:
+            r = subprocess.run(
+                ['bash', '-c',
+                 f'source {_BACKUP_LIB_SH}; declare -a paths=(); '
+                 f'hb_select_profile_paths default paths >/dev/null 2>&1; '
+                 f'printf "%s\\n" "${{paths[@]}}"'],
+                capture_output=True, text=True, timeout=10
+            )
+            resolved_paths = [p for p in r.stdout.splitlines() if p.strip()]
+        except (subprocess.TimeoutExpired, OSError):
+            resolved_paths = []
+        if not resolved_paths:
+            return jsonify({'error': 'could not resolve default profile paths'}), 500
+
+    # Build the new .env from scratch using the canonical field order.
+    lines = [
+        f'JOB_ID={job_id}',
+        f'BACKEND={backend}',
+    ]
+    if attached:
+        lines.append(f"PVE_PARENT_JOB={(payload.get('pve_parent_job_id') or existing.get('PVE_PARENT_JOB'))}")
+        lines.append(f"PVE_STORAGE={(payload.get('pve_storage') or existing.get('PVE_STORAGE'))}")
+    else:
+        lines.append(f'ON_CALENDAR={on_calendar}')
+    lines.append(f'PROFILE_MODE={profile_mode}')
+    lines.append(f'ENABLED={"1" if enabled else "0"}')
+
+    # Retention
+    if attached:
+        if parent and parent.get('prune'):
+            shell_mapping = {
+                'keep-last': 'KEEP_LAST',
+                'keep-hourly': 'KEEP_HOURLY',
+                'keep-daily': 'KEEP_DAILY',
+                'keep-weekly': 'KEEP_WEEKLY',
+                'keep-monthly': 'KEEP_MONTHLY',
+                'keep-yearly': 'KEEP_YEARLY',
+            }
+            for part in parent['prune'].split(','):
+                part = part.strip()
+                if '=' not in part:
+                    continue
+                k, v = part.split('=', 1)
+                if k in shell_mapping:
+                    lines.append(f'{shell_mapping[k]}={v}')
+    else:
+        retention = payload.get('retention')
+        if retention is None:
+            # Keep existing retention if the operator didn't touch the form
+            for env_key in _KEEP_FIELD_MAP.values():
+                v = existing.get(env_key)
+                if v and str(v) != '0':
+                    lines.append(f'{env_key}={v}')
+        else:
+            if not isinstance(retention, dict):
+                return jsonify({'error': 'retention must be an object'}), 400
+            for key, env_key in _KEEP_FIELD_MAP.items():
+                v = retention.get(key)
+                if v is None or v == '':
+                    continue
+                try:
+                    n = int(v)
+                except (TypeError, ValueError):
+                    return jsonify({'error': f'retention.{key} must be an integer'}), 400
+                if n < 0:
+                    return jsonify({'error': f'retention.{key} must be non-negative'}), 400
+                if n > 0:
+                    lines.append(f'{env_key}={n}')
+
+    # Backend-specific
+    if backend == 'pbs':
+        pbs_repo = (payload.get('pbs_repository') or existing.get('PBS_REPOSITORY') or '').strip()
+        if not pbs_repo:
+            return jsonify({'error': 'pbs_repository is required'}), 400
+        # Empty-string password means "keep the existing one"; missing
+        # password key also means keep. Replacement only happens when
+        # the operator typed something new. If the stored password is
+        # ALSO empty (e.g. job created against a PVE-managed PBS where
+        # the password lives in /etc/pve/priv/storage/<name>.pw), fall
+        # through to _resolve_pbs_password so the runner doesn't choke.
+        new_pass = payload.get('pbs_password')
+        if new_pass is None or new_pass == '':
+            pbs_pass = existing.get('PBS_PASSWORD', '')
+        else:
+            pbs_pass = new_pass
+        if not pbs_pass:
+            for dest in _list_pbs_destinations():
+                if dest.get('repository') == pbs_repo:
+                    pbs_pass = _resolve_pbs_password(dest.get('name') or '')
+                    if pbs_pass:
+                        break
+        pbs_backup_id = (payload.get('pbs_backup_id') or existing.get('PBS_BACKUP_ID') or '').strip()
+        if not pbs_backup_id:
+            import socket
+            pbs_backup_id = f'hostcfg-{socket.gethostname()}'
+        pbs_fingerprint = (payload.get('pbs_fingerprint') or existing.get('PBS_FINGERPRINT') or '').strip()
+        # Encryption: matches job-create + manual-run. The Web sends
+        # `pbs_encrypt_mode` ("none" / "new" / "existing"); older
+        # clients may still send the legacy `pbs_encrypt` bool.
+        # Absent field on edit means "keep the current state" — so
+        # a partial payload doesn't accidentally turn encryption off.
+        # Before this fix the endpoint only looked at `pbs_encrypt`
+        # and defaulted to `bool(existing PBS_KEYFILE)` when absent,
+        # which meant unchecking the box in the Edit dialog was a
+        # no-op because the new UI sends `pbs_encrypt_mode` instead.
+        pbs_encrypt_mode = (payload.get('pbs_encrypt_mode') or '').strip().lower()
+        if not pbs_encrypt_mode:
+            if 'pbs_encrypt' in payload:
+                pbs_encrypt_mode = 'new' if bool(payload.get('pbs_encrypt')) else 'none'
+            else:
+                pbs_encrypt_mode = 'existing' if existing.get('PBS_KEYFILE') else 'none'
+        if pbs_encrypt_mode not in ('none', 'new', 'existing'):
+            return jsonify({'error': "pbs_encrypt_mode must be 'none', 'new' or 'existing'"}), 400
+        lines.append(f'PBS_REPOSITORY={pbs_repo}')
+        lines.append(f'PBS_PASSWORD={pbs_pass}')
+        lines.append(f'PBS_BACKUP_ID={pbs_backup_id}')
+        if pbs_encrypt_mode == 'new':
+            kf = _pbs_keyfile_get_or_create(True)
+            if not kf:
+                return jsonify({'error': 'failed to create PBS encryption keyfile'}), 500
+            lines.append(f'PBS_KEYFILE={kf}')
+        elif pbs_encrypt_mode == 'existing':
+            if not os.path.isfile(_PBS_KEYFILE_PATH):
+                return jsonify({
+                    'error': (
+                        "pbs_encrypt_mode='existing' but no keyfile is installed at "
+                        f"{_PBS_KEYFILE_PATH} — import one first with "
+                        "POST /api/host-backups/pbs-encryption/import"
+                    ),
+                }), 400
+            lines.append(f'PBS_KEYFILE={_PBS_KEYFILE_PATH}')
+        # else 'none' → no PBS_KEYFILE line written → job runs unencrypted
+        if pbs_fingerprint:
+            lines.append(f'PBS_FINGERPRINT={pbs_fingerprint}')
+    elif backend == 'local':
+        explicit = (payload.get('local_dest_dir') or '').strip()
+        if explicit:
+            dest_dir = explicit.rstrip('/')
+        else:
+            dest_dir = existing.get('LOCAL_DEST_DIR') or _get_local_target()['effective']
+        archive_ext = (payload.get('local_archive_ext') or existing.get('LOCAL_ARCHIVE_EXT') or 'tar.zst').strip()
+        lines.append(f'LOCAL_DEST_DIR={dest_dir}')
+        lines.append(f'LOCAL_ARCHIVE_EXT={archive_ext}')
+    elif backend == 'borg':
+        borg_repo = (payload.get('borg_repo') or existing.get('BORG_REPO') or '').strip()
+        if not borg_repo:
+            return jsonify({'error': 'borg_repo is required'}), 400
+        dest = _resolve_borg_destination_for_repo(borg_repo)
+        # Encryption mode: payload > existing .env > destination > "none".
+        borg_encrypt = (payload.get('borg_encrypt_mode')
+                        or existing.get('BORG_ENCRYPT_MODE')
+                        or (dest.get('encrypt_mode') if dest else None)
+                        or 'none').strip().lower()
+        if borg_encrypt not in ('none', 'repokey', 'keyfile', 'authenticated'):
+            return jsonify({'error': 'borg_encrypt_mode must be one of: none, repokey, keyfile, authenticated'}), 400
+        new_pass = payload.get('borg_passphrase')
+        if new_pass is None or new_pass == '':
+            borg_pass = existing.get('BORG_PASSPHRASE', '')
+        else:
+            borg_pass = new_pass
+        if not borg_pass and dest:
+            borg_pass = _resolve_borg_passphrase(dest.get('name') or '')
+        if borg_encrypt != 'none' and not borg_pass:
+            return jsonify({'error': 'borg_passphrase is required when encryption is enabled (save it on the destination or pass one in the request)'}), 400
+        lines.append(f'BORG_REPO={borg_repo}')
+        lines.append(f'BORG_PASSPHRASE={borg_pass}')
+        lines.append(f'BORG_ENCRYPT_MODE={borg_encrypt}')
+
+    # Atomically rewrite .env (rwx --- ---) and .paths
+    try:
+        tmp_env = f'{env_file}.tmp.{os.getpid()}'
+        with open(tmp_env, 'w') as f:
+            for ln in lines:
+                f.write(ln + '\n')
+        os.chmod(tmp_env, 0o600)
+        os.replace(tmp_env, env_file)
+        paths_file = f'{_BACKUP_JOBS_DIR}/{job_id}.paths'
+        tmp_paths = f'{paths_file}.tmp.{os.getpid()}'
+        with open(tmp_paths, 'w') as f:
+            for p in resolved_paths:
+                f.write(p + '\n')
+        os.chmod(tmp_paths, 0o644)
+        os.replace(tmp_paths, paths_file)
+    except OSError as e:
+        return jsonify({'error': f'failed to write job files: {e}'}), 500
+
+    if attached:
+        # If the job used to be standalone, its .service + .timer are
+        # now obsolete. Disable + remove them before installing the hook
+        # so the operator doesn't have a stale timer firing alongside.
+        if not existing_attached:
+            timer_unit = f'proxmenux-backup-{job_id}.timer'
+            subprocess.run(
+                ['systemctl', '--now', 'disable', timer_unit],
+                capture_output=True, timeout=10
+            )
+            for f in (
+                f'/etc/systemd/system/proxmenux-backup-{job_id}.service',
+                f'/etc/systemd/system/proxmenux-backup-{job_id}.timer',
+            ):
+                try:
+                    if os.path.exists(f):
+                        os.remove(f)
+                except OSError:
+                    pass
+            subprocess.run(['systemctl', 'daemon-reload'], capture_output=True, timeout=10)
+        if os.path.exists(_BACKUP_LIB_SH):
+            try:
+                subprocess.run(
+                    ['bash', '-c', f'source {_BACKUP_LIB_SH}; hb_install_vzdump_hook'],
+                    capture_output=True, timeout=10
+                )
+            except (subprocess.TimeoutExpired, OSError):
+                pass
+    else:
+        # Rewrite the timer (schedule may have changed) and reconcile
+        # the timer state with `enabled`. If the job used to be
+        # attached, no units existed yet — _write_systemd_units creates
+        # both fresh and daemon-reloads.
+        ok, err = _write_systemd_units(job_id, on_calendar)
+        if not ok:
+            return jsonify({'error': f'failed to update systemd units: {err}'}), 500
+        timer_unit = f'proxmenux-backup-{job_id}.timer'
+        action = 'enable' if enabled else 'disable'
+        subprocess.run(
+            ['systemctl', '--now', action, timer_unit],
+            capture_output=True, timeout=10
+        )
+
+    return jsonify({
+        'status': 'ok',
+        'job': _backup_job_summary(env_file),
+    })
+
+
+@app.route('/api/host-backups/manual-run', methods=['POST'])
+@require_auth
+def api_host_backups_manual_run():
+    """Fire a one-shot host backup. Reuses the same .env + runner the
+    scheduler uses — the only difference is the job is born disabled,
+    has no schedule, no retention, and is flagged with MANUAL_RUN=1 so
+    the UI can render it differently. The .env is left on disk so the
+    operator can see the result and decide when to clean it up."""
+    payload = request.get_json(silent=True) or {}
+
+    backend = (payload.get('backend') or '').strip().lower()
+    if backend not in ('pbs', 'local', 'borg'):
+        return jsonify({'error': 'backend must be pbs, local or borg'}), 400
+    profile_mode = (payload.get('profile_mode') or 'default').strip().lower()
+    if profile_mode not in ('default', 'custom'):
+        return jsonify({'error': 'profile_mode must be default or custom'}), 400
+
+    # Resolve paths
+    if profile_mode == 'custom':
+        paths = payload.get('paths') or []
+        if not isinstance(paths, list) or not all(isinstance(p, str) and p.startswith('/') for p in paths):
+            return jsonify({'error': 'paths must be a list of absolute paths'}), 400
+        if not paths:
+            return jsonify({'error': 'custom profile needs at least one path'}), 400
+        resolved_paths = paths
+    else:
+        try:
+            r = subprocess.run(
+                ['bash', '-c',
+                 f'source {_BACKUP_LIB_SH}; declare -a paths=(); '
+                 f'hb_select_profile_paths default paths >/dev/null 2>&1; '
+                 f'printf "%s\\n" "${{paths[@]}}"'],
+                capture_output=True, text=True, timeout=10
+            )
+            resolved_paths = [p for p in r.stdout.splitlines() if p.strip()]
+        except (subprocess.TimeoutExpired, OSError):
+            resolved_paths = []
+        if not resolved_paths:
+            return jsonify({'error': 'could not resolve default profile paths'}), 500
+
+    # Auto-generate a non-colliding job id from the current time.
+    from datetime import datetime
+    base_id = f'manual-{datetime.now().strftime("%Y%m%d-%H%M%S")}'
+    job_id = base_id
+    suffix = 1
+    while os.path.exists(f'{_BACKUP_JOBS_DIR}/{job_id}.env'):
+        suffix += 1
+        job_id = f'{base_id}-{suffix}'
+
+    lines = [
+        f'JOB_ID={job_id}',
+        f'BACKEND={backend}',
+        f'PROFILE_MODE={profile_mode}',
+        'ENABLED=0',
+        'MANUAL_RUN=1',
+    ]
+
+    if backend == 'pbs':
+        pbs_repo = (payload.get('pbs_repository') or '').strip()
+        if not pbs_repo:
+            return jsonify({'error': 'pbs_repository is required'}), 400
+        pbs_pass = payload.get('pbs_password') or ''
+        pbs_backup_id = (payload.get('pbs_backup_id') or '').strip()
+        if not pbs_backup_id:
+            import socket
+            # Unified naming with scheduled/TUI runs (run_scheduled_backup.sh
+            # and backup_host.sh both default to `hostcfg-<host>`). Keeping
+            # the `-manual` suffix split snapshots into two PBS groups for
+            # the same host, breaking the dedup view and forcing restore to
+            # check both groups. Operators can still override the id in the
+            # form when they need a separate retention bucket.
+            pbs_backup_id = f'hostcfg-{socket.gethostname()}'
+        pbs_fingerprint = (payload.get('pbs_fingerprint') or '').strip()
+        # Encryption mode: matches the job-create endpoint exactly.
+        # Reads the modern `pbs_encrypt_mode` string ("none"/"new"/
+        # "existing") first, falls back to legacy `pbs_encrypt` bool
+        # only if the modern field is absent. Both dialogs on the
+        # front-end send the modern field — the older ManualBackup
+        # code path was ignoring it and silently downgrading every
+        # encrypted manual backup to plain because it only looked at
+        # the legacy `pbs_encrypt` boolean, which the front-end
+        # stopped sending.
+        pbs_encrypt_mode = (payload.get('pbs_encrypt_mode') or '').strip().lower()
+        if not pbs_encrypt_mode:
+            pbs_encrypt_mode = 'new' if bool(payload.get('pbs_encrypt')) else 'none'
+        if pbs_encrypt_mode not in ('none', 'new', 'existing'):
+            return jsonify({'error': "pbs_encrypt_mode must be 'none', 'new' or 'existing'"}), 400
+        lines.append(f'PBS_REPOSITORY={pbs_repo}')
+        lines.append(f'PBS_PASSWORD={pbs_pass}')
+        lines.append(f'PBS_BACKUP_ID={pbs_backup_id}')
+        if pbs_fingerprint:
+            lines.append(f'PBS_FINGERPRINT={pbs_fingerprint}')
+        if pbs_encrypt_mode == 'new':
+            kf = _pbs_keyfile_get_or_create(True)
+            if not kf:
+                return jsonify({'error': 'failed to create PBS encryption keyfile'}), 500
+            lines.append(f'PBS_KEYFILE={kf}')
+        elif pbs_encrypt_mode == 'existing':
+            if not os.path.isfile(_PBS_KEYFILE_PATH):
+                return jsonify({
+                    'error': (
+                        "pbs_encrypt_mode='existing' but no keyfile is installed at "
+                        f"{_PBS_KEYFILE_PATH} — import one first with "
+                        "POST /api/host-backups/pbs-encryption/import"
+                    ),
+                }), 400
+            lines.append(f'PBS_KEYFILE={_PBS_KEYFILE_PATH}')
+    elif backend == 'local':
+        explicit = (payload.get('local_dest_dir') or '').strip()
+        dest_dir = explicit.rstrip('/') if explicit else _get_local_target()['effective']
+        archive_ext = (payload.get('local_archive_ext') or 'tar.zst').strip()
+        lines.append(f'LOCAL_DEST_DIR={dest_dir}')
+        lines.append(f'LOCAL_ARCHIVE_EXT={archive_ext}')
+    elif backend == 'borg':
+        borg_repo = (payload.get('borg_repo') or '').strip()
+        if not borg_repo:
+            return jsonify({'error': 'borg_repo is required'}), 400
+        dest = _resolve_borg_destination_for_repo(borg_repo)
+        borg_encrypt_raw = payload.get('borg_encrypt_mode')
+        if borg_encrypt_raw is None or borg_encrypt_raw == '':
+            borg_encrypt = (dest.get('encrypt_mode') if dest else None) or 'none'
+        else:
+            borg_encrypt = borg_encrypt_raw.strip().lower()
+        if borg_encrypt not in ('none', 'repokey', 'keyfile', 'authenticated'):
+            return jsonify({'error': 'borg_encrypt_mode must be one of: none, repokey, keyfile, authenticated'}), 400
+        borg_pass = payload.get('borg_passphrase') or ''
+        if not borg_pass and dest:
+            borg_pass = _resolve_borg_passphrase(dest.get('name') or '')
+        if borg_encrypt != 'none' and not borg_pass:
+            return jsonify({'error': 'borg_passphrase is required when encryption is enabled (save it on the destination or pass one in the request)'}), 400
+        lines.append(f'BORG_REPO={borg_repo}')
+        lines.append(f'BORG_PASSPHRASE={borg_pass}')
+        lines.append(f'BORG_ENCRYPT_MODE={borg_encrypt}')
+
+    env_file = f'{_BACKUP_JOBS_DIR}/{job_id}.env'
+    paths_file = f'{_BACKUP_JOBS_DIR}/{job_id}.paths'
+    try:
+        os.makedirs(_BACKUP_JOBS_DIR, exist_ok=True)
+        with open(env_file, 'w') as f:
+            for ln in lines:
+                f.write(ln + '\n')
+        os.chmod(env_file, 0o600)
+        with open(paths_file, 'w') as f:
+            for p in resolved_paths:
+                f.write(p + '\n')
+        os.chmod(paths_file, 0o644)
+    except OSError as e:
+        return jsonify({'error': f'failed to write job files: {e}'}), 500
+
+    if not os.path.exists(_BACKUP_RUNNER):
+        return jsonify({'error': 'runner script not installed'}), 500
+    try:
+        subprocess.Popen(
+            ['bash', _BACKUP_RUNNER, job_id],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            stdin=subprocess.DEVNULL,
+            close_fds=True,
+            start_new_session=True,
+        )
+    except OSError as e:
+        return jsonify({'error': f'failed to start: {e}'}), 500
+
+    return jsonify({'status': 'started', 'job_id': job_id}), 202
+
+
+# ── Sprint D: Backup destinations CRUD ─────────────────────────────
+#
+# All three persistence files live in $HB_STATE_DIR and follow the
+# exact format the shell scheduler reads/writes, so anything created
+# from the Monitor is visible to the shell menu and vice versa.
+
+_DEST_NAME_RE = re.compile(r'^[a-zA-Z0-9_-]+$')
+
+
+def _safe_dest_name(s: str) -> str | None:
+    s = (s or '').strip()
+    if not s or not _DEST_NAME_RE.match(s):
+        return None
+    return s
+
+
+@app.route('/api/host-backups/destinations/local', methods=['POST'])
+@require_auth
+def api_host_backups_dest_local_set():
+    """Add a custom local destination path. Body: {path: string}.
+
+    Local destinations are append-only from the API — the new path is
+    stacked onto local-target.conf rather than replacing whatever was
+    there. The /var/lib/vz/dump default is always implicit and isn't
+    written into the file.
+
+    Returns 409 if the same path is already saved (default or custom)
+    so the UI can surface the conflict instead of silently no-op."""
+    payload = request.get_json(silent=True) or {}
+    path = (payload.get('path') or '').strip()
+    if not path:
+        return jsonify({'error': 'path is required'}), 400
+    if not path.startswith('/'):
+        return jsonify({'error': 'path must be absolute'}), 400
+    path = path.rstrip('/') or '/'
+    if path == _LOCAL_DEFAULT_PATH:
+        return jsonify({'error': f'{_LOCAL_DEFAULT_PATH} is the built-in default; no need to add it'}), 409
+    existing = _read_local_target_paths()
+    if path in existing:
+        return jsonify({'error': 'this path is already configured'}), 409
+    existing.append(path)
+    cfg = f'{_BACKUP_STATE_DIR}/local-target.conf'
+    try:
+        os.makedirs(_BACKUP_STATE_DIR, exist_ok=True)
+        with open(cfg, 'w') as f:
+            for p in existing:
+                f.write(p + '\n')
+        os.chmod(cfg, 0o600)
+    except OSError as e:
+        return jsonify({'error': f'failed to write local-target.conf: {e}'}), 500
+    return jsonify({'status': 'ok', 'path': path, 'count': len(existing) + 1})
+
+
+@app.route('/api/host-backups/destinations/local', methods=['DELETE'])
+@require_auth
+def api_host_backups_dest_local_clear():
+    """Remove a custom local destination. Body or query: {path: string}.
+
+    With a `path`, only that entry is removed (404 if not custom). With
+    no path the file is wiped entirely, leaving only the built-in
+    /var/lib/vz/dump default — kept for backwards compat with the
+    earlier single-path UI."""
+    target = (request.args.get('path') or '').strip()
+    if not target:
+        payload = request.get_json(silent=True) or {}
+        target = (payload.get('path') or '').strip()
+    cfg = f'{_BACKUP_STATE_DIR}/local-target.conf'
+    if not target:
+        try:
+            if os.path.exists(cfg):
+                os.remove(cfg)
+        except OSError as e:
+            return jsonify({'error': str(e)}), 500
+        return jsonify({'status': 'ok', 'cleared_all': True})
+
+    target = target.rstrip('/') or '/'
+    if target == _LOCAL_DEFAULT_PATH:
+        return jsonify({'error': f'{_LOCAL_DEFAULT_PATH} is the built-in default and cannot be removed'}), 400
+    existing = _read_local_target_paths()
+    if target not in existing:
+        return jsonify({'error': 'path not found'}), 404
+    force = (request.args.get('force') or '').lower() in ('1', 'true', 'yes')
+    cascaded: list = []
+    if force:
+        for jid in _jobs_using_local(target):
+            _delete_job_internal(jid)
+            cascaded.append(jid)
+    remaining = [p for p in existing if p != target]
+    try:
+        if remaining:
+            with open(cfg, 'w') as f:
+                for p in remaining:
+                    f.write(p + '\n')
+            os.chmod(cfg, 0o600)
+        elif os.path.exists(cfg):
+            os.remove(cfg)
+    except OSError as e:
+        return jsonify({'error': str(e)}), 500
+    return jsonify({'status': 'ok', 'removed': target, 'jobs_removed': cascaded})
+
+
+@app.route('/api/host-backups/destinations/borg', methods=['POST'])
+@require_auth
+def api_host_backups_dest_borg_add():
+    """Add a Borg target. Body modes:
+      - mode="local": {name, repo}                — repo is an absolute
+        path on this host (covers USB-mounted directories too).
+      - mode="ssh":   {name, ssh_user, ssh_host,
+                       ssh_remote_path, ssh_key_path?} — builds
+        ssh://user@host/path and persists the ssh_key_path on the
+        3rd field of borg-targets.txt.
+    Replaces an existing entry with the same name."""
+    payload = request.get_json(silent=True) or {}
+    name = _safe_dest_name(payload.get('name'))
+    if not name:
+        return jsonify({'error': 'name is required (letters, digits, _ or -)'}), 400
+    mode = (payload.get('mode') or 'local').strip().lower()
+    ssh_key = ''
+    if mode == 'ssh':
+        user = (payload.get('ssh_user') or '').strip()
+        host = (payload.get('ssh_host') or '').strip()
+        rpath = (payload.get('ssh_remote_path') or '').strip().lstrip('/')
+        if not user or not host or not rpath:
+            return jsonify({'error': 'ssh_user, ssh_host and ssh_remote_path are required for ssh mode'}), 400
+        repo = f'ssh://{user}@{host}/{rpath}'
+        ssh_key = (payload.get('ssh_key_path') or '').strip()
+    elif mode == 'local':
+        repo = (payload.get('repo') or '').strip()
+        if not repo:
+            return jsonify({'error': 'repo is required'}), 400
+        ssh_key = (payload.get('ssh_key') or '').strip()
+    else:
+        return jsonify({'error': 'mode must be "local" or "ssh"'}), 400
+
+    # Encryption + passphrase live on the DESTINATION, not on each job.
+    # `encrypt_mode` is one of: none, repokey, keyfile, authenticated
+    # (the UI exposes only `none`/`repokey`; the others stay supported
+    # so existing shell-created configs aren't downgraded). The body
+    # may carry `passphrase`; if set and non-empty we persist it next
+    # to the config in `borg-pass-<name>.txt` (chmod 0600).
+    encrypt_mode = (payload.get('encrypt_mode') or 'repokey').strip().lower()
+    if encrypt_mode not in ('none', 'repokey', 'keyfile', 'authenticated'):
+        return jsonify({'error': 'encrypt_mode must be one of: none, repokey, keyfile, authenticated'}), 400
+    passphrase = payload.get('passphrase') or ''
+    # POST is upsert-by-name: in edit mode we keep the saved passphrase
+    # when the caller doesn't send a new one. Only required when there
+    # is no saved one AND encryption is enabled.
+    existing_pp = ''
+    pass_file_existing = f'{_BACKUP_STATE_DIR}/borg-pass-{name}.txt'
+    if os.path.isfile(pass_file_existing):
+        try:
+            with open(pass_file_existing) as f:
+                existing_pp = f.read().strip()
+        except OSError:
+            pass
+    if encrypt_mode != 'none' and not passphrase and not existing_pp:
+        return jsonify({'error': 'passphrase is required when encryption is enabled'}), 400
+    if encrypt_mode != 'none' and not passphrase:
+        passphrase = existing_pp
+
+    cfg = f'{_BACKUP_STATE_DIR}/borg-targets.txt'
+    try:
+        os.makedirs(_BACKUP_STATE_DIR, exist_ok=True)
+        existing_lines: list = []
+        if os.path.exists(cfg):
+            with open(cfg) as f:
+                for ln in f:
+                    if ln.startswith(f'{name}|'):
+                        continue
+                    existing_lines.append(ln.rstrip('\n'))
+        existing_lines.append(f'{name}|{repo}|{ssh_key}|{encrypt_mode}')
+        with open(cfg, 'w') as f:
+            for ln in existing_lines:
+                f.write(ln + '\n')
+        os.chmod(cfg, 0o600)
+        # Persist or remove the passphrase sidecar, depending on mode.
+        pass_file = f'{_BACKUP_STATE_DIR}/borg-pass-{name}.txt'
+        if encrypt_mode == 'none':
+            if os.path.exists(pass_file):
+                try:
+                    os.remove(pass_file)
+                except OSError:
+                    pass
+        elif passphrase:
+            with open(pass_file, 'w') as f:
+                f.write(passphrase)
+            os.chmod(pass_file, 0o600)
+    except OSError as e:
+        return jsonify({'error': f'failed to write borg-targets.txt: {e}'}), 500
+    return jsonify({'status': 'ok', 'name': name, 'repo': repo, 'encrypt_mode': encrypt_mode})
+
+
+@app.route('/api/host-backups/destinations/borg/<name>', methods=['DELETE'])
+@require_auth
+def api_host_backups_dest_borg_remove(name):
+    """Remove a Borg target by name. Also drops its passphrase file
+    if present."""
+    safe = _safe_dest_name(name)
+    if not safe:
+        return jsonify({'error': 'invalid name'}), 400
+    force = (request.args.get('force') or '').lower() in ('1', 'true', 'yes')
+    cascaded: list = []
+    if force:
+        for d in _list_borg_destinations():
+            if d.get('name') == safe:
+                for jid in _jobs_using_borg(d.get('repository') or ''):
+                    _delete_job_internal(jid)
+                    cascaded.append(jid)
+                break
+    cfg = f'{_BACKUP_STATE_DIR}/borg-targets.txt'
+    if os.path.exists(cfg):
+        try:
+            with open(cfg) as f:
+                kept = [ln.rstrip('\n') for ln in f if not ln.startswith(f'{safe}|')]
+            with open(cfg, 'w') as f:
+                for ln in kept:
+                    f.write(ln + '\n')
+            os.chmod(cfg, 0o600)
+        except OSError as e:
+            return jsonify({'error': f'failed to update borg-targets.txt: {e}'}), 500
+    for f in (
+        f'{_BACKUP_STATE_DIR}/borg-pass-{safe}.txt',
+    ):
+        try:
+            if os.path.exists(f):
+                os.remove(f)
+        except OSError:
+            pass
+    return jsonify({'status': 'ok', 'name': safe, 'jobs_removed': cascaded})
+
+
+@app.route('/api/host-backups/destinations/pbs', methods=['POST'])
+@require_auth
+def api_host_backups_dest_pbs_add():
+    """Add a manual PBS configuration. Body: {name, server, datastore,
+    username, password, fingerprint?}. Writes name|repo to
+    pbs-manual-configs.txt, plus pbs-pass-<name>.txt and (optionally)
+    pbs-fingerprint-<name>.txt — the same layout hb_configure_pbs_manual
+    produces."""
+    payload = request.get_json(silent=True) or {}
+    name = _safe_dest_name(payload.get('name'))
+    if not name:
+        return jsonify({'error': 'name is required (letters, digits, _ or -)'}), 400
+    server = (payload.get('server') or '').strip()
+    datastore = (payload.get('datastore') or '').strip()
+    username = (payload.get('username') or 'root@pam').strip()
+    password = payload.get('password') or ''
+    fingerprint = (payload.get('fingerprint') or '').strip()
+    if not server or not datastore:
+        return jsonify({'error': 'server and datastore are required'}), 400
+    # POST is upsert-by-name: if `name` already exists and password
+    # is omitted, keep the saved one (the edit-destination flow uses
+    # this to update server/datastore/fingerprint without forcing
+    # the operator to re-type the password).
+    existing_pw = ''
+    pass_file = f'{_BACKUP_STATE_DIR}/pbs-pass-{name}.txt'
+    if os.path.isfile(pass_file):
+        try:
+            with open(pass_file) as f:
+                existing_pw = f.read()
+        except OSError:
+            pass
+    if not password and not existing_pw:
+        return jsonify({'error': 'password is required'}), 400
+    if not password:
+        password = existing_pw
+
+    repo = f'{username}@{server}:{datastore}'
+    cfg_line = f'{name}|{repo}'
+    cfg = f'{_BACKUP_STATE_DIR}/pbs-manual-configs.txt'
+    try:
+        os.makedirs(_BACKUP_STATE_DIR, exist_ok=True)
+        # Replace any existing entry with the same name
+        existing: list = []
+        if os.path.exists(cfg):
+            with open(cfg) as f:
+                for ln in f:
+                    if ln.startswith(f'{name}|'):
+                        continue
+                    existing.append(ln.rstrip('\n'))
+        existing.append(cfg_line)
+        with open(cfg, 'w') as f:
+            for ln in existing:
+                f.write(ln + '\n')
+        os.chmod(cfg, 0o600)
+        # Password sidecar
+        pass_file = f'{_BACKUP_STATE_DIR}/pbs-pass-{name}.txt'
+        with open(pass_file, 'w') as f:
+            f.write(password)
+        os.chmod(pass_file, 0o600)
+        # Fingerprint sidecar (only if provided)
+        fp_file = f'{_BACKUP_STATE_DIR}/pbs-fingerprint-{name}.txt'
+        if fingerprint:
+            with open(fp_file, 'w') as f:
+                f.write(fingerprint)
+            os.chmod(fp_file, 0o600)
+        else:
+            try:
+                if os.path.exists(fp_file):
+                    os.remove(fp_file)
+            except OSError:
+                pass
+    except OSError as e:
+        return jsonify({'error': f'failed to persist PBS config: {e}'}), 500
+    return jsonify({'status': 'ok', 'name': name, 'repository': repo})
+
+
+@app.route('/api/host-backups/destinations/pbs/<name>', methods=['DELETE'])
+@require_auth
+def api_host_backups_dest_pbs_remove(name):
+    """Remove a manual PBS config by name. Auto-discovered PBS storages
+    from /etc/pve/storage.cfg are NOT removable from here (PVE owns
+    those — the operator manages them under Datacenter → Storage).
+
+    When `?force=true`, any jobs whose .env points at this PBS
+    repository are removed too (cascade). Backups on the PBS side
+    are NEVER touched — only the local job definitions go."""
+    safe = _safe_dest_name(name)
+    if not safe:
+        return jsonify({'error': 'invalid name'}), 400
+    force = (request.args.get('force') or '').lower() in ('1', 'true', 'yes')
+    cascaded: list = []
+    if force:
+        # Find the repo string for this name first, then look up the
+        # jobs that depend on it. We do this BEFORE deleting the
+        # config so the lookup still works.
+        for d in _list_pbs_destinations():
+            if d.get('name') == safe:
+                for jid in _jobs_using_pbs(d.get('repository') or ''):
+                    _delete_job_internal(jid)
+                    cascaded.append(jid)
+                break
+    cfg = f'{_BACKUP_STATE_DIR}/pbs-manual-configs.txt'
+    if not os.path.exists(cfg):
+        return jsonify({'error': 'no manual PBS configs file'}), 404
+    try:
+        with open(cfg) as f:
+            kept = [ln.rstrip('\n') for ln in f if not ln.startswith(f'{safe}|')]
+        with open(cfg, 'w') as f:
+            for ln in kept:
+                f.write(ln + '\n')
+        os.chmod(cfg, 0o600)
+    except OSError as e:
+        return jsonify({'error': f'failed to update pbs-manual-configs.txt: {e}'}), 500
+    for f in (
+        f'{_BACKUP_STATE_DIR}/pbs-pass-{safe}.txt',
+        f'{_BACKUP_STATE_DIR}/pbs-fingerprint-{safe}.txt',
+    ):
+        try:
+            if os.path.exists(f):
+                os.remove(f)
+        except OSError:
+            pass
+    return jsonify({'status': 'ok', 'name': safe, 'jobs_removed': cascaded})
+
+
+# ── Sprint D.2.c: SSH key generation for Borg remotes ──────────────
+
+
+@app.route('/api/host-backups/ssh-keys/generate', methods=['POST'])
+@require_auth
+def api_host_backups_ssh_key_generate():
+    """Generate (or fetch the public side of) an SSH key the operator
+    can drop into the Borg server's authorized_keys. Defaults: ed25519,
+    no passphrase, stored at /root/.ssh/proxmenux_borg. If the key
+    already exists we don't regenerate — we just hand back the public
+    half + a sensible authorized_keys line."""
+    payload = request.get_json(silent=True) or {}
+    key_path = (payload.get('key_path') or '/root/.ssh/proxmenux_borg').strip()
+    remote_path = (payload.get('remote_path') or '').strip()
+    if not key_path.startswith('/'):
+        return jsonify({'error': 'key_path must be absolute'}), 400
+
+    pub_path = f'{key_path}.pub'
+
+    if not os.path.exists(key_path):
+        try:
+            ssh_dir = os.path.dirname(key_path) or '/'
+            os.makedirs(ssh_dir, exist_ok=True)
+            os.chmod(ssh_dir, 0o700)
+        except OSError as e:
+            return jsonify({'error': f'cannot prepare ssh dir: {e}'}), 500
+        try:
+            import socket
+            comment = f'proxmenux@{socket.gethostname()}'
+            r = subprocess.run(
+                ['ssh-keygen', '-t', 'ed25519', '-f', key_path, '-N', '', '-C', comment],
+                capture_output=True, text=True, timeout=15
+            )
+            if r.returncode != 0:
+                return jsonify({'error': f'ssh-keygen failed: {r.stderr.strip()}'}), 500
+        except (subprocess.TimeoutExpired, OSError) as e:
+            return jsonify({'error': str(e)}), 500
+
+    if not os.path.exists(pub_path):
+        return jsonify({'error': f'public key not found after generation: {pub_path}'}), 500
+
+    try:
+        with open(pub_path) as f:
+            pub_text = f.read().strip()
+    except OSError as e:
+        return jsonify({'error': str(e)}), 500
+
+    # Build a restricted authorized_keys line if we know the remote path.
+    # Mirrors the line `hb_borg_generate_and_install_key` emits in the shell.
+    if remote_path:
+        rp = '/' + remote_path.lstrip('/')
+        authorized_line = f'command="borg serve --restrict-to-path {rp}",restrict {pub_text}'
+    else:
+        authorized_line = pub_text
+
+    return jsonify({
+        'key_path': key_path,
+        'pub_path': pub_path,
+        'public_key': pub_text,
+        'authorized_keys_line': authorized_line,
+    })
+
+
+# ── Sprint D.2.b: USB drives management ────────────────────────────
+#
+# Thin wrappers around hb_list_usb_partitions / hb_mount_usb_partition /
+# hb_format_usb_disk in lib_host_backup_common.sh so the Monitor and
+# the shell scheduler menu agree on what a USB drive looks like and
+# how it gets mounted.
+
+_USB_DEVICE_RE = re.compile(r'^/dev/[a-zA-Z0-9]+$')
+
+
+@app.route('/api/host-backups/usb-drives', methods=['GET'])
+@require_auth
+def api_host_backups_usb_drives():
+    """List USB partitions (mounted + unmounted with a filesystem) and
+    raw USB disks with no partition table. Each entry has a `state` of
+    "mounted", "unmounted" or "empty"."""
+    if not os.path.exists(_BACKUP_LIB_SH):
+        return jsonify({'drives': []})
+    try:
+        r = subprocess.run(
+            ['bash', '-c', f'source {_BACKUP_LIB_SH}; hb_list_usb_partitions'],
+            capture_output=True, text=True, timeout=10
+        )
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return jsonify({'error': str(e)}), 500
+    drives: list = []
+    for line in r.stdout.splitlines():
+        parts = line.split('\t')
+        if len(parts) < 2:
+            continue
+        # State + dev_or_mp are always present; the rest may be blank.
+        state = parts[0]
+        dev_or_mp = parts[1]
+        label = parts[2] if len(parts) > 2 else ''
+        size = parts[3] if len(parts) > 3 else ''
+        fstype = parts[4] if len(parts) > 4 else ''
+        uuid = parts[5] if len(parts) > 5 else ''
+        drives.append({
+            'state': state,
+            'path_or_device': dev_or_mp,
+            'label': label,
+            'size': size,
+            'fstype': fstype,
+            'uuid': uuid,
+        })
+    return jsonify({'drives': drives})
+
+
+@app.route('/api/host-backups/usb-drives/mount', methods=['POST'])
+@require_auth
+def api_host_backups_usb_mount():
+    """Mount an unmounted USB partition. Body: {device, label?, uuid?}.
+    Returns the mountpoint chosen by hb_usb_mountpoint_for."""
+    payload = request.get_json(silent=True) or {}
+    device = (payload.get('device') or '').strip()
+    if not _USB_DEVICE_RE.match(device):
+        return jsonify({'error': 'invalid device path'}), 400
+    if not os.path.exists(device):
+        return jsonify({'error': f'device does not exist: {device}'}), 404
+    label = (payload.get('label') or '').strip()
+    uuid = (payload.get('uuid') or '').strip()
+    try:
+        r = subprocess.run(
+            ['bash', '-c',
+             f'source {_BACKUP_LIB_SH}; hb_mount_usb_partition "$1" "$2" "$3"',
+             'mount-wrapper', device, label, uuid],
+            capture_output=True, text=True, timeout=30
+        )
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return jsonify({'error': str(e)}), 500
+    if r.returncode != 0:
+        # hb_mount_usb_partition writes mount stderr to /tmp/proxmenux-mount.log
+        err_tail = ''
+        try:
+            with open('/tmp/proxmenux-mount.log') as f:
+                err_tail = f.read().strip().splitlines()[-5:]
+                err_tail = '\n'.join(err_tail)
+        except OSError:
+            pass
+        return jsonify({'error': f'mount failed: {err_tail or r.stderr.strip()}'}), 500
+    mountpoint = r.stdout.strip()
+    return jsonify({'status': 'ok', 'mountpoint': mountpoint})
+
+
+@app.route('/api/host-backups/usb-drives/unmount', methods=['POST'])
+@require_auth
+def api_host_backups_usb_unmount():
+    """Unmount a USB mountpoint and remove the directory if empty."""
+    payload = request.get_json(silent=True) or {}
+    mountpoint = (payload.get('mountpoint') or '').strip()
+    if not mountpoint or not mountpoint.startswith('/'):
+        return jsonify({'error': 'absolute mountpoint required'}), 400
+    if not os.path.ismount(mountpoint):
+        return jsonify({'error': f'not a mountpoint: {mountpoint}'}), 400
+    r = subprocess.run(['umount', mountpoint], capture_output=True, text=True, timeout=15)
+    if r.returncode != 0:
+        return jsonify({'error': f'umount failed: {r.stderr.strip()}'}), 500
+    try:
+        os.rmdir(mountpoint)
+    except OSError:
+        pass
+    return jsonify({'status': 'ok', 'mountpoint': mountpoint})
+
+
+@app.route('/api/host-backups/usb-drives/format', methods=['POST'])
+@require_auth
+def api_host_backups_usb_format():
+    """DESTRUCTIVE — wipes the disk, lays a fresh GPT + ext4 partition,
+    and mounts it. The body MUST include `confirm_device` matching
+    `device` exactly; the UI is expected to ask the operator to type it
+    by hand before sending. Mirrors the double-confirmation the shell
+    flow imposes."""
+    payload = request.get_json(silent=True) or {}
+    device = (payload.get('device') or '').strip()
+    confirm = (payload.get('confirm_device') or '').strip()
+    if not _USB_DEVICE_RE.match(device):
+        return jsonify({'error': 'invalid device path'}), 400
+    if confirm != device:
+        return jsonify({'error': 'confirm_device must match device exactly (typo / safety check)'}), 400
+    if not os.path.exists(device):
+        return jsonify({'error': f'device does not exist: {device}'}), 404
+    label = (payload.get('label') or 'proxmenux-backup').strip()
+    try:
+        r = subprocess.run(
+            ['bash', '-c',
+             f'source {_BACKUP_LIB_SH}; hb_format_usb_disk "$1" "$2"',
+             'format-wrapper', device, label],
+            capture_output=True, text=True, timeout=180
+        )
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return jsonify({'error': str(e)}), 500
+    if r.returncode != 0:
+        err_tail = ''
+        try:
+            with open('/tmp/proxmenux-format.log') as f:
+                err_tail = '\n'.join(f.read().strip().splitlines()[-10:])
+        except OSError:
+            pass
+        return jsonify({'error': f'format failed: {err_tail or r.stderr.strip()}'}), 500
+    mountpoint = r.stdout.strip()
+    return jsonify({'status': 'ok', 'mountpoint': mountpoint, 'label': label})
+
+
+# ── Sprint C: Custom backup paths CRUD ─────────────────────────────
+#
+# Paths the operator added on top of the default profile. The runner
+# merges this list into every backup (manual + scheduled). One path
+# per line in backup-extra-paths.txt; # comments allowed.
+
+_BACKUP_EXTRA_PATHS_FILE = f'{_BACKUP_STATE_DIR}/backup-extra-paths.txt'
+
+
+def _read_extra_paths() -> list:
+    if not os.path.exists(_BACKUP_EXTRA_PATHS_FILE):
+        return []
+    try:
+        seen: set = set()
+        out: list = []
+        with open(_BACKUP_EXTRA_PATHS_FILE) as f:
+            for raw in f:
+                line = raw.split('#', 1)[0].strip()
+                if not line:
+                    continue
+                if line in seen:
+                    continue
+                seen.add(line)
+                out.append(line)
+        return sorted(out)
+    except OSError:
+        return []
+
+
+def _write_extra_paths(paths: list) -> tuple[bool, str]:
+    try:
+        os.makedirs(_BACKUP_STATE_DIR, exist_ok=True)
+        with open(_BACKUP_EXTRA_PATHS_FILE, 'w') as f:
+            for p in paths:
+                f.write(p + '\n')
+        os.chmod(_BACKUP_EXTRA_PATHS_FILE, 0o600)
+        return True, ''
+    except OSError as e:
+        return False, str(e)
+
+
+@app.route('/api/host-backups/extra-paths', methods=['GET'])
+@require_auth
+def api_host_backups_extra_paths_get():
+    """List the user-added paths included in every backup on top of
+    the default profile."""
+    paths = _read_extra_paths()
+    return jsonify({
+        'paths': [
+            {'path': p, 'exists': os.path.exists(p)}
+            for p in paths
+        ]
+    })
+
+
+@app.route('/api/host-backups/extra-paths', methods=['POST'])
+@require_auth
+def api_host_backups_extra_paths_add():
+    """Add a path. Body: {path: string}. Idempotent — duplicates are
+    silently ignored."""
+    payload = request.get_json(silent=True) or {}
+    path = (payload.get('path') or '').strip().rstrip('/')
+    if not path:
+        return jsonify({'error': 'path is required'}), 400
+    if not path.startswith('/'):
+        return jsonify({'error': 'path must be absolute'}), 400
+    if not os.path.exists(path):
+        return jsonify({'error': f'path does not exist on this host: {path}'}), 400
+    existing = _read_extra_paths()
+    if path not in existing:
+        existing.append(path)
+        existing = sorted(set(existing))
+        ok, err = _write_extra_paths(existing)
+        if not ok:
+            return jsonify({'error': f'failed to persist: {err}'}), 500
+    return jsonify({'status': 'ok', 'paths': existing})
+
+
+@app.route('/api/host-backups/extra-paths', methods=['DELETE'])
+@require_auth
+def api_host_backups_extra_paths_remove():
+    """Remove a path. The path is taken from ?path=<urlencoded> so
+    DELETE stays bodyless."""
+    path = (request.args.get('path') or '').strip().rstrip('/')
+    if not path:
+        return jsonify({'error': 'path query parameter is required'}), 400
+    existing = _read_extra_paths()
+    if path not in existing:
+        return jsonify({'status': 'ok', 'paths': existing})
+    existing = [p for p in existing if p != path]
+    ok, err = _write_extra_paths(existing)
+    if not ok:
+        return jsonify({'error': f'failed to persist: {err}'}), 500
+    return jsonify({'status': 'ok', 'paths': existing})
+
+
+# ── Sprint H: Remote backups (PBS / Borg) listed and exported on-demand ──
+#
+# Listing is cheap (snapshot metadata only — milliseconds, no payload
+# download). Export is on-demand: only when the operator clicks Download
+# do we extract the snapshot to a local staging dir and pack it as a
+# .tar.zst, so the PBS / Borg server sees no load while the operator is
+# just browsing.
+
+_REMOTE_EXPORT_DIR = '/var/lib/proxmenux/exports'
+_REMOTE_EXPORT_TTL = 3600  # auto-clean staging directories untouched for > 1h
+_remote_export_tasks: dict = {}
+_remote_export_lock = threading.Lock()
+
+
+def _pbs_secret_for(repo_name: str) -> tuple[str, str]:
+    """Return (password, fingerprint) for the named PBS repo, looking
+    first in the manual sidecars and falling back to /etc/pve/storage.cfg."""
+    pass_text = ''
+    fp_text = ''
+    pass_file = f'{_BACKUP_STATE_DIR}/pbs-pass-{repo_name}.txt'
+    if os.path.exists(pass_file):
+        try:
+            with open(pass_file) as f:
+                pass_text = f.read().strip()
+        except OSError:
+            pass
+    fp_file = f'{_BACKUP_STATE_DIR}/pbs-fingerprint-{repo_name}.txt'
+    if os.path.exists(fp_file):
+        try:
+            with open(fp_file) as f:
+                fp_text = f.read().strip()
+        except OSError:
+            pass
+    # If we don't have a sidecar, the manual config screen could have
+    # left only the storage.cfg entry — pull whatever PVE has.
+    if not pass_text or not fp_text:
+        for r in _list_pbs_destinations():
+            if r.get('name') == repo_name:
+                if not fp_text:
+                    fp_text = r.get('fingerprint') or ''
+                # PVE storage.cfg keeps the password in a separate file
+                # under /etc/pve/priv/storage/<name>.pw — read it if we
+                # have permission.
+                pw_path = f'/etc/pve/priv/storage/{repo_name}.pw'
+                if not pass_text and os.path.exists(pw_path):
+                    try:
+                        with open(pw_path) as f:
+                            pass_text = f.read().strip()
+                    except OSError:
+                        pass
+                break
+    return pass_text, fp_text
+
+
+def _list_pbs_snapshots_for_repo(repo: dict, timeout: int = 15) -> tuple[list, str | None]:
+    """Run proxmox-backup-client snapshot list for one PBS config and
+    return (snapshots, error). Snapshots come back as the raw JSON the
+    client emits, with the source repo name attached for the UI."""
+    pwd, fp = _pbs_secret_for(repo['name'])
+    if not pwd:
+        return [], f"no password available for PBS repo \"{repo['name']}\""
+    env = {**os.environ, 'PBS_PASSWORD': pwd}
+    if fp:
+        env['PBS_FINGERPRINT'] = fp
+    try:
+        r = subprocess.run(
+            ['proxmox-backup-client', 'snapshot', 'list',
+             '--repository', repo['repository'],
+             '--output-format', 'json'],
+            capture_output=True, text=True, timeout=timeout, env=env,
+        )
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return [], str(e)
+    if r.returncode != 0:
+        return [], (r.stderr.strip() or r.stdout.strip() or
+                    f'proxmox-backup-client exited {r.returncode}')
+    try:
+        items = json.loads(r.stdout)
+    except json.JSONDecodeError:
+        return [], 'snapshot list output was not valid JSON'
+    out: list = []
+    for it in items:
+        backup_type = it.get('backup-type', '')
+        # The host-backup tab lists ONLY backups taken with the
+        # ProxMenux host-backup flow (`backup-type: host`). PBS
+        # repositories often also carry vzdump-style VM/LXC snapshots
+        # (`vm` / `ct`) — those belong to the Virtual Machines / LXC
+        # views, not here.
+        if backup_type != 'host':
+            continue
+        backup_id = it.get('backup-id', '')
+        # Hide internal keyrecovery escrow backups — they're a
+        # ProxMenux implementation detail, not user-facing backups.
+        # See _PBS_RECOVERY_ENC_PATH and the runner upload step.
+        # Matches both current `hostcfg-<host>-keyrecovery` and
+        # legacy `proxmenux-keyrecovery-<host>` naming so escrow
+        # blobs from either build stay hidden from the main list.
+        if _is_pbs_keyrecovery_backup_id(backup_id):
+            continue
+        backup_time = it.get('backup-time', 0)
+        # proxmox-backup-client expects the timestamp portion as an
+        # ISO-8601 UTC string ("2026-06-20T20:23:17Z"), NOT the raw
+        # epoch — passing the epoch back makes it reject the path
+        # with "unable to parse backup snapshot path".
+        from datetime import datetime, timezone
+        try:
+            iso = datetime.fromtimestamp(int(backup_time), tz=timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ')
+        except (ValueError, OSError):
+            iso = str(backup_time)
+        snapshot = f"{backup_type}/{backup_id}/{iso}"
+        # A snapshot is "encrypted" when ANY of its files reports a
+        # crypt-mode other than `none`. Used to render the lock badge.
+        files = it.get('files', []) or []
+        encrypted = any(
+            (f.get('crypt-mode') or 'none') != 'none'
+            for f in files if isinstance(f, dict)
+        )
+        out.append({
+            'backend': 'pbs',
+            'repo_name': repo['name'],
+            'repo_repository': repo['repository'],
+            'snapshot': snapshot,
+            'backup_type': backup_type,
+            'backup_id': backup_id,
+            'backup_time': backup_time,
+            'size_bytes': it.get('size', 0),
+            'owner': it.get('owner'),
+            'protected': it.get('protected', False),
+            'files': files,
+            'fingerprint': it.get('fingerprint'),
+            'encrypted': encrypted,
+        })
+    return out, None
+
+
+@app.route('/api/host-backups/remote-archives', methods=['GET'])
+@require_auth
+def api_host_backups_remote_archives():
+    """List backups living on remote backends (PBS, eventually Borg).
+    Optional ?backend=pbs|borg filter; default returns all. Cheap to
+    call: only metadata is fetched from the remote — no payload data
+    moves until the operator clicks Download."""
+    backend_filter = (request.args.get('backend') or '').strip().lower()
+    snapshots: list = []
+    errors: list = []
+
+    if backend_filter in ('', 'pbs'):
+        for repo in _list_pbs_destinations():
+            items, err = _list_pbs_snapshots_for_repo(repo)
+            if err:
+                errors.append({'backend': 'pbs', 'repo_name': repo['name'], 'error': err})
+            snapshots.extend(items)
+
+    if backend_filter in ('', 'borg'):
+        for target in _list_borg_destinations():
+            items, err = _list_borg_archives_for_target(target)
+            if err:
+                errors.append({'backend': 'borg', 'repo_name': target['name'], 'error': err})
+            snapshots.extend(items)
+
+    return jsonify({'snapshots': snapshots, 'errors': errors})
+
+
+@app.route('/api/host-backups/remote-archives', methods=['DELETE'])
+@require_auth
+def api_host_backups_remote_archive_delete():
+    """Forget/delete a single PBS snapshot or Borg archive.
+
+    Body: {"backend": "pbs"|"borg", "repo_name": "...", "snapshot": "..."}
+        - PBS snapshot:   "host/<backup-id>/<iso-ts>"  → invokes
+                          `proxmox-backup-client snapshot forget`.
+        - Borg archive:   "<archive-name>"             → invokes
+                          `borg delete <repo>::<archive>`.
+
+    Local archives have their own DELETE endpoint
+    (`/api/host-backups/archives/<id>`); this one only handles remotes.
+    Protected PBS snapshots and missing remotes surface a clear error.
+    """
+    payload = request.get_json(silent=True) or {}
+    backend  = (payload.get('backend')   or '').strip().lower()
+    repo_nm  = (payload.get('repo_name') or '').strip()
+    snapshot = (payload.get('snapshot')  or '').strip()
+
+    if backend not in ('pbs', 'borg'):
+        return jsonify({'error': "backend must be 'pbs' or 'borg'"}), 400
+    if not repo_nm:
+        return jsonify({'error': 'repo_name is required'}), 400
+    if not snapshot:
+        return jsonify({'error': 'snapshot is required'}), 400
+
+    if backend == 'pbs':
+        repo = next((r for r in _list_pbs_destinations() if r['name'] == repo_nm), None)
+        if not repo:
+            return jsonify({'error': f"PBS destination '{repo_nm}' not found"}), 404
+        pwd, fp = _pbs_secret_for(repo_nm)
+        if not pwd:
+            return jsonify({'error': f"no password available for PBS repo '{repo_nm}'"}), 400
+        env = {**os.environ, 'PBS_PASSWORD': pwd}
+        if fp:
+            env['PBS_FINGERPRINT'] = fp
+        try:
+            r = subprocess.run(
+                ['proxmox-backup-client', 'snapshot', 'forget',
+                 snapshot, '--repository', repo['repository']],
+                capture_output=True, text=True, timeout=30, env=env,
+            )
+        except (subprocess.TimeoutExpired, OSError) as e:
+            return jsonify({'error': str(e)}), 500
+        if r.returncode != 0:
+            msg = (r.stderr.strip() or r.stdout.strip() or
+                   f'proxmox-backup-client exited {r.returncode}')
+            # Surface PBS's own "protected" error as a 409 so the UI
+            # can show a clearer message than the generic 500.
+            status = 409 if 'protected' in msg.lower() else 500
+            return jsonify({'error': msg}), status
+        return jsonify({'status': 'ok', 'removed': snapshot})
+
+    # backend == 'borg'
+    target = next((t for t in _list_borg_destinations() if t['name'] == repo_nm), None)
+    if not target:
+        return jsonify({'error': f"Borg destination '{repo_nm}' not found"}), 404
+    repo = target.get('repository') or ''
+    if not repo:
+        return jsonify({'error': "target has no repository path"}), 400
+    env = _borg_env_for(target)
+    try:
+        r = subprocess.run(
+            ['borg', 'delete', f'{repo}::{snapshot}'],
+            capture_output=True, text=True, timeout=120, env=env,
+        )
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return jsonify({'error': str(e)}), 500
+    if r.returncode != 0:
+        msg = (r.stderr.strip() or r.stdout.strip() or
+               f'borg delete exited {r.returncode}')
+        return jsonify({'error': msg}), 500
+    return jsonify({'status': 'ok', 'removed': snapshot})
+
+
+# ── Borg helpers (mirrors the PBS pair above) ──────────────────────
+
+
+def _borg_passphrase_for(name: str) -> str:
+    pass_file = f'{_BACKUP_STATE_DIR}/borg-pass-{name}.txt'
+    if not os.path.exists(pass_file):
+        return ''
+    try:
+        with open(pass_file) as f:
+            return f.read().strip()
+    except OSError:
+        return ''
+
+
+def _borg_env_for(target: dict, extra: dict | None = None) -> dict:
+    """Build the env dict for invoking the borg client against `target`.
+    Sets BORG_PASSPHRASE from the saved sidecar, BORG_RSH when an SSH
+    key is configured, and a generous BORG_RELOCATED_REPO_ACCESS_IS_OK
+    so we don't bail when the repo was last touched from a different
+    mountpoint label."""
+    env = {**os.environ}
+    pw = _borg_passphrase_for(target['name'])
+    if pw:
+        env['BORG_PASSPHRASE'] = pw
+    ssh_key = target.get('ssh_key') or ''
+    if ssh_key:
+        env['BORG_RSH'] = f'ssh -i {ssh_key} -o StrictHostKeyChecking=accept-new'
+    # Non-interactive: if borg would prompt about a relocated repo, take
+    # the safe answer instead of hanging the request.
+    env['BORG_RELOCATED_REPO_ACCESS_IS_OK'] = 'yes'
+    env['BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK'] = 'yes'
+    if extra:
+        env.update(extra)
+    return env
+
+
+def _list_borg_archives_for_target(target: dict, timeout: int = 30) -> tuple[list, str | None]:
+    """Run `borg list --json` against one saved Borg target and shape
+    the output the same way PBS snapshots are shaped — same UnifiedArchive
+    contract for the UI."""
+    repo = target.get('repository') or ''
+    if not repo:
+        return [], 'target has no repository path'
+    env = _borg_env_for(target)
+    try:
+        r = subprocess.run(
+            ['borg', 'list', '--json', repo],
+            capture_output=True, text=True, timeout=timeout, env=env,
+        )
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return [], str(e)
+    if r.returncode != 0:
+        return [], (r.stderr.strip() or r.stdout.strip() or
+                    f'borg list exited {r.returncode}')
+    try:
+        data = json.loads(r.stdout)
+    except json.JSONDecodeError:
+        return [], 'borg list output was not valid JSON'
+
+    archives = data.get('archives', []) or []
+
+    # `borg list --json` only carries archive name + start time. Pull
+    # the per-archive size with a parallel batch of `borg info --json
+    # repo::name` calls so the UI can render a real number instead of
+    # "0 MB". 4-way concurrency keeps the wall-clock acceptable on
+    # repos with dozens of archives. Results are returned alongside
+    # the listing so callers don't have to re-issue per-row probes.
+    from concurrent.futures import ThreadPoolExecutor
+
+    def _info_size(name: str) -> int:
+        if not name:
+            return 0
+        try:
+            ri = subprocess.run(
+                ['borg', 'info', '--json', f'{repo}::{name}'],
+                capture_output=True, text=True, timeout=15, env=env,
+            )
+        except (subprocess.TimeoutExpired, OSError):
+            return 0
+        if ri.returncode != 0:
+            return 0
+        try:
+            info = json.loads(ri.stdout)
+        except (json.JSONDecodeError, ValueError):
+            return 0
+        arcs = info.get('archives') or []
+        if not arcs:
+            return 0
+        stats = arcs[0].get('stats') or {}
+        # Prefer original (uncompressed, undeduplicated) — matches what
+        # users expect when comparing to PBS source-data size.
+        v = stats.get('original_size') or stats.get('compressed_size') or 0
+        try:
+            return int(v)
+        except (TypeError, ValueError):
+            return 0
+
+    names = [a.get('name') or '' for a in archives]
+    sizes: dict[str, int] = {}
+    if names:
+        with ThreadPoolExecutor(max_workers=4) as ex:
+            for nm, sz in zip(names, ex.map(_info_size, names)):
+                sizes[nm] = sz
+
+    out: list = []
+    for arc in archives:
+        name = arc.get('name') or ''
+        start_iso = arc.get('start') or arc.get('time') or ''
+        # Borg timestamps come as ISO-8601 with microseconds — convert
+        # to unix seconds so the unified UI can sort against the PBS
+        # entries (which use unix seconds natively).
+        backup_time = 0
+        if start_iso:
+            try:
+                from datetime import datetime
+                cleaned = start_iso.split('.')[0]
+                dt = datetime.strptime(cleaned, '%Y-%m-%dT%H:%M:%S')
+                backup_time = int(dt.timestamp())
+            except (ValueError, OSError):
+                pass
+        out.append({
+            'backend': 'borg',
+            'repo_name': target['name'],
+            'repo_repository': repo,
+            'snapshot': name,
+            'backup_type': 'archive',
+            'backup_id': name,
+            'backup_time': backup_time,
+            'size_bytes': sizes.get(name, 0),
+            'owner': arc.get('username'),
+            'protected': False,
+            'files': [],
+            'fingerprint': None,
+            'borg_id': arc.get('id'),
+            'borg_start_iso': start_iso,
+            'encrypted': (target.get('encrypt_mode') or 'repokey') != 'none',
+        })
+    return out, None
+
+
+def _run_borg_export(task_id: str, target: dict, archive_name: str, output_path: str):
+    """Background worker: `borg extract` one archive into a staging
+    directory and pack the result as a .tar.zst. Same shape and
+    progress states as _run_pbs_export so the UI can poll generically."""
+    import shutil, time
+    def _update(**kw):
+        with _remote_export_lock:
+            _remote_export_tasks[task_id].update(kw, updated_at=time.time())
+
+    staging = os.path.join(_REMOTE_EXPORT_DIR, f'staging-{task_id}')
+    try:
+        os.makedirs(staging, exist_ok=True)
+        os.chmod(staging, 0o700)
+        env = _borg_env_for(target)
+
+        # 1) Extract the archive. borg extract writes into cwd, so we
+        #    cd to a fresh subdirectory under staging.
+        target_tree = os.path.join(staging, 'tree')
+        os.makedirs(target_tree, exist_ok=True)
+        _update(state='restoring', message='Extracting from Borg repo')
+        r = subprocess.run(
+            ['borg', 'extract', f'{target["repository"]}::{archive_name}'],
+            capture_output=True, text=True, timeout=3600, env=env,
+            cwd=target_tree,
+        )
+        if r.returncode != 0:
+            _update(state='failed', error=(r.stderr.strip() or 'borg extract failed'))
+            return
+
+        # 2) Pack as .tar.zst.
+        _update(state='packing', message='Compressing as tar.zst')
+        with open(output_path, 'wb') as out:
+            tar_p = subprocess.Popen(
+                ['tar', '-C', target_tree, '-cf', '-', '.'],
+                stdout=subprocess.PIPE,
+            )
+            zstd_p = subprocess.Popen(
+                ['zstd', '-T0', '-19', '-q'],
+                stdin=tar_p.stdout,
+                stdout=out,
+            )
+            if tar_p.stdout:
+                tar_p.stdout.close()
+            zstd_rc = zstd_p.wait(timeout=3600)
+            tar_rc = tar_p.wait(timeout=60)
+        if zstd_rc != 0 or tar_rc != 0:
+            _update(state='failed', error=f'archive packing failed (tar={tar_rc}, zstd={zstd_rc})')
+            return
+
+        size = os.path.getsize(output_path)
+        _update(state='completed', message='Export ready', size_bytes=size, output_path=output_path)
+    except Exception as e:
+        _update(state='failed', error=str(e))
+    finally:
+        try:
+            if os.path.isdir(staging):
+                shutil.rmtree(staging)
+        except OSError:
+            pass
+
+
+def _safe_export_id() -> str:
+    """Generate a collision-free identifier for a single export run."""
+    from datetime import datetime
+    import secrets
+    return f'{datetime.now().strftime("%Y%m%d%H%M%S")}-{secrets.token_hex(3)}'
+
+
+def _cleanup_stale_exports():
+    """Drop staging dirs and finished tar files older than _REMOTE_EXPORT_TTL.
+    Called opportunistically on each new export request — no separate
+    cron is needed."""
+    if not os.path.isdir(_REMOTE_EXPORT_DIR):
+        return
+    import time
+    now = time.time()
+    for name in os.listdir(_REMOTE_EXPORT_DIR):
+        full = os.path.join(_REMOTE_EXPORT_DIR, name)
+        try:
+            st = os.stat(full)
+        except OSError:
+            continue
+        if now - st.st_mtime < _REMOTE_EXPORT_TTL:
+            continue
+        if os.path.isdir(full):
+            try:
+                import shutil
+                shutil.rmtree(full)
+            except OSError:
+                pass
+        else:
+            try:
+                os.remove(full)
+            except OSError:
+                pass
+    # Also forget completed task records older than the TTL so they
+    # don't pile up forever.
+    with _remote_export_lock:
+        for tid in list(_remote_export_tasks):
+            task = _remote_export_tasks[tid]
+            if task['state'] in ('completed', 'failed') and now - task.get('updated_at', 0) > _REMOTE_EXPORT_TTL:
+                _remote_export_tasks.pop(tid, None)
+
+
+def _run_pbs_export(task_id: str, repo: dict, snapshot: str, output_path: str):
+    """Background worker: pull a single PBS snapshot to a local staging
+    dir, then pack it as a .tar.zst at output_path. Updates the shared
+    task record in place so the poll endpoint can report progress."""
+    import shutil, time
+    def _update(**kw):
+        with _remote_export_lock:
+            _remote_export_tasks[task_id].update(kw, updated_at=time.time())
+
+    staging = os.path.join(_REMOTE_EXPORT_DIR, f'staging-{task_id}')
+    try:
+        os.makedirs(staging, exist_ok=True)
+        os.chmod(staging, 0o700)
+
+        pwd, fp = _pbs_secret_for(repo['name'])
+        if not pwd:
+            _update(state='failed', error=f"no password for PBS repo \"{repo['name']}\"")
+            return
+        env = {**os.environ, 'PBS_PASSWORD': pwd}
+        if fp:
+            env['PBS_FINGERPRINT'] = fp
+        # Load the scrypt-unlock passphrase stored during import. Without
+        # this env var proxmox-backup-client can't decrypt a scrypt
+        # keyfile at restore time and fails with "no password input
+        # mechanism available". kdf=none keyfiles don't need it (empty
+        # file → env stays empty). Matches how the scheduled runner
+        # resolves PBS_ENCRYPTION_PASSWORD in run_scheduled_backup.sh.
+        try:
+            if os.path.isfile(_PBS_KEYFILE_PASS_PATH) and os.path.getsize(_PBS_KEYFILE_PASS_PATH) > 0:
+                with open(_PBS_KEYFILE_PASS_PATH, 'r') as _pf:
+                    env['PBS_ENCRYPTION_PASSWORD'] = _pf.read()
+        except OSError:
+            pass
+
+        # 1) Pull the .pxar archive out of the snapshot. PBS stores the
+        # host backup as `hostcfg.pxar.didx`; restoring it as `hostcfg.pxar`
+        # writes the file tree under <target>/hostcfg/.
+        # If a local keyfile is installed we always pass --keyfile: PBS
+        # ignores it for unencrypted archives and needs it for encrypted
+        # ones. Without this flag an encrypted download fails with
+        # "missing key - manifest was created with key XX:XX:..." even
+        # when the operator has the correct key on disk.
+        _update(state='restoring', message='Pulling snapshot from PBS')
+        target_tree = os.path.join(staging, 'tree')
+        os.makedirs(target_tree, exist_ok=True)
+        cmd = ['proxmox-backup-client', 'restore',
+               '--repository', repo['repository']]
+        if os.path.isfile(_PBS_KEYFILE_PATH):
+            cmd.extend(['--keyfile', _PBS_KEYFILE_PATH])
+        cmd.extend([snapshot, 'hostcfg.pxar', target_tree])
+        r = subprocess.run(cmd, capture_output=True, text=True, timeout=1800, env=env)
+        if r.returncode != 0:
+            err = (r.stderr.strip() or 'pbs restore failed')
+            # Fingerprint mismatch is the most common encrypted-restore
+            # failure and the error message alone doesn't tell the
+            # operator whether the installed keyfile is the wrong one
+            # or PBS just isn't finding it. Include the local keyfile
+            # fingerprint so a side-by-side compare with the manifest's
+            # XX:XX:... value is possible without shell access.
+            if 'missing key' in err.lower() or 'was created with key' in err.lower():
+                local_fp = _pbs_keyfile_fingerprint()
+                if local_fp:
+                    err += f'\n\nLocal keyfile fingerprint: {local_fp}'
+                else:
+                    err += '\n\n(No local PBS keyfile installed at ' + _PBS_KEYFILE_PATH + ')'
+            _update(state='failed', error=err)
+            return
+
+        # 2) Pack the restored tree as a .tar.zst — same format the
+        # local-backend backups already use, so the rest of the Monitor
+        # treats both shapes uniformly.
+        _update(state='packing', message='Compressing as tar.zst')
+        with open(output_path, 'wb') as out:
+            tar_p = subprocess.Popen(
+                ['tar', '-C', target_tree, '-cf', '-', '.'],
+                stdout=subprocess.PIPE,
+            )
+            zstd_p = subprocess.Popen(
+                ['zstd', '-T0', '-19', '-q'],
+                stdin=tar_p.stdout,
+                stdout=out,
+            )
+            if tar_p.stdout:
+                tar_p.stdout.close()
+            zstd_rc = zstd_p.wait(timeout=1800)
+            tar_rc = tar_p.wait(timeout=60)
+        if zstd_rc != 0 or tar_rc != 0:
+            _update(state='failed', error=f'archive packing failed (tar={tar_rc}, zstd={zstd_rc})')
+            return
+
+        size = os.path.getsize(output_path)
+        _update(state='completed', message='Export ready', size_bytes=size, output_path=output_path)
+    except Exception as e:
+        _update(state='failed', error=str(e))
+    finally:
+        # Drop the staging tree once we're done — only the final tarball
+        # stays around until the operator downloads it.
+        try:
+            if os.path.isdir(staging):
+                shutil.rmtree(staging)
+        except OSError:
+            pass
+
+
+@app.route('/api/host-backups/remote-archives/export', methods=['POST'])
+@require_auth
+def api_host_backups_remote_archive_export():
+    """Kick off an on-demand export. Body:
+      {backend: 'pbs'|'borg', repo_name, snapshot}
+    Returns a task_id the UI polls for progress and uses to fetch the
+    resulting .tar.zst once ready."""
+    import time
+    _cleanup_stale_exports()
+    payload = request.get_json(silent=True) or {}
+    backend = (payload.get('backend') or '').strip().lower()
+    if backend not in ('pbs', 'borg'):
+        return jsonify({'error': 'backend must be pbs or borg'}), 400
+    repo_name = (payload.get('repo_name') or '').strip()
+    snapshot = (payload.get('snapshot') or '').strip()
+    if not repo_name or not snapshot:
+        return jsonify({'error': 'repo_name and snapshot are required'}), 400
+
+    repo: dict | None = None
+    if backend == 'pbs':
+        repo = next((r for r in _list_pbs_destinations() if r['name'] == repo_name), None)
+        if not repo:
+            return jsonify({'error': f'PBS repo not found: {repo_name}'}), 404
+    else:
+        repo = next((r for r in _list_borg_destinations() if r['name'] == repo_name), None)
+        if not repo:
+            return jsonify({'error': f'Borg target not found: {repo_name}'}), 404
+
+    os.makedirs(_REMOTE_EXPORT_DIR, exist_ok=True)
+    task_id = _safe_export_id()
+    safe_snap = snapshot.replace('/', '_')
+    output_path = os.path.join(
+        _REMOTE_EXPORT_DIR, f'{backend}-{repo_name}-{safe_snap}.tar.zst'
+    )
+    with _remote_export_lock:
+        _remote_export_tasks[task_id] = {
+            'task_id': task_id,
+            'backend': backend,
+            'repo_name': repo_name,
+            'snapshot': snapshot,
+            'state': 'queued',
+            'message': 'Queued',
+            'created_at': time.time(),
+            'updated_at': time.time(),
+            'output_path': None,
+            'size_bytes': 0,
+            'error': None,
+        }
+
+    worker = _run_pbs_export if backend == 'pbs' else _run_borg_export
+    t = threading.Thread(
+        target=worker,
+        args=(task_id, repo, snapshot, output_path),
+        daemon=True,
+    )
+    t.start()
+    return jsonify({'task_id': task_id, 'state': 'queued'}), 202
+
+
+@app.route('/api/host-backups/remote-archives/export/<task_id>', methods=['GET'])
+@require_auth
+def api_host_backups_remote_archive_export_status(task_id):
+    """Poll a running export. Returns the live task record; the UI uses
+    `state` to decide what to render (queued → progress, completed →
+    trigger download)."""
+    with _remote_export_lock:
+        task = _remote_export_tasks.get(task_id)
+        if not task:
+            return jsonify({'error': 'task not found or expired'}), 404
+        # Defensive copy — the worker keeps mutating the original.
+        return jsonify({k: v for k, v in task.items()})
+
+
+@app.route('/api/host-backups/remote-archives/export/<task_id>/download', methods=['GET'])
+@require_auth_or_ticket
+def api_host_backups_remote_archive_export_download(task_id):
+    """Stream the packed export to the browser. Same auth + send_file
+    pattern as the local archive download. Cleans up the tarball after
+    the response is dispatched so the staging area doesn't grow."""
+    with _remote_export_lock:
+        task = _remote_export_tasks.get(task_id)
+    if not task:
+        return jsonify({'error': 'task not found or expired'}), 404
+    if task['state'] != 'completed':
+        return jsonify({'error': f'task is in state "{task["state"]}", not completed'}), 409
+    output_path = task.get('output_path')
+    if not output_path or not os.path.isfile(output_path):
+        return jsonify({'error': 'output file missing'}), 500
+    download_name = os.path.basename(output_path)
+
+    @after_this_request
+    def _cleanup(response):
+        try:
+            if os.path.exists(output_path):
+                os.remove(output_path)
+        except OSError:
+            pass
+        with _remote_export_lock:
+            _remote_export_tasks.pop(task_id, None)
+        return response
+
+    return send_file(
+        output_path,
+        as_attachment=True,
+        download_name=download_name,
+        mimetype='application/x-zstd-compressed-tar',
+    )
+
+
+_BACKUP_TAR_SUFFIXES = ('.tar', '.tar.zst', '.tar.gz')
+
+
+@app.route('/api/host-backups/archives', methods=['GET'])
+@require_auth
+def api_host_backups_archives():
+    """List ProxMenux host-backup archives found on disk.
+
+    Scans /var/lib/vz/dump (PVE default — covers manual backups from
+    backup_host.sh options 1-6) plus every DEST_DIR registered by a
+    local_tar scheduled job. For each archive, _identify_host_backup()
+    decides whether it's really a ProxMenux backup using, in order of
+    confidence: (a) the .proxmenux.json sidecar dropped by the backup
+    scripts at completion (definitive — survives any future rename of
+    the .tar); (b) the filename conventions (`hostcfg-<host>-<ts>` for
+    manual, `<job_id>-<ts>` for scheduled with the job env still on
+    disk); (c) a tar-peek for the in-archive `metadata/run_info.env`
+    marker that every ProxMenux backup ships with (catches legacy
+    archives and ones copied in from another host).
+    PBS and Borg backups aren't surfaced in the UI yet."""
+    archives: list = []
+    seen: set = set()
+    hostname = socket.gethostname()
+    job_ids = _known_job_ids()
+
+    for d in _collect_backup_scan_dirs():
+        try:
+            entries = os.listdir(d)
+        except OSError:
+            continue
+        for name in entries:
+            if not name.endswith(_BACKUP_TAR_SUFFIXES):
+                continue
+            tar_path = os.path.join(d, name)
+            if tar_path in seen:
+                continue
+            seen.add(tar_path)
+            try:
+                st = os.stat(tar_path)
+            except OSError:
+                continue
+            info = _identify_host_backup(tar_path, st, hostname, job_ids)
+            if info is None:
+                continue
+            archives.append({
+                'id': name,
+                'path': tar_path,
+                'size_bytes': st.st_size,
+                'mtime': int(st.st_mtime),
+                **info,
+            })
+
+    archives.sort(key=lambda a: a['mtime'], reverse=True)
+    return jsonify({'archives': archives})
+
+
+# ──────────────────────────────────────────────────────────────
+# Snapshot inspection — extract + analyze backend
+# ──────────────────────────────────────────────────────────────
+# The "View contents" button in the Available Archives modal needs
+# to read manifest + restore plan + file list out of ANY backup —
+# PBS, Borg, or local. The trick is that PBS and Borg snapshots
+# aren't files: they have to be extracted to a staging directory
+# first. These helpers + endpoint do exactly that, reuse the four
+# restore-side shell scripts (parse_manifest / run_restore), and
+# clean the staging tree before returning.
+# Staging lives under /tmp/pmnx-inspect-XXX and is removed in the
+# `finally` block — there's nothing to leak even if the request
+# fails mid-flight.
+
+def _inspect_extract_to_staging(source: str, repo_dict: dict, snapshot: str, staging: str) -> tuple:
+    """Pull a snapshot into <staging>. Returns (ok, error_message).
+    PBS: pulls the `hostcfg.pxar` archive (the canonical name the
+    ProxMenux backup uses) and lets the client write straight into
+    staging — the pxar already wraps the rootfs/+metadata/ layout.
+    Borg: `borg extract` into staging; if the archive used absolute
+    paths, the wrapped tree is normalized by _inspect_normalize_layout.
+    Local: tar/zst/gz extract into staging."""
+    if source == 'pbs':
+        pwd = _resolve_pbs_password(repo_dict['name'])
+        if not pwd:
+            return False, f"no password for PBS repo \"{repo_dict['name']}\""
+        env = {**os.environ, 'PBS_PASSWORD': pwd}
+        fp = _resolve_pbs_fingerprint(repo_dict['name'])
+        if fp:
+            env['PBS_FINGERPRINT'] = fp
+        cmd = ['proxmox-backup-client', 'restore',
+               '--repository', repo_dict['repository'],
+               snapshot, 'hostcfg.pxar', staging]
+        if os.path.isfile(_PBS_KEYFILE_PATH):
+            cmd.extend(['--keyfile', _PBS_KEYFILE_PATH])
+        try:
+            r = subprocess.run(cmd, capture_output=True, text=True, timeout=900, env=env)
+        except (subprocess.TimeoutExpired, OSError) as e:
+            return False, str(e)
+        if r.returncode != 0:
+            return False, (r.stderr.strip() or r.stdout.strip() or 'pbs restore failed')[:500]
+        return True, None
+
+    if source == 'borg':
+        env = _borg_env_for(repo_dict)
+        cmd = ['borg', 'extract', f"{repo_dict['repository']}::{snapshot}"]
+        try:
+            r = subprocess.run(cmd, cwd=staging, capture_output=True, text=True, timeout=900, env=env)
+        except (subprocess.TimeoutExpired, OSError) as e:
+            return False, str(e)
+        if r.returncode != 0:
+            return False, (r.stderr.strip() or r.stdout.strip() or 'borg extract failed')[:500]
+        return True, None
+
+    if source == 'local':
+        archive_path = repo_dict.get('path') or ''
+        if not os.path.isfile(archive_path):
+            return False, f'local archive not found: {archive_path}'
+        if archive_path.endswith('.tar.zst'):
+            cmd = ['tar', '--zstd', '-xf', archive_path, '-C', staging]
+        elif archive_path.endswith(('.tar.gz', '.tgz')):
+            cmd = ['tar', '-xzf', archive_path, '-C', staging]
+        elif archive_path.endswith('.tar'):
+            cmd = ['tar', '-xf', archive_path, '-C', staging]
+        else:
+            return False, f'unknown archive type: {archive_path}'
+        try:
+            r = subprocess.run(cmd, capture_output=True, text=True, timeout=900)
+        except (subprocess.TimeoutExpired, OSError) as e:
+            return False, str(e)
+        if r.returncode != 0:
+            return False, (r.stderr.strip() or 'tar extract failed')[:500]
+        return True, None
+
+    return False, f'unknown source: {source}'
+
+
+def _inspect_normalize_layout(staging: str) -> bool:
+    """Coerce arbitrary backup layouts into the canonical
+    rootfs/+metadata/ structure that parse_manifest.sh / run_restore.sh
+    expect. Mirrors backup_host.sh::_rs_check_layout without the dialogs."""
+    if os.path.isdir(os.path.join(staging, 'rootfs')):
+        return True
+    # Case 2: rootfs/ nested one level deep (Borg with absolute paths).
+    try:
+        for entry in os.listdir(staging):
+            sub = os.path.join(staging, entry)
+            if not os.path.isdir(sub):
+                continue
+            inner_rootfs = os.path.join(sub, 'rootfs')
+            if os.path.isdir(inner_rootfs):
+                shutil.move(inner_rootfs, os.path.join(staging, 'rootfs'))
+                inner_meta = os.path.join(sub, 'metadata')
+                if os.path.isdir(inner_meta):
+                    shutil.move(inner_meta, os.path.join(staging, 'metadata'))
+                return True
+    except OSError:
+        return False
+    # Case 3: flat layout — etc/, var/, root/, usr/ extracted at top.
+    flat_indicators = ('etc', 'var', 'root', 'usr')
+    if any(os.path.isdir(os.path.join(staging, x)) for x in flat_indicators):
+        import tempfile
+        tmp = tempfile.mkdtemp(prefix='.rootfs_wrap.', dir=staging)
+        for entry in os.listdir(staging):
+            src = os.path.join(staging, entry)
+            if src == tmp:
+                continue
+            try:
+                shutil.move(src, os.path.join(tmp, entry))
+            except OSError:
+                pass
+        shutil.move(tmp, os.path.join(staging, 'rootfs'))
+        os.makedirs(os.path.join(staging, 'metadata'), exist_ok=True)
+        return True
+    return False
+
+
+def _inspect_compose_json(staging: str) -> dict:
+    """Run the restore-aware scripts against the normalized staging and
+    merge their JSON outputs into one dict the UI can render. Best-
+    effort: a failure in one section reports an error in that section
+    only, the rest of the report still comes back."""
+    scripts_dir = f'{_PROXMENUX_SCRIPTS_DIR}/backup_restore/restore'
+    out: dict = {}
+
+    # ── Manifest ──
+    # Many in-the-wild backups don't ship a manifest.json (the
+    # collectors that generate it are wired up but not invoked by
+    # the current backup_host.sh / run_scheduled_backup.sh). When
+    # that's the case, set `manifest_missing=True` so the UI shows
+    # a soft informational note instead of a red error — and skip
+    # run_restore.sh entirely since it would only repeat the
+    # "no manifest" message.
+    try:
+        r = subprocess.run(['bash', f'{scripts_dir}/parse_manifest.sh', staging],
+                           capture_output=True, text=True, timeout=30)
+        if r.returncode == 0 and r.stdout.strip():
+            try:
+                out['manifest'] = json.loads(r.stdout)
+            except json.JSONDecodeError:
+                out['manifest_error'] = 'parse_manifest output was not valid JSON'
+        else:
+            err = (r.stderr.strip() or 'parse_manifest failed')[:500]
+            if 'no manifest.json' in err.lower():
+                out['manifest_missing'] = True
+            else:
+                out['manifest_error'] = err
+    except (subprocess.TimeoutExpired, OSError) as e:
+        out['manifest_error'] = str(e)
+
+    # ── Full preflight (storage + network + drivers + plan) ──
+    # Only run when a manifest is actually present — run_restore.sh
+    # uses it as input, and without one the report is just a repeat
+    # of the parse_manifest failure (already surfaced above).
+    if out.get('manifest'):
+        run_script = f'{scripts_dir}/run_restore.sh'
+        try:
+            r = subprocess.run(['bash', run_script, staging, '--mode', 'full', '--json'],
+                               capture_output=True, text=True, timeout=180)
+            if r.stdout.strip():
+                try:
+                    out['plan'] = json.loads(r.stdout)
+                except json.JSONDecodeError:
+                    out['plan_raw_stderr'] = r.stderr[:1000]
+                    out['plan_error'] = 'run_restore output was not valid JSON'
+            else:
+                out['plan_error'] = (r.stderr.strip() or 'no report from run_restore')[:500]
+        except (subprocess.TimeoutExpired, OSError) as e:
+            out['plan_error'] = str(e)
+
+    # ── File listing (capped, for the Files tab) ──
+    rootfs = os.path.join(staging, 'rootfs')
+    metadata = os.path.join(staging, 'metadata')
+    if os.path.isdir(rootfs):
+        files: list = []
+        limit = 5000
+        truncated = False
+        for root, dirs, fnames in os.walk(rootfs):
+            rel_dir = os.path.relpath(root, rootfs)
+            if rel_dir == '.':
+                rel_dir = ''
+            depth = rel_dir.count(os.sep) + (1 if rel_dir else 0)
+            if depth > 6:
+                dirs[:] = []
+                continue
+            for fn in fnames:
+                full = os.path.join(root, fn)
+                try:
+                    sz = os.path.getsize(full)
+                except OSError:
+                    sz = 0
+                files.append({
+                    'path': ('/' + rel_dir + '/' + fn) if rel_dir else ('/' + fn),
+                    'size': sz,
+                })
+                if len(files) >= limit:
+                    truncated = True
+                    break
+            if truncated:
+                break
+        out['files'] = files
+        out['files_truncated'] = truncated
+        out['files_total_count'] = len(files)
+
+    # ── Rollback plan ──
+    # Compare backup state vs current host to surface VMs/LXCs that
+    # would be removed and components that would be uninstalled by
+    # a "restore to backup state" operation. Read-only here — the
+    # actual rollback is executed by apply_cluster_postboot.sh after
+    # the operator confirms in the Restore flow.
+    rollback_script = f'{scripts_dir}/compute_rollback_plan.sh'
+    if os.path.isfile(rollback_script):
+        try:
+            r = subprocess.run(['bash', rollback_script, staging],
+                               capture_output=True, text=True, timeout=20)
+            if r.returncode == 0 and r.stdout.strip():
+                out['rollback_plan'] = json.loads(r.stdout)
+        except (subprocess.TimeoutExpired, OSError, json.JSONDecodeError, ValueError):
+            pass
+
+    # ── Bundle the loose metadata sidecars for quick reference ──
+    if os.path.isdir(metadata):
+        meta_view: dict = {}
+        for fname in ('run_info.env', 'pveversion.txt', 'selected_paths.txt',
+                      'missing_paths.txt', 'sha256sums.txt'):
+            fp = os.path.join(metadata, fname)
+            if os.path.isfile(fp):
+                try:
+                    with open(fp, encoding='utf-8', errors='replace') as f:
+                        meta_view[fname] = f.read()
+                except OSError:
+                    pass
+        out['metadata_files'] = meta_view
+
+    return out
+
+
+@app.route('/api/host-backups/inspect-archive', methods=['POST'])
+@require_auth
+def api_host_backups_inspect_archive():
+    """One-shot 'View Contents' endpoint for any backend. Extracts the
+    snapshot to a temp staging dir, runs the restore-side tools, then
+    cleans up. Body:
+      {source: "pbs"|"borg"|"local", repo_name?, snapshot?, path?}
+    """
+    payload = request.get_json(silent=True) or {}
+    source = (payload.get('source') or '').strip()
+    if source not in ('pbs', 'borg', 'local'):
+        return jsonify({'error': 'source must be pbs, borg, or local'}), 400
+
+    repo_dict: dict = {}
+    snapshot = ''
+    if source == 'pbs':
+        repo_name = (payload.get('repo_name') or '').strip()
+        snapshot = (payload.get('snapshot') or '').strip()
+        if not repo_name or not snapshot:
+            return jsonify({'error': 'repo_name and snapshot are required for pbs'}), 400
+        for r in _list_pbs_destinations():
+            if r.get('name') == repo_name:
+                repo_dict = r
+                break
+        if not repo_dict:
+            return jsonify({'error': f'PBS repo "{repo_name}" not configured'}), 404
+    elif source == 'borg':
+        repo_name = (payload.get('repo_name') or '').strip()
+        snapshot = (payload.get('snapshot') or '').strip()
+        if not repo_name or not snapshot:
+            return jsonify({'error': 'repo_name and snapshot are required for borg'}), 400
+        for r in _list_borg_destinations():
+            if r.get('name') == repo_name:
+                repo_dict = r
+                break
+        if not repo_dict:
+            return jsonify({'error': f'Borg repo "{repo_name}" not configured'}), 404
+    else:  # local
+        path = (payload.get('path') or '').strip()
+        if not path or not os.path.isfile(path):
+            return jsonify({'error': f'local archive not found: {path}'}), 404
+        repo_dict = {'path': path}
+
+    import tempfile
+    staging = tempfile.mkdtemp(prefix='pmnx-inspect-')
+    try:
+        ok, err = _inspect_extract_to_staging(source, repo_dict, snapshot, staging)
+        if not ok:
+            return jsonify({'error': err}), 500
+        if not _inspect_normalize_layout(staging):
+            return jsonify({'error': 'archive layout not recognized — no rootfs/ found'}), 500
+        return jsonify(_inspect_compose_json(staging))
+    finally:
+        try:
+            shutil.rmtree(staging, ignore_errors=True)
+        except OSError:
+            pass
+
+
+# ──────────────────────────────────────────────────────────────
+# Restore prepare/cleanup — Monitor → shell TUI handoff
+# ──────────────────────────────────────────────────────────────
+# The "Restore" button in the Inspect modal goes through TWO steps:
+#   1. POST /restore/prepare → backend extracts the snapshot to a
+#      persistent staging dir under _RESTORE_STAGING_ROOT. Returns
+#      the staging path so the next step can find it.
+#   2. The frontend launches a ScriptTerminalModal pointing at
+#      restore/monitor_apply.sh with that staging path + selected
+#      mode/components. monitor_apply.sh sources backup_host.sh and
+#      calls _rs_run_complete_guided / _rs_run_custom_restore — the
+#      exact same apply path the TUI uses.
+#
+# Staging dirs auto-expire: every new prepare() removes any leftover
+# from previous runs older than _RESTORE_STAGING_TTL_SECONDS so a
+# crashed Monitor session doesn't accumulate gigabytes on /tmp.
+
+_RESTORE_STAGING_ROOT = '/tmp'
+_RESTORE_STAGING_PREFIX = 'pmnx-restore-'
+_RESTORE_STAGING_TTL_SECONDS = 6 * 3600  # 6 hours
+
+def _restore_staging_gc():
+    """Remove stale Monitor restore staging dirs. Best-effort; any
+    OSError silently skips the entry so a permission glitch on one
+    item doesn't block the new prepare."""
+    import time
+    now = time.time()
+    try:
+        entries = os.listdir(_RESTORE_STAGING_ROOT)
+    except OSError:
+        return
+    for entry in entries:
+        if not entry.startswith(_RESTORE_STAGING_PREFIX):
+            continue
+        full = os.path.join(_RESTORE_STAGING_ROOT, entry)
+        try:
+            age = now - os.path.getmtime(full)
+        except OSError:
+            continue
+        if age > _RESTORE_STAGING_TTL_SECONDS:
+            try:
+                shutil.rmtree(full, ignore_errors=True)
+            except OSError:
+                pass
+
+
+@app.route('/api/host-backups/restore/prepare', methods=['POST'])
+@require_auth
+def api_host_backups_restore_prepare():
+    """Extract a snapshot to a persistent staging directory. The
+    frontend follows up by launching monitor_apply.sh against that
+    staging via ScriptTerminalModal. Body is the same shape as
+    /inspect-archive: {source, repo_name?, snapshot?, path?}.
+    Returns: {staging_path}."""
+    payload = request.get_json(silent=True) or {}
+    source = (payload.get('source') or '').strip()
+    if source not in ('pbs', 'borg', 'local'):
+        return jsonify({'error': 'source must be pbs, borg, or local'}), 400
+
+    repo_dict: dict = {}
+    snapshot = ''
+    if source == 'pbs':
+        repo_name = (payload.get('repo_name') or '').strip()
+        snapshot = (payload.get('snapshot') or '').strip()
+        if not repo_name or not snapshot:
+            return jsonify({'error': 'repo_name and snapshot are required for pbs'}), 400
+        for r in _list_pbs_destinations():
+            if r.get('name') == repo_name:
+                repo_dict = r
+                break
+        if not repo_dict:
+            return jsonify({'error': f'PBS repo "{repo_name}" not configured'}), 404
+    elif source == 'borg':
+        repo_name = (payload.get('repo_name') or '').strip()
+        snapshot = (payload.get('snapshot') or '').strip()
+        if not repo_name or not snapshot:
+            return jsonify({'error': 'repo_name and snapshot are required for borg'}), 400
+        for r in _list_borg_destinations():
+            if r.get('name') == repo_name:
+                repo_dict = r
+                break
+        if not repo_dict:
+            return jsonify({'error': f'Borg repo "{repo_name}" not configured'}), 404
+    else:
+        path = (payload.get('path') or '').strip()
+        if not path or not os.path.isfile(path):
+            return jsonify({'error': f'local archive not found: {path}'}), 404
+        repo_dict = {'path': path}
+
+    _restore_staging_gc()
+
+    import tempfile
+    staging = tempfile.mkdtemp(prefix=_RESTORE_STAGING_PREFIX, dir=_RESTORE_STAGING_ROOT)
+    try:
+        ok, err = _inspect_extract_to_staging(source, repo_dict, snapshot, staging)
+        if not ok:
+            shutil.rmtree(staging, ignore_errors=True)
+            return jsonify({'error': err}), 500
+        if not _inspect_normalize_layout(staging):
+            shutil.rmtree(staging, ignore_errors=True)
+            return jsonify({'error': 'archive layout not recognized — no rootfs/ found'}), 500
+        # List the real backup paths so the Custom restore checklist
+        # only offers what's actually present (default profile + the
+        # operator's extras). Mirrors what _rs_select_component_paths
+        # in backup_host.sh now does after the paths-not-components
+        # refactor — perfect backup↔restore parity.
+        paths_available: list = []
+        list_script = f'{_PROXMENUX_SCRIPTS_DIR}/backup_restore/restore/list_paths.sh'
+        if os.path.isfile(list_script):
+            try:
+                r = subprocess.run(['bash', list_script, staging],
+                                   capture_output=True, text=True, timeout=30)
+                if r.returncode == 0 and r.stdout.strip():
+                    paths_available = json.loads(r.stdout.strip())
+            except (subprocess.TimeoutExpired, OSError, json.JSONDecodeError, ValueError):
+                pass
+
+        rollback_plan: dict = {}
+        rollback_script = f'{_PROXMENUX_SCRIPTS_DIR}/backup_restore/restore/compute_rollback_plan.sh'
+        if os.path.isfile(rollback_script):
+            try:
+                r = subprocess.run(['bash', rollback_script, staging],
+                                   capture_output=True, text=True, timeout=20)
+                if r.returncode == 0 and r.stdout.strip():
+                    rollback_plan = json.loads(r.stdout)
+            except (subprocess.TimeoutExpired, OSError, json.JSONDecodeError, ValueError):
+                pass
+
+        # Direction-aware cross-kernel signal for the Web restore UI.
+        # We source the same logic the CLI uses: read the backup's
+        # kernel from the staging's run_info.env, compare major.minor
+        # to the target's current kernel, and classify the direction.
+        # "bk_older" is the only mode that trims the picker; the
+        # blocked list mirrors hb_unsafe_paths_cross_version so both
+        # surfaces skip the exact same set. "bk_newer" and "same" send
+        # empty lists and the Web treats them as a normal restore.
+        cross_kernel: dict = {
+            'direction': 'same',
+            'backup_kernel': '',
+            'target_kernel': '',
+            'blocked_paths': [],
+        }
+        try:
+            bk_kernel = ''
+            run_info = os.path.join(staging, 'metadata', 'run_info.env')
+            if os.path.isfile(run_info):
+                with open(run_info, 'r') as f:
+                    for line in f:
+                        if line.startswith('kernel='):
+                            bk_kernel = line.strip().split('=', 1)[1]
+                            break
+            try:
+                tg_kernel = subprocess.check_output(['uname', '-r'], text=True).strip()
+            except (OSError, subprocess.CalledProcessError):
+                tg_kernel = ''
+            cross_kernel['backup_kernel'] = bk_kernel
+            cross_kernel['target_kernel'] = tg_kernel
+            def _mm(k: str) -> tuple:
+                parts = (k or '').split('.')
+                try:
+                    return (int(parts[0]), int(parts[1]))
+                except (ValueError, IndexError):
+                    return (0, 0)
+            if bk_kernel and tg_kernel:
+                bk_mm, tg_mm = _mm(bk_kernel), _mm(tg_kernel)
+                if bk_mm != tg_mm and bk_mm != (0, 0) and tg_mm != (0, 0):
+                    if bk_mm < tg_mm:
+                        cross_kernel['direction'] = 'bk_older'
+                        # Pull the exact list the CLI uses.
+                        lib_sh = f'{_PROXMENUX_SCRIPTS_DIR}/backup_restore/lib_host_backup_common.sh'
+                        if os.path.isfile(lib_sh):
+                            try:
+                                r = subprocess.run(
+                                    ['bash', '-c',
+                                     f'source "{lib_sh}"; hb_unsafe_paths_cross_version'],
+                                    capture_output=True, text=True, timeout=10)
+                                if r.returncode == 0:
+                                    blocked = []
+                                    for line in r.stdout.splitlines():
+                                        parts = line.split('\t', 1)
+                                        if parts and parts[0].strip():
+                                            blocked.append(parts[0].strip())
+                                    cross_kernel['blocked_paths'] = blocked
+                            except (subprocess.TimeoutExpired, OSError):
+                                pass
+                    else:
+                        cross_kernel['direction'] = 'bk_newer'
+        except (OSError, ValueError):
+            pass
+
+        # Hydration preview — only meaningful in bk_older direction.
+        # Runs the same phases the CLI runs in "plan" mode: no
+        # writes to the live target, just the list of would-be
+        # actions. Same code path as the shell dialog, so the Web
+        # banner and the CLI msgbox always list the same items.
+        hydration = {'applies': False, 'actions': []}
+        if cross_kernel['direction'] == 'bk_older':
+            backup_sh = (
+                f'{_PROXMENUX_SCRIPTS_DIR}/backup_restore/backup_host.sh'
+            )
+            if os.path.isfile(backup_sh):
+                try:
+                    # Source lib+backup_host in a subshell, set the
+                    # direction so any inner guard passes, run the
+                    # orchestrator in plan mode, print RS_HYDRATION_ACTIONS
+                    # one per line. HB_LIB_ONLY/HB_NO_MAIN etc. are not
+                    # needed: sourcing backup_host.sh only defines
+                    # functions; nothing runs until we call one.
+                    script = (
+                        f'set +e; '
+                        f'source "{_PROXMENUX_SCRIPTS_DIR}/backup_restore/lib_host_backup_common.sh"; '
+                        f'source "{backup_sh}" >/dev/null 2>&1; '
+                        f'HB_COMPAT_KERNEL_DIRECTION=bk_older '
+                        f'_rs_apply_bk_older_hydration "{staging}" plan >/dev/null 2>&1; '
+                        f'printf "%s\\n" "${{RS_HYDRATION_ACTIONS[@]}}"'
+                    )
+                    r = subprocess.run(
+                        ['bash', '-c', script],
+                        capture_output=True, text=True, timeout=15)
+                    if r.returncode == 0:
+                        actions = [
+                            ln.strip() for ln in r.stdout.splitlines()
+                            if ln.strip()
+                        ]
+                        hydration['actions'] = actions
+                        hydration['applies'] = bool(actions)
+                except (subprocess.TimeoutExpired, OSError):
+                    pass
+
+        return jsonify({
+            'staging_path': staging,
+            'paths_available': paths_available,
+            'rollback_plan': rollback_plan,
+            'cross_kernel': cross_kernel,
+            'hydration': hydration,
+        })
+    except Exception as e:
+        shutil.rmtree(staging, ignore_errors=True)
+        return jsonify({'error': str(e)}), 500
+
+
+@app.route('/api/host-backups/restore/cleanup', methods=['POST'])
+@require_auth
+def api_host_backups_restore_cleanup():
+    """Explicit cleanup for a staging dir. Called by the UI after the
+    ScriptTerminalModal closes. Best-effort: the GC in prepare() will
+    catch anything missed here within _RESTORE_STAGING_TTL_SECONDS."""
+    payload = request.get_json(silent=True) or {}
+    staging = (payload.get('staging_path') or '').strip()
+    # Defense in depth: only allow paths under the staging root with
+    # the expected prefix. Anything else could be the operator trying
+    # to coerce the endpoint into rm-ing arbitrary files.
+    if (not staging
+            or not staging.startswith(os.path.join(_RESTORE_STAGING_ROOT, _RESTORE_STAGING_PREFIX))
+            or '..' in staging.split(os.sep)):
+        return jsonify({'error': 'invalid staging_path'}), 400
+    try:
+        shutil.rmtree(staging, ignore_errors=True)
+    except OSError as e:
+        return jsonify({'error': str(e)}), 500
+    return jsonify({'status': 'ok'})
+
+
+@app.route('/api/host-backups/archives/<path:archive_id>/manifest', methods=['GET'])
+@require_auth
+def api_host_backups_archive_manifest(archive_id):
+    """Extract the manifest.json embedded inside a backup archive,
+    using scripts/backup_restore/restore/parse_manifest.sh. Returns the
+    unwrapped manifest (i.e. without the proxmenux_backup_manifest key)."""
+    archive_path = _find_backup_archive_path(archive_id)
+    if not archive_path:
+        return jsonify({'error': 'archive not found'}), 404
+
+    parse_script = f'{_PROXMENUX_SCRIPTS_DIR}/backup_restore/restore/parse_manifest.sh'
+    if not os.path.exists(parse_script):
+        return jsonify({'error': 'restore tooling not installed on this host',
+                        'install_hint': 'Run the ProxMenux installer to deploy scripts/backup_restore/'}), 503
+
+    try:
+        r = subprocess.run(['bash', parse_script, archive_path],
+                           capture_output=True, text=True, timeout=30)
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return jsonify({'error': f'parser invocation failed: {e}'}), 500
+
+    if r.returncode != 0:
+        return jsonify({'error': r.stderr.strip() or 'parse_manifest exited non-zero'}), 422
+
+    try:
+        return jsonify(json.loads(r.stdout))
+    except json.JSONDecodeError:
+        return jsonify({'error': 'parser output was not valid JSON'}), 500
+
+
+@app.route('/api/host-backups/archives/<path:archive_id>/preflight', methods=['POST'])
+@require_auth
+def api_host_backups_archive_preflight(archive_id):
+    """Run the dry-run preflight + storage + network + driver-plan report
+    for this archive against the current host. Body: {"mode": "<mode>"}.
+    Modes match restore_modes.sh: full, storage_only, network_only, base,
+    custom. Returns the combined run_restore.sh JSON report."""
+    archive_path = _find_backup_archive_path(archive_id)
+    if not archive_path:
+        return jsonify({'error': 'archive not found'}), 404
+
+    body = request.get_json(silent=True) or {}
+    mode = body.get('mode', 'full')
+    if mode not in ('full', 'storage_only', 'network_only', 'base', 'custom'):
+        return jsonify({'error': f'unknown mode "{mode}"'}), 400
+
+    run_script = f'{_PROXMENUX_SCRIPTS_DIR}/backup_restore/restore/run_restore.sh'
+    if not os.path.exists(run_script):
+        return jsonify({'error': 'restore tooling not installed on this host',
+                        'install_hint': 'Run the ProxMenux installer to deploy scripts/backup_restore/'}), 503
+
+    try:
+        r = subprocess.run(
+            ['bash', run_script, archive_path, '--mode', mode, '--json'],
+            capture_output=True, text=True, timeout=120
+        )
+    except (subprocess.TimeoutExpired, OSError) as e:
+        return jsonify({'error': f'preflight invocation failed: {e}'}), 500
+
+    # run_restore.sh exits non-zero when preflight has fails; we still
+    # want to surface the report so the UI can show what failed.
+    if not r.stdout.strip():
+        return jsonify({'error': r.stderr.strip() or 'no report emitted'}), 500
+    try:
+        return jsonify(json.loads(r.stdout))
+    except json.JSONDecodeError:
+        return jsonify({'error': 'run_restore output was not valid JSON',
+                        'raw_stderr': r.stderr[:2000]}), 500
+
+
+@app.route('/api/host-backups/archives/<path:archive_id>/prepare-restore', methods=['POST'])
+@require_auth
+def api_host_backups_archive_prepare_restore(archive_id):
+    """Produce the exact shell command the operator needs to run to
+    apply this archive on this host. Sprint G is "preview / preflight
+    in Monitor, apply on the CLI" — the runtime risk of restoring while
+    the Monitor itself is being overwritten is too high to swallow into
+    a single POST. So we hand back a copy-pasteable command plus the
+    menu path inside backup_host.sh."""
+    archive_path = _find_backup_archive_path(archive_id)
+    if not archive_path:
+        return jsonify({'error': 'archive not found'}), 404
+
+    body = request.get_json(silent=True) or {}
+    mode = (body.get('mode') or 'full').lower()
+    if mode not in ('full', 'storage_only', 'network_only', 'base', 'custom'):
+        return jsonify({'error': f'unknown mode "{mode}"'}), 400
+
+    backup_host_sh = '/usr/local/share/proxmenux/scripts/backup_restore/backup_host.sh'
+    archive_basename = os.path.basename(archive_path)
+
+    # Mode → human-readable menu hint inside backup_host.sh
+    mode_label_map = {
+        'full': 'Full restore',
+        'storage_only': 'Storage / hardware only',
+        'network_only': 'Network only',
+        'base': 'Base config only',
+        'custom': 'Custom — pick components',
+    }
+    mode_label = mode_label_map.get(mode, mode)
+
+    # Which restore modes typically need a reboot to take effect.
+    # `full` rewrites /etc/pve, /etc/network, kernel cmdline, etc.
+    # `base` and `network_only` touch host identity / interfaces too.
+    reboot_required = mode in ('full', 'base', 'network_only', 'storage_only')
+
+    menu_path = [
+        'Inside the menu opened by the command above:',
+        f'  1. Pick:  "{archive_basename}"',
+        f'  2. Choose: Restore action  →  {mode_label}',
+        '  3. Confirm when prompted.',
+    ]
+    if reboot_required:
+        menu_path.append(
+            "  4. After the restore finishes, reboot when the menu offers it — "
+            "some changes only land after the post-boot apply runs.",
+        )
+
+    notes: list = []
+    if mode == 'full':
+        notes.append(
+            "Full restore rewrites cluster, network and bootloader state. "
+            "Don't run it remotely without out-of-band access — if the "
+            "network config goes wrong you'll lose SSH.",
+        )
+    if mode == 'custom':
+        notes.append(
+            "Custom mode lets you tick / untick components. The Monitor's "
+            "preflight already shows the per-component plan above.",
+        )
+
+    return jsonify({
+        'archive_id': archive_id,
+        'archive_basename': archive_basename,
+        'mode': mode,
+        'mode_label': mode_label,
+        'shell_command': f'bash {backup_host_sh}',
+        'menu_path': menu_path,
+        'reboot_required': reboot_required,
+        'notes': notes,
+    })
+
+
+@app.route('/api/host-backups/archives/<path:archive_id>/download', methods=['GET'])
+@require_auth_or_ticket
+def api_host_backups_archive_download(archive_id):
+    """Stream the .tar.zst archive back to the operator with a sane
+    Content-Disposition. send_file handles range requests + streaming
+    so the Flask process doesn't hold the whole archive in memory —
+    important since these can be hundreds of MB."""
+    archive_path = _find_backup_archive_path(archive_id)
+    if not archive_path:
+        return jsonify({'error': 'archive not found'}), 404
+    if not os.path.isfile(archive_path):
+        return jsonify({'error': 'archive path is not a regular file'}), 500
+    return send_file(
+        archive_path,
+        as_attachment=True,
+        download_name=os.path.basename(archive_path),
+        mimetype='application/x-zstd-compressed-tar',
+    )
+
+
+@app.route('/api/host-backups/archives/<path:archive_id>', methods=['DELETE'])
+@require_auth
+def api_host_backups_archive_delete(archive_id):
+    """Delete a local archive plus everything tied to it: the
+    `.tar.zst`, its `.proxmenux.json` sidecar, and the matching runner
+    `<stem>.log`. Remote backups (PBS / Borg) are not handled here —
+    those are pruned from their own datastore."""
+    archive_path = _find_backup_archive_path(archive_id)
+    if not archive_path:
+        return jsonify({'error': 'archive not found'}), 404
+    if not os.path.isfile(archive_path):
+        return jsonify({'error': 'archive path is not a regular file'}), 500
+
+    removed = []
+    # Archive itself.
+    try:
+        os.remove(archive_path)
+        removed.append(os.path.basename(archive_path))
+    except OSError as e:
+        return jsonify({'error': f'failed to remove archive: {e}'}), 500
+    # Sidecar JSON (best effort — missing sidecar is OK).
+    sidecar = f'{archive_path}.proxmenux.json'
+    if os.path.exists(sidecar):
+        try:
+            os.remove(sidecar)
+            removed.append(os.path.basename(sidecar))
+        except OSError:
+            pass
+    # Runner log — same stem as the archive.
+    basename = os.path.basename(archive_path)
+    stem = basename
+    for ext in ('.tar.zst', '.tar.gz', '.tar.bz2', '.tar.xz', '.tar'):
+        if stem.endswith(ext):
+            stem = stem[:-len(ext)]
+            break
+    log_path = f'{_BACKUP_LOG_DIR}/{stem}.log'
+    if os.path.exists(log_path):
+        try:
+            os.remove(log_path)
+            removed.append(os.path.basename(log_path))
+        except OSError:
+            pass
+
+    return jsonify({'status': 'ok', 'removed': removed})
+
+
+@app.route('/api/host-backups/archives/<path:archive_id>/log', methods=['GET'])
+@require_auth
+def api_host_backups_archive_log(archive_id):
+    """Return the runner log that produced this specific local archive.
+
+    The runner names both files from the same `<job_id>-<ts>` stem —
+    `<stem>.tar.zst` for the archive, `<stem>.log` for the run log —
+    so we just strip the archive extension and look up the matching
+    .log under `/var/log/proxmenux/backup-jobs/`. Returns 80-line tail
+    + total content; the UI uses both (tail in the inspect modal, full
+    content if the operator clicks "Open full log")."""
+    basename = os.path.basename(archive_id)
+    # Strip the tar.* extension to recover the <job_id>-<ts> stem.
+    stem = basename
+    for ext in ('.tar.zst', '.tar.gz', '.tar.bz2', '.tar.xz', '.tar'):
+        if stem.endswith(ext):
+            stem = stem[:-len(ext)]
+            break
+    log_path = f'{_BACKUP_LOG_DIR}/{stem}.log'
+    if not os.path.isfile(log_path):
+        # Return 200 with empty fields instead of 404 so SWR doesn't
+        # have to special-case the "no log available" branch — the UI
+        # just checks `log_path === null`.
+        return jsonify({
+            'log_path': None,
+            'size': 0,
+            'content': '',
+            'tail': [],
+        })
+    try:
+        with open(log_path, 'r', errors='replace') as f:
+            content = f.read()
+    except OSError as e:
+        return jsonify({'error': str(e)}), 500
+    lines = content.splitlines()
+    return jsonify({
+        'log_path': log_path,
+        'size': len(content),
+        'content': content,
+        'tail': lines[-80:],
+    })
+
+
 if __name__ == '__main__':
     import sys
     import logging
+
+    # Regenerate /etc/cron.d/proxmenux-smart from the current schedule
+    # config on every Monitor start. Pre-existing installs may carry
+    # a cron file with the broken script path (without /storage/),
+    # left over from before the path-fix in this build. Rewriting it
+    # at startup is idempotent and silently heals those hosts on the
+    # first restart after the upgrade — no operator action needed.
+    try:
+        _update_smart_cron()
+    except Exception as _e:
+        print(f"[startup] smart cron regen failed: {_e}", file=sys.stderr)
     
     # Custom filter to suppress TLS handshake noise when running HTTP
     # (browsers may cache HTTPS and keep sending TLS ClientHello to an HTTP server)
@@ -11812,29 +18428,32 @@ if __name__ == '__main__':
     # ── Temperature & Latency history collector ──
     # Initialize SQLite DB and start background thread to record CPU temp + latency every 60s
     if init_temperature_db() and init_latency_db():
-        # Record initial readings immediately
-        _record_temperature()
-        _record_latency()
-        # Sprint 14: per-disk temperature history shares the same DB
-        # and the same 60s collector loop — initialize the table and
-        # take a baseline sample so the first chart draw isn't empty.
-        try:
-            import disk_temperature_history
-            if disk_temperature_history.init_disk_temperature_db():
-                disk_temperature_history.record_all_disk_temperatures()
-        except Exception as e:
-            print(f"[ProxMenux] Disk temperature history init failed: {e}")
-
-        # Sprint 14.7: managed-installs registry. Run a detection
-        # sweep at startup so manual NVIDIA/Tailscale installs that
-        # predated this build show up immediately — without waiting
-        # for the first 24h notification cycle to populate the file.
-        try:
-            import managed_installs
-            managed_installs.detect_and_register()
-            print("[ProxMenux] Managed-installs registry initialised")
-        except Exception as e:
-            print(f"[ProxMenux] managed_installs init failed: {e}")
+        # The heavy baseline-collection + detection sweeps below
+        # used to run inline here and added ~9 s of cold-start time
+        # (per-disk SMART scan + Tailscale/NVIDIA subprocess sweeps).
+        # Move them to a daemon thread so app.run() can start
+        # accepting requests immediately. The dashboard endpoints
+        # that read this data simply return empty/cached until the
+        # first cycle finishes a few seconds later.
+        def _deferred_startup_inits():
+            try:
+                _record_temperature()
+                _record_latency()
+            except Exception as e:
+                print(f"[ProxMenux] initial temp/latency record failed: {e}")
+            try:
+                import disk_temperature_history
+                if disk_temperature_history.init_disk_temperature_db():
+                    disk_temperature_history.record_all_disk_temperatures()
+            except Exception as e:
+                print(f"[ProxMenux] Disk temperature history init failed: {e}")
+            try:
+                import managed_installs
+                managed_installs.detect_and_register()
+                print("[ProxMenux] Managed-installs registry initialised")
+            except Exception as e:
+                print(f"[ProxMenux] managed_installs init failed: {e}")
+        threading.Thread(target=_deferred_startup_inits, daemon=True).start()
 
         # Self-healing maintenance run on every startup. Two passes, both
         # idempotent and safe to run repeatedly. They exist because issues
@@ -12065,14 +18684,14 @@ if __name__ == '__main__':
                 ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
                 ssl_context.load_cert_chain(ssl_cert, ssl_key)
                 print("[ProxMenux] Starting Flask server with SSL (using flask-sock for WebSockets)...")
-                app.run(host='::', port=8008, debug=False, ssl_context=ssl_context)
+                app.run(host='::', port=8008, debug=False, ssl_context=ssl_context, threaded=True)
         else:
             # HTTP mode - use Flask dev server (simpler, works fine without SSL)
             print("[ProxMenux] Starting Flask server with HTTP...")
-            app.run(host='::', port=8008, debug=False)
+            app.run(host='::', port=8008, debug=False, threaded=True)
     except Exception as e:
         if ssl_ctx and not gevent_available:
             print(f"[ProxMenux] SSL startup failed ({e}), falling back to HTTP")
-            app.run(host='::', port=8008, debug=False)
+            app.run(host='::', port=8008, debug=False, threaded=True)
         else:
             raise e
diff --git a/AppImage/scripts/health_monitor.py b/AppImage/scripts/health_monitor.py
index e4e47c89..a9a7ea24 100644
--- a/AppImage/scripts/health_monitor.py
+++ b/AppImage/scripts/health_monitor.py
@@ -58,6 +58,88 @@ def _perf_log(section: str, elapsed_ms: float):
     if DEBUG_PERF:
         print(f"[PERF] {section} = {elapsed_ms:.1f}ms")
 
+
+# Cap notification `reason` strings so a spike (e.g. 40 CTs above 85%
+# rootfs) can't blow past Telegram's 4096-byte cap or truncate the
+# subject line in email clients. First 8 names + a tail count keeps
+# the message actionable without listing every offender.
+_NAME_LIST_LIMIT = 8
+
+def _fmt_name_list(items, limit: int = _NAME_LIST_LIMIT, sep: str = ", ") -> str:
+    """Join up to `limit` items into a comma-separated list; when the
+    input is longer, append " …and N more" so the reader sees both a
+    concrete sample AND that the list is truncated.
+
+    items: iterable of strings.
+    """
+    seq = list(items)
+    if len(seq) <= limit:
+        return sep.join(seq)
+    head = sep.join(seq[:limit])
+    return f"{head} …and {len(seq) - limit} more"
+
+
+def _fmt_entity_and_summary(items, singular: str, plural: str, limit: int = _NAME_LIST_LIMIT):
+    """Return a (title_entity, reason_summary) tuple for a list of
+    affected entities. Used by health checks that want to surface both
+    a headline entity in the notification title AND a full summary in
+    the body.
+
+    - 1 item  → ("Foo", "Foo <singular>")
+    - 2 items → ("Foo +1", "2 <plural>: Foo, Bar")
+    - N items → ("Foo +N-1", "N <plural>: Foo, Bar, … …and M more")
+    """
+    seq = list(items)
+    n = len(seq)
+    if n == 0:
+        return "", ""
+    if n == 1:
+        return seq[0], f"{seq[0]} {singular}"
+    title_entity = f"{seq[0]} +{n - 1}"
+    reason = f"{n} {plural}: {_fmt_name_list(seq, limit)}"
+    return title_entity, reason
+
+
+# USB-NVMe bridges (ASMedia, JMicron, Realtek) answer plain smartctl with
+# the *bridge* identity — model shows as "ASMT 2462 NVME" and there is no
+# temperature. Only `-d snt*` passes through to the actual NVMe controller
+# behind the bridge. For removable disks we try the snt* variants first
+# so both identity and health reflect the drive, not the enclosure.
+_USB_NVME_DRIVERS = ('sntasmedia', 'sntjmicron', 'sntrealtek')
+
+
+def _disk_base_for_sysfs(name: str) -> str:
+    """Normalize `/dev/sda` / `sda` to just `sda` for `/sys/block/<name>` lookups."""
+    if name.startswith('/dev/'):
+        return name[5:]
+    return name
+
+
+def _is_disk_removable(disk_name: str) -> bool:
+    """True if `/sys/block/<disk>/removable` reads 1. USB-attached storage."""
+    try:
+        base = _disk_base_for_sysfs(disk_name)
+        with open(f'/sys/block/{base}/removable') as f:
+            return f.read().strip() == '1'
+    except Exception:
+        return False
+
+
+def _is_disk_usb(disk_name: str) -> bool:
+    """True if the disk sits behind a USB bus. Reads the resolved sysfs
+    device path — reliable for USB-NVMe bridges and USB-attached HDDs
+    that report `removable=0` even though they ARE USB (so the older
+    `_is_disk_removable` heuristic skipped snt* driver probes and left
+    NVMe-behind-a-bridge disks with the bridge's own chatter cached
+    forever)."""
+    try:
+        base = _disk_base_for_sysfs(disk_name)
+        real = os.path.realpath(f'/sys/block/{base}')
+        return any(seg.startswith('usb') and (len(seg) == 3 or seg[3:].isdigit())
+                   for seg in real.split('/'))
+    except Exception:
+        return False
+
 class HealthMonitor:
     """
     Monitors system health across multiple components with minimal impact.
@@ -1107,16 +1189,16 @@ class HealthMonitor:
         # Severity: CRITICAL > WARNING > UNKNOWN (capped at WARNING) > INFO > OK
         if critical_issues:
             overall = 'CRITICAL'
-            summary = '; '.join(critical_issues[:3])
+            summary = _fmt_name_list(critical_issues, sep='; ')
         elif warning_issues:
             overall = 'WARNING'
-            summary = '; '.join(warning_issues[:3])
+            summary = _fmt_name_list(warning_issues, sep='; ')
         elif unknown_issues:
             overall = 'WARNING'  # UNKNOWN caps at WARNING, never escalates to CRITICAL
-            summary = '; '.join(unknown_issues[:3])
+            summary = _fmt_name_list(unknown_issues, sep='; ')
         elif info_issues:
             overall = 'OK'  # INFO statuses don't degrade overall health
-            summary = '; '.join(info_issues[:3])
+            summary = _fmt_name_list(info_issues, sep='; ')
         else:
             overall = 'OK'
             summary = 'All systems operational'
@@ -1143,15 +1225,24 @@ class HealthMonitor:
                 cat_status = cat_data.get('status', 'OK')
                 prev_status = previous_details.get(cat_key, 'OK')
                 if prev_status != cat_status and cat_status in ('WARNING', 'CRITICAL'):
+                    # `entity` gives the notification title a concrete
+                    # subject (e.g. "Tuxis (dir)") instead of the bare
+                    # category name. Checks that surface a single
+                    # affected object populate it in _check_XXX; the
+                    # rest just fall through and the template renders
+                    # without the placeholder thanks to _SafeDict.
+                    event_data = {
+                        'previous': prev_status,
+                        'current': cat_status,
+                        'reason': cat_data.get('reason', ''),
+                    }
+                    if cat_data.get('entity'):
+                        event_data['entity'] = cat_data['entity']
                     health_persistence.emit_event(
                         event_type='state_change',
                         category=cat_key,
                         severity=cat_status,
-                        data={
-                            'previous': prev_status,
-                            'current': cat_status,
-                            'reason': cat_data.get('reason', '')
-                        }
+                        data=event_data,
                     )
             
             self._last_overall_status = overall
@@ -1219,6 +1310,16 @@ class HealthMonitor:
             WARNING_MIN_SAMPLES = 25   # ~250s of sustained elevated CPU
             RECOVERY_MIN_SAMPLES = 10  # ~100s of recovery
             
+            # Build the `details` payload the cpu_high notification
+            # template (notification_templates.py) expects: `value`
+            # (already-formatted percent), `cores` (CPU count) and a
+            # human-readable `details` line. The previous payload only
+            # carried `cpu_percent`/`duration`, which left the template
+            # placeholders blank — the user got "High CPU usage — %"
+            # and "CPU usage has reached % on  cores." with no values.
+            cpu_count = os.cpu_count() or 1
+            value_str = f"{cpu_percent:.0f}"
+
             if len(critical_samples) >= CRITICAL_MIN_SAMPLES:
                 # Calculate actual duration from oldest to newest sample
                 oldest = min(s['time'] for s in critical_samples)
@@ -1231,7 +1332,13 @@ class HealthMonitor:
                     category='cpu',
                     severity='CRITICAL',
                     reason=reason,
-                    details={'cpu_percent': cpu_percent, 'duration': actual_duration}
+                    details={
+                        'value': value_str,
+                        'cores': cpu_count,
+                        'details': f'Sustained for {actual_duration}s above {self.CPU_CRITICAL}%.',
+                        'cpu_percent': cpu_percent,
+                        'duration': actual_duration,
+                    },
                 )
             elif len(warning_samples) >= WARNING_MIN_SAMPLES and len(recovery_samples) < RECOVERY_MIN_SAMPLES:
                 oldest = min(s['time'] for s in warning_samples)
@@ -1244,7 +1351,13 @@ class HealthMonitor:
                     category='cpu',
                     severity='WARNING',
                     reason=reason,
-                    details={'cpu_percent': cpu_percent, 'duration': actual_duration}
+                    details={
+                        'value': value_str,
+                        'cores': cpu_count,
+                        'details': f'Sustained for {actual_duration}s above {self.CPU_WARNING}%.',
+                        'cpu_percent': cpu_percent,
+                        'duration': actual_duration,
+                    },
                 )
             else:
                 status = 'OK'
@@ -1283,7 +1396,9 @@ class HealthMonitor:
                 t_status = temp_status.get('status', 'OK')
                 checks['cpu_temperature'] = {
                     'status': t_status,
-                    'detail': 'Temperature elevated' if t_status != 'OK' else 'Normal'
+                    'detail': 'Temperature elevated' if t_status != 'OK' else 'Normal',
+                    'error_key': 'cpu_temperature',
+                    'dismissable': True,
                 }
             else:
                 checks['cpu_temperature'] = {
@@ -1378,7 +1493,7 @@ class HealthMonitor:
                         category='temperature',
                         severity='WARNING',
                         reason=reason,
-                        details={'temperature': max_temp, 'duration': actual_duration, 'dismissable': False}
+                        details={'temperature': max_temp, 'duration': actual_duration, 'dismissable': True}
                     )
                 elif len(recovery_samples) >= 3:
                     # Temperature has been ≤80°C for 30 seconds - clear the error
@@ -1579,6 +1694,17 @@ class HealthMonitor:
                     error_key = f'disk_space_{mount_point}'
                     if fs_status['status'] != 'OK':
                         issues.append(f"{mount_point}: {fs_status['reason']}")
+                        # Carry error_key + dismissable into the check
+                        # dict — the frontend gates the Dismiss dropdown
+                        # on `dismissable === true` strictly, and the
+                        # spread at the consumer (`storage_details →
+                        # checks[key]`) only forwards fields actually
+                        # present on fs_status. Without these two lines,
+                        # /mnt/* fullness rows reach the UI as plain
+                        # CRITICAL/WARNING with no Dismiss button — the
+                        # same gap the operator hit on stable 1.2.2.
+                        fs_status['error_key'] = error_key
+                        fs_status['dismissable'] = True
                         storage_details[mount_point] = fs_status
                         # Record persistent error for notifications
                         usage = psutil.disk_usage(mount_point)
@@ -1596,7 +1722,7 @@ class HealthMonitor:
                                 'mount': mount_point,
                                 'used': str(round(usage.percent, 1)),
                                 'available': avail_str,
-                                'dismissable': False,
+                                'dismissable': True,
                             }
                         )
                     else:
@@ -1610,10 +1736,19 @@ class HealthMonitor:
         if zfs_pool_issues:
             for pool_name, pool_info in zfs_pool_issues.items():
                 issues.append(f'{pool_name}: {pool_info["reason"]}')
-                storage_details[pool_name] = pool_info
-                
-                # Record error for notification system
+                # Carry error_key + dismissable BEFORE pushing — same
+                # rationale as the disk_space path above: the frontend
+                # gates the Dismiss button on `dismissable === true`
+                # strictly, and the splat at the consumer only forwards
+                # what pool_info already has. real_pool gets computed
+                # twice (here + below) but both paths land on the same
+                # key.
                 real_pool = pool_info.get('pool_name', pool_name)
+                pool_info['error_key'] = f'zfs_pool_{real_pool}'
+                pool_info['dismissable'] = True
+                storage_details[pool_name] = pool_info
+
+                # Record error for notification system
                 zfs_error_key = f'zfs_pool_{real_pool}'
                 zfs_reason = f'ZFS pool {real_pool}: {pool_info["reason"]}'
                 try:
@@ -1627,7 +1762,7 @@ class HealthMonitor:
                                 'pool_name': real_pool,
                                 'health': pool_info.get('health', ''),
                                 'device': f'zpool:{real_pool}',
-                                'dismissable': False,
+                                'dismissable': True,
                             }
                         )
                 except Exception:
@@ -1999,22 +2134,22 @@ class HealthMonitor:
                 # persistent WARNING after user has acknowledged.
                 return {
                     'status': 'OK',
-                    'reason': '; '.join(issues[:3]),
+                    'reason': _fmt_name_list(issues, sep='; '),
                     'details': storage_details,
                     'checks': checks,
                     'all_dismissed': True,
                 }
         except Exception:
             pass
-        
+
         # Determine overall status
         has_critical = any(
             d.get('status') == 'CRITICAL' for d in storage_details.values()
         )
-        
+
         return {
             'status': 'CRITICAL' if has_critical else 'WARNING',
-            'reason': '; '.join(issues[:3]),
+            'reason': _fmt_name_list(issues, sep='; '),
             'details': storage_details,
             'checks': checks
         }
@@ -2361,15 +2496,36 @@ class HealthMonitor:
         result = {'serial': '', 'model': '', '_fp': fp}
         try:
             dev_path = f'/dev/{disk_name}' if not disk_name.startswith('/') else disk_name
-            proc = subprocess.run(
-                ['smartctl', '-i', '-j', dev_path],
-                capture_output=True, text=True, timeout=5
-            )
-            if proc.returncode in (0, 4):
-                import json as _json
-                data = _json.loads(proc.stdout)
-                result['serial'] = data.get('serial_number', '')
-                result['model'] = data.get('model_name', '') or data.get('model_family', '')
+
+            # USB-attached disks may sit behind an NVMe bridge: try the
+            # snt* driver variants first so identity reflects the drive
+            # (Samsung 990 PRO) rather than the enclosure (ASMT 2462 NVME).
+            # If all snt* fail, fall through to the plain call — that's
+            # still correct for USB-SATA sticks and non-USB devices.
+            # USB detection is by sysfs path (`_is_disk_usb`) rather than
+            # the `removable` flag, since USB-NVMe and USB-HDD both report
+            # `removable=0` even though they ARE USB.
+            attempts = []
+            if _is_disk_usb(disk_name) or _is_disk_removable(disk_name):
+                for drv in _USB_NVME_DRIVERS:
+                    attempts.append(['smartctl', '-i', '-j', '-d', drv, dev_path])
+            attempts.append(['smartctl', '-i', '-j', dev_path])
+
+            import json as _json
+            for cmd in attempts:
+                proc = subprocess.run(cmd, capture_output=True, text=True, timeout=5)
+                if proc.returncode not in (0, 4):
+                    continue
+                try:
+                    data = _json.loads(proc.stdout)
+                except Exception:
+                    continue
+                serial = data.get('serial_number', '')
+                model = data.get('model_name', '') or data.get('model_family', '')
+                if serial or model:
+                    result['serial'] = serial
+                    result['model'] = model
+                    break
         except Exception:
             pass
 
@@ -2402,20 +2558,51 @@ class HealthMonitor:
         
         try:
             dev_path = f'/dev/{disk_name}' if not disk_name.startswith('/') else disk_name
-            result = subprocess.run(
-                ['smartctl', '--health', '-j', dev_path],
-                capture_output=True, text=True, timeout=5
-            )
+            # `-n standby` skips the command (exit code 2, no disk I/O)
+            # when the drive is parked, preventing the health poller
+            # from spinning up HDDs that hdparm / hd-idle just put to
+            # sleep — issue #232. The "UNKNOWN" branch below correctly
+            # keeps the previous cached result alive on exit code 2.
+            #
+            # USB-attached disks may sit behind an NVMe bridge: try snt*
+            # drivers first so health reflects the actual NVMe controller.
+            # A bridge that fakes "PASSED" while the drive behind it is
+            # failing is exactly the false-negative we want to avoid.
+            # USB detection uses the sysfs path so USB-NVMe bridges (which
+            # report removable=0) are caught too.
+            attempts = []
+            if _is_disk_usb(disk_name) or _is_disk_removable(disk_name):
+                for drv in _USB_NVME_DRIVERS:
+                    attempts.append(['smartctl', '-n', 'standby', '--health', '-j', '-d', drv, dev_path])
+            attempts.append(['smartctl', '-n', 'standby', '--health', '-j', dev_path])
+
             import json as _json
-            data = _json.loads(result.stdout)
-            passed = data.get('smart_status', {}).get('passed', None)
-            if passed is True:
-                smart_result = 'PASSED'
-            elif passed is False:
-                smart_result = 'FAILED'
-            else:
+            smart_result = None
+            for cmd in attempts:
+                result = subprocess.run(cmd, capture_output=True, text=True, timeout=5)
+                if result.returncode == 2:
+                    # Drive in standby — reuse the previous health state
+                    # if we have one, otherwise report UNKNOWN. Either way,
+                    # don't refresh the cache TTL so we retry on the next
+                    # cycle (a drive can come out of standby at any time).
+                    if cached:
+                        return cached['result']
+                    return 'UNKNOWN'
+                try:
+                    data = _json.loads(result.stdout)
+                except Exception:
+                    continue
+                passed = data.get('smart_status', {}).get('passed', None)
+                if passed is True:
+                    smart_result = 'PASSED'
+                    break
+                if passed is False:
+                    smart_result = 'FAILED'
+                    break
+                # No opinion yet — next attempt (fallthrough to plain).
+            if smart_result is None:
                 smart_result = 'UNKNOWN'
-            
+
             # Cache the result with the device fingerprint for hot-swap invalidation
             self._smart_cache[cache_key] = {'result': smart_result, 'time': current_time, 'fp': fp}
             return smart_result
@@ -2725,7 +2912,7 @@ class HealthMonitor:
                                 'device': disk,
                                 'error_count': error_count,
                                 'smart_status': smart_health,
-                                'dismissable': False,
+                                'dismissable': True,
                                 'error_key': error_key,
                             }
                         elif smart_ok:
@@ -2744,7 +2931,7 @@ class HealthMonitor:
                                 'device': disk,
                                 'error_count': error_count,
                                 'smart_status': smart_health,
-                                'dismissable': False,
+                                'dismissable': True,
                                 'error_key': error_key,
                             }
                         elif smart_health == 'FAILED':
@@ -2764,7 +2951,7 @@ class HealthMonitor:
                                          'serial': resolved_serial or '',
                                          'error_count': error_count,
                                          'smart_status': smart_health,
-                                         'sample': sample, 'dismissable': False}
+                                         'sample': sample, 'dismissable': True}
                             )
                             disk_results[display] = {
                                 'status': severity,
@@ -2772,7 +2959,7 @@ class HealthMonitor:
                                 'device': disk,
                                 'error_count': error_count,
                                 'smart_status': smart_health,
-                                'dismissable': False,
+                                'dismissable': True,
                                 'error_key': error_key,
                             }
                         else:
@@ -2894,10 +3081,17 @@ class HealthMonitor:
                 }
             
             has_critical = any(d.get('status') == 'CRITICAL' for d in active_results.values())
-            
+
+            # Surface disk names in the reason so notifications identify
+            # which device(s) took the hit rather than just a count.
+            disk_names = sorted(active_results.keys())
+            entity, summary = _fmt_entity_and_summary(
+                disk_names, singular='has errors', plural='disks with errors',
+            )
             return {
                 'status': 'CRITICAL' if has_critical else 'WARNING',
-                'reason': f"{len(active_results)} disk(s) with errors",
+                'reason': summary,
+                'entity': entity,
                 'details': disk_results
             }
         
@@ -2991,13 +3185,14 @@ class HealthMonitor:
                             category='network',
                             severity='CRITICAL',
                             reason=alert_reason or 'Interface DOWN',
-                            details={'interface': interface, 'dismissable': False}
+                            details={'interface': interface, 'dismissable': True}
                         )
                         
                         interface_details[interface] = {
                             'status': 'CRITICAL',
                             'reason': alert_reason or 'Interface DOWN',
-                            'dismissable': False
+                            'dismissable': True,
+                            'error_key': error_key,
                         }
                 else:
                     active_interfaces.add(interface)
@@ -3028,7 +3223,8 @@ class HealthMonitor:
                     checks[iface] = {
                         'status': detail.get('status', 'OK'),
                         'detail': detail.get('reason', 'DOWN'),
-                        'dismissable': detail.get('dismissable', False)
+                        'dismissable': detail.get('dismissable', True),
+                        'error_key': detail.get('error_key') or iface,
                     }
             checks['connectivity'] = connectivity_check
             
@@ -3039,11 +3235,11 @@ class HealthMonitor:
             
             return {
                 'status': 'CRITICAL' if has_critical else 'WARNING',
-                'reason': '; '.join(issues[:2]),
+                'reason': _fmt_name_list(issues, sep='; '),
                 'details': interface_details,
                 'checks': checks
             }
-        
+
         except Exception as e:
             print(f"[HealthMonitor] Network check failed: {e}")
             return {'status': 'UNKNOWN', 'reason': f'Network check unavailable: {str(e)}', 'checks': {}, 'dismissable': True}
@@ -3383,10 +3579,10 @@ class HealthMonitor:
             
             return {
                 'status': 'CRITICAL' if has_critical else 'WARNING',
-                'reason': '; '.join(issues[:3]),
+                'reason': _fmt_name_list(issues, sep='; '),
                 'details': vm_details
             }
-        
+
         except Exception as e:
             print(f"[HealthMonitor] VMs/CTs check failed: {e}")
             return {'status': 'UNKNOWN', 'reason': f'VM/CT check unavailable: {str(e)}', 'checks': {}, 'dismissable': True}
@@ -3613,11 +3809,11 @@ class HealthMonitor:
             
             return {
                 'status': 'CRITICAL' if has_critical else 'WARNING',
-                'reason': '; '.join(issues[:3]),
+                'reason': _fmt_name_list(issues, sep='; '),
                 'details': vm_details,
                 'checks': checks
             }
-            
+
         except Exception as e:
             print(f"[HealthMonitor] VMs/CTs persistence check failed: {e}")
             return {'status': 'UNKNOWN', 'reason': f'VM/CT check unavailable: {str(e)}', 'checks': {}, 'dismissable': True}
@@ -4228,7 +4424,12 @@ class HealthMonitor:
                     'log_persistent_errors': {'active': persistent_count > 0, 'severity': 'WARNING',
                         'reason': f'{persistent_count} recurring pattern(s) over 15+ min:\n' + '\n'.join(f'  - {s}' for s in persist_samples) if persistent_count else ''},
                     'log_critical_errors': {'active': unique_critical_count > 0, 'severity': 'CRITICAL',
-                        'reason': f'{unique_critical_count} critical error(s) found', 'dismissable': False},
+                        'reason': (
+                            self._enrich_critical_log_reason(next(iter(critical_errors_found.values())))
+                            if unique_critical_count == 1
+                            else f'{unique_critical_count} critical errors:\n' + self._enrich_critical_log_reason(next(iter(critical_errors_found.values())))
+                        ) if unique_critical_count > 0 else '',
+                        'dismissable': True},
                 }
                 
                 # Track which sub-checks were dismissed
@@ -4298,7 +4499,7 @@ class HealthMonitor:
                     'log_critical_errors': {
                         'status': _log_check_status('log_critical_errors', unique_critical_count > 0, 'CRITICAL'),
                         'detail': reason if unique_critical_count > 0 else 'No critical errors',
-                        'dismissable': False,
+                        'dismissable': True,
                         'error_key': 'log_critical_errors'
                     }
                 }
@@ -4318,7 +4519,7 @@ class HealthMonitor:
                         detail = v.get('detail', '')
                         if detail:
                             active_reasons.append(detail)
-                    reason = '; '.join(active_reasons[:3]) if active_reasons else None
+                    reason = _fmt_name_list(active_reasons, sep='; ') if active_reasons else None
                 
                 log_result = {'status': status, 'checks': log_checks}
                 if reason:
@@ -4623,7 +4824,7 @@ class HealthMonitor:
                     health_persistence.record_error(
                         error_key='system_age', category='updates',
                         severity='CRITICAL', reason=reason,
-                        details={'days': last_update_days, 'update_count': update_count, 'dismissable': False}
+                        details={'days': last_update_days, 'update_count': update_count, 'dismissable': True}
                     )
                 elif last_update_days and last_update_days >= 365:
                     status = 'WARNING'
@@ -5071,7 +5272,7 @@ class HealthMonitor:
                 overall_status = 'CRITICAL' if has_critical else 'WARNING'
                 return {
                     'status': overall_status,
-                    'reason': '; '.join(active_issues[:2]),
+                    'reason': _fmt_name_list(active_issues, sep='; '),
                     'checks': checks
                 }
             
@@ -5557,7 +5758,7 @@ class HealthMonitor:
                             'storage_name': storage_name,
                             'storage_type': storage.get('type', 'unknown'),
                             'status_detail': status_detail,
-                            'dismissable': False
+                            'dismissable': True
                         }
                     )
                 
@@ -5566,7 +5767,7 @@ class HealthMonitor:
                     'reason': reason,
                     'type': storage.get('type', 'unknown'),
                     'status': status_detail,
-                    'dismissable': False
+                    'dismissable': True
                 }
             
             # Build checks from storage_details
@@ -5577,14 +5778,14 @@ class HealthMonitor:
                     checks[st_name] = {
                         'status': 'INFO',
                         'detail': f"[Startup] {st_info.get('reason', 'Unavailable')} (checking...)",
-                        'dismissable': False,
+                        'dismissable': True,
                         'grace_period': True
                     }
                 else:
                     checks[st_name] = {
                         'status': 'CRITICAL',
                         'detail': st_info.get('reason', 'Unavailable'),
-                        'dismissable': False
+                        'dismissable': True
                     }
             
             # Add excluded unavailable storages as INFO (not as errors)
@@ -5609,11 +5810,22 @@ class HealthMonitor:
             
             # Determine overall status based on non-excluded issues only
             if real_unavailable:
+                # Build a name list like "Tuxis (dir), backups-nfs (nfs)"
+                # so both the notification body and the (headline) title
+                # can tell the user which storages actually went down —
+                # the previous "N storage(s) unavailable" wording forced
+                # them to open the UI to find out.
+                labels = [f"{s['name']} ({s.get('type', 'unknown')})" for s in real_unavailable]
+                entity, summary = _fmt_entity_and_summary(
+                    labels, singular='unavailable', plural='Proxmox storages unavailable',
+                )
                 # During grace period, return INFO instead of CRITICAL
                 if in_grace_period:
+                    grace_summary = f"{summary} (startup)" if len(labels) > 1 else f"{labels[0]} not yet available (startup)"
                     return {
                         'status': 'INFO',
-                        'reason': f'{len(real_unavailable)} storage(s) not yet available (startup)',
+                        'reason': grace_summary,
+                        'entity': entity,
                         'details': storage_details,
                         'checks': checks,
                         'grace_period': True
@@ -5621,7 +5833,8 @@ class HealthMonitor:
                 else:
                     return {
                         'status': 'CRITICAL',
-                        'reason': f'{len(real_unavailable)} Proxmox storage(s) unavailable',
+                        'reason': summary,
+                        'entity': entity,
                         'details': storage_details,
                         'checks': checks
                     }
@@ -5802,15 +6015,23 @@ class HealthMonitor:
                 health_persistence.clear_error(ek)
 
         if critical_targets:
+            entity, summary = _fmt_entity_and_summary(
+                critical_targets, singular='is stale', plural='remote mounts stale',
+            )
             return {
                 'status': 'CRITICAL',
-                'reason': f'{len(critical_targets)} remote mount(s) stale: {", ".join(critical_targets[:3])}',
+                'reason': summary,
+                'entity': entity,
                 'checks': checks,
             }
         if warning_targets:
+            entity, summary = _fmt_entity_and_summary(
+                warning_targets, singular='is read-only', plural='remote mounts read-only',
+            )
             return {
                 'status': 'WARNING',
-                'reason': f'{len(warning_targets)} remote mount(s) read-only: {", ".join(warning_targets[:3])}',
+                'reason': summary,
+                'entity': entity,
                 'checks': checks,
             }
         return {
@@ -5943,15 +6164,19 @@ class HealthMonitor:
         if not checks:
             return None
         if critical_cts:
+            entity, _ = _fmt_entity_and_summary(critical_cts, 'x', 'x')
             return {
                 'status': 'CRITICAL',
-                'reason': f'{len(critical_cts)} CT(s) at >{CRIT_PCT}% rootfs: {", ".join(critical_cts[:3])}',
+                'reason': f'{len(critical_cts)} CT(s) at >{CRIT_PCT}% rootfs: {_fmt_name_list(critical_cts)}',
+                'entity': entity,
                 'checks': checks,
             }
         if warning_cts:
+            entity, _ = _fmt_entity_and_summary(warning_cts, 'x', 'x')
             return {
                 'status': 'WARNING',
-                'reason': f'{len(warning_cts)} CT(s) at >{WARN_PCT}% rootfs: {", ".join(warning_cts[:3])}',
+                'reason': f'{len(warning_cts)} CT(s) at >{WARN_PCT}% rootfs: {_fmt_name_list(warning_cts)}',
+                'entity': entity,
                 'checks': checks,
             }
         return {
@@ -6065,15 +6290,19 @@ class HealthMonitor:
                 health_persistence.clear_error(ek)
 
         if critical_labels:
+            entity, _ = _fmt_entity_and_summary(critical_labels, 'x', 'x')
             return {
                 'status': 'CRITICAL',
-                'reason': f'{len(critical_labels)} CT mount(s) ≥{crit_pct:.0f}%: {", ".join(critical_labels[:3])}',
+                'reason': f'{len(critical_labels)} CT mount(s) ≥{crit_pct:.0f}%: {_fmt_name_list(critical_labels)}',
+                'entity': entity,
                 'checks': checks,
             }
         if warning_labels:
+            entity, _ = _fmt_entity_and_summary(warning_labels, 'x', 'x')
             return {
                 'status': 'WARNING',
-                'reason': f'{len(warning_labels)} CT mount(s) ≥{warn_pct:.0f}%: {", ".join(warning_labels[:3])}',
+                'entity': entity,
+                'reason': f'{len(warning_labels)} CT mount(s) ≥{warn_pct:.0f}%: {_fmt_name_list(warning_labels)}',
                 'checks': checks,
             }
         return {
@@ -6184,15 +6413,19 @@ class HealthMonitor:
         if not checks:
             return None  # No block storages on this host
         if critical_labels:
+            entity, _ = _fmt_entity_and_summary(critical_labels, 'x', 'x')
             return {
                 'status': 'CRITICAL',
-                'reason': f'{len(critical_labels)} PVE storage(s) ≥{crit_pct:.0f}%: {", ".join(critical_labels[:3])}',
+                'reason': f'{len(critical_labels)} PVE storage(s) ≥{crit_pct:.0f}%: {_fmt_name_list(critical_labels)}',
+                'entity': entity,
                 'checks': checks,
             }
         if warning_labels:
+            entity, _ = _fmt_entity_and_summary(warning_labels, 'x', 'x')
             return {
                 'status': 'WARNING',
-                'reason': f'{len(warning_labels)} PVE storage(s) ≥{warn_pct:.0f}%: {", ".join(warning_labels[:3])}',
+                'reason': f'{len(warning_labels)} PVE storage(s) ≥{warn_pct:.0f}%: {_fmt_name_list(warning_labels)}',
+                'entity': entity,
                 'checks': checks,
             }
         return {
@@ -6292,15 +6525,19 @@ class HealthMonitor:
                 health_persistence.clear_error(ek)
 
         if critical_labels:
+            entity, _ = _fmt_entity_and_summary(critical_labels, 'x', 'x')
             return {
                 'status': 'CRITICAL',
-                'reason': f'{len(critical_labels)} ZFS pool(s) ≥{crit_pct:.0f}%: {", ".join(critical_labels[:3])}',
+                'reason': f'{len(critical_labels)} ZFS pool(s) ≥{crit_pct:.0f}%: {_fmt_name_list(critical_labels)}',
+                'entity': entity,
                 'checks': checks,
             }
         if warning_labels:
+            entity, _ = _fmt_entity_and_summary(warning_labels, 'x', 'x')
             return {
                 'status': 'WARNING',
-                'reason': f'{len(warning_labels)} ZFS pool(s) ≥{warn_pct:.0f}%: {", ".join(warning_labels[:3])}',
+                'reason': f'{len(warning_labels)} ZFS pool(s) ≥{warn_pct:.0f}%: {_fmt_name_list(warning_labels)}',
+                'entity': entity,
                 'checks': checks,
             }
         return {
diff --git a/AppImage/scripts/health_persistence.py b/AppImage/scripts/health_persistence.py
index 4c595808..41f1a1a8 100644
--- a/AppImage/scripts/health_persistence.py
+++ b/AppImage/scripts/health_persistence.py
@@ -487,7 +487,55 @@ class HealthPersistence:
 
         conn.close()
     
-    def record_error(self, error_key: str, category: str, severity: str, 
+    @staticmethod
+    def _entity_from_details(details: Optional[Dict]) -> str:
+        """Derive a short display identifier for the affected object from
+        the details blob so notification titles can name it. Returns ''
+        when no per-object identity is available (aggregate-only checks).
+
+        Order of preference matches what users actually recognize:
+        friendly name first, then id-with-name, then bare id, then path.
+        """
+        if not details:
+            return ''
+        d = details
+        # Storage / mounts / pools
+        if d.get('storage_name'):
+            st = d.get('storage_type') or d.get('type')
+            return f"{d['storage_name']} ({st})" if st else d['storage_name']
+        if d.get('pool_name'):
+            return d['pool_name']
+        if d.get('mount_point'):
+            return d['mount_point']
+        if d.get('mount_target'):
+            return d['mount_target']
+        # VMs / CTs
+        if d.get('vm_name') and d.get('vmid'):
+            return f"{d['vm_name']} ({d['vmid']})"
+        if d.get('ct_name') and d.get('vmid'):
+            return f"{d['ct_name']} ({d['vmid']})"
+        if d.get('vmid'):
+            return str(d['vmid'])
+        # Disks / devices
+        if d.get('device'):
+            return d['device']
+        if d.get('disk'):
+            return d['disk']
+        # Network / services
+        if d.get('interface'):
+            return d['interface']
+        if d.get('iface'):
+            return d['iface']
+        if d.get('service_name'):
+            return d['service_name']
+        if d.get('service'):
+            return d['service']
+        # Generic fallback
+        if d.get('name'):
+            return str(d['name'])
+        return ''
+
+    def record_error(self, error_key: str, category: str, severity: str,
                     reason: str, details: Optional[Dict] = None) -> Dict[str, Any]:
         """
         Record or update an error.
@@ -601,6 +649,8 @@ class HealthPersistence:
                     event_info = {'type': 'new', 'needs_notification': True}
                     self._record_event(cursor, 'new', error_key,
                                       {'severity': severity, 'reason': reason,
+                                       'entity': self._entity_from_details(details),
+                                       'details': details,
                                        'note': 'Re-triggered after suppression expired'})
                     conn.commit()
                     return event_info
@@ -653,9 +703,15 @@ class HealthPersistence:
                                 conn.commit()
                                 return event_info
 
-            # Record event
+            # Record event with the caller-supplied `details` so downstream
+            # notification templates can render the affected object's name
+            # (storage_name, vm_name, mount_point, …) in the title/body
+            # via `_SafeDict`. Without this, only the aggregate `reason`
+            # travels and titles fall back to bare category labels.
             self._record_event(cursor, event_info['type'], error_key,
-                              {'severity': severity, 'reason': reason})
+                              {'severity': severity, 'reason': reason,
+                               'entity': self._entity_from_details(details),
+                               'details': details})
 
             conn.commit()
         finally:
@@ -690,7 +746,26 @@ class HealthPersistence:
             ''', (now, reason, error_key))
 
             if cursor.rowcount > 0:
-                self._record_event(cursor, 'resolved', error_key, {'reason': reason})
+                # Reload the resolved error's details so the resolution
+                # event can name the same entity that was named when it
+                # was created — otherwise "Storage 'Tuxis' unavailable"
+                # comes back as "Resolved - Storage" with no identity.
+                cursor.execute(
+                    'SELECT details FROM errors WHERE error_key = ? ORDER BY id DESC LIMIT 1',
+                    (error_key,),
+                )
+                row = cursor.fetchone()
+                stored_details = None
+                if row and row[0]:
+                    try:
+                        stored_details = json.loads(row[0])
+                    except Exception:
+                        stored_details = None
+                self._record_event(cursor, 'resolved', error_key, {
+                    'reason': reason,
+                    'entity': self._entity_from_details(stored_details),
+                    'details': stored_details or {},
+                })
 
             conn.commit()
     
diff --git a/AppImage/scripts/jwt_middleware.py b/AppImage/scripts/jwt_middleware.py
index 9b05c1d0..69725972 100644
--- a/AppImage/scripts/jwt_middleware.py
+++ b/AppImage/scripts/jwt_middleware.py
@@ -66,6 +66,47 @@ def require_auth(f):
     return decorated_function
 
 
+def require_auth_or_ticket(f):
+    """Like `require_auth` but ALSO accepts a single-use `?ticket=...`
+    query parameter (same tickets `/api/terminal/ticket` issues for
+    WebSockets). Use on endpoints that the browser needs to invoke
+    from an <a download href="..."> tag — anchor tags can't send the
+    Authorization header, so the caller fetches a ticket first and
+    appends it to the URL.
+
+    Use only for streaming downloads where adding `?ticket=...` is
+    the only practical way to authenticate; everything else stays
+    on plain Bearer-token auth."""
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        config = load_auth_config()
+        if not config.get("enabled", False) or config.get("declined", False):
+            return f(*args, **kwargs)
+
+        # First try the Bearer header (fetch from JS uses this).
+        auth_header = request.headers.get('Authorization')
+        if auth_header:
+            parts = auth_header.split()
+            if len(parts) == 2 and parts[0].lower() == 'bearer':
+                if verify_token(parts[1]):
+                    return f(*args, **kwargs)
+
+        # Fall through to single-use ticket (works for <a download>).
+        try:
+            from flask_terminal_routes import _consume_terminal_ticket
+            if _consume_terminal_ticket(request.args.get('ticket', '')):
+                return f(*args, **kwargs)
+        except ImportError:
+            pass
+
+        return jsonify({
+            "error": "Authentication required",
+            "message": "Provide a Bearer token in the Authorization header or a fresh ?ticket=... from /api/terminal/ticket"
+        }), 401
+
+    return decorated_function
+
+
 def require_admin_scope(f):
     """Like `require_auth` but ALSO requires the token's `scope == full_admin`.
 
diff --git a/AppImage/scripts/notification_events.py b/AppImage/scripts/notification_events.py
index a92100a0..e34ebeaa 100644
--- a/AppImage/scripts/notification_events.py
+++ b/AppImage/scripts/notification_events.py
@@ -597,22 +597,50 @@ class JournalWatcher:
             if self._running:
                 time.sleep(5)  # Wait before restart
     
+    # Discard a saved cursor older than this many seconds — resuming
+    # from a stale cursor replays every event journald has produced
+    # since the file was last touched, which surfaces as duplicate
+    # notifications. 15 min comfortably covers graceful shutdowns,
+    # cron-restart loops and brief outages while keeping a multi-day
+    # downtime from spamming the operator. Reported on RimegraVE
+    # (.1.10): the service was last stopped 11 days before a restart;
+    # on respawn the JournalWatcher fired 16 backup_start notifs in
+    # 40 min for vzdump runs that PVE had logged hours-to-days
+    # earlier. source=journal in notification_history proved the
+    # event chain came from this replay path.
+    _CURSOR_STALE_AFTER_SEC = 15 * 60
+
     def _run_journalctl(self):
-        """Run journalctl -f and process output line by line."""
-        # Persist the cursor across watcher restarts so we don't lose events
-        # in the 5s gap between subprocess crash and respawn. journalctl
-        # writes the file with the latest seen cursor and on next start
-        # resumes from there. Falls back to -n 0 (start from now) only on
-        # the very first run when the cursor file doesn't exist yet.
+        """Run journalctl -f and process output line by line.
+
+        The cursor file lets us pick up after a short watcher crash
+        without dropping events, but we drop it before invoking
+        journalctl if it's older than _CURSOR_STALE_AFTER_SEC.
+        That forces journalctl back to `-n 0` (start from now)
+        instead of replaying days of history as if it were live.
+        """
         cursor_file = '/usr/local/share/proxmenux/journal_cursor.txt'
         try:
             Path(cursor_file).parent.mkdir(parents=True, exist_ok=True)
         except Exception:
             pass
+        cursor_path = Path(cursor_file)
+        if cursor_path.exists():
+            try:
+                age = time.time() - cursor_path.stat().st_mtime
+                if age > self._CURSOR_STALE_AFTER_SEC:
+                    cursor_path.unlink(missing_ok=True)
+                    print(
+                        f"[JournalWatcher] Cursor stale "
+                        f"({int(age)}s old) — restarting from now to "
+                        f"avoid replaying historical events"
+                    )
+            except OSError:
+                pass
         cmd = ['journalctl', '-f', '-o', 'json', '--no-pager',
                f'--cursor-file={cursor_file}']
-        if not Path(cursor_file).exists():
-            cmd.extend(['-n', '0'])  # First run: don't replay history
+        if not cursor_path.exists():
+            cmd.extend(['-n', '0'])  # First run (or stale): don't replay history
 
         self._process = subprocess.Popen(
             cmd, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL,
@@ -2516,12 +2544,17 @@ class PollingCollector:
             if not error_key:
                 continue
             
+            # Keep the raw `details` blob in the tracker so recovery
+            # notifications later can name the same entity ("Storage
+            # 'Tuxis'") that the original alert did — without this, the
+            # resolved notification defaults to the bare category.
             current_keys[error_key] = {
                 'category': error.get('category', ''),
                 'severity': error.get('severity', 'WARNING'),
                 'reason': error.get('reason', ''),
                 'first_seen': error.get('first_seen', ''),
                 'error_key': error_key,
+                'details': error.get('details'),
             }
             category = error.get('category', '')
             severity = error.get('severity', 'WARNING')
@@ -2852,6 +2885,18 @@ class PollingCollector:
                 'duration': duration_label,
                 'is_recovery': True,
             }
+            # Spread the original details blob so the resolved notification
+            # can use the same {storage_name}/{vm_name}/{device} placeholders
+            # the alert did. Mirrors what the alert path does on line ~2718.
+            resolved_details = old_meta.get('details')
+            if isinstance(resolved_details, str):
+                try:
+                    resolved_details = json.loads(resolved_details)
+                except (json.JSONDecodeError, TypeError):
+                    resolved_details = None
+            if isinstance(resolved_details, dict):
+                for _k, _v in resolved_details.items():
+                    data.setdefault(_k, _v)
 
             self._queue.put(NotificationEvent(
                 'error_resolved', 'OK', data, source='health',
@@ -3475,13 +3520,20 @@ class PollingCollector:
         about the final shape."""
         item_type = item.get('type', '')
         update = item.get('update_check', {}) or {}
+        # Version fallbacks: if `latest` is missing (checker couldn't
+        # determine an upstream — network hiccup, or the app itself
+        # isn't in the update list because only sidecar packages need
+        # updating), anchor to the current version so template
+        # placeholders never render as "v" with nothing after.
+        _cur = item.get('current_version') or ''
+        _lat = update.get('latest') or _cur or 'unknown'
         common = {
             'hostname': self._hostname,
             'name': item.get('name') or item.get('id'),
             'menu_label': item.get('menu_label') or '',
             'menu_script': item.get('menu_script') or '',
-            'current_version': item.get('current_version') or '',
-            'latest_version': update.get('latest') or '',
+            'current_version': _cur or 'unknown',
+            'latest_version': _lat,
         }
 
         if item_type == 'oci_app':
@@ -3491,12 +3543,24 @@ class PollingCollector:
                 f" → {p.get('latest', '?')}"
                 for p in packages
             ]
+            # Decide the wording based on whether Tailscale itself moved.
+            # When current == latest, showing "v1.90 → v1.90" reads as a
+            # bug ("update to same version?"); switch to a neutral line
+            # that makes it clear only sidecar packages are updating.
+            if _cur and _lat and _cur == _lat:
+                update_title_suffix = f' — v{_cur} (packages only)'
+                version_line = f'🔹 Tailscale: v{_cur} (unchanged — only sidecar packages need updating)'
+            else:
+                update_title_suffix = f' — v{_lat}'
+                version_line = f'🔹 Current Tailscale: v{_cur or "unknown"}  →  🟢 Latest: v{_lat}'
             data = {
                 **common,
                 'app_id': item.get('id', '').removeprefix('oci:'),
                 'app_name': common['name'],
                 'package_count': len(packages),
                 'package_list': '\n'.join(pkg_lines) or '  (no detail)',
+                'update_title_suffix': update_title_suffix,
+                'version_line': version_line,
             }
             return 'secure_gateway_update_available', data
 
@@ -3827,6 +3891,30 @@ class ProxmoxHookWatcher:
             'title': title or event_type,
             'job_id': pve_job_id,
         }
+
+        # ProxMenux Host Backup: pull the extra fields that the runner
+        # packs into payload.fields so the host_backup_* templates can
+        # render backend, destination, sizes, etc. without falling back
+        # to '{field}' literals or empty placeholders.
+        if pve_type.startswith('proxmenux-host-backup-'):
+            backend = (fields.get('backend') or '').strip().lower()
+            backend_label_map = {
+                'pbs':   'Proxmox Backup Server',
+                'local': 'Local archive',
+                'borg':  'Borg repository',
+            }
+            data['backend']       = backend
+            data['backend_label'] = backend_label_map.get(backend, backend or 'unknown')
+            data['destination']   = fields.get('destination', '') or ''
+            data['profile_mode']  = fields.get('profile_mode', 'default') or 'default'
+            data['data_size']     = fields.get('data_size', '') or '-'
+            data['archive_size']  = fields.get('archive_size', '') or '-'
+            data['duration']      = fields.get('duration', '') or '-'
+            data['log_file']      = fields.get('log_file', '') or ''
+            # `reason` is what the body template substitutes for the
+            # failure case; fall back to the human message the runner
+            # sent so the operator never sees an empty Reason line.
+            data['reason']        = fields.get('reason', message) or message
         
         # ── Extract clean reason for system-mail events ──
         # smartd and other system mail contains verbose boilerplate.
@@ -3923,6 +4011,21 @@ class ProxmoxHookWatcher:
             if severity in ('error', 'err'):
                 return 'backup_fail', 'vm', ''
             return 'backup_complete', 'vm', ''
+
+        # ProxMenux Host Backups run as a standalone systemd timer +
+        # `run_scheduled_backup.sh` (or manually via `backup_host.sh`),
+        # NOT as PVE vzdump tasks. Routed to dedicated event types
+        # (`host_backup_*`) so the operator can toggle them separately
+        # from VM/CT backup events and the body can show host-backup
+        # specifics (backend, destination, data/archive size). Without
+        # this branch the Host Backup ran fine but never produced a
+        # notification — operator-reported.
+        if pve_type == 'proxmenux-host-backup-start':
+            return 'host_backup_start', 'node', ''
+        if pve_type == 'proxmenux-host-backup-complete':
+            return 'host_backup_complete', 'node', ''
+        if pve_type == 'proxmenux-host-backup-fail':
+            return 'host_backup_fail', 'node', ''
         
         if pve_type == 'fencing':
             return 'split_brain', 'node', ''
diff --git a/AppImage/scripts/notification_manager.py b/AppImage/scripts/notification_manager.py
index 57267dbc..f071a81e 100644
--- a/AppImage/scripts/notification_manager.py
+++ b/AppImage/scripts/notification_manager.py
@@ -69,10 +69,17 @@ SENSITIVE_KEYS = {
     'ai_api_key_anthropic',
     'ai_api_key_openai',
     'ai_api_key_openrouter',
-    'telegram.token',
+    # `telegram.bot_token` — was previously listed as `telegram.token`,
+    # which never matched the real config_key (`bot_token` in
+    # CHANNEL_TYPES). The mismatch silently sent Telegram bot tokens
+    # in cleartext on every GET /api/notifications/settings since the
+    # masking layer was introduced. Fixed alongside the eye-reveal
+    # endpoint so the operator can still inspect the value on demand.
+    'telegram.bot_token',
     'gotify.token',
     'discord.webhook_url',
     'email.password',
+    'apprise.url',
     'webhook_secret',
 }
 
@@ -932,23 +939,57 @@ class NotificationManager:
     
     def start(self):
         """Start the notification service in server mode.
-        
-        Launches watchers and dispatch loop as daemon threads.
+
+        Detection (the polling collector + watchers) ALWAYS runs because
+        the managed_installs registry — NVIDIA, ProxMenux, Coral, OCI
+        updates — drives the dashboard's "update available" UI even when
+        notifications are off. Caught on .89 in June 2026: the user had
+        disabled notifications back in May and the NVIDIA card was stuck
+        on a stale "v580.159.03 available" because the polling collector
+        was gated behind `self._enabled` here and never ran again.
+
+        Notification *delivery* (channel setup, cooldown reset, PVE
+        webhook, dispatch loop emitting events) stays conditional on
+        `self._enabled` — the dispatch loop itself bails early when
+        disabled, so events from the watchers queue up briefly and get
+        dropped without ever being sent.
+
         Called by flask_server.py on startup.
         """
         if self._running:
             return
-        
+
         self._load_config()
         self._load_cooldowns_from_db()
-        
-        if not self._enabled:
-            print("[NotificationManager] Service is disabled. Skipping start.")
-            return
-        
+
         self._running = True
         self._stats['started_at'] = datetime.now().isoformat()
 
+        # ── Detection (always on) ────────────────────────────────
+        # Even when notifications are disabled, these watchers and the
+        # polling collector keep the managed_installs registry, the
+        # error history, and the task state up to date.
+        self._journal_watcher = JournalWatcher(self._event_queue)
+        self._task_watcher = TaskWatcher(self._event_queue)
+        self._polling_collector = PollingCollector(self._event_queue)
+
+        self._journal_watcher.start()
+        self._task_watcher.start()
+        self._polling_collector.start()
+
+        # Dispatch loop runs unconditionally too; its internal
+        # `if not self._enabled` guards drop events when disabled.
+        # Without it the event queue would grow forever.
+        self._dispatch_thread = threading.Thread(
+            target=self._dispatch_loop, daemon=True, name='notification-dispatch'
+        )
+        self._dispatch_thread.start()
+
+        if not self._enabled:
+            print("[NotificationManager] Notifications disabled — detection on, delivery off.")
+            return
+
+        # ── Delivery setup (only when enabled) ────────────────────
         # Reset cooldowns for the curated event-type set so the user gets
         # a fresh status report (update_summary, …) and a fresh security
         # signal (auth_fail) after every Monitor deploy/restart. The 24h
@@ -971,22 +1012,7 @@ class NotificationManager:
             pass  # flask_notification_routes not loaded yet (early startup)
         except Exception as e:
             print(f"[NotificationManager] PVE webhook setup error: {e}")
-        
-        # Start event watchers
-        self._journal_watcher = JournalWatcher(self._event_queue)
-        self._task_watcher = TaskWatcher(self._event_queue)
-        self._polling_collector = PollingCollector(self._event_queue)
-        
-        self._journal_watcher.start()
-        self._task_watcher.start()
-        self._polling_collector.start()
-        
-        # Start dispatch loop
-        self._dispatch_thread = threading.Thread(
-            target=self._dispatch_loop, daemon=True, name='notification-dispatch'
-        )
-        self._dispatch_thread.start()
-        
+
         print(f"[NotificationManager] Started with channels: {list(self._channels.keys())}")
     
     def stop(self):
@@ -1514,7 +1540,22 @@ class NotificationManager:
     def _flush_digest_for_channel(self, ch_name: str, channel: Any,
                                   now: datetime) -> None:
         """Read pending rows for the channel, render a grouped summary,
-        send it, and delete the buffer entries on success."""
+        send it, and delete the buffer entries on success.
+
+        Every path through here records a `digest` entry in the
+        notification history (success or fail, empty buffer or not) and
+        bumps `_stats['total_sent']` / `total_errors` accordingly — the
+        rest of the notification system does this in
+        `_dispatch_to_channels`, and skipping it here was the reason the
+        operator's `/api/notifications/history` and `total_sent` counter
+        showed zero digest entries even when the schedule was firing
+        (issue #233).
+        """
+        host = _hostname(self._config)
+        summary_title = (
+            f"{host}: 24h summary ({now.strftime('%Y-%m-%d %H:%M')})"
+        )
+
         try:
             conn = sqlite3.connect(str(DB_PATH), timeout=10)
             conn.execute('PRAGMA journal_mode=WAL')
@@ -1528,6 +1569,12 @@ class NotificationManager:
             conn.close()
         except Exception as e:
             print(f"[NotificationManager] digest read failed for {ch_name}: {e}")
+            self._record_history(
+                'digest', ch_name, summary_title,
+                f'digest read failed: {e}', 'INFO',
+                False, str(e), 'digest_scheduler',
+            )
+            self._stats['total_errors'] += 1
             return
 
         # Mark `last_at` even if there's nothing to send — otherwise an
@@ -1535,24 +1582,46 @@ class NotificationManager:
         self._save_setting(f'{ch_name}.digest_last_at', now.isoformat())
 
         if not rows:
+            # Empty digest: don't ping the channel (no point in sending
+            # "nothing to report"), but DO log the run in history so the
+            # operator can see the schedule fired. Without this the digest
+            # looked dead silent when in fact it was working — there was
+            # just nothing INFO non-exempt to summarize.
+            self._record_history(
+                'digest', ch_name, summary_title,
+                'No INFO events buffered for this digest window.',
+                'INFO', True, '', 'digest_scheduler',
+            )
             return
 
-        host = _hostname(self._config)
-        summary_title = (
-            f"{host}: 24h summary ({now.strftime('%Y-%m-%d %H:%M')})"
-        )
         summary_body = self._compose_digest_body(rows)
 
+        result: dict = {'success': False, 'error': ''}
         try:
-            channel.send(summary_title, summary_body, severity='INFO',
-                         data={'_digest': True, '_count': len(rows)})
+            result = channel.send(summary_title, summary_body, severity='INFO',
+                                  data={'_digest': True, '_count': len(rows)}) or result
         except Exception as e:
             print(f"[NotificationManager] digest send failed for "
                   f"{ch_name}: {e}")
-            return
+            result = {'success': False, 'error': str(e)}
+
+        if result.get('success'):
+            self._stats['total_sent'] += 1
+            self._stats['last_sent_at'] = datetime.now().isoformat()
+        else:
+            self._stats['total_errors'] += 1
+        self._record_history(
+            'digest', ch_name, summary_title, summary_body, 'INFO',
+            result.get('success', False), result.get('error', '') or '',
+            'digest_scheduler',
+        )
 
         # Delete only after a successful send so a transient failure
-        # doesn't lose the day's data.
+        # doesn't lose the day's data. The pre-fix version deleted
+        # unconditionally as long as `channel.send` didn't raise — a
+        # silent `{'success': False}` would still wipe the buffer.
+        if not result.get('success'):
+            return
         try:
             ids = [r[0] for r in rows]
             conn = sqlite3.connect(str(DB_PATH), timeout=10)
diff --git a/AppImage/scripts/notification_templates.py b/AppImage/scripts/notification_templates.py
index af0eca4b..6fd75cb8 100644
--- a/AppImage/scripts/notification_templates.py
+++ b/AppImage/scripts/notification_templates.py
@@ -448,35 +448,44 @@ TEMPLATES = {
     # status oscillation (OK->WARNING->OK) which creates noise.
     # The health_persistent and new_error templates cover this better.
     'state_change': {
-        'title': '{hostname}: {category} changed to {current}',
+        'title': '{hostname}: {category} changed to {current}{entity_suffix}',
         'body': '{category} status changed from {previous} to {current}.\n{reason}',
         'label': 'Health state changed',
         'group': 'health',
         'default_enabled': False,
     },
     'new_error': {
-        'title': '{hostname}: New {severity} - {category}',
+        'title': '{hostname}: New {severity} - {category}{entity_suffix}',
         'body': '{reason}',
         'label': 'New health issue',
         'group': 'health',
         'default_enabled': True,
     },
     'error_resolved': {
-        'title': '{hostname}: Resolved - {category}',
+        # `{entity}` is populated by health_persistence.resolve_error()
+        # (via _entity_from_details) and by PollingCollector's spread of
+        # the original details blob. When absent, _SafeDict elides the
+        # placeholder and the title collapses back to "Resolved - <cat>"
+        # without a trailing dash.
+        'title': '{hostname}: Resolved - {category}{entity_suffix}',
         'body': 'The {category} issue has been resolved.\n{reason}\n\U0001F6A6 Previous severity: {original_severity}\n\u23F1\uFE0F Duration: {duration}',
         'label': 'Recovery notification',
         'group': 'health',
         'default_enabled': True,
     },
     'error_escalated': {
-        'title': '{hostname}: Escalated to {severity} - {category}',
+        'title': '{hostname}: Escalated to {severity} - {category}{entity_suffix}',
         'body': '{reason}',
         'label': 'Health issue escalated',
         'group': 'health',
         'default_enabled': True,
     },
     'health_degraded': {
-        'title': '{hostname}: Health check degraded',
+        # flask_server._health_collector already builds the rich title
+        # (e.g. "prox: Storage CRITICAL — Tuxis (dir)") and passes it in
+        # data['title']. Fall back to the constant when absent so hand-
+        # rolled callers keep working.
+        'title': '{title_or_default}',
         'body': '{reason}',
         'label': 'Health check degraded',
         'group': 'health',
@@ -657,6 +666,37 @@ TEMPLATES = {
         'group': 'backup',
         'default_enabled': True,
     },
+
+    # ── ProxMenux Host Backup events ──
+    # Distinct event types from `backup_*` (which are for vzdump VM/CT
+    # backups). The runner — both `run_scheduled_backup.sh` (timer) and
+    # the manual flow from `backup_host.sh` — POSTs to the local webhook
+    # with these explicit pve_type values, so the operator can toggle
+    # Host Backup notifications separately from VM/CT backup ones.
+    # Backend label (PBS / local / Borg) is highlighted in the title so
+    # the operator can tell at a glance where the data went.
+    'host_backup_start': {
+        'title': '{hostname}: Host backup started → {backend_label}',
+        'body': 'Job: {job_id}\nBackend: {backend_label}\nDestination: {destination}\nProfile: {profile_mode}',
+        'label': 'Host backup started',
+        'group': 'backup',
+        'default_enabled': False,
+    },
+    'host_backup_complete': {
+        'title': '{hostname}: Host backup complete → {backend_label}',
+        'body': 'Job: {job_id}\nBackend: {backend_label}\nDestination: {destination}\nData size: {data_size}\nArchive size: {archive_size}\nDuration: {duration}',
+        'label': 'Host backup complete',
+        'group': 'backup',
+        'default_enabled': True,
+    },
+    'host_backup_fail': {
+        'title': '{hostname}: Host backup FAILED → {backend_label}',
+        'body': 'Job: {job_id}\nBackend: {backend_label}\nDestination: {destination}\nDuration before failure: {duration}\nReason: {reason}\nLog: {log_file}',
+        'label': 'Host backup FAILED',
+        'group': 'backup',
+        'default_enabled': True,
+    },
+
     'snapshot_complete': {
         'title': '{hostname}: Snapshot created — {vmname} ({vmid})',
         'body': 'Snapshot "{snapshot_name}" created for {vmname} (ID: {vmid}).',
@@ -756,7 +796,7 @@ TEMPLATES = {
         'default_enabled': True,
     },
     'pci_passthrough_conflict': {
-        'title': '{hostname}: PCIe device conflict detected',
+        'title': '{hostname}: PCIe device conflict detected — {device_pci}',
         'body': (
             'A PCIe device is assigned to multiple guests.\n'
             'Device: {device_pci}\n'
@@ -778,7 +818,7 @@ TEMPLATES = {
     
     # ── Network events ──
     'network_down': {
-        'title': '{hostname}: Network connectivity lost',
+        'title': '{hostname}: Network connectivity lost{entity_suffix}',
         'body': 'The node has lost network connectivity.\nReason: {reason}',
         'label': 'Network connectivity lost',
         'group': 'network',
@@ -808,7 +848,7 @@ TEMPLATES = {
         'default_enabled': True,
     },
     'firewall_issue': {
-        'title': '{hostname}: Firewall issue detected',
+        'title': '{hostname}: Firewall issue detected{entity_suffix}',
         'body': 'A firewall configuration issue has been detected.\nReason: {reason}',
         'label': 'Firewall issue detected',
         'group': 'security',
@@ -868,8 +908,24 @@ TEMPLATES = {
         'group': 'services',
         'default_enabled': True,
     },
+    'system_restore_completed': {
+        'title': '{hostname}: Host restore finished',
+        'body': (
+            'Post-restore tasks completed in background.\n\n'
+            'Guests applied: {guests}\n'
+            'Bind-mount stubs: {stubs}\n'
+            'Stale node dirs removed: {stale_nodes}\n'
+            'Components reinstalled: {components}\n'
+            'Duration: {duration}\n'
+            '{warnings_block}\n'
+            'The node is now fully ready to use.'
+        ),
+        'label': 'Host restore completed',
+        'group': 'services',
+        'default_enabled': True,
+    },
     'system_problem': {
-        'title': '{hostname}: System problem detected',
+        'title': '{hostname}: System problem detected{entity_suffix}',
         'body': 'A system-level problem has been detected.\nReason: {reason}',
         'label': 'System problem detected',
         'group': 'services',
@@ -892,7 +948,7 @@ TEMPLATES = {
     
     # ── Hidden internal templates (not shown in UI) ──
     'service_fail_batch': {
-        'title': '{hostname}: {service_count} services failed',
+        'title': '{hostname}: {service_count} services failed{entity_suffix}',
         'body': '{reason}',
         'label': 'Service fail batch',
         'group': 'services',
@@ -957,31 +1013,31 @@ TEMPLATES = {
         'hidden': True,
     },
     'unknown_persistent': {
-        'title': '{hostname}: Check unavailable - {category}',
+        'title': '{hostname}: Check unavailable - {category}{entity_suffix}',
         'body': 'Health check for {category} has been unavailable for 3+ cycles.\n{reason}',
         'label': 'Check unavailable',
         'group': 'health',
         'default_enabled': False,
         'hidden': True,
     },
-    
+
     # ── Health Monitor events ──
     'health_persistent': {
-        'title': '{hostname}: {count} active health issue(s)',
+        'title': '{hostname}: {count} active health issue(s){entity_suffix}',
         'body': 'The following health issues remain unresolved:\n{issue_list}\n\nThis digest is sent once every 24 hours while issues persist.',
         'label': 'Active health issues (daily)',
         'group': 'health',
         'default_enabled': True,
     },
     'health_issue_new': {
-        'title': '{hostname}: New health issue — {category}',
+        'title': '{hostname}: New health issue — {category}{entity_suffix}',
         'body': 'New {severity} issue detected in: {category}\nDetails: {reason}',
         'label': 'New health issue',
         'group': 'health',
         'default_enabled': True,
     },
     'health_issue_resolved': {
-        'title': '{hostname}: Resolved - {category}',
+        'title': '{hostname}: Resolved - {category}{entity_suffix}',
         'body': '{category} issue has been resolved.\n{reason}\nDuration: {duration}',
         'label': 'Health issue resolved',
         'group': 'health',
@@ -1091,7 +1147,7 @@ TEMPLATES = {
         'title': '{hostname}: CT {vmid} rootfs at {usage_percent}%',
         'body': (
             'CT {vmid} ({name}) rootfs is at {usage_percent}% '
-            '({disk_bytes} / {maxdisk_bytes}).\n\n'
+            '({disk_bytes_human} / {maxdisk_bytes_human}).\n\n'
             'A full LXC rootfs prevents the container from booting cleanly. '
             'Either expand the rootfs (pct resize {vmid} rootfs +1G) or free '
             'space inside the container.'
@@ -1177,11 +1233,19 @@ TEMPLATES = {
     # bullet list make sure the operator sees exactly what's moving
     # without opening the dashboard first.
     'secure_gateway_update_available': {
-        'title': '{hostname}: {app_name} update available — v{latest_version}',
+        # `{update_title_suffix}` and `{version_line}` are computed in
+        # `_build_managed_install_event` so the same template can render
+        # both scenarios cleanly:
+        # - Tailscale itself moved: "— v<new>" + "current → latest" line
+        # - Only sidecar packages moved: "— v<current> (packages only)" +
+        #   single-line "Tailscale unchanged" body
+        # Prevents the confusing "v1.90.9-r6 → v1.90.9-r6" render when
+        # Tailscale is stable and only alpine libs are updating.
+        'title': '{hostname}: {app_name} update available{update_title_suffix}',
         'body': (
             '{app_name} (managed by ProxMenux) has 📦 {package_count} package update(s) '
             'pending in its container.\n'
-            '🔹 Current Tailscale: v{current_version}  →  🟢 Latest: v{latest_version}\n\n'
+            '{version_line}\n\n'
             '💡 Open ProxMenux Monitor > Settings > Secure Gateway and click '
             '"Update" to apply.\n\n'
             '🗂️ Packages:\n{package_list}'
@@ -1338,6 +1402,28 @@ def _get_hostname() -> str:
             return 'proxmox'
 
 
+def _format_bytes_human(n: Any) -> str:
+    """Compact human-readable size (base 1024): '35.3 GiB', '4.8 TiB'.
+
+    Matches what `df -h` and the Proxmox UI show, so operators reading a
+    notification aren't asked to translate a 12-digit byte count.
+    """
+    try:
+        size = float(n)
+    except (TypeError, ValueError):
+        return ''
+    if size <= 0:
+        return '0 B'
+    units = ('B', 'KiB', 'MiB', 'GiB', 'TiB', 'PiB')
+    i = 0
+    while size >= 1024.0 and i < len(units) - 1:
+        size /= 1024.0
+        i += 1
+    if i == 0:
+        return f'{int(size)} B'
+    return f'{size:.1f} {units[i]}'
+
+
 def render_template(event_type: str, data: Dict[str, Any]) -> Dict[str, Any]:
     """Render a template into a structured notification object.
     
@@ -1381,12 +1467,54 @@ def render_template(event_type: str, data: Dict[str, Any]) -> Dict[str, Any]:
         'issue_list': '', 'error_key': '',
         'storage_name': '', 'storage_type': '',
         'important_list': 'none',
+        # Host Backup specifics (run_scheduled_backup.sh + backup_host.sh).
+        'job_id': '', 'backend': '', 'backend_label': '',
+        'destination': '', 'profile_mode': '',
+        'data_size': '', 'archive_size': '',
+        'log_file': '',
     }
     variables.update(data)
-    
+
+    # Humanise raw-byte fields so templates can render '35.3 GiB' instead
+    # of '37952020480'. Producers keep emitting raw ints (needed by APIs
+    # and the dashboard); the humanised twin is derived on the fly here.
+    for _byte_key in ('disk_bytes', 'maxdisk_bytes'):
+        if _byte_key in data:
+            variables[f'{_byte_key}_human'] = _format_bytes_human(data[_byte_key])
+
     # Ensure important_list is never blank (fallback to 'none')
     if not variables.get('important_list', '').strip():
         variables['important_list'] = 'none'
+
+    # Derive the affected object's display name for titles that use it.
+    # Priority: caller-supplied `entity` (health_monitor.emit_event) →
+    # per-detail fields spread in from `record_error`'s details blob.
+    # `entity_suffix` gives templates a way to render "…- Storage 'Tuxis'"
+    # without the trailing " - " when the field is empty.
+    _ent = str(variables.get('entity', '')).strip()
+    if not _ent:
+        _ent = (
+            variables.get('storage_name')
+            or variables.get('mount_point')
+            or variables.get('device')
+            or variables.get('interface')
+            or variables.get('vm_name')
+            or ''
+        )
+        _ent = str(_ent).strip()
+    variables['entity'] = _ent
+    variables['entity_suffix'] = f' — {_ent}' if _ent else ''
+
+    # `title_or_default` lets a template surface a caller-computed title
+    # when the caller already knows the entity context (e.g.
+    # flask_server's health collector), and fall back to a stock string
+    # otherwise. Prevents empty subject lines when the caller forgot to
+    # populate `title`.
+    _caller_title = str(variables.get('title', '')).strip()
+    if not _caller_title:
+        hn = variables.get('hostname', '')
+        _caller_title = f'{hn}: Health check degraded' if hn else 'Health check degraded'
+    variables['title_or_default'] = _caller_title
     
     # `format_map` with a SafeDict avoids the KeyError → "show raw template
     # with `{placeholder}` literal" failure mode. If a template gets a new
@@ -1567,6 +1695,9 @@ EVENT_EMOJI = {
     'replication_complete': '\u2705',
     # Backups
     'backup_start':         '\U0001F4BE\U0001F680',  # 💾🚀 floppy + rocket
+    'host_backup_start':    '\U0001F5C4️\U0001F680',     # 🗄️🚀 cabinet + rocket
+    'host_backup_complete': '\U0001F5C4️✅',         # 🗄️✅ cabinet + check
+    'host_backup_fail':     '\U0001F5C4️❌',         # 🗄️❌ cabinet + cross
     'backup_complete':      '\U0001F4BE\u2705',       # 💾✅ floppy + check
     'backup_warning':       '\U0001F4BE\u26A0\uFE0F', # 💾⚠️ floppy + warning
     'backup_fail':          '\U0001F4BE\u274C',       # 💾❌ floppy + cross
@@ -1604,6 +1735,7 @@ EVENT_EMOJI = {
     'system_startup':       '\U0001F680',         # rocket (startup)
     'system_shutdown':      '\u23FB\uFE0F',       # power symbol (Unicode)
     'system_reboot':        '\U0001F504',
+    'system_restore_completed': '✅',          # check mark
     'system_problem':       '\u26A0\uFE0F',
     'service_fail':         '\u274C',
     'oom_kill':             '\U0001F4A3',         # bomb
diff --git a/AppImage/scripts/oci_manager.py b/AppImage/scripts/oci_manager.py
index 2d8b61f4..3c2b0329 100644
--- a/AppImage/scripts/oci_manager.py
+++ b/AppImage/scripts/oci_manager.py
@@ -1508,6 +1508,15 @@ def check_app_update_available(app_id: str, force: bool = False) -> Dict[str, An
         except Exception:
             pass
 
+    # When Tailscale itself isn't in the update list but other packages
+    # inside the container are, `latest_version` stays None and downstream
+    # notification renders "— v" / "🟢 Latest: v" with a dangling prefix.
+    # Anchor it to the installed version so the notification reads
+    # cleanly ("current == latest" tells the operator Tailscale itself
+    # is unchanged, only sidecar packages are updating).
+    if result["current_version"] and not result["latest_version"]:
+        result["latest_version"] = result["current_version"]
+
     _app_update_cache[app_id] = result
     return result
 
diff --git a/AppImage/scripts/post_install_versions.py b/AppImage/scripts/post_install_versions.py
index c21d26b7..f3a86ba2 100644
--- a/AppImage/scripts/post_install_versions.py
+++ b/AppImage/scripts/post_install_versions.py
@@ -27,7 +27,8 @@ import re
 import threading
 import time
 from pathlib import Path
-from typing import Any
+import os
+from typing import Any, Callable
 
 _BASE = Path("/usr/local/share/proxmenux")
 _POST_INSTALL_DIR = _BASE / "scripts" / "post_install"
@@ -191,9 +192,52 @@ def load_installed_tools(path: Path = _INSTALLED_JSON) -> dict[str, dict[str, An
         else:
             # Unknown shape — treat as not installed rather than crash.
             normalized[key] = {"installed": False, "version": "", "source": ""}
+
+    _apply_legacy_detectors(normalized)
     return normalized
 
 
+# Tool keys that were added later than 1.2.2 and therefore are missing
+# from installed_tools.json on hosts that already had the underlying
+# config in place. For each, declare how to recognise "this host has
+# the thing configured already" so the registry surfaces it as a v1.0
+# legacy install — the per-tool wrapper then bumps it to the current
+# FUNC_VERSION on first apply, and from then on the regular update
+# detector takes over without any special-casing.
+_LEGACY_DETECTORS: dict[str, Callable[[], bool]] = {
+    "proxmox_repos": lambda: any(
+        os.path.exists(p) for p in (
+            "/etc/apt/sources.list.d/proxmox.sources",
+            "/etc/apt/sources.list.d/pve-no-subscription.list",
+            "/etc/apt/sources.list.d/pve-enterprise.list",
+        )
+    ),
+}
+
+
+def _apply_legacy_detectors(normalized: dict[str, dict[str, Any]]) -> None:
+    """Inject synthetic v1.0 entries for tools that the host already
+    has configured but were never recorded in installed_tools.json.
+
+    Skips any tool that already has an entry — once the user applies
+    the update, ``register_tool`` writes the real entry and the
+    detector path becomes a no-op for that key.
+    """
+    for key, probe in _LEGACY_DETECTORS.items():
+        if key in normalized:
+            continue
+        try:
+            if probe():
+                normalized[key] = {
+                    "installed": True,
+                    "version": "1.0",
+                    "source": "detected",
+                }
+        except Exception:
+            # Detectors must never break the registry load.
+            continue
+
+
 # ---------------------------------------------------------------------------
 # Detection logic
 # ---------------------------------------------------------------------------
diff --git a/AppImage/tsconfig.json b/AppImage/tsconfig.json
index 946cd624..93a4405a 100644
--- a/AppImage/tsconfig.json
+++ b/AppImage/tsconfig.json
@@ -1,6 +1,10 @@
 {
   "compilerOptions": {
-    "lib": ["dom", "dom.iterable", "es6"],
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "es6"
+    ],
     "allowJs": true,
     "skipLibCheck": true,
     "strict": true,
@@ -19,9 +23,19 @@
     ],
     "baseUrl": ".",
     "paths": {
-      "@/*": ["./*"]
-    }
+      "@/*": [
+        "./*"
+      ]
+    },
+    "target": "ES2017"
   },
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
 }
diff --git a/README.md b/README.md
index 4d14c012..c3f1326d 100644
--- a/README.md
+++ b/README.md
@@ -138,7 +138,7 @@ journalctl -u proxmenux-monitor -n 50
 
 ## 🔧 Dependencies
 
-The following dependencies are installed automatically during setup:
+The following Debian packages are installed automatically during setup:
 
 | Package | Purpose |
 |---|---|
@@ -146,12 +146,9 @@ The following dependencies are installed automatically during setup:
 | `curl` | Downloads and connectivity checks |
 | `jq` | JSON processing |
 | `git` | Repository cloning and updates |
-| `python3` + `python3-venv` | Translation support *(Translation version only)* |
-| `googletrans` | Google Translate library *(Translation version only)* |
+| `python3` + `python3-pip` | ProxMenux Monitor (Flask web dashboard) |
 
-> **🛡️ Security Note / VirusTotal False Positive**
->
-> If you scan the raw installation URL on VirusTotal, you might see a 1/95 detection by heuristic engines like *Chong Lua Dao*. This is a **known false positive**. Because this script uses the standard `curl | bash` installation pattern and downloads legitimate binaries (like `jq` from its official GitHub release), overly aggressive scanners flag the *behavior*. The script is 100% open source and safe to review. You can read more about this in [Issue #162](https://github.com/MacRimi/ProxMenux/issues/162).
+UI translations ship as pre-built JSON files per language (English, Spanish, French, German, Italian, Portuguese). There is no runtime translation dependency.
 
 ---
 
diff --git a/beta_version.txt b/beta_version.txt
index 93f340a7..30fc7104 100644
--- a/beta_version.txt
+++ b/beta_version.txt
@@ -1 +1 @@
-1.2.1.4
+1.2.3.0
diff --git a/install_proxmenux.sh b/install_proxmenux.sh
index 22212201..ab267335 100755
--- a/install_proxmenux.sh
+++ b/install_proxmenux.sh
@@ -44,11 +44,15 @@ LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 INSTALL_DIR="/usr/local/bin"
 BASE_DIR="/usr/local/share/proxmenux"
 CONFIG_FILE="$BASE_DIR/config.json"
-CACHE_FILE="$BASE_DIR/cache.json"
 UTILS_FILE="$BASE_DIR/utils.sh"
 LOCAL_VERSION_FILE="$BASE_DIR/version.txt"
 MENU_SCRIPT="menu"
-VENV_PATH="/opt/googletrans-env"
+
+# Legacy path that existed during the Python+googletrans era. The current
+# translate flow uses pre-generated JSON files in lang/ — no virtualenv,
+# no online translation at runtime — so this path is purged on install
+# if present. Kept as a literal here so the cleanup is grep-able.
+LEGACY_VENV_PATH="/opt/googletrans-env"
 
 MONITOR_INSTALL_DIR="$BASE_DIR"
 MONITOR_RUNTIME_DIR="$BASE_DIR/monitor-app"
@@ -272,10 +276,6 @@ cleanup_corrupted_files() {
         echo "Cleaning up corrupted configuration file..."
         rm -f "$CONFIG_FILE"
     fi
-    if [ -f "$CACHE_FILE" ] && ! jq empty "$CACHE_FILE" >/dev/null 2>&1; then
-        echo "Cleaning up corrupted cache file..."
-        rm -f "$CACHE_FILE"
-    fi
 }
 
 # Cleanup function
@@ -291,157 +291,27 @@ trap cleanup EXIT
 
 # ==========================================================
 check_existing_installation() {
-    local has_venv=false
-    local has_config=false
-    local has_language=false
-    local has_menu=false
-    
+    # After the googletrans removal there is only one install variant.
+    # The function still distinguishes "installed" vs "not installed" so
+    # show_installation_options can pick the right banner.
     if [ -f "$INSTALL_DIR/$MENU_SCRIPT" ]; then
-        has_menu=true
-    fi
-    
-    if [ -d "$VENV_PATH" ] && [ -f "$VENV_PATH/bin/activate" ]; then
-        has_venv=true
-    fi
-    
-    if [ -f "$CONFIG_FILE" ]; then
-        if jq empty "$CONFIG_FILE" >/dev/null 2>&1; then
-            has_config=true
-            local current_language=$(jq -r '.language // empty' "$CONFIG_FILE" 2>/dev/null)
-            if [[ -n "$current_language" && "$current_language" != "null" && "$current_language" != "empty" ]]; then
-                has_language=true
-            fi
-        else
-            echo "Warning: Corrupted config file detected, removing..."
+        # Quietly fix a corrupted config so the install can proceed.
+        if [ -f "$CONFIG_FILE" ] && ! jq empty "$CONFIG_FILE" >/dev/null 2>&1; then
+            echo "Warning: Corrupted config file detected, removing..." >&2
             rm -f "$CONFIG_FILE"
         fi
-    fi
-    
-    if [ "$has_venv" = true ] && [ "$has_language" = true ]; then
-        echo "translation"
-    elif [ "$has_menu" = true ] && [ "$has_venv" = false ]; then
-        echo "normal"
-    elif [ "$has_menu" = true ]; then
-        echo "unknown"
+        echo "installed"
     else
         echo "none"
     fi
 }
 
-uninstall_proxmenux() {
-    local install_type="$1"
-    local force_clean="$2"
-    
-    if [ "$force_clean" != "force" ]; then
-        if ! whiptail --title "Uninstall ProxMenux" --yesno "Are you sure you want to uninstall ProxMenux?" 10 60; then
-            return 1
-        fi
-    fi
-    
-    echo "Uninstalling ProxMenux..."
-    
-    if systemctl is-active --quiet proxmenux-monitor.service; then
-        echo "Stopping ProxMenux Monitor service..."
-        systemctl stop proxmenux-monitor.service
-    fi
-    
-    if systemctl is-enabled --quiet proxmenux-monitor.service 2>/dev/null; then
-        echo "Disabling ProxMenux Monitor service..."
-        systemctl disable proxmenux-monitor.service
-    fi
-    
-    if [ -f "$MONITOR_SERVICE_FILE" ]; then
-        echo "Removing ProxMenux Monitor service file..."
-        rm -f "$MONITOR_SERVICE_FILE"
-        systemctl daemon-reload
-    fi
-    
-    if [ -d "$MONITOR_INSTALL_DIR" ]; then
-        echo "Removing ProxMenux Monitor directory..."
-        rm -rf "$MONITOR_INSTALL_DIR"
-    fi
-    
-    if [ -f "$VENV_PATH/bin/activate" ]; then
-        echo "Removing googletrans and virtual environment..."
-        source "$VENV_PATH/bin/activate"
-        pip uninstall -y googletrans >/dev/null 2>&1
-        deactivate
-        rm -rf "$VENV_PATH"
-    fi
-    
-    if [ "$install_type" = "translation" ] && [ "$force_clean" != "force" ]; then
-        DEPS_TO_REMOVE=$(whiptail --title "Remove Translation Dependencies" --checklist \
-            "Select translation-specific dependencies to remove:" 15 60 3 \
-            "python3-venv" "Python virtual environment" OFF \
-            "python3-pip" "Python package installer" OFF \
-            "python3" "Python interpreter" OFF \
-            3>&1 1>&2 2>&3)
-        
-        if [ -n "$DEPS_TO_REMOVE" ]; then
-            echo "Removing selected dependencies..."
-            read -r -a DEPS_ARRAY <<< "$(echo "$DEPS_TO_REMOVE" | tr -d '"')"
-            for dep in "${DEPS_ARRAY[@]}"; do
-                echo "Removing $dep..."
-                apt-mark auto "$dep" >/dev/null 2>&1
-                apt-get -y --purge autoremove "$dep" >/dev/null 2>&1
-            done
-            apt-get autoremove -y --purge >/dev/null 2>&1
-        fi
-    fi
-    
-    rm -f "$INSTALL_DIR/$MENU_SCRIPT"
-    rm -rf "$BASE_DIR"
-    
-    [ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc
-    if [ -f /etc/motd.bak ]; then
-        mv /etc/motd.bak /etc/motd
-    else
-        sed -i '/This system is optimised by: ProxMenux/d' /etc/motd
-    fi
-    
-    echo "ProxMenux has been uninstalled."
-    return 0
-}
-
-handle_installation_change() {
-    local current_type="$1"
-    local new_type="$2"
-    
-    if [ "$current_type" = "$new_type" ]; then
-        return 0
-    fi
-    
-    case "$current_type-$new_type" in
-        "translation-1"|"translation-normal")
-            if whiptail --title "Installation Type Change" \
-                --yesno "Switch from Translation to Normal Version?\n\nThis will remove translation components." 10 60; then
-                echo "Preparing for installation type change..."
-                uninstall_proxmenux "translation" "force" >/dev/null 2>&1
-                return 0
-            else
-                return 1
-            fi
-            ;;
-        "normal-2"|"normal-translation")
-            if whiptail --title "Installation Type Change" \
-                --yesno "Switch from Normal to Translation Version?\n\nThis will add translation components." 10 60; then
-                return 0
-            else
-                return 1
-            fi
-            ;;
-        *)
-            return 0
-            ;;
-    esac
-}
-
 update_config() {
     local component="$1"
     local status="$2"
     local timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
     
-    local tracked_components=("dialog" "curl" "jq" "git" "python3" "python3-venv" "python3-pip" "virtual_environment" "pip" "googletrans" "proxmenux_monitor")
+    local tracked_components=("dialog" "curl" "jq" "git" "python3" "python3-pip" "proxmenux_monitor")
     
     if [[ " ${tracked_components[@]} " =~ " ${component} " ]]; then
         mkdir -p "$(dirname "$CONFIG_FILE")"
@@ -485,7 +355,7 @@ select_language() {
     fi
     
     LANGUAGE=$(whiptail --title "Select Language" --menu "Choose a language for the menu:" 20 60 12 \
-        "en" "English (Recommended)" \
+        "en" "English" \
         "es" "Spanish" \
         "fr" "French" \
         "de" "German" \
@@ -517,26 +387,12 @@ select_language() {
 
 # Show installation confirmation for new installations
 show_installation_confirmation() {
-    local install_type="$1"
-    
-    case "$install_type" in
-        "1")
-            if whiptail --title "ProxMenux - Normal Version Installation" \
-                --yesno "ProxMenux Normal Version will install:\n\n• dialog  (interactive menus) - Official Debian package\n• curl       (file downloads) - Official Debian package\n• jq        (JSON processing) - Official Debian package\n• ProxMenux core files     (/usr/local/share/proxmenux)\n• ProxMenux Monitor        (Web dashboard on port 8008)\n\nThis is a lightweight installation with minimal dependencies.\n\nProceed with installation?" 20 70; then
-                return 0
-            else
-                return 1
-            fi
-            ;;
-        "2")
-            if whiptail --title "ProxMenux - Translation Version Installation" \
-                --yesno "ProxMenux Translation Version will install:\n\n• dialog (interactive menus)\n• curl (file downloads)\n• jq (JSON processing)\n• python3 + python3-venv + python3-pip\n• Google Translate library (googletrans)\n• Virtual environment (/opt/googletrans-env)\n• Translation cache system\n• ProxMenux core files\n• ProxMenux Monitor        (Web dashboard on port 8008)\n\nThis version requires more dependencies for translation support.\n\nProceed with installation?" 20 70; then
-                return 0
-            else
-                return 1
-            fi
-            ;;
-    esac
+    if whiptail --title "ProxMenux Installation" \
+        --yesno "ProxMenux will install:\n\n• dialog       (interactive menus) - Official Debian package\n• curl         (file downloads) - Official Debian package\n• jq           (JSON processing) - Official Debian package\n• ProxMenux core files     (/usr/local/share/proxmenux)\n• ProxMenux Monitor        (Web dashboard on port 8008)\n• Pre-built translation files\n\nProceed with installation?" 20 70; then
+        return 0
+    else
+        return 1
+    fi
 }
 
 get_server_ip() {
@@ -800,14 +656,33 @@ EOF
 }
 
 install_normal_version() {
-    local total_steps=5
+    local total_steps=6
     local current_step=1
-    
+
+    # Translations now live as pre-generated JSON files under lang/, so
+    # asking the language up front is the right place — every install is
+    # multilingual-capable and the user picks once.
+    show_progress $current_step $total_steps "Language selection"
+    select_language
+    ((current_step++))
+
+    # Purge the legacy googletrans virtualenv if a previous install left it
+    # behind. The new translate flow has no runtime Python/googletrans
+    # dependency — the venv is dead weight on disk now.
+    if [[ -d "$LEGACY_VENV_PATH" ]]; then
+        msg_info "Removing legacy translation virtualenv at $LEGACY_VENV_PATH..."
+        rm -rf "$LEGACY_VENV_PATH"
+        msg_ok "Legacy translation virtualenv removed."
+    fi
+
     show_progress $current_step $total_steps "Installing basic dependencies."
-    
+
+    msg_info "Refreshing apt cache..."
+    apt-get update -y > /dev/null 2>&1 || true
+    msg_ok "apt cache refreshed."
+
+    msg_info "Installing jq..."
     if ! command -v jq > /dev/null 2>&1; then
-        apt-get update > /dev/null 2>&1
-        
         if apt-get install -y jq > /dev/null 2>&1 && command -v jq > /dev/null 2>&1; then
             update_config "jq" "installed"
         else
@@ -829,20 +704,14 @@ install_normal_version() {
     else
         update_config "jq" "already_installed"
     fi
-    
-
-
-
+    msg_ok "jq ready."
 
     BASIC_DEPS=("dialog" "curl" "git")
 
-    if [ -z "${APT_UPDATED:-}" ]; then
-        apt-get update -y > /dev/null 2>&1 || true
-        APT_UPDATED=1
-    fi
-
     for pkg in "${BASIC_DEPS[@]}"; do
-        # Strict per-package check — see comment in install_translation_version().
+        msg_info "Installing $pkg..."
+        # dpkg-query for the EXACT package — `dpkg -l | grep -qw python3`
+        # falsely matches `python3-pip`. Issue #205.
         if ! dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null | grep -q "ok installed"; then
             if apt-get install -y "$pkg" > /dev/null 2>&1; then
                 update_config "$pkg" "installed"
@@ -854,6 +723,7 @@ install_normal_version() {
         else
             update_config "$pkg" "already_installed"
         fi
+        msg_ok "$pkg ready."
     done
 
 
@@ -921,10 +791,28 @@ install_normal_version() {
     show_progress $current_step $total_steps "Copying necessary files"
     
     cp "./scripts/utils.sh" "$UTILS_FILE"
-    cp "./menu" "$INSTALL_DIR/$MENU_SCRIPT"
+    # Atomic install of /usr/local/bin/menu: stage to .new on the same
+    # filesystem then mv. This protects any reader that happens to open
+    # the file mid-install from seeing a partial/half-written script
+    # (the suspected root cause of the post-1.2.2-update reports:
+    #   "menu: line 138 syntax error near unexpected token `$REMOTE_VERSION`")
+    cp "./menu" "$INSTALL_DIR/${MENU_SCRIPT}.new"
+    mv -f "$INSTALL_DIR/${MENU_SCRIPT}.new" "$INSTALL_DIR/$MENU_SCRIPT"
     cp "./version.txt" "$LOCAL_VERSION_FILE"
     cp "./install_proxmenux.sh" "$BASE_DIR/install_proxmenux.sh"
 
+    # Pre-built translation cache. The runtime translate() in utils.sh
+    # reads $BASE_DIR/lang/<lang>.json — these files ship with the repo
+    # (one per supported language) so the install ends up multilingual
+    # without any runtime download or Python dependency. Refresh the
+    # whole dir on every install so a language that was renamed or
+    # dropped upstream disappears here too.
+    if [ -d "./lang" ]; then
+        rm -rf "$BASE_DIR/lang"
+        mkdir -p "$BASE_DIR/lang"
+        cp -r "./lang/"* "$BASE_DIR/lang/" 2>/dev/null || true
+    fi
+
     # A user that previously rode the beta train and then switched back
     # to stable would still have a leftover beta_version.txt under
     # $BASE_DIR, which makes the `menu` update check (check_updates_beta)
@@ -936,7 +824,7 @@ install_normal_version() {
 
     # Wipe the scripts tree before copying so any file removed upstream
     # (renamed, consolidated, deprecated) disappears from the user install.
-    # Only $BASE_DIR/scripts/ is cleared; config.json, cache.json,
+    # Only $BASE_DIR/scripts/ is cleared; config.json,
     # components_status.json, version.txt, monitor.db, smart/, oci/ and
     # the AppImage live outside this path and are preserved.
     rm -rf "$BASE_DIR/scripts"
@@ -963,204 +851,16 @@ install_normal_version() {
     msg_ok "ProxMenux Normal Version installation completed successfully."
 }
 
-install_translation_version() {
-    local total_steps=5
-    local current_step=1
-    
-    show_progress $current_step $total_steps "Language selection"
-    select_language
-    ((current_step++))
-    
-    show_progress $current_step $total_steps "Installing system dependencies"
-    
-    if ! command -v jq > /dev/null 2>&1; then
-        apt-get update > /dev/null 2>&1
-        
-        if apt-get install -y jq > /dev/null 2>&1 && command -v jq > /dev/null 2>&1; then
-            update_config "jq" "installed"
-        else
-            local jq_url="https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64"
-            if wget -q -O /usr/local/bin/jq "$jq_url" 2>/dev/null && chmod +x /usr/local/bin/jq; then
-                if command -v jq > /dev/null 2>&1; then
-                    update_config "jq" "installed_from_github"
-                else
-                    msg_error "Failed to install jq. Please install it manually."
-                    update_config "jq" "failed"
-                    return 1
-                fi
-            else
-                msg_error "Failed to install jq from both APT and GitHub. Please install it manually."
-                update_config "jq" "failed"
-                return 1
-            fi
-        fi
-    else
-        update_config "jq" "already_installed"
-    fi
-    
-    DEPS=("dialog" "curl" "git" "python3" "python3-venv" "python3-pip")
-    for pkg in "${DEPS[@]}"; do
-        # `dpkg -l | grep -qw "$pkg"` treats `-` as a word boundary, so a
-        # query for `python3` would falsely match `python3-pip` and skip
-        # the real `python3` install. `dpkg-query -W -f='${Status}'` asks
-        # for the EXACT package and reports "install ok installed" only
-        # when truly present. Issue #205 traced back here.
-        if ! dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null | grep -q "ok installed"; then
-            if apt-get install -y "$pkg" > /dev/null 2>&1; then
-                update_config "$pkg" "installed"
-            else
-                msg_error "Failed to install $pkg. Please install it manually."
-                update_config "$pkg" "failed"
-                return 1
-            fi
-        else
-            update_config "$pkg" "already_installed"
-        fi
-    done
-    
-    msg_ok "jq, dialog, curl, git, python3, python3-venv and python3-pip installed successfully."
-    
-    ((current_step++))
-    
-    show_progress $current_step $total_steps "Setting up translation environment"
-    
-    if [ ! -d "$VENV_PATH" ] || [ ! -f "$VENV_PATH/bin/activate" ]; then
-        python3 -m venv --system-site-packages "$VENV_PATH" > /dev/null 2>&1
-        if [ ! -f "$VENV_PATH/bin/activate" ]; then
-            msg_error "Failed to create virtual environment. Please check your Python installation."
-            update_config "virtual_environment" "failed"
-            return 1
-        else
-            update_config "virtual_environment" "created"
-        fi
-    else
-        update_config "virtual_environment" "already_exists"
-    fi
-    
-    source "$VENV_PATH/bin/activate"
-    
-    if pip install --upgrade pip > /dev/null 2>&1; then
-        update_config "pip" "upgraded"
-    else
-        msg_error "Failed to upgrade pip."
-        update_config "pip" "upgrade_failed"
-        return 1
-    fi
-    
-    if pip install --break-system-packages --no-cache-dir googletrans==4.0.0-rc1 > /dev/null 2>&1; then
-        update_config "googletrans" "installed"
-    else
-        msg_error "Failed to install googletrans. Please check your internet connection."
-        update_config "googletrans" "failed"
-        deactivate
-        return 1
-    fi
-    
-    deactivate
-    
-    show_progress $current_step $total_steps "Cloning ProxMenux repository"
-    if ! git clone --depth 1 "$REPO_URL" "$TEMP_DIR" 2>/dev/null; then
-        msg_error "Failed to clone repository from $REPO_URL"
-        exit 1
-    fi
-    msg_ok "Repository cloned successfully."
-    
-    cd "$TEMP_DIR"
-    
-    ((current_step++))
-    
-    show_progress $current_step $total_steps "Copying necessary files"
-    
-    mkdir -p "$BASE_DIR"
-    mkdir -p "$INSTALL_DIR"
-    
-    cp "./json/cache.json" "$CACHE_FILE"
-    msg_ok "Cache file copied with translations."
-    
-    cp "./scripts/utils.sh" "$UTILS_FILE"
-    cp "./menu" "$INSTALL_DIR/$MENU_SCRIPT"
-    cp "./version.txt" "$LOCAL_VERSION_FILE"
-    cp "./install_proxmenux.sh" "$BASE_DIR/install_proxmenux.sh"
-
-    # Clear any leftover beta_version.txt — see the equivalent block
-    # in the update path above for the rationale (in short: prevents
-    # the menu from offering a phantom "Beta update available" after a
-    # user has switched back to the stable channel).
-    rm -f "$BASE_DIR/beta_version.txt"
-
-    mkdir -p "$BASE_DIR/scripts"
-    cp -r "./scripts/"* "$BASE_DIR/scripts/"
-    chmod -R +x "$BASE_DIR/scripts/"
-    chmod +x "$BASE_DIR/install_proxmenux.sh"
-    msg_ok "Necessary files created."
-
-    chmod +x "$INSTALL_DIR/$MENU_SCRIPT"
-    
-    ((current_step++))
-    show_progress $current_step $total_steps "Installing ProxMenux Monitor"
-    
-    install_proxmenux_monitor
-    local monitor_status=$?
-    
-    if [ $monitor_status -eq 0 ]; then
-        create_monitor_service
-    elif [ $monitor_status -eq 2 ]; then
-        msg_ok "ProxMenux Monitor updated successfully."
-    fi
-    
-    msg_ok "ProxMenux Translation Version installation completed successfully."
-}
-
 show_installation_options() {
     local current_install_type
     current_install_type=$(check_existing_installation)
-    local pve_version
-    pve_version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+' | head -1)
-    
-    local menu_title="ProxMenux Installation"
-    local menu_text="Choose installation type:"
-    
-    if [ "$current_install_type" != "none" ]; then
-        case "$current_install_type" in
-            "translation")
-                menu_title="ProxMenux Update - Translation Version Detected"
-                ;;
-            "normal")
-                menu_title="ProxMenux Update - Normal Version Detected"
-                ;;
-            "unknown")
-                menu_title="ProxMenux Update - Existing Installation Detected"
-                ;;
-        esac
-    fi
-    
-    if [[ "$pve_version" -ge 9 ]]; then
-        INSTALL_TYPE=$(whiptail --backtitle "ProxMenux" --title "$menu_title" --menu "\n$menu_text" 14 70 2 \
-            "1" "Normal Version      (English only)" 3>&1 1>&2 2>&3)
-        
-        if [ -z "$INSTALL_TYPE" ]; then
-            show_proxmenux_logo
-            msg_warn "Installation cancelled."
-            exit 1
-        fi
-    else
-        INSTALL_TYPE=$(whiptail --backtitle "ProxMenux" --title "$menu_title" --menu "\n$menu_text" 14 70 2 \
-            "1" "Normal Version      (English only)" \
-            "2" "Translation Version (Multi-language support)" 3>&1 1>&2 2>&3)
-        
-        if [ -z "$INSTALL_TYPE" ]; then
-            show_proxmenux_logo
-            msg_warn "Installation cancelled."
-            exit 1
-        fi
-    fi
-    
-    if [ -z "$INSTALL_TYPE" ]; then
-        show_proxmenux_logo
-        msg_warn "Installation cancelled."
-        exit 1
-    fi
-    
+    # Translation Version is gone — translations now ship as pre-built
+    # JSON files in lang/. There is only one install path, so this
+    # function just shows the confirmation dialog for new installs and
+    # then returns. Existing installs go straight through (they already
+    # consented to update via the menu).
+    INSTALL_TYPE="1"
+
     if [ "$current_install_type" = "none" ]; then
         if ! show_installation_confirmation "$INSTALL_TYPE"; then
             show_proxmenux_logo
@@ -1168,33 +868,23 @@ show_installation_options() {
             exit 1
         fi
     fi
-    
-    if ! handle_installation_change "$current_install_type" "$INSTALL_TYPE"; then
-        show_proxmenux_logo
-        msg_warn "Installation cancelled."
-        exit 1
-    fi
 }
 
 install_proxmenux() {
-    show_installation_options
-    
-    case "$INSTALL_TYPE" in
-        "1")
-            show_proxmenux_logo
-            msg_title "Installing ProxMenux - Normal Version"
-            install_normal_version
-            ;;
-        "2")
-            show_proxmenux_logo
-            msg_title "Installing ProxMenux - Translation Version"
-            install_translation_version
-            ;;
-        *)
-            msg_error "Invalid option selected."
-            exit 1
-            ;;
-    esac
+    if [[ "${UPDATE_MODE:-0}" == "1" ]]; then
+        # Update path: the user already accepted "Update now?" in the
+        # menu. Hand off to the freshly-installed menu binary at the end
+        # (exec, see below) so no shell ever returns to a half-written
+        # /usr/local/bin/menu — the new copy is the only thing parsed.
+        show_proxmenux_logo
+        msg_title "Updating ProxMenux"
+        install_normal_version
+    else
+        show_installation_options
+        show_proxmenux_logo
+        msg_title "Installing ProxMenux"
+        install_normal_version
+    fi
 
     if [[ -f "$UTILS_FILE" ]]; then
     source "$UTILS_FILE"
@@ -1210,14 +900,27 @@ install_proxmenux() {
         bash "$LOCAL_SCRIPTS/global/cleanup_gpu_hookscripts.sh" || true
     fi
 
+    # UPDATE_MODE used to `exec "$INSTALL_DIR/$MENU_SCRIPT"` here to
+    # auto-relaunch the freshly-installed menu. That produced visible
+    # "line: syntax" errors when bash tried to read the just-rewritten
+    # /usr/local/bin/menu (or a shared utils.sh sourced by it) under
+    # its feet. Fall through to the standard "installed successfully"
+    # end-of-run message instead — the operator types `menu` when
+    # ready and the terminal is stable by then.
+    #
+    # `change_release_channel` in scripts/menus/config_menu.sh is
+    # unaffected: it invokes the installer without `--update`
+    # (UPDATE_MODE=0) so it never went through this branch, and its
+    # "return to config menu" behaviour is preserved.
+
     msg_title "ProxMenux has been installed successfully"
-    
+
     if systemctl is-active --quiet proxmenux-monitor.service; then
         local server_ip=$(get_server_ip)
         echo -e "${GN}🌐  ProxMenux Monitor activated${CL}: ${BL}http://${server_ip}:${MONITOR_PORT}${CL}"
         echo
     fi
-    
+
     echo -ne "${GN}"
     type_text "To run ProxMenux, simply execute this command in the console or terminal:"
     echo -e "${YWB}    menu${CL}"
@@ -1226,6 +929,12 @@ install_proxmenux() {
     exit 0
 }
 
+# Parse CLI flags before anything else so install_proxmenux() can
+# branch on UPDATE_MODE without re-reading "$@".
+if [[ "${1:-}" == "--update" ]]; then
+    UPDATE_MODE=1
+fi
+
 if [ "$(id -u)" -ne 0 ]; then
     msg_error "This script must be run as root."
     exit 1
diff --git a/install_proxmenux_beta.sh b/install_proxmenux_beta.sh
index 0a2fa075..d014c3c5 100644
--- a/install_proxmenux_beta.sh
+++ b/install_proxmenux_beta.sh
@@ -35,12 +35,16 @@
 INSTALL_DIR="/usr/local/bin"
 BASE_DIR="/usr/local/share/proxmenux"
 CONFIG_FILE="$BASE_DIR/config.json"
-CACHE_FILE="$BASE_DIR/cache.json"
 UTILS_FILE="$BASE_DIR/utils.sh"
 LOCAL_VERSION_FILE="$BASE_DIR/version.txt"
 BETA_VERSION_FILE="$BASE_DIR/beta_version.txt"
 MENU_SCRIPT="menu"
 
+# Legacy path that existed during the Python+googletrans era. Purged on
+# install if present — the current translate flow uses pre-built JSON
+# files in lang/ and has no runtime venv dependency.
+LEGACY_VENV_PATH="/opt/googletrans-env"
+
 MONITOR_INSTALL_DIR="$BASE_DIR"
 MONITOR_RUNTIME_DIR="$BASE_DIR/monitor-app"
 MONITOR_SERVICE_FILE="/etc/systemd/system/proxmenux-monitor.service"
@@ -304,9 +308,6 @@ cleanup_corrupted_files() {
     if [ -f "$CONFIG_FILE" ] && ! jq empty "$CONFIG_FILE" >/dev/null 2>&1; then
         rm -f "$CONFIG_FILE"
     fi
-    if [ -f "$CACHE_FILE" ] && ! jq empty "$CACHE_FILE" >/dev/null 2>&1; then
-        rm -f "$CACHE_FILE"
-    fi
 }
 
 detect_latest_appimage() {
@@ -541,15 +542,78 @@ EOF
 }
 
 # ── Main install ───────────────────────────────────────────
+select_language() {
+    if [ -f "$CONFIG_FILE" ] && jq empty "$CONFIG_FILE" >/dev/null 2>&1; then
+        local existing_language=$(jq -r '.language // empty' "$CONFIG_FILE" 2>/dev/null)
+        if [[ -n "$existing_language" && "$existing_language" != "null" && "$existing_language" != "empty" ]]; then
+            LANGUAGE="$existing_language"
+            msg_ok "Using existing language configuration: $LANGUAGE"
+            return 0
+        fi
+    fi
+
+    LANGUAGE=$(whiptail --title "Select Language" --menu "Choose a language for the menu:" 20 60 12 \
+        "en" "English" \
+        "es" "Spanish" \
+        "fr" "French" \
+        "de" "German" \
+        "it" "Italian" \
+        "pt" "Portuguese" 3>&1 1>&2 2>&3)
+
+    if [ -z "$LANGUAGE" ]; then
+        msg_error "No language selected. Exiting."
+        exit 1
+    fi
+
+    mkdir -p "$(dirname "$CONFIG_FILE")"
+
+    if [ ! -f "$CONFIG_FILE" ] || ! jq empty "$CONFIG_FILE" >/dev/null 2>&1; then
+        echo '{}' > "$CONFIG_FILE"
+    fi
+
+    local tmp_file
+    tmp_file=$(mktemp)
+    if jq --arg lang "$LANGUAGE" '. + {language: $lang}' "$CONFIG_FILE" > "$tmp_file" 2>/dev/null; then
+        mv "$tmp_file" "$CONFIG_FILE"
+    else
+        echo "{\"language\": \"$LANGUAGE\"}" > "$CONFIG_FILE"
+    fi
+
+    [ -f "$tmp_file" ] && rm -f "$tmp_file"
+
+    msg_ok "Language set to: $LANGUAGE"
+}
+
 install_beta() {
-    local total_steps=4
+    local total_steps=5
     local current_step=1
 
-    # ── Step 1: Dependencies ──────────────────────────────
+    # ── Step 1: Language selection ────────────────────────
+    # Pre-built translations in lang/<locale>.json make every beta install
+    # multilingual-capable. Ask the operator once up front; subsequent
+    # update runs reuse the saved choice without re-prompting.
+    show_progress $current_step $total_steps "Language selection"
+    select_language
+    ((current_step++))
+
+    # Purge the legacy googletrans virtualenv if a previous install left it
+    # behind. Runtime translation is now a static JSON lookup — the venv
+    # is dead weight on disk now.
+    if [[ -d "$LEGACY_VENV_PATH" ]]; then
+        msg_info "Removing legacy translation virtualenv at $LEGACY_VENV_PATH..."
+        rm -rf "$LEGACY_VENV_PATH"
+        msg_ok "Legacy translation virtualenv removed."
+    fi
+
+    # ── Step 2: Dependencies ──────────────────────────────
     show_progress $current_step $total_steps "Installing system dependencies"
 
+    msg_info "Refreshing apt cache..."
+    apt-get update -y > /dev/null 2>&1 || true
+    msg_ok "apt cache refreshed."
+
+    msg_info "Installing jq..."
     if ! command -v jq > /dev/null 2>&1; then
-        apt-get update > /dev/null 2>&1
         if apt-get install -y jq > /dev/null 2>&1 && command -v jq > /dev/null 2>&1; then
             update_config "jq" "installed"
         else
@@ -566,18 +630,13 @@ install_beta() {
     else
         update_config "jq" "already_installed"
     fi
+    msg_ok "jq ready."
 
     local BASIC_DEPS=("dialog" "curl" "git")
-    if [ -z "${APT_UPDATED:-}" ]; then
-        apt-get update -y > /dev/null 2>&1 || true
-        APT_UPDATED=1
-    fi
-
     for pkg in "${BASIC_DEPS[@]}"; do
-        # Strict per-package check — `dpkg -l | grep -qw python3` falsely
-        # matches `python3-pip` (the `-` is a word boundary), so dpkg-query
-        # for the EXACT package name is the only reliable test.
-        # Issue #205.
+        msg_info "Installing $pkg..."
+        # dpkg-query for the EXACT package name — `dpkg -l | grep -qw python3`
+        # falsely matches `python3-pip`. Issue #205.
         if ! dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null | grep -q "ok installed"; then
             if apt-get install -y "$pkg" > /dev/null 2>&1; then
                 update_config "$pkg" "installed"
@@ -589,11 +648,12 @@ install_beta() {
         else
             update_config "$pkg" "already_installed"
         fi
+        msg_ok "$pkg ready."
     done
 
     msg_ok "Dependencies installed: jq, dialog, curl, git."
 
-    # ── Step 2: Clone develop branch ─────────────────────
+    # ── Step 3: Clone develop branch ─────────────────────
     ((current_step++))
     show_progress $current_step $total_steps "Cloning ProxMenux develop branch"
 
@@ -612,7 +672,7 @@ install_beta() {
 
     cd "$TEMP_DIR"
 
-    # ── Step 3: Files ─────────────────────────────────────
+    # ── Step 4: Files ─────────────────────────────────────
     ((current_step++))
     show_progress $current_step $total_steps "Creating directories and copying files"
 
@@ -623,7 +683,11 @@ install_beta() {
     mkdir -p "$BASE_DIR/oci"
 
     cp "./scripts/utils.sh" "$UTILS_FILE"
-    cp "./menu" "$INSTALL_DIR/$MENU_SCRIPT"
+    # Atomic install of /usr/local/bin/menu — see install_proxmenux.sh
+    # for the rationale (prevents partial-file reads during mid-update
+    # parsing).
+    cp "./menu" "$INSTALL_DIR/${MENU_SCRIPT}.new"
+    mv -f "$INSTALL_DIR/${MENU_SCRIPT}.new" "$INSTALL_DIR/$MENU_SCRIPT"
     cp "./version.txt" "$LOCAL_VERSION_FILE" 2>/dev/null || true
 
     # Store beta version marker
@@ -636,11 +700,23 @@ install_beta() {
     cp "./install_proxmenux.sh" "$BASE_DIR/install_proxmenux.sh" 2>/dev/null || true
     cp "./install_proxmenux_beta.sh" "$BASE_DIR/install_proxmenux_beta.sh" 2>/dev/null || true
 
+    # Pre-built translation cache. The runtime translate() in utils.sh
+    # reads $BASE_DIR/lang/<lang>.json — these files ship with the repo
+    # (one per supported language) so every beta install is multilingual
+    # without any runtime download or Python dependency. Refresh the
+    # whole dir on every install so a language that was renamed or
+    # dropped upstream disappears here too.
+    if [ -d "./lang" ]; then
+        rm -rf "$BASE_DIR/lang"
+        mkdir -p "$BASE_DIR/lang"
+        cp -r "./lang/"* "$BASE_DIR/lang/" 2>/dev/null || true
+    fi
+
     # Wipe the scripts tree before copying so any file removed upstream
     # (renamed, consolidated, deprecated) disappears from the user install.
-    # Only $BASE_DIR/scripts/ is cleared; config.json, cache.json,
-    # components_status.json, version.txt, beta_version.txt, monitor.db,
-    # smart/, oci/ and the AppImage live outside this path and are preserved.
+    # Only $BASE_DIR/scripts/ is cleared; config.json, components_status.json,
+    # version.txt, beta_version.txt, monitor.db, smart/, oci/ and the
+    # AppImage live outside this path and are preserved.
     rm -rf "$BASE_DIR/scripts"
     mkdir -p "$BASE_DIR/scripts"
     cp -r "./scripts/"* "$BASE_DIR/scripts/"
@@ -663,7 +739,7 @@ install_beta() {
 
     msg_ok "Files installed. Beta version: ${beta_version}."
 
-    # ── Step 4: Monitor ───────────────────────────────────
+    # ── Step 5: Monitor ───────────────────────────────────
     ((current_step++))
     show_progress $current_step $total_steps "Installing ProxMenux Monitor (beta)"
 
@@ -698,6 +774,14 @@ check_stable_available() {
 }
 
 # ── Entry point ────────────────────────────────────────────
+# Parse --update before any work so the welcome banner can be skipped
+# and the relaunch hand-off can fire at the end. The flag arrives from
+# `menu`'s check_updates_beta() → `exec bash $INSTALL_SCRIPT --update`.
+UPDATE_MODE=0
+if [[ "${1:-}" == "--update" ]]; then
+    UPDATE_MODE=1
+fi
+
 if [ "$(id -u)" -ne 0 ]; then
     echo -e "${RD}[ERROR] This script must be run as root.${CL}"
     exit 1
@@ -705,9 +789,13 @@ fi
 
 cleanup_corrupted_files
 show_proxmenux_logo
-show_beta_welcome
 
-msg_title "Installing ProxMenux Beta — branch: develop"
+if [[ "$UPDATE_MODE" == "1" ]]; then
+    msg_title "Updating ProxMenux Beta — branch: develop"
+else
+    show_beta_welcome
+    msg_title "Installing ProxMenux Beta — branch: develop"
+fi
 install_beta
 
 # Load utils if available
@@ -723,6 +811,17 @@ if [ -x "$BASE_DIR/scripts/global/cleanup_gpu_hookscripts.sh" ]; then
     bash "$BASE_DIR/scripts/global/cleanup_gpu_hookscripts.sh" || true
 fi
 
+# UPDATE_MODE used to `exec "$INSTALL_DIR/$MENU_SCRIPT"` here to
+# auto-relaunch the freshly-installed menu. That produced visible
+# "line: syntax" errors when bash tried to read the just-rewritten
+# /usr/local/bin/menu (or a shared utils.sh sourced by it) under its
+# feet. Fall through to the standard end-of-run message instead —
+# the operator types `menu` when ready and the terminal is stable.
+#
+# `change_release_channel` in scripts/menus/config_menu.sh is
+# unaffected: it invokes the installer without `--update`
+# (UPDATE_MODE=0) so it never went through this branch.
+
 msg_title "ProxMenux Beta installed successfully"
 
 if systemctl is-active --quiet proxmenux-monitor.service; then
diff --git a/lang/cache.json b/lang/cache.json
deleted file mode 100644
index 1b60a832..00000000
--- a/lang/cache.json
+++ /dev/null
@@ -1,198 +0,0 @@
-{
-  "Language changed to": {
-    "es": "Idioma cambiado a",
-    "fr": "Langue changée en",
-    "de": "Sprache geändert zu",
-    "it": "Lingua cambiata in",
-    "pt": "Idioma alterado para"
-  },
-  "Main Menu": {
-    "es": "Menú principal",
-    "fr": "Menu principal",
-    "de": "Hauptmenü",
-    "it": "Menu principale",
-    "pt": "Menu principal"
-  },
-  "Select an option:": {
-    "es": "Seleccione una opción:",
-    "fr": "Sélectionnez une option :",
-    "de": "Wählen Sie eine Option aus:",
-    "it": "Selezionare un'opzione:",
-    "pt": "Selecione uma opção:"
-  },
-  "GPUs and Coral-TPU": {
-    "es": "GPUs y Coral-TPU",
-    "fr": "GPUs et Coral-TPU",
-    "de": "GPUs und Coral-TPU",
-    "it": "GPUs e Coral-TPU",
-    "pt": "GPUs e Coral-TPU"
-  },
-  "Hard Drives, Disk Images, and Storage": {
-    "es": "Discos duros, imágenes de disco y almacenamiento",
-    "fr": "Disques durs, images disque et stockage",
-    "de": "Festplatten, Festplattenabbilder und Speicherplatz",
-    "it": "Dischi rigidi, immagini del disco e archiviazione",
-    "pt": "Discos rígidos, imagens de disco e armazenamento"
-  },
-  "Network": {
-    "es": "Red",
-    "fr": "Réseau",
-    "de": "Netzwerk",
-    "it": "Rete",
-    "pt": "Rede"
-  },
-  "Settings": {
-    "es": "Configuración",
-    "fr": "Paramètres",
-    "de": "Einstellungen",
-    "it": "Impostazioni",
-    "pt": "Configurações"
-  },
-  "Exit": {
-    "es": "Salir",
-    "fr": "Quitter",
-    "de": "Beenden",
-    "it": "Esci",
-    "pt": "Sair"
-  },
-  "HW: GPUs and Coral": {
-    "es": "HW: GPUs y Coral",
-    "fr": "HW: GPUs et Coral",
-    "de": "HW: GPUs und Coral",
-    "it": "HW: GPUs e Coral",
-    "pt": "HW: GPUs e Coral"
-  },
-  "Return to Main Menu": {
-    "es": "Volver al menú principal",
-    "fr": "Retour au menu principal",
-    "de": "Zum Hauptmenü zurückkehren",
-    "it": "Torna al menu principale",
-    "pt": "Retornar ao menu principal"
-  },
-  "Disk and Storage Menu": {
-    "es": "Menú de discos y almacenamiento",
-    "fr": "Menu des disques et stockage",
-    "de": "Datenträger- und Speichermenü",
-    "it": "Menu dischi e archiviazione",
-    "pt": "Menu de discos e armazenamento"
-  },
-  "Add Disk Passthrough to a VM": {
-    "es": "Añadir disco Passthrough a una VM",
-    "fr": "Ajouter un disque Passthrough à une VM",
-    "de": "Disk-Passthrough zu einer VM hinzufügen",
-    "it": "Aggiungi passthrough del disco a una VM",
-    "pt": "Adicionar passthrough de disco a uma VM"
-  },
-  "Network Menu": {
-    "es": "Menú de red",
-    "fr": "Menu réseau",
-    "de": "Netzwerkmenü",
-    "it": "Menu di rete",
-    "pt": "Menu de rede"
-  },
-  "Repair Network": {
-    "es": "Reparar red",
-    "fr": "Réparer le réseau",
-    "de": "Netzwerk reparieren",
-    "it": "Riparare la rete",
-    "pt": "Reparar rede"
-  },
-  "Configuration Menu": {
-    "es": "Menú de configuración",
-    "fr": "Menu de configuration",
-    "de": "Konfigurationsmenü",
-    "it": "Menu di configurazione",
-    "pt": "Menu de configuração"
-  },
-  "Change Language": {
-    "es": "Cambiar idioma",
-    "fr": "Changer de langue",
-    "de": "Sprache ändern",
-    "it": "Cambia lingua",
-    "pt": "Alterar idioma"
-  },
-  "Show Version Information": {
-    "es": "Mostrar información de la versión",
-    "fr": "Afficher les informations de version",
-    "de": "Versionsinformationen anzeigen",
-    "it": "Mostra informazioni sulla versione",
-    "pt": "Mostrar informações da versão"
-  },
-  "Uninstall ProxMenu": {
-    "es": "Desinstalar ProxMenu",
-    "fr": "Désinstaller ProxMenu",
-    "de": "ProxMenu deinstallieren",
-    "it": "Disinstallare ProxMenu",
-    "pt": "Desinstalar ProxMenu"
-  },
-  "Select a new language for the menu:": {
-    "es": "Seleccione un nuevo idioma para el menú:",
-    "fr": "Sélectionnez une nouvelle langue pour le menu :",
-    "de": "Wählen Sie eine neue Sprache für das Menü:",
-    "it": "Seleziona una nuova lingua per il menu:",
-    "pt": "Selecione um novo idioma para o menu:"
-  },
-  "English (Recommended)": {
-    "es": "Inglés (recomendado)",
-    "fr": "Anglais (recommandé)",
-    "de": "Englisch (empfohlen)",
-    "it": "Inglese (consigliato)",
-    "pt": "Inglês (recomendado)"
-  },
-  "Spanish": {
-    "es": "Español",
-    "fr": "Espagnol",
-    "de": "Spanisch",
-    "it": "Spagnolo",
-    "pt": "Espanhol"
-  },
-  "French": {
-    "es": "Francés",
-    "fr": "Français",
-    "de": "Französisch",
-    "it": "Francese",
-    "pt": "Francês"
-  },
-  "German": {
-    "es": "Alemán",
-    "fr": "Allemand",
-    "de": "Deutsch",
-    "it": "Tedesco",
-    "pt": "Alemão"
-  },
-  "Italian": {
-    "es": "Italiano",
-    "fr": "Italien",
-    "de": "Italienisch",
-    "it": "Italiano",
-    "pt": "Italiano"
-  },
-  "Portuguese": {
-    "es": "Portugués",
-    "fr": "Portugais",
-    "de": "Portugiesisch",
-    "it": "Portoghese",
-    "pt": "Português"
-  },
-  "Simplified Chinese": {
-    "es": "Chino simplificado",
-    "fr": "Chinois simplifié",
-    "de": "Vereinfachtes Chinesisch",
-    "it": "Cinese semplificato",
-    "pt": "Chinês simplificado"
-  },
-  "Japanese": {
-    "es": "Japonés",
-    "fr": "Japonais",
-    "de": "Japanisch",
-    "it": "Giapponese",
-    "pt": "Japonês"
-  },
-  "Thank you for using ProxMenu. Goodbye!": {
-  "es": "Gracias por usar ProxMenu. ¡Hasta luego!",
-  "fr": "Merci d'avoir utilisé ProxMenu. À bientôt !",
-  "de": "Vielen Dank, dass Sie ProxMenu verwendet haben. Bis bald!",
-  "it": "Grazie per aver usato ProxMenu. A presto!",
-  "pt": "Obrigado por usar o ProxMenu. Até logo!"
-  }
-}
diff --git a/lang/de.json b/lang/de.json
new file mode 100644
index 00000000..68561b16
--- /dev/null
+++ b/lang/de.json
@@ -0,0 +1,5231 @@
+{
+  "# Alternative if you prefer screen": "# Alternative, wenn Sie den Bildschirm bevorzugen",
+  "# Recommended: avoids disconnection during upgrade": "# Empfohlen: Verhindert Verbindungsabbrüche während des Upgrades",
+  "(Checked entries will be removed. Uncheck to keep in VM.)": "(Überprüfte Einträge werden entfernt. Deaktivieren Sie die Markierung, um sie in VM zu behalten.)",
+  "(Import is selected by default — required for disk image imports)": "(Import ist standardmäßig ausgewählt – erforderlich für Disk-Image-Importe)",
+  "(Only the host directory is modified. Nothing inside the container is changed.": "(Es wird nur das Hostverzeichnis geändert. Im Container wird nichts geändert.",
+  "(common default on Debian/LXC: PermitRootLogin prohibit-password).": "(allgemeiner Standard unter Debian/LXC: PermitRootLogin prohibit-password).",
+  "(disabled)": "(deaktiviert)",
+  "(e.g.": "(z.B.",
+  "(for unprivileged LXCs)": "(für unprivilegierte LXCs)",
+  "(if only privileged LXCs need write access)": "(wenn nur privilegierte LXCs Schreibzugriff benötigen)",
+  "(make.log not found — DKMS may have failed before invoking make)": "(make.log nicht gefunden – DKMS ist möglicherweise vor dem Aufruf von make fehlgeschlagen)",
+  "(need ≥ 1024MB)": "(Benötigung ≥ 1024 MB)",
+  "(no credentials file — guest mode)": "(keine Anmeldeinformationsdatei – Gastmodus)",
+  "(none)": "(keiner)",
+  "(not mounted — will be mounted)": "(nicht montiert – wird montiert)",
+  "(only on SSD/NVMe) to protect your disk": "(nur auf SSD/NVMe), um Ihre Festplatte zu schützen",
+  "(parent PF:": "(Eltern-PF:",
+  "(recommended)": "(empfohlen)",
+  "(same MAC — restored config adjusted automatically)": "(gleicher MAC – wiederhergestellte Konfiguration automatisch angepasst)",
+  ")": ")",
+  "+ Add a path": "+ Fügen Sie einen Pfad hinzu",
+  "+ Add new Borg target": "+ Neues Borg-Ziel hinzufügen",
+  "+ Add new PBS manually": "+ Neues PBS manuell hinzufügen",
+  "- Delete a saved target": "- Löschen Sie ein gespeichertes Ziel",
+  "/backup": "/backup",
+  "/etc/exports file does not exist.": "Die Datei /etc/exports existiert nicht.",
+  "/etc/fstab updated — permissions will persist after reboot": "/etc/fstab aktualisiert – Berechtigungen bleiben nach dem Neustart bestehen",
+  "/etc/network controls active interfaces. Applying may immediately change or drop network connectivity, including active SSH sessions.": "/etc/network steuert aktive Schnittstellen. Durch die Anwendung kann die Netzwerkkonnektivität, einschließlich aktiver SSH-Sitzungen, sofort geändert oder unterbrochen werden.",
+  "/etc/network/interfaces uses allow-hotplug. Renaming interfaces via systemd .link can break that flow — review the file after reboot.": "/etc/network/interfaces verwendet Allow-Hotplug. Das Umbenennen von Schnittstellen über systemd .link kann diesen Ablauf unterbrechen – überprüfen Sie die Datei nach dem Neustart.",
+  "/etc/pve is managed by pmxcfs (cluster filesystem). Applying this on a running node can corrupt cluster state. Use 'Export to file' and apply it manually during a maintenance window.": "/etc/pve wird von pmxcfs (Cluster-Dateisystem) verwaltet. Wenn Sie dies auf einen laufenden Knoten anwenden, kann der Clusterstatus beschädigt werden. Verwenden Sie „In Datei exportieren“ und wenden Sie es während eines Wartungsfensters manuell an.",
+  "/etc/samba/smb.conf file does not exist.": "Die Datei /etc/samba/smb.conf existiert nicht.",
+  "/var/lib/pve-cluster is live cluster data. Never restore this while the node is running. Use 'Export to file' for manual recovery only.": "/var/lib/pve-cluster sind Live-Clusterdaten. Stellen Sie dies niemals wieder her, während der Knoten läuft. Verwenden Sie „In Datei exportieren“ nur für die manuelle Wiederherstellung.",
+  "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump (Proxmox-Standard-vzdump-Pfad)",
+  "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump (Proxmox-Standard)",
+  "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = Sticky Bit + RWX für alle. Keine gemeinsame Gruppe erforderlich.",
+  "====== PVE UPDATE COMPLETED ======": "====== PVE-UPDATE ABGESCHLOSSEN ======",
+  "A VirtIO ISO already exists. Do you want to overwrite it?": "Eine VirtIO-ISO ist bereits vorhanden. Möchten Sie es überschreiben?",
+  "A ZFS pool with this name already exists.": "Ein ZFS-Pool mit diesem Namen ist bereits vorhanden.",
+  "A ZFS pool with this name already exists:": "Ein ZFS-Pool mit diesem Namen existiert bereits:",
+  "A complete restore will:": "Eine vollständige Wiederherstellung führt zu Folgendem:",
+  "A host reboot is required after this change.": "Nach dieser Änderung ist ein Neustart des Hosts erforderlich.",
+  "A host reboot is required before starting the VM. Reboot now?": "Vor dem Starten der VM ist ein Host-Neustart erforderlich. Jetzt neu starten?",
+  "A job with this ID already exists.": "Ein Job mit dieser ID existiert bereits.",
+  "A keyfile is installed at:": "Eine Schlüsseldatei ist installiert unter:",
+  "A newer version is available:": "Eine neuere Version ist verfügbar:",
+  "A reboot is required after installation to load the new kernel modules.": "Nach der Installation ist ein Neustart erforderlich, um die neuen Kernelmodule zu laden.",
+  "A reboot is required for VFIO binding to take effect. Do you want to restart now?": "Damit die VFIO-Bindung wirksam wird, ist ein Neustart erforderlich. Möchten Sie jetzt neu starten?",
+  "A reboot is required to apply the new GPU mode. Do you want to restart now?": "Um den neuen GPU-Modus anzuwenden, ist ein Neustart erforderlich. Möchten Sie jetzt neu starten?",
+  "A reboot is required to finish the restore.": "Um die Wiederherstellung abzuschließen, ist ein Neustart erforderlich.",
+  "A reboot will be required to complete the restore.": "Ein Neustart ist erforderlich, um die Wiederherstellung abzuschließen.",
+  "A server reboot is recommended for all changes to take full effect.": "Damit alle Änderungen vollständig wirksam werden, wird ein Neustart des Servers empfohlen.",
+  "A system reboot is recommended to ensure all changes take effect.": "Um sicherzustellen, dass alle Änderungen wirksam werden, wird ein Systemneustart empfohlen.",
+  "ACL Status:": "ACL-Status:",
+  "ACL permissions applied for local access for user:": "ACL-Berechtigungen für lokalen Zugriff für Benutzer angewendet:",
+  "ADVANCED SETTINGS COMPLETE": "ERWEITERTE EINSTELLUNGEN ABGESCHLOSSEN",
+  "ALL DATA ON": "ALLE DATEN EIN",
+  "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "ALLE DATEN AUF DIESER Diskette gehen dauerhaft verloren!",
+  "ALL Utilities": "ALLE Dienstprogramme",
+  "AMD CPU detected": "AMD-CPU erkannt",
+  "AMD CPU fixes applied successfully": "AMD-CPU-Korrekturen erfolgreich angewendet",
+  "AMD GPU Tools installation completed!": "Die Installation der AMD GPU Tools ist abgeschlossen!",
+  "AMD GPU passthrough configured.": "AMD GPU-Passthrough konfiguriert.",
+  "AMD GPU(s) detected:": "Erkannte AMD-GPU(s):",
+  "AMD fixes have been successfully reverted": "AMD-Korrekturen wurden erfolgreich rückgängig gemacht",
+  "AMD mesa drivers installed.": "AMD Mesa-Treiber installiert.",
+  "AMD softdep configured": "AMD-Softdep konfiguriert",
+  "AMD softdep configured in /etc/modprobe.d/vfio.conf": "AMD Softdep konfiguriert in /etc/modprobe.d/vfio.conf",
+  "ANALYSIS SUMMARY": "ANALYSE-ZUSAMMENFASSUNG",
+  "API returned an invalid timezone": "Die API hat eine ungültige Zeitzone zurückgegeben",
+  "API tokens (Home Assistant, scripts) will keep working.": "API-Tokens (Home Assistant, Skripte) funktionieren weiterhin.",
+  "APT IPv4 configuration completed": "APT IPv4-Konfiguration abgeschlossen",
+  "APT IPv4 configuration removed": "APT IPv4-Konfiguration entfernt",
+  "APT and repositories": "APT und Repositorys",
+  "APT configured to skip additional languages": "APT ist so konfiguriert, dass zusätzliche Sprachen übersprungen werden",
+  "APT configured to skip downloading additional languages": "APT ist so konfiguriert, dass das Herunterladen zusätzlicher Sprachen übersprungen wird",
+  "APT configured to use IPv4": "APT ist für die Verwendung von IPv4 konfiguriert",
+  "APT index update failed after switching to no-subscription. See log:": "Die Aktualisierung des APT-Index ist nach dem Wechsel zu „Kein Abonnement“ fehlgeschlagen. Siehe Protokoll:",
+  "APT index update failed. See log:": "Die Aktualisierung des APT-Index ist fehlgeschlagen. Siehe Protokoll:",
+  "APT indexes updated for Trixie": "APT-Indizes für Trixie aktualisiert",
+  "APT indexes updated for Trixie (no-subscription)": "APT-Indizes für Trixie aktualisiert (kein Abonnement)",
+  "APT language configuration already set": "Die APT-Sprachkonfiguration ist bereits festgelegt",
+  "APT language configuration updated": "APT-Sprachkonfiguration aktualisiert",
+  "APT language downloads restored": "APT-Sprachdownloads wiederhergestellt",
+  "APT package lists updated": "APT-Paketlisten aktualisiert",
+  "Aborted": "Abgebrochen",
+  "About to restore": "Wird gerade wiederhergestellt",
+  "Absolute directory path to use as backup target:": "Absoluter Verzeichnispfad zur Verwendung als Sicherungsziel:",
+  "Absolute path to a file or directory you want backed up:": "Absoluter Pfad zu einer Datei oder einem Verzeichnis, die/das Sie sichern möchten:",
+  "Accept routes from other nodes?": "Routen von anderen Knoten akzeptieren?",
+  "Access Scope:": "Zugriffsbereich:",
+  "Access profile:": "Zugangsprofil:",
+  "Account is not locked": "Das Konto ist nicht gesperrt",
+  "Action cancelled due to previous xshok-proxmox modifications.": "Aktion aufgrund früherer xshok-proxmox-Änderungen abgebrochen.",
+  "Action:": "Aktion:",
+  "Activate Monitor": "Monitor aktivieren",
+  "Activate ProxMenux Monitor": "Aktivieren Sie den ProxMenux-Monitor",
+  "Active": "Aktiv",
+  "Active Connections": "Aktive Verbindungen",
+  "Active exports:": "Aktive Exporte:",
+  "Active session:": "Aktive Sitzung:",
+  "Add Audio Passthrough": "Fügen Sie Audio-Passthrough hinzu",
+  "Add CIFS storage:": "CIFS-Speicher hinzufügen:",
+  "Add Controller or NVMe (PCI passthrough)": "Controller oder NVMe hinzufügen (PCI-Passthrough)",
+  "Add Controller or NVMe PCIe to VM": "Fügen Sie der VM einen Controller oder NVMe PCIe hinzu",
+  "Add Coral TPU to LXC": "Fügen Sie Coral TPU zu LXC hinzu",
+  "Add GPU to LXC": "GPU zu LXC hinzufügen",
+  "Add GPU to LXC   (Intel | AMD | NVIDIA)": "GPU zu LXC hinzufügen (Intel | AMD | NVIDIA)",
+  "Add GPU to VM    (Intel | AMD | NVIDIA)": "GPU zur VM hinzufügen (Intel | AMD | NVIDIA)",
+  "Add Local Disk   as Proxmox Storage": "Lokale Festplatte als Proxmox-Speicher hinzufügen",
+  "Add Local Disk (Proxmox storage + host mount)": "Lokale Festplatte hinzufügen (Proxmox-Speicher + Host-Mount)",
+  "Add Local Disk as Host Mount (for LXC bind-mounts)": "Lokale Festplatte als Host-Mount hinzufügen (für LXC-Bind-Mounts)",
+  "Add Local Disk as Proxmox Storage": "Lokale Festplatte als Proxmox-Speicher hinzufügen",
+  "Add NFS Share as Proxmox Storage": "Fügen Sie eine NFS-Freigabe als Proxmox-Speicher hinzu",
+  "Add NFS share    as Proxmox Storage": "Fügen Sie eine NFS-Freigabe als Proxmox-Speicher hinzu",
+  "Add NFS storage:": "NFS-Speicher hinzufügen:",
+  "Add PBS": "PBS hinzufügen",
+  "Add Samba Share as Proxmox Storage": "Samba-Freigabe als Proxmox-Speicher hinzufügen",
+  "Add Samba share  as Proxmox Storage": "Samba-Freigabe als Proxmox-Speicher hinzufügen",
+  "Add as IDE": "Als IDE hinzufügen",
+  "Add as SATA": "Als SATA hinzufügen",
+  "Add as SCSI": "Als SCSI hinzufügen",
+  "Add as VirtIO": "Als VirtIO hinzufügen",
+  "Add as disk (standard)": "Als Datenträger hinzufügen (Standard)",
+  "Add bind mount to container:": "Bind-Mount zum Container hinzufügen:",
+  "Add color prompts and useful aliases to the terminal environment": "Fügen Sie der Terminalumgebung Farbaufforderungen und nützliche Aliase hinzu",
+  "Add custom path": "Benutzerdefinierten Pfad hinzufügen",
+  "Add disk to LXC container": "Fügen Sie dem LXC-Container eine Festplatte hinzu",
+  "Add explicit privileged flag (optional but recommended):": "Fügen Sie ein explizites privilegiertes Flag hinzu (optional, aber empfohlen):",
+  "Add export rule:": "Exportregel hinzufügen:",
+  "Add iSCSI Target as Proxmox Storage": "Fügen Sie das iSCSI-Ziel als Proxmox-Speicher hinzu",
+  "Add iSCSI storage in Proxmox Storage": "iSCSI-Speicher in Proxmox Storage hinzufügen",
+  "Add iSCSI storage in Proxmox:": "iSCSI-Speicher in Proxmox hinzufügen:",
+  "Add import disk": "Importdatenträger hinzufügen",
+  "Add latest Ceph support": "Neueste Ceph-Unterstützung hinzufügen",
+  "Add new PVE 9 enterprise repository (deb822 format) (Only if using enterprise):": "Neues PVE 9-Unternehmens-Repository hinzufügen (deb822-Format) (nur bei Verwendung von Enterprise):",
+  "Add physical disk to VM via": "Fügen Sie der VM eine physische Festplatte hinzu über",
+  "Add share block in /etc/samba/smb.conf:": "Freigabeblock in /etc/samba/smb.conf hinzufügen:",
+  "Add unprivileged flag to container configuration:": "Unprivilegiert-Flag zur Containerkonfiguration hinzufügen:",
+  "Add virtual disk": "Fügen Sie eine virtuelle Festplatte hinzu",
+  "Add: Mount Host Directory into LXC": "Hinzufügen: Hostverzeichnis in LXC einbinden",
+  "Added to /etc/fstab": "Zu /etc/fstab hinzugefügt",
+  "Added to /etc/fstab for permanent mounting.": "Zur dauerhaften Bereitstellung zu /etc/fstab hinzugefügt.",
+  "Added to /etc/fstab using UUID": "Mit UUID zu /etc/fstab hinzugefügt",
+  "Added to /etc/fstab using device path": "Über den Gerätepfad zu /etc/fstab hinzugefügt",
+  "Added to /etc/fstab.": "Zu /etc/fstab hinzugefügt.",
+  "Added user": "Benutzer hinzugefügt",
+  "Adding": "Hinzufügen",
+  "Adding CIFS storage to Proxmox...": "CIFS-Speicher zu Proxmox hinzufügen...",
+  "Adding QEMU Guest Agent support...": "QEMU Guest Agent-Unterstützung wird hinzugefügt...",
+  "Adding disk using the generated command to the selected VM": "Hinzufügen einer Festplatte mithilfe des generierten Befehls zur ausgewählten VM",
+  "Adding existing users to sharedfiles group...": "Vorhandene Benutzer werden zur Sharedfiles-Gruppe hinzugefügt...",
+  "Adding iSCSI storage to Proxmox...": "iSCSI-Speicher zu Proxmox hinzufügen...",
+  "Adding new share to smb.conf...": "Neue Freigabe zur smb.conf hinzufügen...",
+  "Adding this NVMe as a PCIe device (via 'Add Controller or NVMe PCIe to VM') gives better performance.": "Das Hinzufügen dieses NVMe als PCIe-Gerät (über „Controller oder NVMe PCIe zur VM hinzufügen“) führt zu einer besseren Leistung.",
+  "Adding to /etc/fstab for permanent mounting...": "Hinzufügen zu /etc/fstab für dauerhaftes Mounten ...",
+  "Additional audio function(s) to be added": "Zusätzliche Audiofunktion(en) sollen hinzugefügt werden",
+  "Adjust network/CIDR to your environment.": "Passen Sie Netzwerk/CIDR an Ihre Umgebung an.",
+  "Adjust options if needed (vers=4,hard,timeo,...).": "Passen Sie die Optionen bei Bedarf an (vers=4,hard,timeo,...).",
+  "Adjusting systemd-journald limits to match Log2RAM size...": "Anpassen der systemd-journald-Grenzwerte an die Log2RAM-Größe ...",
+  "Adjusts journald log level if needed (Proxmox defaults may block auth logs)": "Passt die Journal-Protokollebene bei Bedarf an (Proxmox-Standardeinstellungen blockieren möglicherweise Authentifizierungsprotokolle)",
+  "Advanced": "Fortschrittlich",
+  "Advanced Diagnostics": "Erweiterte Diagnose",
+  "Advanced Network Diagnostics": "Erweiterte Netzwerkdiagnose",
+  "Affected LXC containers": "Betroffene LXC-Container",
+  "After completing GPU setup, start the VM manually when the host is ready.": "Nachdem Sie die GPU-Einrichtung abgeschlossen haben, starten Sie die VM manuell, wenn der Host bereit ist.",
+  "After confirming, you will be asked to choose the NVIDIA driver version to install.": "Nach der Bestätigung werden Sie aufgefordert, die zu installierende NVIDIA-Treiberversion auszuwählen.",
+  "After detailed analysis, no changes are needed.": "Nach detaillierter Analyse sind keine Änderungen erforderlich.",
+  "After detailed analysis, no cleanup is needed.": "Nach einer detaillierten Analyse ist keine Bereinigung erforderlich.",
+  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Führen Sie nach der Anmeldung Folgendes aus: ip a, um die IP-Adresse zu erhalten.\nGeben Sie dann diese IP-Adresse wie folgt in Ihren Webbrowser ein:\n  http://IP_ADDRESS\n\nDadurch wird das Umbral OS-Dashboard geöffnet.",
+  "After pasting on the server, ensure the file is chmod 600 and owned by": "Stellen Sie nach dem Einfügen auf dem Server sicher, dass die Datei chmod 600 ist und Eigentum von ist",
+  "After reboot the system will be fully accessible (SSH, web UI, login), but the following components will be reinstalled in BACKGROUND — until they finish, commands like nvidia-smi may not yet be available:": "Nach dem Neustart ist das System vollständig zugänglich (SSH, Web-Benutzeroberfläche, Anmeldung), aber die folgenden Komponenten werden im HINTERGRUND neu installiert – bis sie abgeschlossen sind, sind Befehle wie nvidia-smi möglicherweise noch nicht verfügbar:",
+  "After reboot, these components will reinstall in background:": "Nach dem Neustart werden diese Komponenten im Hintergrund neu installiert:",
+  "After reboot, verify PVE version:": "Überprüfen Sie nach dem Neustart die PVE-Version:",
+  "After switching mode, reboot the host if requested.": "Starten Sie den Host nach dem Umschalten des Modus ggf. neu.",
+  "After that, run this script again to add it.": "Führen Sie anschließend dieses Skript erneut aus, um es hinzuzufügen.",
+  "After the reboot you can follow the post-restore work live from ProxMenux Monitor → Backups tab (estimated time, per-component status, log tail, rollback delta).": "Nach dem Neustart können Sie die Arbeit nach der Wiederherstellung live über ProxMenux Monitor → Registerkarte „Backups“ verfolgen (geschätzte Zeit, Status pro Komponente, Protokollende, Rollback-Delta).",
+  "After the reboot, you will only be able to access the Proxmox host via:": "Nach dem Neustart können Sie nur noch auf den Proxmox-Host zugreifen über:",
+  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Starten Sie nach diesem Wechsel von LXC → VM den Host neu, damit der neue Bindungsstatus sauber angewendet wird.",
+  "Aliases added to .bashrc": "Aliase wurden zu .bashrc hinzugefügt",
+  "All": "Alle",
+  "All Available Scripts": "Alle verfügbaren Skripte",
+  "All GPUs Already Assigned": "Alle GPUs bereits zugewiesen",
+  "All ProxMenux optimizations are up to date.": "Alle ProxMenux-Optimierungen sind auf dem neuesten Stand.",
+  "All block devices:": "Alle Blockgeräte:",
+  "All changes applied. No reboot required.": "Alle Änderungen übernommen. Kein Neustart erforderlich.",
+  "All changes are reversible using the ProxMenux uninstaller.": "Alle Änderungen können mit dem ProxMenux-Deinstallationsprogramm rückgängig gemacht werden.",
+  "All dependencies installed and verified.": "Alle Abhängigkeiten installiert und überprüft.",
+  "All detected GPUs are already assigned to this VM.": "Alle erkannten GPUs sind dieser VM bereits zugewiesen.",
+  "All detected controllers/NVMe are already present in the selected VM.": "Alle erkannten Controller/NVMe sind bereits in der ausgewählten VM vorhanden.",
+  "All disks may already be in use or mounted.": "Möglicherweise sind alle Datenträger bereits verwendet oder gemountet.",
+  "All images imported and configured successfully": "Alle Bilder wurden erfolgreich importiert und konfiguriert",
+  "All imports failed": "Alle Importe sind fehlgeschlagen",
+  "All partitions and metadata removed.": "Alle Partitionen und Metadaten entfernt.",
+  "All physical interfaces from backup are present on target": "Alle physischen Schnittstellen aus dem Backup sind auf dem Ziel vorhanden",
+  "All types      (images, backup, iso, vztmpl, snippets)": "Alle Typen (Images, Backup, ISO, Vztmpl, Snippets)",
+  "All user-installed packages from the backup are present on this host": "Alle vom Benutzer installierten Pakete aus dem Backup sind auf diesem Host vorhanden",
+  "All users with UID and GID": "Alle Benutzer mit UID und GID",
+  "Allocate CPU Cores": "Weisen Sie CPU-Kerne zu",
+  "Allocate RAM in MiB": "Weisen Sie RAM in MiB zu",
+  "Already Mounted": "Bereits montiert",
+  "Already configured": "Bereits konfiguriert",
+  "Already installed — skipping": "Bereits installiert – wird übersprungen",
+  "Also comment any remaining 'bookworm' entries in *.list if present.": "Kommentieren Sie auch alle verbleibenden „Bücherwurm“-Einträge in *.list, falls vorhanden.",
+  "Also install the VirtIO network driver during setup to enable network access.": "Installieren Sie während des Setups auch den VirtIO-Netzwerktreiber, um den Netzwerkzugriff zu ermöglichen.",
+  "Although VFIO can bind to this device, full passthrough to a VM is": "Obwohl sich VFIO an dieses Gerät binden kann, ist ein vollständiger Passthrough zu einer VM möglich",
+  "Amount of RAM in MiB (default: 4096)": "RAM-Größe in MiB (Standard: 4096)",
+  "An AMD dedicated GPU has been detected without FLR support": "Es wurde eine dedizierte AMD-GPU ohne FLR-Unterstützung erkannt",
+  "An AMD integrated GPU (APU) has been detected": "Eine integrierte AMD-GPU (APU) wurde erkannt",
+  "An Intel dedicated GPU has been detected without FLR support": "Es wurde eine dedizierte Intel-GPU ohne FLR-Unterstützung erkannt",
+  "An fstab entry already exists for:": "Es existiert bereits ein fstab-Eintrag für:",
+  "Analysis Tools": "Analysetools",
+  "Analyze Bridge Configuration": "Analysieren Sie die Bridge-Konfiguration",
+  "Analyze Network Configuration": "Analysieren Sie die Netzwerkkonfiguration",
+  "Analyzing Bridge Configuration - READ ONLY MODE": "Analysieren der Bridge-Konfiguration – schreibgeschützter Modus",
+  "Analyzing Network Configuration - READ ONLY MODE": "Analysieren der Netzwerkkonfiguration – schreibgeschützter Modus",
+  "Analyzing selected disks...": "Ausgewählte Festplatten werden analysiert...",
+  "Analyzing system for available PCIe storage devices...": "Analysesystem für verfügbare PCIe-Speichergeräte...",
+  "Apply": "Anwenden",
+  "Apply AMD CPU fixes": "AMD-CPU-Korrekturen anwenden",
+  "Apply Available Updates": "Verfügbare Updates anwenden",
+  "Apply and restart services:": "Dienste anwenden und neu starten:",
+  "Apply available updates": "Verfügbare Updates anwenden",
+  "Apply boot/initramfs changes": "Übernehmen Sie Boot-/Initramfs-Änderungen",
+  "Apply fix now?": "Fix jetzt anwenden?",
+  "Apply fix now? (The share will be briefly remounted)": "Fix jetzt anwenden? (Die Freigabe wird kurzzeitig wieder gemountet)",
+  "Apply network optimizations": "Netzwerkoptimierungen anwenden",
+  "Apply read+write access for 'others' on the host directory?": "Lese- und Schreibzugriff für „Andere“ auf das Hostverzeichnis anwenden?",
+  "Applying AMD-specific fixes...": "Anwenden von AMD-spezifischen Korrekturen...",
+  "Applying Changes": "Anwenden von Änderungen",
+  "Applying Controller/NVMe passthrough to VM": "Anwenden von Controller/NVMe-Passthrough auf die VM",
+  "Applying balanced memory optimization settings...": "Ausgewogene Einstellungen zur Speicheroptimierung werden angewendet...",
+  "Applying changes safely...": "Änderungen sicher anwenden...",
+  "Applying custom restore": "Benutzerdefinierte Wiederherstellung anwenden",
+  "Applying default VM configuration": "Anwenden der Standard-VM-Konfiguration",
+  "Applying host permissions for unprivileged LXC bind-mounts...": "Anwenden von Hostberechtigungen für nicht privilegierte LXC-Bind-Mounts ...",
+  "Applying optimized logrotate configuration...": "Anwenden der optimierten Logrotate-Konfiguration...",
+  "Applying passthrough to CT": "Anwenden von Passthrough auf CT",
+  "Applying safe paths and preparing pending restore": "Anwenden sicherer Pfade und Vorbereiten der ausstehenden Wiederherstellung",
+  "Applying selected LXC switch action": "Anwenden der ausgewählten LXC-Schalteraktion",
+  "Archive deleted.": "Archiv gelöscht.",
+  "Archive extracted.": "Archiv extrahiert.",
+  "Archive format": "Archivformat",
+  "Archive ready": "Archiv bereit",
+  "Archive size:": "Archivgröße:",
+  "Archive:": "Archiv:",
+  "Are you absolutely sure?": "Bist du absolut sicher?",
+  "Are you sure you want to continue?": "Sind Sie sicher, dass Sie fortfahren möchten?",
+  "Are you sure you want to delete this export?": "Möchten Sie diesen Export wirklich löschen?",
+  "Are you sure you want to delete this share?": "Sind Sie sicher, dass Sie diese Freigabe löschen möchten?",
+  "Are you sure you want to remove these configurations?": "Möchten Sie diese Konfigurationen wirklich entfernen?",
+  "Are you sure you want to restore this backup?\nCurrent configuration will be overwritten.": "Sind Sie sicher, dass Sie dieses Backup wiederherstellen möchten?\nDie aktuelle Konfiguration wird überschrieben.",
+  "Are you sure you want to uninstall ProxMenux?": "Sind Sie sicher, dass Sie ProxMenux deinstallieren möchten?",
+  "Are you sure you want to uninstall the selected optimizations.": "Sind Sie sicher, dass Sie die ausgewählten Optimierungen deinstallieren möchten?",
+  "Are you sure you want to unmount this NFS share?": "Sind Sie sicher, dass Sie die Bereitstellung dieser NFS-Freigabe aufheben möchten?",
+  "Are you sure you want to unmount this Samba share?": "Sind Sie sicher, dass Sie die Bereitstellung dieser Samba-Freigabe aufheben möchten?",
+  "Are you sure?": "Bist du sicher?",
+  "As Proxmox storage": "Als Proxmox-Speicher",
+  "As host fstab mount only": "Nur als Host-fstab-Mount",
+  "Assign GPU PCI function to VM": "Weisen Sie der VM die GPU-PCI-Funktion zu",
+  "Assign controller/NVMe passthrough": "Weisen Sie Controller/NVMe-Passthrough zu",
+  "Assigned to VM": "Der VM zugewiesen",
+  "Assigned to VM(s)": "Zugeordnet zu VM(s)",
+  "Assigning imported disk to VM using the generated command": "Zuweisen der importierten Festplatte zur VM mithilfe des generierten Befehls",
+  "Associated Audio Devices": "Zugehörige Audiogeräte",
+  "Associated audio removed from VM": "Zugehöriges Audio von der VM entfernt",
+  "At least 5GB free space on root filesystem": "Mindestens 5 GB freier Speicherplatz im Root-Dateisystem",
+  "At least one selected GPU is blocked by policy for GPU -> VM mode due to passthrough instability risk.": "Mindestens eine ausgewählte GPU wird aufgrund des Passthrough-Instabilitätsrisikos durch die Richtlinie für den GPU->VM-Modus blockiert.",
+  "Attach imported disk to VM": "Hängen Sie die importierte Festplatte an die VM an",
+  "Attach to an existing PVE vzdump job (inherit schedule + retention)": "An einen vorhandenen PVE-vzdump-Job anhängen (Zeitplan + Aufbewahrung erben)",
+  "Attached to PVE job:": "An PVE-Job angehängt:",
+  "Attempting automatic repair...": "Versuch einer automatischen Reparatur...",
+  "Attempting passthrough with this GPU typically results in": "Ein Passthrough-Versuch mit dieser GPU führt normalerweise zu:",
+  "Attention: Removing the subscription banner may cause issues in the web interface after a future update.": "Achtung: Das Entfernen des Abonnementbanners kann nach einem zukünftigen Update zu Problemen in der Weboberfläche führen.",
+  "Audit completed. Press Enter to continue...": "Prüfung abgeschlossen. Drücken Sie die Eingabetaste, um fortzufahren...",
+  "Auth key is required.": "Authentifizierungsschlüssel ist erforderlich.",
+  "Auth:": "Authentifizierung:",
+  "Authentication": "Authentifizierung",
+  "Authentication Error": "Authentifizierungsfehler",
+  "Authentication failed.": "Die Authentifizierung ist fehlgeschlagen.",
+  "Authentication required:": "Authentifizierung erforderlich:",
+  "Authentication:": "Authentifizierung:",
+  "Authorization failed": "Die Autorisierung ist fehlgeschlagen",
+  "Authorization successful": "Autorisierung erfolgreich",
+  "Authorize this key on the server": "Autorisieren Sie diesen Schlüssel auf dem Server",
+  "Authorize via 'pct exec' (Borg server is an LXC on a PVE host I can SSH into)": "Autorisieren über „pct exec“ (Borg-Server ist ein LXC auf einem PVE-Host, in den ich SSH einbinden kann)",
+  "Authorized": "Autorisiert",
+  "Auto-detected firewall backend (nftables/iptables)": "Automatisch erkanntes Firewall-Backend (nftables/iptables)",
+  "Auto-discover servers on network": "Automatische Erkennung von Servern im Netzwerk",
+  "Auto-negotiate:": "Automatische Aushandlung:",
+  "Auto-start was skipped because GPU passthrough setup was requested.": "Der automatische Start wurde übersprungen, da die GPU-Passthrough-Einrichtung angefordert wurde.",
+  "Auto-sync enabled when /var/log exceeds 80% of": "Automatische Synchronisierung aktiviert, wenn /var/log 80 % überschreitet",
+  "Auto-sync was not enabled": "Die automatische Synchronisierung war nicht aktiviert",
+  "Automated Post-Install Script": "Automatisiertes Post-Install-Skript",
+  "Automated post-installation script": "Automatisiertes Nachinstallationsskript",
+  "Automatic/Unattended": "Automatisch/unbeaufsichtigt",
+  "Available": "Verfügbar",
+  "Available Borg archives (newest first):": "Verfügbare Borg-Archive (neueste zuerst):",
+  "Available Borg targets:": "Verfügbare Borg-Ziele:",
+  "Available Disks on Host": "Verfügbare Festplatten auf dem Host",
+  "Available ISO Images": "Verfügbare ISO-Images",
+  "Available PBS repositories:": "Verfügbare PBS-Repositories:",
+  "Available PVE Version": "Verfügbare PVE-Version",
+  "Available Shares:": "Verfügbare Aktien:",
+  "Available action": "Verfügbare Aktion",
+  "Available archives:": "Verfügbare Archive:",
+  "Available disks detected.": "Verfügbare Festplatten erkannt.",
+  "Available host backups:": "Verfügbare Host-Backups:",
+  "Available images in /var/lib/vz/images/:": "Verfügbare Bilder in /var/lib/vz/images/:",
+  "Available network interfaces:": "Verfügbare Netzwerkschnittstellen:",
+  "Available output formats include:": "Zu den verfügbaren Ausgabeformaten gehören:",
+  "Available physical disks for passthrough:": "Verfügbare physische Festplatten für Passthrough:",
+  "Available shares for guest access:": "Verfügbare Freigaben für Gastzugang:",
+  "Available space in /mnt:": "Verfügbarer Speicherplatz in /mnt:",
+  "Available storage information:": "Verfügbare Speicherinformationen:",
+  "Available storage volumes:": "Verfügbare Speichervolumina:",
+  "BIOS TYPE": "BIOS-TYP",
+  "BIOS Type": "BIOS-Typ",
+  "BIOS from": "BIOS von",
+  "BIOS: OVMF (UEFI)": "BIOS: OVMF (UEFI)",
+  "BRIDGE CONFIGURATION ANALYSIS": "BRÜCKENKONFIGURATIONSANALYSE",
+  "BTRFS:": "BTRFS:",
+  "Back to previous menu or Esc + Enter": "Zurück zum vorherigen Menü oder Esc + Enter",
+  "Backed up and cleared": "Gesichert und gelöscht",
+  "Backend": "Backend",
+  "Backend:": "Backend:",
+  "Backup            — VM and CT backups": "Backup – VM- und CT-Backups",
+  "Backup Created": "Backup erstellt",
+  "Backup ID (group name in PBS):": "Backup-ID (Gruppenname in PBS):",
+  "Backup ID for this job:": "Backup-ID für diesen Job:",
+  "Backup ID:": "Backup-ID:",
+  "Backup Preview": "Backup-Vorschau",
+  "Backup Recommendation": "Backup-Empfehlung",
+  "Backup Restored": "Sicherung wiederhergestellt",
+  "Backup all VMs and CTs": "Sichern Sie alle VMs und CTs",
+  "Backup and Restore Commands": "Befehle zum Sichern und Wiederherstellen",
+  "Backup available at": "Backup verfügbar unter",
+  "Backup completed successfully.": "Sicherung erfolgreich abgeschlossen.",
+  "Backup completed:": "Sicherung abgeschlossen:",
+  "Backup created:": "Backup erstellt:",
+  "Backup declares unused NICs that are not on this host:": "Backup deklariert nicht verwendete Netzwerkkarten, die sich nicht auf diesem Host befinden:",
+  "Backup destination is inside the backup": "Das Backup-Ziel liegt innerhalb des Backups",
+  "Backup failed. See log:": "Sicherung fehlgeschlagen.Siehe Protokoll:",
+  "Backup file appears corrupted, will reinstall packages": "Die Sicherungsdatei scheint beschädigt zu sein, die Pakete werden neu installiert",
+  "Backup host configuration": "Backup-Hostkonfiguration",
+  "Backup includes /etc/zfs/zpool.cache. Restore it (same host detected)?": "Die Sicherung umfasst /etc/zfs/zpool.cache. Wiederherstellen (gleicher Host erkannt)?",
+  "Backup information": "Backup-Informationen",
+  "Backup location": "Backup-Speicherort",
+  "Backup metadata": "Metadaten sichern",
+  "Backup of original MOTD created": "Backup des ursprünglichen MOTD erstellt",
+  "Backup on newer kernel:": "Backup auf neuerem Kernel:",
+  "Backup on older kernel:": "Backup auf älterem Kernel:",
+  "Backup origin metadata:": "Metadaten des Backup-Ursprungs:",
+  "Backup path:": "Sicherungspfad:",
+  "Backup pools not present on this host:": "Auf diesem Host sind keine Sicherungspools vorhanden:",
+  "Backup saved to:": "Backup gespeichert unter:",
+  "Backup scheduler and retention": "Backup-Planer und Aufbewahrung",
+  "Backup to Borg repository": "Sicherung im Borg-Repository",
+  "Backup to Proxmox Backup Server (PBS)": "Backup auf Proxmox Backup Server (PBS)",
+  "Backup to a specific directory": "Backup in ein bestimmtes Verzeichnis",
+  "Backup to local archive  (.tar.zst)": "Sicherung im lokalen Archiv (.tar.zst)",
+  "Backup:": "Sicherung:",
+  "Backups already on PBS were encrypted with the current key — downloading them will fail unless you first Download the current keyfile to keep a copy.": "Backups, die sich bereits auf PBS befinden, wurden mit dem aktuellen Schlüssel verschlüsselt – der Download schlägt fehl, es sei denn, Sie laden zuerst die aktuelle Schlüsseldatei herunter, um eine Kopie zu behalten.",
+  "Backups already stored on PBS were encrypted with the current keyfile. After this action:": "Bereits auf PBS gespeicherte Backups wurden mit der aktuellen Schlüsseldatei verschlüsselt.Nach dieser Aktion:",
+  "Bandwidth limit configured": "Bandbreitenbegrenzung konfiguriert",
+  "Bandwidth test (iperf3)": "Bandbreitentest (iperf3)",
+  "Bandwidth test completed successfully": "Bandbreitentest erfolgreich abgeschlossen",
+  "Base VM created with ID": "Basis-VM mit ID erstellt",
+  "Bashrc customization completed": "Bashrc-Anpassung abgeschlossen",
+  "Basic Settings": "Grundeinstellungen",
+  "Basic Utilities": "Grundlegende Dienstprogramme",
+  "Before making any changes, we'll create a safety backup.": "Bevor wir Änderungen vornehmen, erstellen wir ein Sicherheitsbackup.",
+  "Beta (develop branch)": "Beta (Entwicklungszweig)",
+  "Beta version:": "Betaversion:",
+  "Binary not found in extracted content.": "Binärdatei im extrahierten Inhalt nicht gefunden.",
+  "Bind mount added:": "Bind-Reittier hinzugefügt:",
+  "Blacklist nouveau driver": "Nouveau-Treiber auf die schwarze Liste setzen",
+  "Blacklisting GPU host drivers...": "GPU-Hosttreiber werden auf die schwarze Liste gesetzt...",
+  "Blacklisting nouveau driver...": "Nouveau-Treiber wird auf die schwarze Liste gesetzt...",
+  "Blocked GPU ID": "Blockierte GPU-ID",
+  "Blocked GPU ID for VM Mode": "Blockierte GPU-ID für den VM-Modus",
+  "Blocked device(s)": "Blockierte(s) Gerät(e)",
+  "Blocked device(s):": "Blockierte(s) Gerät(e):",
+  "Boot Disk": "Bootdiskette",
+  "Boot artifacts regenerated — reboot the host to activate the merged config.": "Boot-Artefakte neu generiert – Starten Sie den Host neu, um die zusammengeführte Konfiguration zu aktivieren.",
+  "Boot disk:": "Bootdiskette:",
+  "Boot order set to": "Boot-Reihenfolge eingestellt auf",
+  "Boot partition UUIDs from backup not found on this host:": "Boot-Partitions-UUIDs aus dem Backup wurden auf diesem Host nicht gefunden:",
+  "Boot type (grub/zfs):": "Boot-Typ (grub/zfs):",
+  "Borg backup error log": "Borg-Backup-Fehlerprotokoll",
+  "Borg backup failed.": "Borg-Backup ist fehlgeschlagen.",
+  "Borg binary checksum verification failed.": "Die Überprüfung der binären Borg-Prüfsumme ist fehlgeschlagen.",
+  "Borg encryption": "Borg-Verschlüsselung",
+  "Borg extraction failed.": "Die Extraktion der Borg ist fehlgeschlagen.",
+  "Borg not found. Downloading borg": "Borg nicht gefunden. Borg wird heruntergeladen",
+  "Borg passphrase:": "Borg-Passphrase:",
+  "Borg ready.": "Borg bereit.",
+  "Borg repositories": "Borg-Repositorys",
+  "Borg repository location": "Standort des Borg-Endlagers",
+  "Borg repository passphrase": "Borg-Repository-Passphrase",
+  "Borg repository path:": "Pfad zum Borg-Repository:",
+  "Borg restore error log": "Fehlerprotokoll der Borg-Wiederherstellung",
+  "Borg server SSH user": "SSH-Benutzer des Borg-Servers",
+  "Bridge": "Brücke",
+  "Bridge Analysis": "Brückenanalyse",
+  "Bridge Configuration Analysis": "Analyse der Brückenkonfiguration",
+  "Bridge:": "Brücke:",
+  "Bridges analyzed": "Brücken analysiert",
+  "Broken gasket-dkms package state recovered.": "Der Status des defekten „gasket-dkms“-Pakets wurde wiederhergestellt.",
+  "Browse manually (advanced)...": "Manuell durchsuchen (erweitert)...",
+  "Build and install the gasket and apex kernel modules (DKMS)": "Erstellen und installieren Sie die Dichtungs- und Apex-Kernel-Module (DKMS).",
+  "Build dependencies installed.": "Build-Abhängigkeiten installiert.",
+  "CHANGES APPLIED SUCCESSFULLY": "ÄNDERUNGEN WURDEN ERFOLGREICH ANGEWENDET",
+  "CIFS Client Tools: AVAILABLE": "CIFS-Client-Tools: VERFÜGBAR",
+  "CIFS Client Tools: NOT AVAILABLE - installing...": "CIFS-Client-Tools: NICHT VERFÜGBAR – Installation...",
+  "CIFS Client: INSTALLED": "CIFS-Client: INSTALLIERT",
+  "CIFS Client: NOT INSTALLED": "CIFS-Client: NICHT INSTALLIERT",
+  "CIFS Mount Not Found": "CIFS-Mount nicht gefunden",
+  "CIFS Mounts on Host": "CIFS wird auf dem Host bereitgestellt",
+  "CIFS Proxmox storages (pvesm):": "CIFS Proxmox-Speicher (pvesm):",
+  "CIFS can cause file locking issues with VM disk operations.": "CIFS kann bei VM-Festplattenvorgängen zu Dateisperrproblemen führen.",
+  "CIFS client tools installed.": "CIFS-Client-Tools installiert.",
+  "CIFS share mounted at:": "CIFS-Freigabe gemountet unter:",
+  "CIFS share remounted — LXC containers can now read and write": "CIFS-Freigabe erneut bereitgestellt – LXC-Container können jetzt lesen und schreiben",
+  "CIFS storage added successfully to Proxmox!": "CIFS-Speicher erfolgreich zu Proxmox hinzugefügt!",
+  "CLEANUP COMPLETED SUCCESSFULLY": "REINIGUNG ERFOLGREICH ABGESCHLOSSEN",
+  "CLUSTER UPGRADE NOTES:": "HINWEISE ZUM CLUSTER-UPGRADE:",
+  "CONFIGURED INTERFACES": "Konfigurierte Schnittstellen",
+  "CONFIRM FORMAT": "BESTÄTIGEN SIE DAS FORMAT",
+  "CPU Cores": "CPU-Kerne",
+  "CPU MODEL": "CPU-MODELL",
+  "CPU Model": "CPU-Modell",
+  "CPU set to host,hidden=1,flags=+pcid": "CPU auf Host,hidden=1,flags=+pcid eingestellt",
+  "CPU vendor (intel/amd):": "CPU-Anbieter (Intel/AMD):",
+  "CRITICAL: The selected disk is referenced by a RUNNING VM or CT.": "KRITISCH: Die ausgewählte Festplatte wird von einer LAUFENDEN VM oder CT referenziert.",
+  "CT": "CT",
+  "CT started successfully.": "CT erfolgreich gestartet.",
+  "Cancel": "Stornieren",
+  "Cancel restore": "Wiederherstellung abbrechen",
+  "Cancel this setup": "Brechen Sie diese Einrichtung ab",
+  "Cancelled by user or empty URL.": "Abgebrochen durch Benutzer oder leere URL.",
+  "Cancelled by user.": "Vom Benutzer abgebrochen.",
+  "Cannot connect to server": "Es kann keine Verbindung zum Server hergestellt werden",
+  "Cannot continue": "Kann nicht fortgesetzt werden",
+  "Cannot create:": "Kann nicht erstellt werden:",
+  "Cannot detect filesystem on": "Dateisystem kann nicht erkannt werden",
+  "Cannot find": "Kann nicht gefunden werden",
+  "Cannot load backup library: lib_host_backup_common.sh": "Sicherungsbibliothek kann nicht geladen werden: lib_host_backup_common.sh",
+  "Cannot proceed with invalid export path.": "Mit ungültigem Exportpfad kann nicht fortgefahren werden.",
+  "Cannot proceed with invalid share name.": "Mit ungültigem Freigabenamen kann nicht fortgefahren werden.",
+  "Cannot reach Proxmox repositories": "Proxmox-Repositorys können nicht erreicht werden",
+  "Cannot reach portal:": "Portal kann nicht erreicht werden:",
+  "Cannot reach server": "Server ist nicht erreichbar",
+  "Cannot validate credentials - no shares available for testing.": "Anmeldeinformationen können nicht validiert werden – keine Freigaben zum Testen verfügbar.",
+  "Category": "Kategorie",
+  "Caution: Maximum mode generates more heat.": "Achtung: Im Maximalmodus entsteht mehr Wärme.",
+  "Ceph check skipped by user flag (--ignore-ceph-check)": "Ceph-Prüfung durch Benutzerflag übersprungen (--ignore-ceph-check)",
+  "Ceph components": "Ceph-Komponenten",
+  "Ceph detected as hyper-converged on this node. Checking version (require 19.x Squid)...": "Ceph wurde auf diesem Knoten als hyperkonvergent erkannt. Version wird überprüft (erfordert 19.x Squid) ...",
+  "Ceph enterprise repository present": "Ceph-Enterprise-Repository vorhanden",
+  "Ceph installation check completed": "Ceph-Installationsprüfung abgeschlossen",
+  "Ceph installation completed successfully": "Die Ceph-Installation wurde erfolgreich abgeschlossen",
+  "Ceph installation could not be verified": "Die Ceph-Installation konnte nicht überprüft werden",
+  "Ceph installation process completed": "Ceph-Installationsprozess abgeschlossen",
+  "Ceph installation process finished with warnings": "Der Ceph-Installationsprozess wurde mit Warnungen abgeschlossen",
+  "Ceph installed but integration may need configuration": "Ceph ist installiert, aber die Integration muss möglicherweise konfiguriert werden",
+  "Ceph integration with PVE 9 verified": "Ceph-Integration mit PVE 9 verifiziert",
+  "Ceph is already installed": "Ceph ist bereits installiert",
+  "Ceph is not 19.x (Squid). Proceeding due to --warn-ceph-check. Detected:": "Ceph ist nicht 19.x (Squid). Fortsetzung wegen --warn-ceph-check. Erkannt:",
+  "Ceph is not 19.x (Squid). Upgrade Ceph first. Detected:": "Ceph ist nicht 19.x (Squid). Aktualisieren Sie zuerst Ceph. Erkannt:",
+  "Ceph no-subscription repository present": "Ceph-Repository ohne Abonnement vorhanden",
+  "Ceph packages and repository removed": "Ceph-Pakete und Repository entfernt",
+  "Ceph packages are available": "Ceph-Pakete sind verfügbar",
+  "Ceph packages installed and verified successfully": "Ceph-Pakete wurden erfolgreich installiert und überprüft",
+  "Ceph packages installed but service verification failed": "Ceph-Pakete wurden installiert, aber die Dienstüberprüfung ist fehlgeschlagen",
+  "Ceph packages may not be available, but continuing installation...": "Ceph-Pakete sind möglicherweise nicht verfügbar, aber die Installation wird fortgesetzt ...",
+  "Ceph repository configured for PVE 8": "Ceph-Repository für PVE 8 konfiguriert",
+  "Ceph repository configured for PVE 9": "Ceph-Repository für PVE 9 konfiguriert",
+  "Ceph version OK:": "Ceph-Version OK:",
+  "Change Language": "Sprache ändern",
+  "Change Release Channel": "Veröffentlichungskanal ändern",
+  "Changes applied. A system reboot is recommended for them to take full effect.": "Änderungen übernommen. Damit sie ihre volle Wirkung entfalten, wird ein Neustart des Systems empfohlen.",
+  "Changes detected. Updating ZFS ARC configuration...": "Änderungen erkannt. ZFS ARC-Konfiguration wird aktualisiert...",
+  "Changes have been applied to the configuration file.": "Es wurden Änderungen an der Konfigurationsdatei vorgenommen.",
+  "Changes will apply after reboot.": "Änderungen werden nach dem Neustart wirksam.",
+  "Changing Release Channel": "Veröffentlichungskanal ändern",
+  "Changing the machine type on an existing installed VM is not safe: it changes the chipset and PCI slot layout, which typically prevents the guest OS from booting.": "Das Ändern des Maschinentyps auf einer vorhandenen installierten VM ist nicht sicher: Es ändert den Chipsatz und das PCI-Steckplatz-Layout, was normalerweise dazu führt, dass das Gastbetriebssystem nicht startet.",
+  "Check": "Überprüfen",
+  "Check BIOS/UEFI in Hardware > BIOS — must match what the original VM used": "Überprüfen Sie BIOS/UEFI unter Hardware > BIOS – es muss mit dem übereinstimmen, was die ursprüngliche VM verwendet hat",
+  "Check Coral USB/M.2 detection": "Überprüfen Sie die Coral USB/M.2-Erkennung",
+  "Check LXC GPU/TPU mapping": "Überprüfen Sie die LXC-GPU/TPU-Zuordnung",
+  "Check NFS Status": "Überprüfen Sie den NFS-Status",
+  "Check NVIDIA driver and devices": "Überprüfen Sie NVIDIA-Treiber und -Geräte",
+  "Check Proxmox Web UI status": "Überprüfen Sie den Status der Proxmox-Web-Benutzeroberfläche",
+  "Check Proxmox firewall status": "Überprüfen Sie den Proxmox-Firewall-Status",
+  "Check Samba Status": "Überprüfen Sie den Samba-Status",
+  "Check VM disk/PCI slots": "Überprüfen Sie die VM-Festplatten-/PCI-Steckplätze",
+  "Check VM passthrough settings": "Überprüfen Sie die VM-Passthrough-Einstellungen",
+  "Check connectivity with another host": "Überprüfen Sie die Konnektivität mit einem anderen Host",
+  "Check container mount points": "Überprüfen Sie die Container-Mount-Punkte",
+  "Check if container is unprivileged:": "Überprüfen Sie, ob der Container nicht privilegiert ist:",
+  "Check kernel params (IOMMU flags)": "Überprüfen Sie die Kernel-Parameter (IOMMU-Flags).",
+  "Check loaded GPU/TPU modules": "Überprüfen Sie die geladenen GPU/TPU-Module",
+  "Check log:": "Protokoll prüfen:",
+  "Check resulting config:": "Überprüfen Sie die resultierende Konfiguration:",
+  "Check script not found": "Prüfskript nicht gefunden",
+  "Check test progress   — show active or last test result": "Überprüfen Sie den Testfortschritt – zeigen Sie das aktive oder letzte Testergebnis an",
+  "Check that:": "Überprüfen Sie Folgendes:",
+  "Check the error messages above for details.": "Weitere Informationen finden Sie in den obigen Fehlermeldungen.",
+  "Check the service status manually if needed.": "Überprüfen Sie den Servicestatus bei Bedarf manuell.",
+  "Checking MOTD configuration...": "MOTD-Konfiguration wird überprüft...",
+  "Checking NVIDIA driver status with nvidia-smi": "Überprüfen des NVIDIA-Treiberstatus mit nvidia-smi",
+  "Checking VFIO modules...": "VFIO-Module werden überprüft...",
+  "Checking VM virtual display model...": "Virtuelles Anzeigemodell der VM wird überprüft...",
+  "Checking ZFS autotrim configuration...": "ZFS-Autotrim-Konfiguration wird überprüft...",
+  "Checking and repairing old LVM PV headers (if needed)...": "Überprüfung und Reparatur alter LVM-PV-Header (falls erforderlich) ...",
+  "Checking conflicting drivers blacklist...": "Blacklist mit in Konflikt stehenden Treibern wird überprüft...",
+  "Checking existing ZFS ARC configuration...": "Überprüfen der vorhandenen ZFS ARC-Konfiguration ...",
+  "Checking for updates...": "Suche nach Updates...",
+  "Checking free space in /var/cache/apt/archives...": "Überprüfen Sie den freien Speicherplatz in /var/cache/apt/archives...",
+  "Checking if system disk is SSD or M.2...": "Überprüfen, ob es sich bei der Systemfestplatte um eine SSD oder M.2 handelt ...",
+  "Checking if the server belongs to OVH...": "Es wird geprüft, ob der Server zu OVH gehört...",
+  "Checking kernel headers and build tools...": "Kernel-Header und Build-Tools werden überprüft...",
+  "Checking remaining interfaces": "Überprüfung der verbleibenden Schnittstellen",
+  "Checklist post-upgrade finished. Warnings:": "Checkliste nach dem Upgrade abgeschlossen. Warnungen:",
+  "Checklist pre-check finished. Warnings:": "Checklisten-Vorprüfung abgeschlossen. Warnungen:",
+  "Checks for LVM and storage issues": "Prüft auf LVM- und Speicherprobleme",
+  "Choose BIOS type": "Wählen Sie den BIOS-Typ",
+  "Choose No to abort and roll back to the legacy refuse behaviour.": "Wählen Sie „Nein“, um den Vorgang abzubrechen und zum alten Ablehnungsverhalten zurückzukehren.",
+  "Choose ZimaOS image option:": "Wählen Sie die ZimaOS-Bildoption:",
+  "Choose a Samba server:": "Wählen Sie einen Samba-Server:",
+  "Choose a Windows ISO to use:": "Wählen Sie ein zu verwendendes Windows-ISO aus:",
+  "Choose a ZimaOS image:": "Wählen Sie ein ZimaOS-Image:",
+  "Choose a custom image:": "Wählen Sie ein benutzerdefiniertes Bild:",
+  "Choose a custom logo:": "Wählen Sie ein benutzerdefiniertes Logo:",
+  "Choose a destination directory OUTSIDE of": "Wählen Sie ein Zielverzeichnis AUSSERHALB von",
+  "Choose a different path or unmount it first.": "Wählen Sie einen anderen Pfad oder heben Sie die Bereitstellung zunächst auf.",
+  "Choose a folder to export:": "Wählen Sie einen Ordner zum Exportieren:",
+  "Choose a folder to mount the export:": "Wählen Sie einen Ordner zum Mounten des Exports:",
+  "Choose a folder to mount the share:": "Wählen Sie einen Ordner zum Mounten der Freigabe:",
+  "Choose a folder to mount:": "Wählen Sie einen Ordner zum Mounten:",
+  "Choose a folder to share:": "Wählen Sie einen Ordner zum Teilen aus:",
+  "Choose a group policy for this shared directory:": "Wählen Sie eine Gruppenrichtlinie für dieses freigegebene Verzeichnis:",
+  "Choose a loader for Synology DSM:": "Wählen Sie einen Loader für Synology DSM:",
+  "Choose a logo for Fastfetch:": "Wählen Sie ein Logo für Fastfetch:",
+  "Choose a recent server:": "Wählen Sie einen aktuellen Server:",
+  "Choose a recovery passphrase (write it down somewhere safe):": "Wählen Sie eine Wiederherstellungspassphrase (notieren Sie sie an einem sicheren Ort):",
+  "Choose a script to execute:": "Wählen Sie ein auszuführendes Skript aus:",
+  "Choose a server:": "Wählen Sie einen Server:",
+  "Choose a share to mount:": "Wählen Sie eine Freigabe zum Mounten aus:",
+  "Choose action for this controller/NVMe:": "Wählen Sie eine Aktion für diesen Controller/NVMe:",
+  "Choose action:": "Aktion auswählen:",
+  "Choose an NFS server:": "Wählen Sie einen NFS-Server:",
+  "Choose an action:": "Wählen Sie eine Aktion:",
+  "Choose an export to mount:": "Wählen Sie einen Export zum Mounten aus:",
+  "Choose an option:": "Wählen Sie eine Option:",
+  "Choose any host path you want to share with CTs.": "Wählen Sie einen beliebigen Hostpfad, den Sie mit CTs teilen möchten.",
+  "Choose conflict policy": "Wählen Sie eine Konfliktrichtlinie",
+  "Choose conflict policy for the source VM:": "Wählen Sie eine Konfliktrichtlinie für die Quell-VM:",
+  "Choose conflict policy:": "Wählen Sie eine Konfliktrichtlinie:",
+  "Choose filesystem for the disk:": "Wählen Sie das Dateisystem für die Festplatte:",
+  "Choose how this host backup will be triggered:": "Wählen Sie aus, wie dieses Host-Backup ausgelöst werden soll:",
+  "Choose how to continue:": "Wählen Sie, wie Sie fortfahren möchten:",
+  "Choose how to handle affected LXC containers before switching to VM mode.": "Wählen Sie aus, wie mit betroffenen LXC-Containern umgegangen werden soll, bevor Sie in den VM-Modus wechseln.",
+  "Choose how to make the disk available on this host. Mark one or both options:": "Wählen Sie aus, wie die Festplatte auf diesem Host verfügbar gemacht werden soll. Markieren Sie eine oder beide Optionen:",
+  "Choose how to mount the NFS share on this host. Mark one or both options:": "Wählen Sie aus, wie die NFS-Freigabe auf diesem Host bereitgestellt werden soll. Markieren Sie eine oder beide Optionen:",
+  "Choose how to mount the Samba share on this host. Mark one or both options:": "Wählen Sie aus, wie die Samba-Freigabe auf diesem Host bereitgestellt werden soll. Markieren Sie eine oder beide Optionen:",
+  "Choose how to perform the upgrade:": "Wählen Sie aus, wie das Upgrade durchgeführt werden soll:",
+  "Choose how to run the script:": "Wählen Sie aus, wie das Skript ausgeführt werden soll:",
+  "Choose iperf3 mode:": "Wählen Sie den iperf3-Modus:",
+  "Choose options to configure:": "Wählen Sie die zu konfigurierenden Optionen aus:",
+  "Choose the driver version for Coral M.2:": "Wählen Sie die Treiberversion für Coral M.2:",
+  "Choose the filesystem for the new partition:": "Wählen Sie das Dateisystem für die neue Partition:",
+  "Choose the release channel to use:": "Wählen Sie den zu verwendenden Veröffentlichungskanal:",
+  "Choose the storage volume for the EFI disk (4MB):\n\nUse Spacebar to select.": "Wählen Sie das Speichervolumen für die EFI-Festplatte (4 MB):\n\nVerwenden Sie zum Auswählen die Leertaste.",
+  "Choose the storage volume for the virtual disk:": "Wählen Sie das Speichervolumen für die virtuelle Festplatte:",
+  "Choose the type of virtual system to install:": "Wählen Sie den Typ des zu installierenden virtuellen Systems:",
+  "Choose what to do with the selected disk:": "Wählen Sie, was mit der ausgewählten Festplatte geschehen soll:",
+  "Choose where to save the backup:": "Wählen Sie, wo das Backup gespeichert werden soll:",
+  "Clean disk metadata": "Bereinigen Sie die Festplattenmetadaten",
+  "Cleaned up": "Aufgeräumt",
+  "Cleaning cached files...": "Zwischengespeicherte Dateien bereinigen...",
+  "Cleaning disk metadata...": "Datenträgermetadaten werden bereinigt...",
+  "Cleaning previous Log2RAM installation...": "Bereinigen der vorherigen Log2RAM-Installation ...",
+  "Cleaning temporary files...": "Temporäre Dateien bereinigen...",
+  "Cleaning up Samba directories...": "Samba-Verzeichnisse bereinigen...",
+  "Cleaning up duplicate parameters...": "Doppelte Parameter bereinigen...",
+  "Cleaning up duplicate repositories...": "Bereinigen doppelter Repositorys...",
+  "Cleaning up remaining processes...": "Verbleibende Prozesse bereinigen...",
+  "Cleaning up unused time synchronization services...": "Bereinigen ungenutzter Zeitsynchronisierungsdienste...",
+  "Cleans duplicate or conflicting sources": "Bereinigt doppelte oder widersprüchliche Quellen",
+  "Cleanup Complete": "Bereinigung abgeschlossen",
+  "Cleanup finished": "Aufräumen abgeschlossen",
+  "Cleanup partial VM?": "Teilweise VM bereinigen?",
+  "Clear configured target": "Konfiguriertes Ziel löschen",
+  "Clear pool error state": "Pool-Fehlerstatus löschen",
+  "Cleared": "Gelöscht",
+  "Clearing login credentials...": "Anmeldedaten werden gelöscht...",
+  "Client (run a bandwidth test to a server)": "Client (führen Sie einen Bandbreitentest für einen Server durch)",
+  "Client determines best version to use": "Der Kunde bestimmt die beste zu verwendende Version",
+  "Cloning Coral driver repository (feranick fork)...": "Klonen des Coral-Treiber-Repositorys (Feranick-Fork) ...",
+  "Cloning Lynis from GitHub...": "Lynis von GitHub klonen...",
+  "Cloning and applying NVIDIA patch (keylase/nvidia-patch)...": "Klonen und Anwenden des NVIDIA-Patches (keylase/nvidia-patch) ...",
+  "Closed": "Geschlossen",
+  "Cloud-Init Automated Installers": "Automatisierte Cloud-Init-Installationsprogramme",
+  "Cluster certificates updated": "Clusterzertifikate aktualisiert",
+  "Cluster configuration (advanced)": "Clusterkonfiguration (erweitert)",
+  "Cluster data will be applied automatically at next boot.": "Clusterdaten werden beim nächsten Start automatisch angewendet.",
+  "Cluster upgrade mode": "Cluster-Upgrade-Modus",
+  "Command": "Befehl",
+  "Commenting any residual Bookworm lines in *.list...": "Kommentieren aller verbleibenden Bookworm-Zeilen in *.list...",
+  "Commenting legacy PVE 8 repository .list files (if any)...": "Kommentieren älterer PVE 8-Repository-.list-Dateien (falls vorhanden) ...",
+  "Commenting legacy ceph.list (if present)...": "Kommentieren der alten ceph.list (falls vorhanden) ...",
+  "Common Issues Check": "Überprüfen Sie häufige Probleme",
+  "Community Scripts": "Community-Skripte",
+  "Compatibility check": "Kompatibilitätsprüfung",
+  "Compatibility check — OK": "Kompatibilitätsprüfung – OK",
+  "Compatibility check — issues detected": "Kompatibilitätsprüfung – Probleme erkannt",
+  "Compatibility check — review warnings": "Kompatibilitätsprüfung – Warnungen überprüfen",
+  "Compatible with privileged and unprivileged LXC containers": "Kompatibel mit privilegierten und unprivilegierten LXC-Containern",
+  "Compatible with:": "Kompatibel mit:",
+  "Compile firewall rules for all nodes": "Erstellen Sie Firewall-Regeln für alle Knoten",
+  "Compiling Coral TPU drivers for current kernel...": "Kompilieren von Coral TPU-Treibern für den aktuellen Kernel ...",
+  "Complete": "Vollständig",
+  "Complete NVIDIA uninstallation finished.": "Vollständige NVIDIA-Deinstallation abgeschlossen.",
+  "Complete post-installation optimization finished!": "Komplette Nachinstallationsoptimierung abgeschlossen!",
+  "Complete restore": "Vollständige Wiederherstellung",
+  "Complete the DSM installation wizard": "Schließen Sie den DSM-Installationsassistenten ab",
+  "Complete the ZimaOS installation wizard": "Schließen Sie den ZimaOS-Installationsassistenten ab",
+  "Completed Successfully with GPU passthrough configured!": "Erfolgreich abgeschlossen mit konfiguriertem GPU-Passthrough!",
+  "Completed Successfully!": "Erfolgreich abgeschlossen!",
+  "Completed with errors —": "Mit Fehlern abgeschlossen –",
+  "Completed.": "Vollendet.",
+  "Completed. Press Enter to return to menu...": "Vollendet. Drücken Sie die Eingabetaste, um zum Menü zurückzukehren...",
+  "Compliance checking (PCI-DSS, HIPAA, etc.)": "Konformitätsprüfung (PCI-DSS, HIPAA usw.)",
+  "Component to uninstall manually (no --auto-uninstall yet):": "Komponente zum manuellen Deinstallieren (noch kein --auto-uninstall):",
+  "Component was installed on the backup source but no matching hardware was found on this host.": "Die Komponente wurde auf der Backup-Quelle installiert, aber auf diesem Host wurde keine passende Hardware gefunden.",
+  "Component:": "Komponente:",
+  "Components to uninstall (manual for now):": "Zu deinstallierende Komponenten (vorerst manuell):",
+  "Compressed size:": "Komprimierte Größe:",
+  "Compressing": "Komprimieren",
+  "Compression Tools": "Komprimierungswerkzeuge",
+  "Concise output of logical volumes": "Übersichtliche Ausgabe logischer Volumes",
+  "Concise output of physical volumes": "Übersichtliche Ausgabe physischer Datenträger",
+  "Concise output of volume groups": "Übersichtliche Ausgabe von Volumengruppen",
+  "Configuration Analysis": "Konfigurationsanalyse",
+  "Configuration Menu": "Konfigurationsmenü",
+  "Configuration Summary:": "Konfigurationszusammenfassung:",
+  "Configuration analysis": "Konfigurationsanalyse",
+  "Configuration backup created:": "Konfigurationssicherung erstellt:",
+  "Configuration can continue now and will be effective after reboot.": "Die Konfiguration kann jetzt fortgesetzt werden und wird nach dem Neustart wirksam.",
+  "Configuration completed successfully!": "Konfiguration erfolgreich abgeschlossen!",
+  "Configuration file for container": "Konfigurationsdatei für Container",
+  "Configuration has been stopped due to high reset risk.": "Die Konfiguration wurde aufgrund eines hohen Reset-Risikos gestoppt.",
+  "Configuration has been stopped to prevent an unusable VM state.": "Die Konfiguration wurde gestoppt, um einen unbrauchbaren VM-Status zu verhindern.",
+  "Configuration has been stopped to prevent leaving the VM in an unusable state.": "Die Konfiguration wurde gestoppt, um zu verhindern, dass die VM in einem unbrauchbaren Zustand verbleibt.",
+  "Configuration name:": "Konfigurationsname:",
+  "Configuration sections that will be REMOVED": "Konfigurationsabschnitte, die ENTFERNT werden",
+  "Configuration to be Removed": "Zu entfernende Konfiguration",
+  "Configuration will continue now and be effective after reboot.": "Die Konfiguration wird jetzt fortgesetzt und ist nach dem Neustart wirksam.",
+  "Configuration:": "Konfiguration:",
+  "Configure": "Konfigurieren",
+  "Configure GPU passthrough with VFIO": "Konfigurieren Sie GPU-Passthrough mit VFIO",
+  "Configure LXC Mount Points    (Host ↔ Container)": "LXC-Mount-Punkte konfigurieren (Host ↔ Container)",
+  "Configure LXC mount points": "Konfigurieren Sie LXC-Mount-Punkte",
+  "Configure Mount Point inside LXC": "Konfigurieren Sie den Mount Point in LXC",
+  "Configure NFS   Client in LXC (only privileged)": "NFS-Client in LXC konfigurieren (nur privilegiert)",
+  "Configure NFS   Server in LXC (only privileged)": "NFS-Server in LXC konfigurieren (nur privilegiert)",
+  "Configure Proxmox APT repositories": "Proxmox APT-Repositorys konfigurieren",
+  "Configure Samba Client in LXC (only privileged)": "Samba-Client in LXC konfigurieren (nur privilegiert)",
+  "Configure Samba Server in LXC (only privileged)": "Samba-Server in LXC konfigurieren (nur privilegiert)",
+  "Configure as guest (no authentication)": "Als Gast konfigurieren (keine Authentifizierung)",
+  "Configure backup destinations": "Konfigurieren Sie Sicherungsziele",
+  "Configure backup destinations (PBS, Borg, local)": "Backup-Ziele konfigurieren (PBS, Borg, lokal)",
+  "Configure the Google Coral APT repository": "Konfigurieren Sie das Google Coral APT-Repository",
+  "Configure with username and password": "Konfigurieren Sie mit Benutzername und Passwort",
+  "Configured Ports": "Konfigurierte Ports",
+  "Configured but doesn't exist": "Konfiguriert, aber nicht vorhanden",
+  "Configuring AMD GPU passthrough...": "AMD-GPU-Passthrough wird konfiguriert...",
+  "Configuring AMD softdep...": "Konfigurieren der AMD-Softdep...",
+  "Configuring APT to skip downloading additional languages": "APT so konfigurieren, dass das Herunterladen zusätzlicher Sprachen übersprungen wird",
+  "Configuring APT to skip downloading additional languages...": "APT so konfigurieren, dass das Herunterladen zusätzlicher Sprachen übersprungen wird ...",
+  "Configuring APT to use IPv4...": "APT für die Verwendung von IPv4 konfigurieren...",
+  "Configuring Ceph repository for PVE": "Ceph-Repository für PVE konfigurieren",
+  "Configuring Coral USB support...": "Coral USB-Unterstützung konfigurieren...",
+  "Configuring EFI disk": "Konfigurieren der EFI-Festplatte",
+  "Configuring I/O priority for vzdump...": "I/O-Priorität für vzdump konfigurieren...",
+  "Configuring Intel iGPU passthrough...": "Intel iGPU-Passthrough wird konfiguriert...",
+  "Configuring MOTD (Message of the Day) banner...": "Konfigurieren des MOTD-Banners (Message of the Day) ...",
+  "Configuring NVIDIA GPU passthrough...": "NVIDIA-GPU-Passthrough wird konfiguriert...",
+  "Configuring NVIDIA KVM hiding...": "Konfigurieren des NVIDIA KVM-Ausblendens...",
+  "Configuring NVIDIA and VFIO modules...": "Konfigurieren von NVIDIA- und VFIO-Modulen...",
+  "Configuring PAM limits...": "PAM-Grenzwerte konfigurieren...",
+  "Configuring ProxMenux Monitor filter...": "Konfigurieren des ProxMenux-Monitorfilters...",
+  "Configuring ProxMenux Monitor jail...": "Konfigurieren des ProxMenux Monitor-Jails...",
+  "Configuring Proxmox APT repositories...": "Proxmox APT-Repositorys konfigurieren ...",
+  "Configuring Proxmox filter...": "Proxmox-Filter konfigurieren...",
+  "Configuring Proxmox jail...": "Proxmox-Jail wird konfiguriert...",
+  "Configuring TCP optimizations...": "TCP-Optimierungen konfigurieren...",
+  "Configuring TPM device": "TPM-Gerät konfigurieren",
+  "Configuring VFIO modules...": "VFIO-Module konfigurieren...",
+  "Configuring VM": "VM konfigurieren",
+  "Configuring bandwidth limit for vzdump...": "Bandbreitenbegrenzung für vzdump konfigurieren...",
+  "Configuring boot order...": "Startreihenfolge konfigurieren...",
+  "Configuring disk as": "Festplatte konfigurieren als",
+  "Configuring global Fail2Ban settings and SSH jail...": "Konfigurieren der globalen Fail2Ban-Einstellungen und des SSH-Gefängnisses ...",
+  "Configuring host for GPU -> VM mode...": "Host für GPU -> VM-Modus konfigurieren ...",
+  "Configuring journald...": "Journald wird konfiguriert...",
+  "Configuring kernel max Key limit...": "Konfigurieren des maximalen Kernel-Schlüssellimits ...",
+  "Configuring kernel panic behavior": "Konfigurieren des Kernel-Panic-Verhaltens",
+  "Configuring kernel swappiness...": "Kernel-Austausch wird konfiguriert...",
+  "Configuring kexec for quick reboots...": "Kexec wird für schnelle Neustarts konfiguriert...",
+  "Configuring max FD limit / ulimit...": "Konfigurieren des maximalen FD-Limits/Ulimit...",
+  "Configuring max user watches...": "Maximale Benutzerüberwachungen werden konfiguriert...",
+  "Configuring pigz as a faster replacement for gzip...": "Pigz als schnelleren Ersatz für gzip konfigurieren ...",
+  "Configuring snapshot schedules...": "Snapshot-Zeitpläne konfigurieren...",
+  "Configuring system time settings...": "Konfigurieren der Systemzeiteinstellungen...",
+  "Configuring vfio-pci binding...": "vfio-pci-Bindung wird konfiguriert...",
+  "Confirm Borg passphrase": "Borg-Passphrase bestätigen",
+  "Confirm Borg passphrase:": "Bestätigen Sie die Borg-Passphrase:",
+  "Confirm Controller + NVMe Assignment": "Bestätigen Sie die Controller- und NVMe-Zuweisung",
+  "Confirm Deletion": "Bestätigen Sie den Löschvorgang",
+  "Confirm Format": "Bestätigen Sie das Format",
+  "Confirm GPU Switch Mode": "Bestätigen Sie den GPU-Switch-Modus",
+  "Confirm Import": "Bestätigen Sie den Import",
+  "Confirm Mount": "Bestätigen Sie die Montage",
+  "Confirm Mount Point Removal": "Bestätigen Sie das Entfernen des Mount-Punkts",
+  "Confirm Password": "Passwort bestätigen",
+  "Confirm Remove": "Bestätigen Sie das Entfernen",
+  "Confirm Restore": "Bestätigen Sie die Wiederherstellung",
+  "Confirm Uninstallation": "Bestätigen Sie die Deinstallation",
+  "Confirm Unmount": "Bestätigen Sie Unmount",
+  "Confirm complete restore": "Bestätigen Sie die vollständige Wiederherstellung",
+  "Confirm custom restore": "Benutzerdefinierte Wiederherstellung bestätigen",
+  "Confirm delete": "Bestätigen Sie das Löschen",
+  "Confirm export": "Bestätigen Sie den Export",
+  "Confirm password for": "Passwort bestätigen für",
+  "Confirm recovery passphrase:": "Bestätigen Sie die Wiederherstellungspassphrase:",
+  "Confirm the keyfile passphrase:": "Bestätigen Sie die Passphrase der Schlüsseldatei:",
+  "Confirm the mount path is visible.": "Bestätigen Sie, dass der Mount-Pfad sichtbar ist.",
+  "Confirm the password:": "Bestätigen Sie das Passwort:",
+  "Confirmation": "Bestätigung",
+  "Confirmation Failed": "Bestätigung fehlgeschlagen",
+  "Conflicting drivers blacklisted successfully.": "In Konflikt stehende Treiber wurden erfolgreich auf die schwarze Liste gesetzt.",
+  "Conflicting path included in backup:": "In der Sicherung enthaltener widersprüchlicher Pfad:",
+  "Conflicting utilities removed": "Widersprüchliche Dienstprogramme entfernt",
+  "Connect a Coral Accelerator and try again.": "Schließen Sie einen Coral Accelerator an und versuchen Sie es erneut.",
+  "Connected": "Verbunden",
+  "Connecting to PBS and starting backup...": "Mit PBS verbinden und Backup starten...",
+  "Connection Details:": "Verbindungsdetails:",
+  "Connection Error": "Verbindungsfehler",
+  "Connection details:": "Verbindungsdetails:",
+  "Connectivity Test": "Konnektivitätstest",
+  "Connectivity Test Results": "Ergebnisse des Konnektivitätstests",
+  "Consider adding physical interface": "Erwägen Sie das Hinzufügen einer physischen Schnittstelle",
+  "Consider removing its configuration": "Erwägen Sie, die Konfiguration zu entfernen",
+  "Consider security implications for production environments": "Berücksichtigen Sie Sicherheitsauswirkungen für Produktionsumgebungen",
+  "Consider visiting the repository and supporting the project.": "Erwägen Sie einen Besuch im Repository und die Unterstützung des Projekts.",
+  "Container": "Container",
+  "Container         — LXC root directories": "Container – LXC-Stammverzeichnisse",
+  "Container ID": "Container-ID",
+  "Container ID not defined. Make sure to select a container first.": "Container-ID nicht definiert. Stellen Sie sicher, dass Sie zuerst einen Container auswählen.",
+  "Container Mount Point": "Container-Montagepunkt",
+  "Container OS:": "Container-Betriebssystem:",
+  "Container Path": "Containerpfad",
+  "Container Path:": "Containerpfad:",
+  "Container Status": "Containerstatus",
+  "Container configuration not found": "Containerkonfiguration nicht gefunden",
+  "Container did not become ready in time. Skipping driver installation.": "Container wurde nicht rechtzeitig fertig. Treiberinstallation wird übersprungen.",
+  "Container did not start in time.": "Container wurde nicht rechtzeitig gestartet.",
+  "Container distro": "Containerverteilung",
+  "Container does not have apt-get available. Coral driver installation only supports Debian/Ubuntu containers.": "Für den Container ist apt-get nicht verfügbar. Die Coral-Treiberinstallation unterstützt nur Debian/Ubuntu-Container.",
+  "Container is already stopped.": "Container ist bereits gestoppt.",
+  "Container is running. Restart to apply changes?": "Container läuft. Neu starten, um die Änderungen zu übernehmen?",
+  "Container is stopped. Start it now to verify the mount works?": "Container wird gestoppt. Jetzt starten, um zu überprüfen, ob die Halterung funktioniert?",
+  "Container mount point:": "Container-Montagepunkt:",
+  "Container must be stopped before conversion": "Der Container muss vor der Konvertierung gestoppt werden",
+  "Container restarted successfully": "Container wurde erfolgreich neu gestartet",
+  "Container started successfully": "Container wurde erfolgreich gestartet",
+  "Container started successfully.": "Container wurde erfolgreich gestartet.",
+  "Container started.": "Container gestartet.",
+  "Container stopped.": "Container gestoppt.",
+  "Container successfully converted to privileged.": "Container wurde erfolgreich in privilegiert konvertiert.",
+  "Container template— LXC templates": "Containervorlage – LXC-Vorlagen",
+  "Container will pick up the mount on next start": "Der Container holt das Reittier beim nächsten Start ab",
+  "Container with ID": "Container mit ID",
+  "Container:": "Container:",
+  "Contains files": "Enthält Dateien",
+  "Contains:": "Enthält:",
+  "Content Types": "Inhaltstypen",
+  "Content Types:": "Inhaltstypen:",
+  "Content is usually images for VM block devices.": "Bei den Inhalten handelt es sich in der Regel um Bilder für VM-Blockgeräte.",
+  "Content type is fixed to:": "Der Inhaltstyp ist festgelegt auf:",
+  "Content:": "Inhalt:",
+  "Continue": "Weitermachen",
+  "Continue anyway?": "Trotzdem weitermachen?",
+  "Continue despite failures?": "Trotz Misserfolgen weitermachen?",
+  "Continue the VM wizard and reboot the host at the end.": "Fahren Sie mit dem VM-Assistenten fort und starten Sie den Host am Ende neu.",
+  "Continue the Windows installation as usual.": "Setzen Sie die Windows-Installation wie gewohnt fort.",
+  "Continue with Coral TPU configuration only?": "Nur mit Coral TPU-Konfiguration fortfahren?",
+  "Continue with live apply now? SSH may disconnect immediately.": "Jetzt mit der Live-Bewerbung fortfahren? SSH wird möglicherweise sofort getrennt.",
+  "Continue with the import?": "Mit dem Import fortfahren?",
+  "Continue: Proceed with conversion": "Weiter: Fahren Sie mit der Konvertierung fort",
+  "Continue?": "Weitermachen?",
+  "Continuing with your selection.": "Fahren Sie mit Ihrer Auswahl fort.",
+  "Controller": "Regler",
+  "Controller + NVMe": "Controller + NVMe",
+  "Controller + NVMe assignment will be written now and become active after host reboot.": "Die Controller + NVMe-Zuweisung wird jetzt geschrieben und wird nach dem Neustart des Hosts aktiv.",
+  "Controller + NVMe passthrough requires machine type q35. Skipping controller assignment.": "Controller + NVMe-Passthrough erfordern Maschinentyp q35. Controller-Zuweisung wird übersprungen.",
+  "Controller/NVMe Conflict Policy": "Controller-/NVMe-Konfliktrichtlinie",
+  "Controller/NVMe already present in VM config": "Controller/NVMe bereits in der VM-Konfiguration vorhanden",
+  "Controller/NVMe assigned": "Controller/NVMe zugewiesen",
+  "Controller/NVMe is in use by running VM": "Controller/NVMe wird von der laufenden VM verwendet",
+  "Controller/NVMe passthrough requires IOMMU enabled in BIOS/UEFI and kernel.": "Controller/NVMe-Passthrough erfordert die Aktivierung von IOMMU im BIOS/UEFI und im Kernel.",
+  "Controller/NVMe passthrough requires machine type q35.": "Controller/NVMe-Passthrough erfordert Maschinentyp q35.",
+  "Controller/NVMe passthrough to VMs requires IOMMU enabled in BIOS/UEFI and kernel.": "Controller/NVMe-Passthrough zu VMs erfordert die Aktivierung von IOMMU im BIOS/UEFI und im Kernel.",
+  "Controller/NVMe passthrough to VMs requires IOMMU to be enabled in the kernel.": "Controller/NVMe-Passthrough zu VMs erfordert die Aktivierung von IOMMU im Kernel.",
+  "Controller/NVMe passthrough — compatibility notice": "Controller/NVMe-Passthrough – Kompatibilitätshinweis",
+  "Controller/NVMe removed from source VM": "Controller/NVMe von der Quell-VM entfernt",
+  "Controllers + NVMe": "Controller + NVMe",
+  "Controllers + NVMe Selected:": "Ausgewählte Controller + NVMe:",
+  "Convert Privileged to Unprivileged": "Konvertieren Sie Privileged in Unprivileged",
+  "Convert Unprivileged to Privileged": "Konvertieren Sie Unprivilegiert in Privilegiert",
+  "Convert directory ownership:": "Verzeichnisbesitz umwandeln:",
+  "Convert disk image format": "Konvertieren Sie das Disk-Image-Format",
+  "Convert disk image format using QEMU-IMG": "Konvertieren Sie das Disk-Image-Format mit QEMU-IMG",
+  "Convert file ownership (this takes time):": "Dateieigentum umwandeln (dies dauert einige Zeit):",
+  "Converted + verified:": "Konvertiert + verifiziert:",
+  "Converted container ID:": "Konvertierte Container-ID:",
+  "Converting container to privileged...": "Konvertieren des Containers in einen privilegierten...",
+  "Converting disk": "Konvertieren einer Festplatte",
+  "Converting file ownership (this may take several minutes)...": "Dateieigentum wird umgewandelt (dies kann mehrere Minuten dauern)...",
+  "Converting image using command:": "Bild mit Befehl konvertieren:",
+  "Converts to deb822; keeps .list backups as .bak": "Konvertiert in deb822; Behält .list-Backups als .bak",
+  "Copy failed": "Kopieren fehlgeschlagen",
+  "Copy that file offsite yourself, or download it from the Monitor.": "Kopieren Sie diese Datei selbst oder laden Sie sie vom Monitor herunter.",
+  "Copy the correct keyfile to this host and rerun Restore — or pick an unencrypted backup.": "Kopieren Sie die richtige Schlüsseldatei auf diesen Host und führen Sie die Wiederherstellung erneut aus – oder wählen Sie ein unverschlüsseltes Backup aus.",
+  "Copy the keyfile to a path for offsite backup": "Kopieren Sie die Schlüsseldatei in einen Pfad für die Offsite-Sicherung",
+  "Copy your PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to": "Kopieren Sie zuerst Ihre PBS-Schlüsseldatei auf diesen Host (über scp, USB, sftp usw.) und geben Sie unten den absoluten Pfad ein.Die Datei wird kopiert",
+  "Copy your existing PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to": "Kopieren Sie zuerst Ihre vorhandene PBS-Schlüsseldatei auf diesen Host (über scp, USB, sftp usw.) und geben Sie unten den absoluten Pfad ein.Die Datei wird kopiert",
+  "Copying installer to container": "Installationsprogramm in Container kopieren",
+  "Copying sources to": "Kopieren von Quellen nach",
+  "Coral APT repository ready.": "Coral APT-Repository bereit.",
+  "Coral Actions": "Korallenaktionen",
+  "Coral M.2 / PCIe detected — installing gasket and apex kernel modules...": "Coral M.2 / PCIe erkannt – Installation von Dichtungs- und Apex-Kernelmodulen ...",
+  "Coral M.2 Apex configuration added - device ready": "Coral M.2 Apex-Konfiguration hinzugefügt – Gerät bereit",
+  "Coral M.2 Apex configuration added - device will be available after reboot": "Coral M.2 Apex-Konfiguration hinzugefügt – Gerät ist nach dem Neustart verfügbar",
+  "Coral M.2 Apex detected, configuring...": "Coral M.2 Apex erkannt, konfiguriert...",
+  "Coral TPU Installation": "Korallen-TPU-Installation",
+  "Coral TPU Uninstall": "Coral TPU-Deinstallation",
+  "Coral TPU device nodes detected with correct group (apex).": "Coral TPU-Geräteknoten wurden mit der richtigen Gruppe (Apex) erkannt.",
+  "Coral TPU driver installed successfully inside the container.": "Der Coral TPU-Treiber wurde erfolgreich im Container installiert.",
+  "Coral TPU drivers installed and loaded successfully.": "Coral TPU-Treiber wurden erfolgreich installiert und geladen.",
+  "Coral TPU is already installed on this host:": "Coral TPU ist bereits auf diesem Host installiert:",
+  "Coral TPU is already installed:": "Coral TPU ist bereits installiert:",
+  "Coral USB Accelerator detected — installing Edge TPU runtime...": "Coral USB Accelerator erkannt – Edge TPU-Laufzeit wird installiert ...",
+  "Coral USB configuration added - device detected": "Coral USB-Konfiguration hinzugefügt – Gerät erkannt",
+  "Coral USB configured but device not currently connected": "Coral USB konfiguriert, aber das Gerät ist derzeit nicht angeschlossen",
+  "Coral USB runtime installed. No reboot required.": "Coral USB-Runtime installiert. Kein Neustart erforderlich.",
+  "Coral hardware configuration completed for container": "Coral-Hardwarekonfiguration für Container abgeschlossen",
+  "Coral kernel modules unloaded.": "Coral-Kernel-Module wurden entladen.",
+  "Coral packages purged.": "Korallenpakete gelöscht.",
+  "Coral uninstallation completed.": "Coral-Deinstallation abgeschlossen.",
+  "Core Proxmox packages reinstalled successfully": "Kern-Proxmox-Pakete wurden erfolgreich neu installiert",
+  "Core packages": "Kernpakete",
+  "Could not add": "Konnte nicht hinzugefügt werden",
+  "Could not add disk": "Festplatte konnte nicht hinzugefügt werden",
+  "Could not assign disk": "Datenträger konnte nicht zugewiesen werden",
+  "Could not authorize the key via 'pct exec' on": "Der Schlüssel konnte nicht über „pct exec“ autorisiert werden",
+  "Could not back up the existing auth.json": "Die vorhandene auth.json konnte nicht gesichert werden",
+  "Could not change VM virtual display to vga: std": "Die virtuelle VM-Anzeige konnte nicht in vga: std geändert werden",
+  "Could not clone any gasket-driver repository. Check your internet connection and": "Es konnte kein Dichtungstreiber-Repository geklont werden. Überprüfen Sie Ihre Internetverbindung und",
+  "Could not configure IOMMU kernel parameters automatically. Configure manually and reboot.": "IOMMU-Kernelparameter konnten nicht automatisch konfiguriert werden. Manuell konfigurieren und neu starten.",
+  "Could not copy the PVE keyfile into place. Check permissions on:": "Die PVE-Schlüsseldatei konnte nicht kopiert werden.Überprüfen Sie die Berechtigungen für:",
+  "Could not copy the keyfile into place.": "Die Schlüsseldatei konnte nicht kopiert werden.",
+  "Could not copy the keyfile into place. Check permissions on:": "Die Schlüsseldatei konnte nicht kopiert werden.Überprüfen Sie die Berechtigungen für:",
+  "Could not create converter directory:": "Konverterverzeichnis konnte nicht erstellt werden:",
+  "Could not create destination directory:": "Zielverzeichnis konnte nicht erstellt werden:",
+  "Could not create or access directory:": "Verzeichnis konnte nicht erstellt oder darauf zugegriffen werden:",
+  "Could not create temporary directory:": "Temporäres Verzeichnis konnte nicht erstellt werden:",
+  "Could not create temporary working directory.": "Das temporäre Arbeitsverzeichnis konnte nicht erstellt werden.",
+  "Could not detect apex major number from /proc/devices. Load the apex module first: modprobe apex": "Die Apex-Hauptnummer konnte nicht aus /proc/devices erkannt werden. Laden Sie zuerst das Apex-Modul: modprobe apex",
+  "Could not detect the CIFS mount for this directory. Try accessing it manually.": "Der CIFS-Mount für dieses Verzeichnis konnte nicht erkannt werden. Versuchen Sie, manuell darauf zuzugreifen.",
+  "Could not determine a valid ISO storage directory.": "Es konnte kein gültiges ISO-Speicherverzeichnis ermittelt werden.",
+  "Could not determine disk path for:": "Der Festplattenpfad konnte nicht ermittelt werden für:",
+  "Could not determine the IOMMU group for the selected GPU.": "Die IOMMU-Gruppe für die ausgewählte GPU konnte nicht ermittelt werden.",
+  "Could not download recovery blob from PBS.": "Wiederherstellungsblob konnte nicht von PBS heruntergeladen werden.",
+  "Could not download the installer.": "Das Installationsprogramm konnte nicht heruntergeladen werden.",
+  "Could not enable on-boot restore service.": "Der On-Boot-Wiederherstellungsdienst konnte nicht aktiviert werden.",
+  "Could not export ZFS pool": "Der ZFS-Pool konnte nicht exportiert werden",
+  "Could not extract from PBS.": "Konnte nicht aus PBS extrahiert werden.",
+  "Could not fetch keylase/nvidia-patch supported list — patch reapply compatibility is not verified.": "Die Liste der unterstützten Keylase/Nvidia-Patches konnte nicht abgerufen werden – die Kompatibilität mit der erneuten Anwendung des Patches wurde nicht überprüft.",
+  "Could not find a valid 'proxmox-ve' 9.x candidate after switching to no-subscription. Please verify your repository configuration and network, then retry.": "Nach der Umstellung auf kein Abonnement konnte kein gültiger „proxmox-ve“ 9.x-Kandidat gefunden werden. Bitte überprüfen Sie Ihre Repository-Konfiguration und Ihr Netzwerk und versuchen Sie es dann erneut.",
+  "Could not find rootfs configuration for container.": "Die RootFS-Konfiguration für den Container konnte nicht gefunden werden.",
+  "Could not format the disk.": "Die Festplatte konnte nicht formatiert werden.",
+  "Could not fully zero": "Konnte nicht vollständig auf Null gesetzt werden",
+  "Could not identify the imported disk in VM config": "Der importierte Datenträger konnte in der VM-Konfiguration nicht identifiziert werden",
+  "Could not install": "Konnte nicht installiert werden",
+  "Could not install Git — Lynis cannot be cloned. Run 'apt-get install git' manually.": "Git konnte nicht installiert werden – Lynis kann nicht geklont werden. Führen Sie „apt-get install git“ manuell aus.",
+  "Could not install exFAT tools automatically.": "Die exFAT-Tools konnten nicht automatisch installiert werden.",
+  "Could not install sshpass automatically (no internet?). Falling back to manual paste mode — you'll see the line to copy onto the server next.": "SSHPass konnte nicht automatisch installiert werden (kein Internet?).Wenn Sie auf den manuellen Einfügemodus zurückgreifen, sehen Sie als Nächstes die Zeile, die auf den Server kopiert werden soll.",
+  "Could not install vzdump hook in /etc/vzdump.conf": "Der vzdump-Hook konnte nicht in /etc/vzdump.conf installiert werden",
+  "Could not load shared functions. Script cannot continue.": "Gemeinsam genutzte Funktionen konnten nicht geladen werden. Das Skript kann nicht fortgesetzt werden.",
+  "Could not locate imported disk in VM config.": "Der importierte Datenträger konnte in der VM-Konfiguration nicht gefunden werden.",
+  "Could not mount": "Konnte nicht gemountet werden",
+  "Could not mount ISO on device": "ISO konnte nicht auf dem Gerät gemountet werden",
+  "Could not parse OVF file, or no disk image references found.": "Die OVF-Datei konnte nicht analysiert werden oder es wurden keine Disk-Image-Referenzen gefunden.",
+  "Could not push the key. Check the password and that": "Die Taste konnte nicht gedrückt werden. Überprüfen Sie das Passwort und so weiter",
+  "Could not read SMART data from": "Die SMART-Daten konnten nicht gelesen werden",
+  "Could not read VM configuration.": "Die VM-Konfiguration konnte nicht gelesen werden.",
+  "Could not remount automatically. Try manually or check credentials.": "Konnte nicht automatisch erneut bereitgestellt werden. Versuchen Sie es manuell oder überprüfen Sie die Anmeldeinformationen.",
+  "Could not remove VM automatically. Run manually:": "VM konnte nicht automatisch entfernt werden. Manuell ausführen:",
+  "Could not remove previous DKMS tree at": "Vorheriger DKMS-Baum konnte nicht entfernt werden",
+  "Could not restart ProxMenux Monitor service.": "Der ProxMenux Monitor-Dienst konnte nicht neu gestartet werden.",
+  "Could not restart the service — start it manually with systemctl start": "Der Dienst konnte nicht neu gestartet werden. Starten Sie ihn manuell mit systemctl start",
+  "Could not retrieve versions list from NVIDIA. Please check your internet connection.": "Die Versionsliste konnte nicht von NVIDIA abgerufen werden. Bitte überprüfen Sie Ihre Internetverbindung.",
+  "Could not run NVIDIA patch script. Please verify repository and driver version.": "Das NVIDIA-Patchskript konnte nicht ausgeführt werden. Bitte überprüfen Sie das Repository und die Treiberversion.",
+  "Could not set VM virtual display to vga: std": "Die virtuelle VM-Anzeige konnte nicht auf vga: std gesetzt werden",
+  "Could not set boot order for": "Die Startreihenfolge konnte nicht festgelegt werden",
+  "Could not stop LXC": "LXC konnte nicht gestoppt werden",
+  "Could not unload nouveau module (may be in use). The blacklist will take effect after reboot. Installation will continue but a reboot will be required.": "Das Nouveau-Modul konnte nicht entladen werden (möglicherweise wird es verwendet). Die Blacklist wird nach dem Neustart wirksam. Die Installation wird fortgesetzt, es ist jedoch ein Neustart erforderlich.",
+  "Could not unmount": "Die Bereitstellung konnte nicht aufgehoben werden",
+  "Could not unmount — disk may be busy. Removing fstab entry anyway.": "Die Bereitstellung konnte nicht aufgehoben werden – die Festplatte ist möglicherweise ausgelastet. Fstab-Eintrag trotzdem entfernen.",
+  "Could not update config file.": "Die Konfigurationsdatei konnte nicht aktualisiert werden.",
+  "Could not write to:": "Es konnte nicht geschrieben werden an:",
+  "Create": "Erstellen",
+  "Create Directory": "Verzeichnis erstellen",
+  "Create GPT and one partition:": "Erstellen Sie GPT und eine Partition:",
+  "Create GPT partition": "Erstellen Sie eine GPT-Partition",
+  "Create LXC server NFS": "Erstellen Sie ein LXC-Server-NFS",
+  "Create Network Backup": "Netzwerk-Backup erstellen",
+  "Create Samba server service": "Erstellen Sie einen Samba-Serverdienst",
+  "Create Samba user:": "Samba-Benutzer erstellen:",
+  "Create Shared Directory": "Erstellen Sie ein freigegebenes Verzeichnis",
+  "Create Shared Directory on Host": "Erstellen Sie ein freigegebenes Verzeichnis auf dem Host",
+  "Create Universal NFS Export": "Erstellen Sie einen universellen NFS-Export",
+  "Create VM from template or script": "Erstellen Sie eine VM aus einer Vorlage oder einem Skript",
+  "Create a VM first (machine type q35 + UEFI BIOS), then run this option again.": "Erstellen Sie zuerst eine VM (Maschinentyp q35 + UEFI-BIOS) und führen Sie diese Option dann erneut aus.",
+  "Create a backup of the container configuration:": "Erstellen Sie ein Backup der Containerkonfiguration:",
+  "Create a backup of your container before proceeding": "Erstellen Sie ein Backup Ihres Containers, bevor Sie fortfahren",
+  "Create a fresh GPT + ext4 partition and mount it?": "Eine neue GPT + ext4-Partition erstellen und mounten?",
+  "Create a new dataset in a ZFS pool": "Erstellen Sie einen neuen Datensatz in einem ZFS-Pool",
+  "Create a new group for isolation": "Erstellen Sie eine neue Gruppe zur Isolierung",
+  "Create credentials file (recommended):": "Anmeldeinformationsdatei erstellen (empfohlen):",
+  "Create directory": "Verzeichnis erstellen",
+  "Create export directory:": "Exportverzeichnis erstellen:",
+  "Create mount point:": "Mountpunkt erstellen:",
+  "Create new directory in /mnt": "Erstellen Sie ein neues Verzeichnis in /mnt",
+  "Create new folder in /mnt": "Erstellen Sie einen neuen Ordner in /mnt",
+  "Create one first in Datacenter → Backup, then return here to attach.": "Erstellen Sie zuerst eins in Datacenter → Backup und kehren Sie dann hierher zurück, um es anzuhängen.",
+  "Create persistent network interface names?": "Permanente Netzwerkschnittstellennamen erstellen?",
+  "Create scheduled backup job": "Erstellen Sie einen geplanten Sicherungsauftrag",
+  "Create share directory:": "Freigabeverzeichnis erstellen:",
+  "Create shared directory:": "Freigegebenes Verzeichnis erstellen:",
+  "Created common remapped user": "Allgemeiner neu zugeordneter Benutzer erstellt",
+  "Created directory on host:": "Erstelltes Verzeichnis auf Host:",
+  "Created persistent names for": "Persistente Namen erstellt für",
+  "Created remapped user": "Neu zugeordneter Benutzer erstellt",
+  "Created sharedfiles group (GID: 101000)": "Sharedfiles-Gruppe erstellt (GID: 101000)",
+  "Creating APT configuration to force IPv4...": "APT-Konfiguration erstellen, um IPv4 zu erzwingen...",
+  "Creating Ceph repository for PVE 8 (legacy format)...": "Erstellen eines Ceph-Repositorys für PVE 8 (Legacy-Format) ...",
+  "Creating Ceph repository for PVE 9 (deb822 format)...": "Erstellen eines Ceph-Repositorys für PVE 9 (deb822-Format) ...",
+  "Creating Proxmox VE 9.x no-subscription repository...": "Proxmox VE 9.x No-Subscription-Repository wird erstellt...",
+  "Creating Proxmox auth logger service...": "Proxmox-Authentifizierungs-Logger-Dienst wird erstellt...",
+  "Creating SSH auth logger service...": "SSH-Authentifizierungsprotokollierungsdienst wird erstellt...",
+  "Creating UID remapping for unprivileged container compatibility...": "Erstellen einer UID-Neuzuordnung für Kompatibilität mit unprivilegierten Containern ...",
+  "Creating VM with the above configuration": "Erstellen einer VM mit der obigen Konfiguration",
+  "Creating VM...": "VM erstellen...",
+  "Creating backup of configuration file...": "Backup der Konfigurationsdatei wird erstellt...",
+  "Creating backup of network interfaces configuration...": "Backup der Netzwerkschnittstellenkonfiguration wird erstellt...",
+  "Creating compressed archive...": "Komprimiertes Archiv wird erstellt...",
+  "Creating export archive...": "Exportarchiv wird erstellt...",
+  "Creating local archive...": "Lokales Archiv erstellen...",
+  "Creating mount point...": "Mountpunkt wird erstellt...",
+  "Creating new ZFS ARC configuration...": "Neue ZFS ARC-Konfiguration erstellen...",
+  "Creating partition table and partition...": "Partitionstabelle und Partition erstellen...",
+  "Creating partition...": "Partition erstellen...",
+  "Creating pigz wrapper script...": "Pigz-Wrapper-Skript wird erstellt...",
+  "Credentials are correct": "Die Anmeldedaten sind korrekt",
+  "Credentials cleared. jwt_secret and API tokens preserved.": "Anmeldedaten gelöscht. jwt_secret und API-Token bleiben erhalten.",
+  "Credentials file created securely.": "Anmeldeinformationsdatei sicher erstellt.",
+  "Credentials file removed.": "Anmeldeinformationsdatei entfernt.",
+  "Credentials file:": "Anmeldeinformationsdatei:",
+  "Credentials validated successfully": "Anmeldeinformationen erfolgreich validiert",
+  "Cross-host restore: guest IDs in backup overlap live IDs on target:": "Hostübergreifende Wiederherstellung: Gast-IDs im Backup überschneiden sich mit Live-IDs auf dem Ziel:",
+  "Cross-kernel restore — kernel-tied paths merged, not copied": "Kernelübergreifende Wiederherstellung – Kernel-gebundene Pfade werden zusammengeführt, nicht kopiert",
+  "Cross-kernel — paths hidden from picker": "Kernelübergreifend – Pfade, die vor der Auswahl verborgen sind",
+  "Cross-version detected — safe restore mode": "Versionsübergreifend erkannt – sicherer Wiederherstellungsmodus",
+  "Current": "Aktuell",
+  "Current CIFS mounts:": "Aktuelle CIFS-Mounts:",
+  "Current Configuration": "Aktuelle Konfiguration",
+  "Current LXC Mount Points": "Aktuelle LXC-Mount-Punkte",
+  "Current NFS Mounts": "Aktuelle NFS-Mounts",
+  "Current NFS client script supports privileged LXC only.": "Das aktuelle NFS-Client-Skript unterstützt nur privilegiertes LXC.",
+  "Current NFS exports in CT": "Aktuelle NFS-Exporte in CT",
+  "Current NFS mounts:": "Aktuelle NFS-Mounts:",
+  "Current Network Configuration": "Aktuelle Netzwerkkonfiguration",
+  "Current PVE Version": "Aktuelle PVE-Version",
+  "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Aktuelle ProxMenux-Hostskripte registrieren Remote-Freigaben mithilfe von pvesm als Proxmox-Speicher.",
+  "Current ProxMenux version:": "Aktuelle ProxMenux-Version:",
+  "Current Samba Mounts": "Aktuelle Samba-Reittiere",
+  "Current Samba client script supports privileged LXC only.": "Das aktuelle Samba-Client-Skript unterstützt nur privilegiertes LXC.",
+  "Current Samba shares in CT": "Aktuelle Samba-Aktien in CT",
+  "Current channel:": "Aktueller Kanal:",
+  "Current driver": "Aktueller Fahrer",
+  "Current free space:": "Derzeitiger freier Speicherplatz:",
+  "Current language:": "Aktuelle Sprache:",
+  "Current mode": "Aktueller Modus",
+  "Current mount options:": "Aktuelle Montageoptionen:",
+  "Current permissions:": "Aktuelle Berechtigungen:",
+  "Current power state: D3cold (device currently inaccessible)": "Aktueller Energiestatus: D3cold (Gerät derzeit nicht erreichbar)",
+  "Current script uses native bind mounts with pct set -mpX.": "Das aktuelle Skript verwendet native Bind-Mounts mit pct set -mpX.",
+  "Current selection:": "Aktuelle Auswahl:",
+  "Current status:": "Aktueller Stand:",
+  "Current user": "Aktueller Benutzer",
+  "Current user UID, GID and groups": "Aktuelle Benutzer-UID, GID und Gruppen",
+  "Current version:": "Aktuelle Version:",
+  "Currently": "Momentan",
+  "Currently Mounted:": "Derzeit montiert:",
+  "Currently configured target:": "Derzeit konfiguriertes Ziel:",
+  "Currently mounted:": "Derzeit montiert:",
+  "Custom": "Brauch",
+  "Custom Configuration": "Benutzerdefinierte Konfiguration",
+  "Custom Content": "Benutzerdefinierter Inhalt",
+  "Custom Directory": "Benutzerdefiniertes Verzeichnis",
+  "Custom Logo Instructions": "Anweisungen für individuelle Logos",
+  "Custom Options": "Benutzerdefinierte Optionen",
+  "Custom Path": "Benutzerdefinierter Pfad",
+  "Custom backup paths": "Benutzerdefinierte Sicherungspfade",
+  "Custom backup profile": "Benutzerdefiniertes Backup-Profil",
+  "Custom backup to Borg": "Benutzerdefiniertes Backup für Borg",
+  "Custom backup to PBS": "Benutzerdefinierte Sicherung auf PBS",
+  "Custom backup to local archive": "Benutzerdefinierte Sicherung in ein lokales Archiv",
+  "Custom local directory": "Benutzerdefiniertes lokales Verzeichnis",
+  "Custom message added to MOTD": "Benutzerdefinierte Nachricht zu MOTD hinzugefügt",
+  "Custom options": "Benutzerdefinierte Optionen",
+  "Custom path": "Benutzerdefinierter Pfad",
+  "Custom path...": "Benutzerdefinierter Pfad...",
+  "Custom paths are included in BOTH default and custom backup profiles.": "Benutzerdefinierte Pfade sind SOWOHL in den Standard- als auch in den benutzerdefinierten Sicherungsprofilen enthalten.",
+  "Custom restore by components": "Benutzerdefinierte Wiederherstellung nach Komponenten",
+  "Custom restore by paths": "Benutzerdefinierte Wiederherstellung nach Pfaden",
+  "Custom scripts and ProxMenux files": "Benutzerdefinierte Skripte und ProxMenux-Dateien",
+  "Custom selection": "Benutzerdefinierte Auswahl",
+  "Custom systemd units": "Benutzerdefinierte Systemd-Einheiten",
+  "Customizable post-installation script": "Anpassbares Nachinstallationsskript",
+  "Customization": "Anpassung",
+  "Customize bashrc": "bashrc anpassen",
+  "Customizing bashrc for root user...": "Anpassen von bashrc für Root-Benutzer ...",
+  "DISABLED unless you enable it": "DEAKTIVIERT, es sei denn, Sie aktivieren es",
+  "DKMS add failed. Check": "DKMS-Hinzufügen fehlgeschlagen. Überprüfen",
+  "DKMS build failed.": "DKMS-Build ist fehlgeschlagen.",
+  "DKMS build failed. Last lines of make.log:": "DKMS-Build ist fehlgeschlagen. Letzte Zeilen von make.log:",
+  "DKMS install failed.": "Die DKMS-Installation ist fehlgeschlagen.",
+  "DKMS module registered.": "DKMS-Modul registriert.",
+  "DNS Resolution": "DNS-Auflösung",
+  "DNS lookup for a domain": "DNS-Suche nach einer Domain",
+  "Data size:": "Datengröße:",
+  "Data wipe complete.": "Datenlöschung abgeschlossen.",
+  "Data wiped from": "Daten gelöscht von",
+  "Datastore name:": "Datenspeichername:",
+  "Deactivate Monitor": "Monitor deaktivieren",
+  "Deactivate ProxMenux Monitor": "Deaktivieren Sie den ProxMenux-Monitor",
+  "Debian repositories missing; creating default source file": "Debian-Repositorys fehlen; Erstellen einer Standardquelldatei",
+  "Decompress backup manually": "Backup manuell dekomprimieren",
+  "Decryption failed. The passphrase may be wrong, or the blob is corrupt. Try again?": "Die Entschlüsselung ist fehlgeschlagen. Möglicherweise ist die Passphrase falsch oder das Blob ist beschädigt. Versuchen Sie es erneut?",
+  "Default ACLs applied for group inheritance.": "Für die Gruppenvererbung werden Standard-ACLs angewendet.",
+  "Default Credentials": "Standardanmeldeinformationen",
+  "Default Gateway": "Standard-Gateway",
+  "Default ISO directory": "Standard-ISO-Verzeichnis",
+  "Default Login Credentials:": "Standard-Anmeldeinformationen:",
+  "Default Port": "Standardport",
+  "Default Proxmox logo applied": "Standardmäßiges Proxmox-Logo angewendet",
+  "Default is none (video-only passthrough). Use SPACE to toggle selections.": "Der Standardwert ist „Keine“ (nur Video-Passthrough). Verwenden Sie die LEERTASTE, um die Auswahl umzuschalten.",
+  "Default journald configuration restored": "Standard-Journald-Konfiguration wiederhergestellt",
+  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "Der Standardspeicherort ist /mnt/<Name>. Die Freigabe wird hier auf dem Host mit offenen Berechtigungen gemountet, sodass ein unprivilegierter LXC sie binden, mounten und darauf schreiben kann. Für den LXC-Zugriff müssen Sie diesen Pfad mit dem LXC Mount Manager binden.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "Der Standardspeicherort ist /mnt/<Name>. Die Freigabe wird hier auf dem Host gemountet. Verwenden Sie diesen Pfad in /etc/fstab. Für den LXC-Zugriff müssen Sie diesen Pfad mit dem LXC Mount Manager binden.",
+  "Default options": "Standardoptionen",
+  "Default options read/write": "Standardoptionen Lesen/Schreiben",
+  "Default will be used:": "Standard wird verwendet:",
+  "Default:": "Standard:",
+  "Delete Borg target": "Borg-Ziel löschen",
+  "Delete Export": "Export löschen",
+  "Delete Share": "Freigabe löschen",
+  "Delete a CT (irreversible). Use the correct <ctid>": "Eine CT löschen (irreversibel). Verwenden Sie die richtige <ctid>",
+  "Delete a VM (irreversible). Use the correct <vmid>": "Eine VM löschen (unwiderruflich). Verwenden Sie die richtige <vmid>",
+  "Delete archive": "Archiv löschen",
+  "Delete job": "Auftrag löschen",
+  "Delete scheduled backup job?": "Geplanten Sicherungsauftrag löschen?",
+  "Delete this corrupt archive and pick another": "Löschen Sie dieses beschädigte Archiv und wählen Sie ein anderes aus",
+  "Dependencies installed successfully": "Abhängigkeiten erfolgreich installiert",
+  "Deploy with this configuration?": "Mit dieser Konfiguration bereitstellen?",
+  "Deploying Secure Gateway...": "Secure Gateway wird bereitgestellt...",
+  "Deployment cancelled.": "Bereitstellung abgebrochen.",
+  "Deployment failed": "Die Bereitstellung ist fehlgeschlagen",
+  "Description": "Beschreibung",
+  "Desktop UI backup created": "Backup der Desktop-Benutzeroberfläche erstellt",
+  "Desktop and Mobile UI patched": "Desktop- und Mobil-UI gepatcht",
+  "Destination Directory": "Zielverzeichnis",
+  "Destination directory does not exist:": "Zielverzeichnis existiert nicht:",
+  "Destination directory is not writable:": "Zielverzeichnis ist nicht beschreibbar:",
+  "Destination path for the copy (typically outside ProxMenux state):": "Zielpfad für die Kopie (normalerweise außerhalb des ProxMenux-Status):",
+  "Destination:": "Ziel:",
+  "Destroy a ZFS dataset (irreversible)": "Zerstören Sie einen ZFS-Datensatz (irreversibel)",
+  "Destructive rollback": "Zerstörerischer Rollback",
+  "Detailed Proxmox version info": "Detaillierte Informationen zur Proxmox-Version",
+  "Detailed partition layout with GPT info": "Detailliertes Partitionslayout mit GPT-Informationen",
+  "Detailed service information": "Detaillierte Serviceinformationen",
+  "Details": "Einzelheiten",
+  "Detect GPUs in host": "GPUs im Host erkennen",
+  "Detect controller/NVMe BDF": "Controller/NVMe BDF erkennen",
+  "Detected": "Erkannt",
+  "Detected AMD CPU": "AMD-CPU erkannt",
+  "Detected Coral hardware:": "Erkannte Coral-Hardware:",
+  "Detected GPU(s):": "Erkannte GPU(s):",
+  "Detected Intel CPU": "Intel-CPU erkannt",
+  "Detected Proxmox VE": "Proxmox VE erkannt",
+  "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Proxmox VE 8.x erkannt – Ceph Squid für Debian installieren",
+  "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Proxmox VE 9.x erkannt – Ceph Squid für Debian Trixie installieren",
+  "Detected RAM:": "Erkannter RAM:",
+  "Detected a mounted directory from host. Setting up shared group...": "Ein gemountetes Verzeichnis vom Host erkannt. Geteilte Gruppe einrichten...",
+  "Detected backups — newest first:": "Erkannte Backups – Neueste zuerst:",
+  "Detected broken gasket-dkms package state:": "Status des defekten Gasket-DKMS-Pakets erkannt:",
+  "Detected existing Samba user:": "Vorhandenen Samba-Benutzer erkannt:",
+  "Detected filesystem:": "Erkanntes Dateisystem:",
+  "Detected nftables - using nftables ban action": "Nftables erkannt – Nftables-Verbotsaktion wird verwendet",
+  "Detected paths in this backup:": "Erkannte Pfade in dieser Sicherung:",
+  "Detected power state": "Erkannter Energiezustand",
+  "Detected reset method": "Erkannte Reset-Methode",
+  "Detected risk factor": "Erkannter Risikofaktor",
+  "Detected subtype": "Erkannter Subtyp",
+  "Detected:": "Erkannt:",
+  "Detecting AMD CPU and applying fixes if necessary...": "AMD-CPU erkennen und bei Bedarf Korrekturen anwenden ...",
+  "Detecting PCI storage controllers and NVMe devices...": "PCI-Speichercontroller und NVMe-Geräte werden erkannt...",
+  "Detecting available disks...": "Verfügbare Festplatten werden erkannt...",
+  "Detecting container OS...": "Container-Betriebssystem wird erkannt...",
+  "Detecting if this is an OVH server and installing OVH RTM if necessary...": "Erkennen Sie, ob es sich um einen OVH-Server handelt, und installieren Sie ggf. OVH RTM ...",
+  "Detecting previous optimizations...": "Frühere Optimierungen werden erkannt...",
+  "Detecting virtualization and installing  guest agent...": "Virtualisierung wird erkannt und Gastagent wird installiert...",
+  "Development Tools": "Entwicklungstools",
+  "Device In Use": "Gerät im Einsatz",
+  "Device added": "Gerät hinzugefügt",
+  "Device already present in target VM — existing hostpci entry reused": "Gerät ist bereits in der Ziel-VM vorhanden – vorhandener Hostpci-Eintrag wiederverwendet",
+  "Device assignments will be written now and become active after reboot.": "Gerätezuordnungen werden jetzt geschrieben und sind nach dem Neustart aktiv.",
+  "Device hostname": "Hostname des Geräts",
+  "Device path mismatch. Format cancelled.": "Nicht übereinstimmender Gerätepfad. Formatierung abgebrochen.",
+  "Device:": "Gerät:",
+  "Devices to add to VM": "Geräte, die zur VM hinzugefügt werden sollen",
+  "Diff: current system vs backup (--- system  +++ backup)": "Unterschied: aktuelles System vs. Backup (--- System +++ Backup)",
+  "Different host. Backup from:": "Anderer Gastgeber. Backup von:",
+  "Direct conversion completed for container": "Direkte Konvertierung für Container abgeschlossen",
+  "Directory Exists": "Verzeichnis existiert",
+  "Directory Not Empty": "Verzeichnis nicht leer",
+  "Directory Not Found": "Verzeichnis nicht gefunden",
+  "Directory already exists. Continue with permission setup?": "Das Verzeichnis existiert bereits. Mit der Berechtigungseinrichtung fortfahren?",
+  "Directory configured for sharedfiles group access on:": "Verzeichnis, das für den Gruppenzugriff auf gemeinsam genutzte Dateien konfiguriert ist auf:",
+  "Directory configured with sharedfiles group ownership": "Verzeichnis, das mit Sharedfiles-Gruppenbesitz konfiguriert ist",
+  "Directory created successfully.": "Verzeichnis erfolgreich erstellt.",
+  "Directory created successfully:": "Verzeichnis erfolgreich erstellt:",
+  "Directory created:": "Verzeichnis erstellt:",
+  "Directory does not exist and was not created.": "Das Verzeichnis existiert nicht und wurde nicht erstellt.",
+  "Directory does not exist:": "Verzeichnis existiert nicht:",
+  "Directory error": "Verzeichnisfehler",
+  "Directory not found": "Verzeichnis nicht gefunden",
+  "Directory storage added successfully to Proxmox!": "Verzeichnisspeicher erfolgreich zu Proxmox hinzugefügt!",
+  "Directory successfully.": "Verzeichnis erfolgreich.",
+  "Directory:": "Verzeichnis:",
+  "Disable NIC Offloading (Intel e1000e)": "NIC-Offloading deaktivieren (Intel e1000e)",
+  "Disable autostart on conflicting VM": "Deaktivieren Sie den Autostart auf in Konflikt stehenden VMs",
+  "Disable autostart on one VM to avoid startup conflicts.": "Deaktivieren Sie den Autostart auf einer VM, um Startkonflikte zu vermeiden.",
+  "Disable kernel audit messages (optional but recommended):": "Deaktivieren Sie Kernel-Überwachungsmeldungen (optional, aber empfohlen):",
+  "Disable onboot on affected VM(s)/CT(s)": "Onboot auf betroffenen VM(s)/CT(s) deaktivieren",
+  "Disable portmapper/rpcbind": "Portmapper/rpcbind deaktivieren",
+  "Disabled": "Deaktiviert",
+  "Disabling High Availability services...": "Hochverfügbarkeitsdienste werden deaktiviert...",
+  "Disabling ZFS autotrim applied by ProxMenux...": "Deaktivieren der von ProxMenux angewendeten ZFS-Autotrim-Funktion ...",
+  "Disabling and removing NetworkManager...": "Deaktivieren und Entfernen von NetworkManager...",
+  "Disabling and stopping rpcbind service...": "Deaktivieren und Stoppen des Rpcbind-Dienstes ...",
+  "Disabling non-free firmware warnings...": "Warnungen zu nicht kostenloser Firmware werden deaktiviert...",
+  "Disabling portmapper/rpcbind for security...": "Portmapper/rpcbind wird aus Sicherheitsgründen deaktiviert...",
+  "Discover targets on portal:": "Entdecken Sie Ziele auf dem Portal:",
+  "Discovering iSCSI targets...": "iSCSI-Ziele werden ermittelt...",
+  "Discovery successful": "Entdeckung erfolgreich",
+  "Disk": "Scheibe",
+  "Disk Already Assigned": "Datenträger bereits zugewiesen",
+  "Disk In Use": "Festplatte wird verwendet",
+  "Disk In Use by Running VM": "Von der ausgeführten VM verwendete Festplatte",
+  "Disk Manager": "Festplattenmanager",
+  "Disk Reference Conflict": "Konflikt mit der Festplattenreferenz",
+  "Disk Setup": "Festplatten-Setup",
+  "Disk added as": "Datenträger hinzugefügt als",
+  "Disk already has": "Die Festplatte ist bereits vorhanden",
+  "Disk and Storage Manager - Manual CLI Guide": "Disk and Storage Manager – Manuelles CLI-Handbuch",
+  "Disk appears empty. It will be formatted.": "Die Festplatte scheint leer zu sein. Es wird formatiert.",
+  "Disk assigned at": "Festplatte zugewiesen bei",
+  "Disk attached as:": "Festplatte angeschlossen als:",
+  "Disk configured as": "Festplatte konfiguriert als",
+  "Disk conversion failed for": "Die Festplattenkonvertierung ist fehlgeschlagen",
+  "Disk file not found:": "Festplattendatei nicht gefunden:",
+  "Disk formatted as": "Festplatte formatiert als",
+  "Disk formatted successfully.": "Festplatte erfolgreich formatiert.",
+  "Disk image        — VM disk images": "Disk-Image – VM-Disk-Images",
+  "Disk interface is required to continue VM creation.": "Zum Fortsetzen der VM-Erstellung ist eine Festplattenschnittstelle erforderlich.",
+  "Disk interface selected:": "Ausgewählte Festplattenschnittstelle:",
+  "Disk interface selection cancelled.": "Auswahl der Festplattenschnittstelle abgebrochen.",
+  "Disk is part of a host ZFS pool": "Die Festplatte ist Teil eines Host-ZFS-Pools",
+  "Disk is part of host LVM": "Die Festplatte ist Teil des Host-LVM",
+  "Disk is ready for VM passthrough.": "Die Festplatte ist für den VM-Passthrough bereit.",
+  "Disk is ready to be added to Proxmox storage.": "Die Festplatte kann zum Proxmox-Speicher hinzugefügt werden.",
+  "Disk metadata cleaned.": "Datenträgermetadaten bereinigt.",
+  "Disk mounted at": "Festplatte gemountet bei",
+  "Disk path resolved via pvesm:": "Über pvesm aufgelöster Festplattenpfad:",
+  "Disk path:": "Festplattenpfad:",
+  "Disk safety revalidation failed.": "Die erneute Überprüfung der Festplattensicherheit ist fehlgeschlagen.",
+  "Disk safety validation passed.": "Festplattensicherheitsvalidierung bestanden.",
+  "Disk unmounted from": "Datenträger nicht gemountet von",
+  "Disk verified and accessible inside CT at": "Datenträger überprüft und im CT zugänglich unter",
+  "Disk:": "Scheibe:",
+  "Disks exported:": "Exportierte Festplatten:",
+  "Disks to export:": "Zu exportierende Festplatten:",
+  "Disks to import:": "Zu importierende Datenträger:",
+  "Disks to process:": "Zu verarbeitende Datenträger:",
+  "Disks:": "Festplatten:",
+  "Display  :": "Anzeige  :",
+  "Display logical volumes (LVM)": "Logische Volumes (LVM) anzeigen",
+  "Display physical volumes (LVM)": "Physische Volumes (LVM) anzeigen",
+  "Display system summary in ASCII format": "Systemzusammenfassung im ASCII-Format anzeigen",
+  "Display volume groups (LVM)": "Volumengruppen anzeigen (LVM)",
+  "Do not run the upgrade from the Web UI virtual console (it will disconnect)": "Führen Sie das Upgrade nicht über die virtuelle Konsole der Web-Benutzeroberfläche aus, da sonst die Verbindung unterbrochen wird.",
+  "Do not start the VM until the system has been rebooted.": "Starten Sie die VM erst, wenn das System neu gestartet wurde.",
+  "Do you want ProxMenux to stop it now?": "Möchten Sie, dass ProxMenux es jetzt stoppt?",
+  "Do you want to activate ProxMenux Monitor?": "Möchten Sie ProxMenux Monitor aktivieren?",
+  "Do you want to apply the optional NVIDIA patch to remove some GPU limitations?": "Möchten Sie den optionalen NVIDIA-Patch anwenden, um einige GPU-Einschränkungen zu beseitigen?",
+  "Do you want to apply these optimizations now?": "Möchten Sie diese Optimierungen jetzt anwenden?",
+  "Do you want to configure GPU passthrough for this VM now?": "Möchten Sie jetzt GPU-Passthrough für diese VM konfigurieren?",
+  "Do you want to continue anyway?": "Möchten Sie trotzdem fortfahren?",
+  "Do you want to continue with the conversion now, or exit to create a backup first?": "Möchten Sie jetzt mit der Konvertierung fortfahren oder den Vorgang beenden, um zunächst ein Backup zu erstellen?",
+  "Do you want to continue?": "Möchten Sie fortfahren?",
+  "Do you want to convert it to a privileged container now?": "Möchten Sie ihn jetzt in einen privilegierten Container umwandeln?",
+  "Do you want to create it now?": "Möchten Sie es jetzt erstellen?",
+  "Do you want to create it?": "Möchten Sie es erstellen?",
+  "Do you want to deactivate ProxMenux Monitor?": "Möchten Sie ProxMenux Monitor deaktivieren?",
+  "Do you want to disable and remove it now?": "Möchten Sie es jetzt deaktivieren und entfernen?",
+  "Do you want to enable IOMMU now?": "Möchten Sie IOMMU jetzt aktivieren?",
+  "Do you want to enable the serial port": "Möchten Sie die serielle Schnittstelle aktivieren?",
+  "Do you want to encrypt this backup?": "Möchten Sie dieses Backup verschlüsseln?",
+  "Do you want to install Log2RAM anyway to reduce log write load?": "Möchten Sie Log2RAM trotzdem installieren, um die Protokollschreiblast zu reduzieren?",
+  "Do you want to make this mount permanent?": "Möchten Sie dieses Reittier dauerhaft machen?",
+  "Do you want to open Switch GPU Mode now?": "Möchten Sie den GPU-Modus jetzt wechseln öffnen?",
+  "Do you want to proceed and run the Proxmox System Update?": "Möchten Sie fortfahren und das Proxmox-Systemupdate ausführen?",
+  "Do you want to proceed with the system update?": "Möchten Sie mit der Systemaktualisierung fortfahren?",
+  "Do you want to proceed?": "Möchten Sie fortfahren?",
+  "Do you want to reboot now?": "Möchten Sie jetzt neu starten?",
+  "Do you want to restart the network service now to apply changes?": "Möchten Sie den Netzwerkdienst jetzt neu starten, um die Änderungen zu übernehmen?",
+  "Do you want to restart the network service to apply changes?": "Möchten Sie den Netzwerkdienst neu starten, um die Änderungen zu übernehmen?",
+  "Do you want to run the network script from": "Möchten Sie das Netzwerkskript ausführen?",
+  "Do you want to run the post-installation script from": "Möchten Sie das Nachinstallationsskript ausführen?",
+  "Do you want to run the script now?": "Möchten Sie das Skript jetzt ausführen?",
+  "Do you want to schedule selected paths for next boot now?": "Möchten Sie ausgewählte Pfade jetzt für den nächsten Start planen?",
+  "Do you want to start the converted unprivileged container": "Möchten Sie den konvertierten unprivilegierten Container starten?",
+  "Do you want to start the privileged container": "Möchten Sie den privilegierten Container starten?",
+  "Do you want to try different credentials or authentication method?": "Möchten Sie andere Anmeldeinformationen oder Authentifizierungsmethoden ausprobieren?",
+  "Do you want to unmount it first?": "Möchten Sie es zuerst aushängen?",
+  "Do you want to update now?": "Möchten Sie jetzt aktualisieren?",
+  "Do you want to update the NVIDIA userspace libraries inside these containers to match the host?": "Möchten Sie die NVIDIA-Userspace-Bibliotheken in diesen Containern aktualisieren, damit sie zum Host passen?",
+  "Do you want to update the existing export?": "Möchten Sie den vorhandenen Export aktualisieren?",
+  "Do you want to update the existing share?": "Möchten Sie die vorhandene Freigabe aktualisieren?",
+  "Do you want to view the selected backup before restoring?": "Möchten Sie das ausgewählte Backup vor der Wiederherstellung anzeigen?",
+  "Download failed for all attempted URLs": "Der Download ist für alle versuchten URLs fehlgeschlagen",
+  "Download keyfile": "Schlüsseldatei herunterladen",
+  "Download latest VirtIO ISO automatically": "Laden Sie die neueste VirtIO-ISO automatisch herunter",
+  "Downloaded amdgpu_top": "Amdgpu_top heruntergeladen",
+  "Downloading": "Herunterladen",
+  "Downloading Helper-Scripts logo...": "Helper-Scripts-Logo wird heruntergeladen...",
+  "Downloading Home-Labs-Club logo...": "Home-Labs-Club-Logo wird heruntergeladen...",
+  "Downloading JC Channel logo...": "JC Channel-Logo wird heruntergeladen...",
+  "Downloading ProxMenux logo...": "ProxMenux-Logo wird heruntergeladen...",
+  "Downloading Proxmology logo...": "Proxmology-Logo wird heruntergeladen...",
+  "Downloading UUP converter...": "UUP-Konverter wird heruntergeladen...",
+  "Downloading amdgpu_top": "Amdgpu_top wird heruntergeladen",
+  "Downloading official installer...": "Offizielles Installationsprogramm wird heruntergeladen...",
+  "Downloading pre-existing encrypted backups from this host will fail unless you kept a copy of the current key.": "Das Herunterladen bereits vorhandener verschlüsselter Backups von diesem Host schlägt fehl, es sei denn, Sie haben eine Kopie des aktuellen Schlüssels aufbewahrt.",
+  "Downloading the latest Fastfetch release...": "Laden Sie die neueste Fastfetch-Version herunter...",
+  "Driver blacklist entries removed": "Treiber-Blacklist-Einträge entfernt",
+  "Driver blacklist removed for": "Treiber-Blacklist entfernt für",
+  "Driver installed successfully. Press Enter to continue...": "Treiber erfolgreich installiert. Drücken Sie die Eingabetaste, um fortzufahren...",
+  "Drivers  :": "Treiber:",
+  "Drivers compiled and installed via DKMS.": "Treiber über DKMS kompiliert und installiert.",
+  "Dumping AMD GPU ROM BIOS via sysfs...": "Das AMD-GPU-ROM-BIOS wird über sysfs gelöscht ...",
+  "Duplicate IP addresses found": "Doppelte IP-Adressen gefunden",
+  "Duplicate parameters cleaned": "Doppelte Parameter bereinigt",
+  "Duration": "Dauer",
+  "Duration:": "Dauer:",
+  "EFI disk created and configured on": "EFI-Festplatte erstellt und konfiguriert auf",
+  "EFI storage selection cancelled.": "EFI-Speicherauswahl abgebrochen.",
+  "EFI storage selection failed or was cancelled. VM creation aborted.": "Die EFI-Speicherauswahl ist fehlgeschlagen oder wurde abgebrochen. VM-Erstellung wurde abgebrochen.",
+  "EMERGENCY PROXMOX SYSTEM REPAIR": "NOTFALLREPARATUR DES PROXMOX-SYSTEMS",
+  "ENABLED for restore": "Für die Wiederherstellung AKTIVIERT",
+  "EXISTS": "EXISTIERT",
+  "Each LUN will appear as a block device assignable to VMs.": "Jede LUN wird als Blockgerät angezeigt, das VMs zugewiesen werden kann.",
+  "Edge TPU runtime installed.": "Edge TPU-Laufzeit installiert.",
+  "Edit raw CT configuration file": "Bearbeiten Sie die Roh-CT-Konfigurationsdatei",
+  "Edit raw VM configuration file": "Bearbeiten Sie die Roh-VM-Konfigurationsdatei",
+  "Edit the VM machine type to q35 and try again.": "Bearbeiten Sie den VM-Maschinentyp auf q35 und versuchen Sie es erneut.",
+  "Emergency Proxmox System Repair": "Notfallreparatur des Proxmox-Systems",
+  "Emergency recovery:": "Notfallwiederherstellung:",
+  "Empty": "Leer",
+  "Enable": "Aktivieren",
+  "Enable / disable job timer": "Job-Timer aktivieren/deaktivieren",
+  "Enable High Availability services": "Hochverfügbarkeitsdienste aktivieren",
+  "Enable IOMMU in GRUB or ZFS boot": "Aktivieren Sie IOMMU im GRUB- oder ZFS-Boot",
+  "Enable IOMMU support if not enabled": "Aktivieren Sie die IOMMU-Unterstützung, falls diese nicht aktiviert ist",
+  "Enable IOMMU, reboot the host, and try again.": "Aktivieren Sie IOMMU, starten Sie den Host neu und versuchen Sie es erneut.",
+  "Enable Remote Desktop (RDP) before disabling the virtual display.": "Aktivieren Sie Remote Desktop (RDP), bevor Sie die virtuelle Anzeige deaktivieren.",
+  "Enable SSD emulation for this disk?": "SSD-Emulation für diese Festplatte aktivieren?",
+  "Enable TCP BBR/Fast Open control": "Aktivieren Sie die TCP-BBR/Fast-Open-Steuerung",
+  "Enable VFIO IOMMU support": "VFIO IOMMU-Unterstützung aktivieren",
+  "Enable ZFS autotrim (SSD/NVMe pools)": "ZFS-Autotrim aktivieren (SSD/NVMe-Pools)",
+  "Enable auto-sync if /var/log exceeds 90% of its size?": "Automatische Synchronisierung aktivieren, wenn /var/log 90 % seiner Größe überschreitet?",
+  "Enable fast reboots": "Schnelle Neustarts aktivieren",
+  "Enable restart on kernel panic": "Neustart bei Kernel-Panic aktivieren",
+  "Enable/Disable job": "Job aktivieren/deaktivieren",
+  "Enabled": "Ermöglicht",
+  "Enabled (device pending — load apex module or reboot)": "Aktiviert (Gerät steht aus – Apex-Modul laden oder neu starten)",
+  "Enabled (repokey)": "Aktiviert (Repokey)",
+  "Enabled and detected": "Aktiviert und erkannt",
+  "Enabled and ready": "Aktiviert und bereit",
+  "Enabled but not connected": "Aktiviert, aber nicht verbunden",
+  "Enabled memory compaction proactiveness": "Aktivierte proaktive Speicherkomprimierung",
+  "Enabling Google TCP BBR congestion control...": "Google TCP BBR-Überlastungskontrolle wird aktiviert...",
+  "Enabling High Availability (HA) services...": "Aktivieren von Hochverfügbarkeitsdiensten (HA)...",
+  "Enabling IOMMU": "IOMMU aktivieren",
+  "Enabling IOMMU and configuring VFIO for PCI passthrough...": "IOMMU aktivieren und VFIO für PCI-Passthrough konfigurieren ...",
+  "Enabling TCP Fast Open...": "TCP Fast Open aktivieren...",
+  "Enabling pigz in vzdump configuration...": "Pigz wird in der vzdump-Konfiguration aktiviert ...",
+  "Encrypt this Borg repository?": "Dieses Borg-Repository verschlüsseln?",
+  "Encryption": "Verschlüsselung",
+  "Encryption key": "Verschlüsselungsschlüssel",
+  "Encryption key creation failed": "Die Erstellung des Verschlüsselungsschlüssels ist fehlgeschlagen",
+  "Encryption:": "Verschlüsselung:",
+  "English": "Englisch",
+  "Ensure there are no errors and that proxmox-ve candidate shows 9.x": "Stellen Sie sicher, dass keine Fehler vorliegen und dass der Proxmox-ve-Kandidat 9.x anzeigt",
+  "Ensuring apex group and udev rules...": "Apex-Gruppe und udev-Regeln sicherstellen...",
+  "Ensuring ceph.sources (enterprise, Trixie) is present...": "Sicherstellen, dass ceph.sources (Enterprise, Trixie) vorhanden ist ...",
+  "Ensuring ceph.sources (no-subscription, Trixie) is present...": "Sicherstellen, dass ceph.sources (kein Abonnement, Trixie) vorhanden ist ...",
+  "Ensuring proxmox.sources (PVE 9, no-subscription, deb822) is present...": "Sicherstellen, dass proxmox.sources (PVE 9, kein Abonnement, deb822) vorhanden ist ...",
+  "Ensuring pve-enterprise.sources (PVE 9, deb822) is present...": "Sicherstellen, dass pve-enterprise.sources (PVE 9, deb822) vorhanden ist ...",
+  "Enter": "Eingeben",
+  "Enter CT ID:": "Geben Sie die CT-ID ein:",
+  "Enter MSR register (e.g. 0x10):": "Geben Sie das MSR-Register ein (z. B. 0x10):",
+  "Enter NFS export path (e.g., /mnt/shared):": "Geben Sie den NFS-Exportpfad ein (z. B. /mnt/shared):",
+  "Enter NFS server IP or hostname:": "Geben Sie die IP-Adresse oder den Hostnamen des NFS-Servers ein:",
+  "Enter NVMe device (e.g., nvme0):": "Geben Sie das NVMe-Gerät ein (z. B. nvme0):",
+  "Enter PCI BDF (e.g. 0000:01:00.0):": "Geben Sie PCI BDF ein (z. B. 0000:01:00.0):",
+  "Enter PCI BDF (e.g. 0000:04:00.0):": "Geben Sie PCI BDF ein (z. B. 0000:04:00.0):",
+  "Enter Path": "Geben Sie den Pfad ein",
+  "Enter Samba server IP:": "Geben Sie die IP des Samba-Servers ein:",
+  "Enter Samba share name:": "Geben Sie den Namen der Samba-Freigabe ein:",
+  "Enter Tailscale Auth Key": "Geben Sie den Tailscale-Authentifizierungsschlüssel ein",
+  "Enter VM ID:": "Geben Sie die VM-ID ein:",
+  "Enter VM/CT ID:": "Geben Sie die VM/CT-ID ein:",
+  "Enter ZFS pool name for the selected disk:": "Geben Sie den ZFS-Poolnamen für die ausgewählte Festplatte ein:",
+  "Enter a name for the mount point (used as /mnt/<name>):": "Geben Sie einen Namen für den Mount-Punkt ein (verwendet als /mnt/<Name>):",
+  "Enter a name for the new virtual machine:": "Geben Sie einen Namen für die neue virtuelle Maschine ein:",
+  "Enter a number, or write or paste a command:": "Geben Sie eine Zahl ein oder schreiben oder fügen Sie einen Befehl ein:",
+  "Enter backup file (.zst):": "Geben Sie die Sicherungsdatei (.zst) ein:",
+  "Enter backup path (.tar.zst):": "Geben Sie den Sicherungspfad (.tar.zst) ein:",
+  "Enter backup path (.vma.zst):": "Geben Sie den Sicherungspfad (.vma.zst) ein:",
+  "Enter base folder for temporary files and converter (default:": "Geben Sie den Basisordner für temporäre Dateien und den Konverter ein (Standard:",
+  "Enter boot target (e.g. scsi0, sata0, ide0):": "Geben Sie das Boot-Ziel ein (z. B. scsi0, sata0, ide0):",
+  "Enter content types (comma-separated):": "Geben Sie Inhaltstypen ein (durch Kommas getrennt):",
+  "Enter custom CIFS mount options (open uid/gid/file_mode strongly recommended for LXC bind-mounts):": "Geben Sie benutzerdefinierte CIFS-Mount-Optionen ein (open uid/gid/file_mode wird für LXC-Bind-Mounts dringend empfohlen):",
+  "Enter custom NFS mount options:": "Geben Sie benutzerdefinierte NFS-Mount-Optionen ein:",
+  "Enter custom NFS options:": "Geben Sie benutzerdefinierte NFS-Optionen ein:",
+  "Enter custom Samba configuration for this share:": "Geben Sie eine benutzerdefinierte Samba-Konfiguration für diese Freigabe ein:",
+  "Enter custom mount options:": "Geben Sie benutzerdefinierte Mount-Optionen ein:",
+  "Enter custom path": "Geben Sie einen benutzerdefinierten Pfad ein",
+  "Enter custom pathr": "Geben Sie einen benutzerdefinierten Pfad ein",
+  "Enter destination directory for exported file(s):": "Geben Sie das Zielverzeichnis für die exportierte(n) Datei(en) ein:",
+  "Enter destination path for ISO file": "Geben Sie den Zielpfad für die ISO-Datei ein",
+  "Enter destination path:": "Geben Sie den Zielpfad ein:",
+  "Enter device (e.g., sda or nvme0):": "Geben Sie das Gerät ein (z. B. sda oder nvme0):",
+  "Enter directory containing OVA/OVF files:": "Geben Sie das Verzeichnis mit den OVA/OVF-Dateien ein:",
+  "Enter directory path:": "Verzeichnispfad eingeben:",
+  "Enter disk image path:": "Geben Sie den Disk-Image-Pfad ein:",
+  "Enter disk or partition path (prefer /dev/disk/by-id/...):": "Geben Sie den Festplatten- oder Partitionspfad ein (bevorzugen Sie /dev/disk/by-id/...):",
+  "Enter domain name:": "Geben Sie den Domainnamen ein:",
+  "Enter domain:": "Domain eingeben:",
+  "Enter filesystem (ext4/xfs/btrfs):": "Geben Sie das Dateisystem ein (ext4/xfs/btrfs):",
+  "Enter folder name for /mnt:": "Geben Sie den Ordnernamen für /mnt ein:",
+  "Enter full disk path as shown above (starting with /dev/disk/by-id/xxx...):": "Geben Sie den vollständigen Festplattenpfad wie oben gezeigt ein (beginnend mit /dev/disk/by-id/xxx...):",
+  "Enter full path for mount point:": "Geben Sie den vollständigen Pfad für den Mount-Punkt ein:",
+  "Enter full path to the disk image (e.g., /var/lib/vz/images/xyz.img):": "Geben Sie den vollständigen Pfad zum Disk-Image ein (z. B. /var/lib/vz/images/xyz.img):",
+  "Enter full path to the input image (e.g., /var/lib/vz/images/disk.vmdk):": "Geben Sie den vollständigen Pfad zum Eingabebild ein (z. B. /var/lib/vz/images/disk.vmdk):",
+  "Enter full path:": "Geben Sie den vollständigen Pfad ein:",
+  "Enter host IP (e.g., 192.168.0.100):": "Geben Sie die Host-IP ein (z. B. 192.168.0.100):",
+  "Enter host or IP:": "Geben Sie Host oder IP ein:",
+  "Enter hostpci slot (e.g. 0):": "Geben Sie den Hostpci-Slot ein (z. B. 0):",
+  "Enter hostpci slot number (e.g. 0):": "Geben Sie die Hostpci-Steckplatznummer ein (z. B. 0):",
+  "Enter iSCSI target portal IP or hostname:": "Geben Sie die IP oder den Hostnamen des iSCSI-Zielportals ein:",
+  "Enter image full path:": "Geben Sie den vollständigen Pfad zum Bild ein:",
+  "Enter imported disk reference (e.g. local-lvm:vm-100-disk-0):": "Geben Sie die importierte Festplattenreferenz ein (z. B. local-lvm:vm-100-disk-0):",
+  "Enter interface (sata/scsi/virtio/ide):": "Geben Sie die Schnittstelle ein (sata/scsi/virtio/ide):",
+  "Enter interface name (e.g. eth0):": "Geben Sie den Schnittstellennamen ein (z. B. eth0):",
+  "Enter mount path on host:": "Geben Sie den Mount-Pfad auf dem Host ein:",
+  "Enter mount point in CT (e.g. /mnt/data):": "Geben Sie den Mount-Punkt in CT ein (z. B. /mnt/data):",
+  "Enter mp slot number (e.g. 0):": "Geben Sie die MP-Slot-Nummer ein (z. B. 0):",
+  "Enter name for the imported VM:": "Geben Sie den Namen für die importierte VM ein:",
+  "Enter networks to advertise (comma-separated CIDR):": "Geben Sie die zu bewerbenden Netzwerke ein (durch Kommas getrenntes CIDR):",
+  "Enter new folder name:": "Geben Sie einen neuen Ordnernamen ein:",
+  "Enter new group name:": "Geben Sie einen neuen Gruppennamen ein:",
+  "Enter partition path (e.g. /dev/sdX1):": "Geben Sie den Partitionspfad ein (z. B. /dev/sdX1):",
+  "Enter password for": "Geben Sie das Passwort für ein",
+  "Enter password:": "Passwort eingeben:",
+  "Enter path manually": "Geben Sie den Pfad manuell ein",
+  "Enter path to analyze:": "Geben Sie den zu analysierenden Pfad ein:",
+  "Enter path:": "Pfad eingeben:",
+  "Enter pool name to clear errors:": "Geben Sie den Poolnamen ein, um Fehler zu löschen:",
+  "Enter pool name to export:": "Geben Sie den Poolnamen zum Exportieren ein:",
+  "Enter pool name to import:": "Geben Sie den Poolnamen zum Importieren ein:",
+  "Enter pool name:": "Geben Sie den Poolnamen ein:",
+  "Enter pool/dataset name:": "Geben Sie den Pool-/Datensatznamen ein:",
+  "Enter pool/dataset to destroy:": "Geben Sie den zu zerstörenden Pool/Datensatz ein:",
+  "Enter pool/dataset to mount:": "Geben Sie den Pool/den Datensatz zum Mounten ein:",
+  "Enter search term (leave empty to show all scripts):": "Suchbegriff eingeben (leer lassen, um alle Skripte anzuzeigen):",
+  "Enter server IP": "Geben Sie die Server-IP ein",
+  "Enter server IP/hostname manually": "Geben Sie die Server-IP/den Hostnamen manuell ein",
+  "Enter server IP:": "Geben Sie die Server-IP ein:",
+  "Enter slot number (e.g. 0):": "Steckplatznummer eingeben (z. B. 0):",
+  "Enter storage ID for Proxmox:": "Geben Sie die Speicher-ID für Proxmox ein:",
+  "Enter storage ID:": "Geben Sie die Speicher-ID ein:",
+  "Enter storage name:": "Geben Sie den Speichernamen ein:",
+  "Enter subnet (e.g., 192.168.0.0/24):": "Geben Sie das Subnetz ein (z. B. 192.168.0.0/24):",
+  "Enter target disk (e.g. /dev/sdX):": "Geben Sie die Zielfestplatte ein (z. B. /dev/sdX):",
+  "Enter target storage name (e.g., local-lvm):": "Geben Sie den Zielspeichernamen ein (z. B. local-lvm):",
+  "Enter target storage:": "Zielspeicher eingeben:",
+  "Enter the BORG REPOKEY passphrase for target:": "Geben Sie die BORG REPOKEY-Passphrase für das Ziel ein:",
+  "Enter the Samba username:": "Geben Sie den Samba-Benutzernamen ein:",
+  "Enter the VMID for the new VM:": "Geben Sie die VMID für die neue VM ein:",
+  "Enter the container terminal:": "Betreten Sie das Containerterminal:",
+  "Enter the full path to the directory containing disk images:": "Geben Sie den vollständigen Pfad zum Verzeichnis mit den Disk-Images ein:",
+  "Enter the full path to the host directory:": "Geben Sie den vollständigen Pfad zum Hostverzeichnis ein:",
+  "Enter the full path to the host folder:": "Geben Sie den vollständigen Pfad zum Hostordner ein:",
+  "Enter the full path to the output image (e.g., /var/lib/vz/images/output.qcow2):": "Geben Sie den vollständigen Pfad zum Ausgabebild ein (z. B. /var/lib/vz/images/output.qcow2):",
+  "Enter the host mount path:": "Geben Sie den Host-Mount-Pfad ein:",
+  "Enter the iperf3 server IP or hostname:": "Geben Sie die IP oder den Hostnamen des iperf3-Servers ein:",
+  "Enter the maximum size (in MB) to allocate for /var/log in RAM (e.g. 128, 256, 512):": "Geben Sie die maximale Größe (in MB) ein, die /var/log im RAM zugewiesen werden soll (z. B. 128, 256, 512):",
+  "Enter the mount point for the NFS export (e.g., /mnt/mynfs):": "Geben Sie den Mount-Punkt für den NFS-Export ein (z. B. /mnt/mynfs):",
+  "Enter the mount point for the shared folder (e.g., /mnt/myshare):": "Geben Sie den Mount-Punkt für den freigegebenen Ordner ein (z. B. /mnt/myshare):",
+  "Enter the mount point inside the CT for": "Geben Sie den Mount-Punkt innerhalb des CT ein",
+  "Enter the number or type the interface name:": "Geben Sie die Nummer ein oder geben Sie den Schnittstellennamen ein:",
+  "Enter the password for Samba user:": "Geben Sie das Passwort für den Samba-Benutzer ein:",
+  "Enter the recovery passphrase set when the keyfile was created:": "Geben Sie die Wiederherstellungspassphrase ein, die beim Erstellen der Schlüsseldatei festgelegt wurde:",
+  "Enter username for Samba server:": "Geben Sie den Benutzernamen für den Samba-Server ein:",
+  "Enter username:": "Benutzernamen eingeben:",
+  "Enterprise Proxmox Ceph repository disabled": "Enterprise Proxmox Ceph-Repository deaktiviert",
+  "Enterprise Proxmox repository disabled": "Enterprise Proxmox-Repository deaktiviert",
+  "Enterprise repositories restored": "Unternehmensrepositorys wiederhergestellt",
+  "Enterprise repository present": "Unternehmens-Repository vorhanden",
+  "Enterprise repository returned 401 Unauthorized (no valid subscription). Switch to the no-subscription repository and retry?": "Das Unternehmens-Repository hat 401 Nicht autorisiert zurückgegeben (kein gültiges Abonnement). Zum Repository ohne Abonnement wechseln und es erneut versuchen?",
+  "Enterprise repository unauthorized and fallback declined by user": "Unternehmens-Repository nicht autorisiert und Fallback vom Benutzer abgelehnt",
+  "Entropy generation optimization removed": "Optimierung der Entropieerzeugung entfernt",
+  "Equivalent manual flow of disk_host.sh: partition, format, mount, persist, register in Proxmox.": "Äquivalenter manueller Ablauf von disk_host.sh: Partitionieren, Formatieren, Mounten, Beibehalten, Registrieren in Proxmox.",
+  "Equivalent manual flow of iscsi_host.sh.": "Äquivalenter manueller Ablauf von iscsi_host.sh.",
+  "Equivalent manual flow used by Local Shared Manager.": "Äquivalenter manueller Ablauf, der von Local Shared Manager verwendet wird.",
+  "Error": "Fehler",
+  "Error applying patch. Backups preserved at": "Fehler beim Anwenden des Patches. Backups werden aufbewahrt unter",
+  "Error details:": "Fehlerdetails:",
+  "Error installing": "Fehler bei der Installation",
+  "Error installing build dependencies. Check": "Fehler beim Installieren von Build-Abhängigkeiten. Überprüfen",
+  "Error:": "Fehler:",
+  "Error: Cannot create directory": "Fehler: Verzeichnis kann nicht erstellt werden",
+  "Error: Failed to download the script.": "Fehler: Das Skript konnte nicht heruntergeladen werden.",
+  "Error: No script data found for slug:": "Fehler: Keine Skriptdaten für Slug gefunden:",
+  "Error: No write permissions in directory": "Fehler: Keine Schreibrechte im Verzeichnis",
+  "Essential Proxmox packages installed": "Wichtige Proxmox-Pakete installiert",
+  "Estimated required free space:": "Geschätzter erforderlicher freier Speicherplatz:",
+  "Every 12 hours": "Alle 12 Stunden",
+  "Every 3 hours": "Alle 3 Stunden",
+  "Every 6 hours": "Alle 6 Stunden",
+  "Every hour": "Stündlich",
+  "Every path in this backup is kernel-tied: the restore applies these paths automatically via the safe-subset filter and re-merges the operator's tuning.": "Jeder Pfad in dieser Sicherung ist an den Kernel gebunden: Die Wiederherstellung wendet diese Pfade automatisch über den Safe-Subset-Filter an und führt die Optimierung des Operators erneut zusammen.",
+  "Everything restorable in this backup will be restored": "Alles, was in diesem Backup wiederhergestellt werden kann, wird wiederhergestellt",
+  "Example output: rootfs: local-lvm:vm-114-disk-0,size=8G": "Beispielausgabe: rootfs: local-lvm:vm-114-disk-0,size=8G",
+  "Example target: /dev/sdb": "Beispielziel: /dev/sdb",
+  "Example: /dev/pve/vm-114-disk-0": "Beispiel: /dev/pve/vm-114-disk-0",
+  "Example: /rpool/data/subvol-114-disk-0": "Beispiel: /rpool/data/subvol-114-disk-0",
+  "Example: MOUNT_PATH=\"/rpool/data/subvol-114-disk-0\"": "Beispiel: MOUNT_PATH=\"/rpool/data/subvol-114-disk-0\"",
+  "Example: cp /etc/pve/lxc/110.conf /etc/pve/lxc/110.conf.bak": "Beispiel: cp /etc/pve/lxc/110.conf /etc/pve/lxc/110.conf.bak",
+  "Example: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak": "Beispiel: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak",
+  "Example: daily or Mon..Fri 03:00": "Beispiel: täglich oder Mo..Fr 03:00",
+  "Example: mkdir -p /tmp/lxc_convert_114": "Beispiel: mkdir -p /tmp/lxc_convert_114",
+  "Example: pct config 110 | grep unprivileged": "Beispiel: pct config 110 | grep unprivilegiert",
+  "Example: pct stop 110": "Beispiel: pct stop 110",
+  "Example: pct stop 114": "Beispiel: pct stop 114",
+  "Example: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup": "Beispiel: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup",
+  "Example: pvesm path local-lvm:vm-114-disk-0": "Beispiel: pvesm-Pfad local-lvm:vm-114-disk-0",
+  "Example: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf": "Beispiel: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf",
+  "Examples:": "Beispiele:",
+  "Execute destructive rollback?": "Destruktives Rollback ausführen?",
+  "Executing destructive rollback (operator confirmed) ...": "Destruktives Rollback wird ausgeführt (Operator bestätigt) ...",
+  "Executing:": "Ausführen:",
+  "Existing Groups": "Bestehende Gruppen",
+  "Existing file, re-downloading...": "Vorhandene Datei, erneuter Download...",
+  "Existing filesystem:": "Vorhandenes Dateisystem:",
+  "Existing hostpci entries detected — they will be reused": "Vorhandene Hostpci-Einträge erkannt – sie werden wiederverwendet",
+  "Existing key is at:": "Der vorhandene Schlüssel befindet sich unter:",
+  "Existing recovery envelopes already on PBS stay intact — they still recover the old key with its original passphrase.": "Vorhandene Wiederherstellungsumschläge, die sich bereits auf PBS befinden, bleiben erhalten – sie stellen weiterhin den alten Schlüssel mit seiner ursprünglichen Passphrase wieder her.",
+  "Exit": "Ausfahrt",
+  "Exit and repair manually": "Beenden und manuell reparieren",
+  "Exit the container terminal:": "Verlassen Sie das Containerterminal:",
+  "Exit: Stop to create backup manually": "Beenden: Anhalten, um ein Backup manuell zu erstellen",
+  "Exiting for manual repair...": "Wird zur manuellen Reparatur beendet...",
+  "Expected /tmp/gasket-driver/src not found. The clone seems incomplete or uses an unknown layout.": "Erwartet, dass /tmp/gasket-driver/src nicht gefunden wurde. Der Klon scheint unvollständig zu sein oder verwendet ein unbekanntes Layout.",
+  "Expected Makefile not found in /tmp/gasket-driver/src. Source tree is incomplete.": "Erwartetes Makefile wurde in /tmp/gasket-driver/src nicht gefunden. Der Quellbaum ist unvollständig.",
+  "Expected path:": "Erwarteter Pfad:",
+  "Expected: rootfs/ directory, or /etc /var /root at archive root.": "Erwartet: rootfs/-Verzeichnis oder /etc /var /root im Archivstammverzeichnis.",
+  "Export Format": "Exportformat",
+  "Export Options": "Exportoptionen",
+  "Export Path": "Exportpfad",
+  "Export Summary": "Zusammenfassung exportieren",
+  "Export VM to OVA or OVF": "VM nach OVA oder OVF exportieren",
+  "Export a ZFS pool": "Exportieren Sie einen ZFS-Pool",
+  "Export added successfully.": "Export erfolgreich hinzugefügt.",
+  "Export backup data to file": "Sicherungsdaten in eine Datei exportieren",
+  "Export completed. The running system has not been modified.": "Export abgeschlossen. Das laufende System wurde nicht verändert.",
+  "Export completed:": "Export abgeschlossen:",
+  "Export deleted and NFS service restarted.": "Export gelöscht und NFS-Dienst neu gestartet.",
+  "Export error log": "Fehlerprotokoll exportieren",
+  "Export exists:": "Export existiert:",
+  "Export failed.": "Der Export ist fehlgeschlagen.",
+  "Export list test": "Listentest exportieren",
+  "Export list:": "Liste exportieren:",
+  "Export mode:": "Exportmodus:",
+  "Export not found on server:": "Export nicht auf Server gefunden:",
+  "Export path:": "Exportpfad:",
+  "Export permissions allow access": "Exportberechtigungen ermöglichen den Zugriff",
+  "Export to file (no system changes)": "In eine Datei exportieren (keine Systemänderungen)",
+  "Export updated successfully.": "Export erfolgreich aktualisiert.",
+  "Export:": "Export:",
+  "Exporting ZFS pool...": "ZFS-Pool wird exportiert...",
+  "Exports cleared.": "Exporte freigegeben.",
+  "Exports:": "Exporte:",
+  "Extended Filesystem 4 (recommended)": "Erweitertes Dateisystem 4 (empfohlen)",
+  "External disk for backup": "Externe Festplatte zur Sicherung",
+  "Extracting NVIDIA installer on host...": "NVIDIA-Installationsprogramm auf Host extrahieren...",
+  "Extracting OVA archive...": "OVA-Archiv wird extrahiert...",
+  "Extracting archive...": "Archiv wird extrahiert...",
+  "Extracting data from Borg...": "Extrahieren von Daten aus Borg...",
+  "Extracting data from PBS...": "Daten aus PBS extrahieren...",
+  "Extraction completed.": "Extraktion abgeschlossen.",
+  "Extraction failed.": "Die Extraktion ist fehlgeschlagen.",
+  "Extraction failed. Check log:": "Die Extraktion ist fehlgeschlagen. Protokoll prüfen:",
+  "Extraction successful": "Extraktion erfolgreich",
+  "FAILED": "FEHLGESCHLAGEN",
+  "FINAL CONFIRMATION — DATA WILL BE ERASED": "ENDGÜLTIGE BESTÄTIGUNG – DIE DATEN WERDEN GELÖSCHT",
+  "Fail2Ban - Intrusion Prevention": "Fail2Ban – Intrusion Prevention",
+  "Fail2Ban Management": "Fail2Ban-Management",
+  "Fail2Ban has been removed": "Fail2Ban wurde entfernt",
+  "Fail2Ban installation and configuration completed successfully!": "Die Installation und Konfiguration von Fail2Ban wurde erfolgreich abgeschlossen!",
+  "Fail2Ban installed successfully": "Fail2Ban erfolgreich installiert",
+  "Fail2Ban is NOT running!": "Fail2Ban läuft NICHT!",
+  "Fail2Ban is currently installed.": "Fail2Ban ist derzeit installiert.",
+  "Fail2Ban is not installed on this system.": "Fail2Ban ist auf diesem System nicht installiert.",
+  "Fail2Ban is running correctly": "Fail2Ban läuft ordnungsgemäß",
+  "Failed": "Fehlgeschlagen",
+  "Failed to access log2ram directory": "Der Zugriff auf das log2ram-Verzeichnis ist fehlgeschlagen",
+  "Failed to access share with provided credentials.": "Der Zugriff auf die Freigabe mit den angegebenen Anmeldeinformationen ist fehlgeschlagen.",
+  "Failed to access:": "Zugriff fehlgeschlagen:",
+  "Failed to add CIFS storage to Proxmox.": "CIFS-Speicher konnte nicht zu Proxmox hinzugefügt werden.",
+  "Failed to add GPU audio function": "Das Hinzufügen der GPU-Audiofunktion ist fehlgeschlagen",
+  "Failed to add GPU to target VM": "Die GPU konnte nicht zur Ziel-VM hinzugefügt werden",
+  "Failed to add IOMMU group device": "IOMMU-Gruppengerät konnte nicht hinzugefügt werden",
+  "Failed to add NFS storage to Proxmox.": "NFS-Speicher konnte nicht zu Proxmox hinzugefügt werden.",
+  "Failed to add bind mount:": "Bind-Mount konnte nicht hinzugefügt werden:",
+  "Failed to add iSCSI storage to Proxmox.": "iSCSI-Speicher konnte nicht zu Proxmox hinzugefügt werden.",
+  "Failed to add storage to Proxmox.": "Das Hinzufügen von Speicher zu Proxmox ist fehlgeschlagen.",
+  "Failed to assign Controller/NVMe": "Controller/NVMe konnte nicht zugewiesen werden",
+  "Failed to assign virtual disk": "Die Zuweisung der virtuellen Festplatte ist fehlgeschlagen",
+  "Failed to clone Lynis from GitHub": "Lynis konnte nicht von GitHub geklont werden",
+  "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "Das Klonen des log2ram-Repositorys ist fehlgeschlagen. Überprüfen Sie /tmp/log2ram_install.log",
+  "Failed to configure EFI disk": "Die EFI-Festplatte konnte nicht konfiguriert werden",
+  "Failed to configure IOMMU automatically.": "IOMMU konnte nicht automatisch konfiguriert werden.",
+  "Failed to configure Proxmox repositories": "Proxmox-Repositorys konnten nicht konfiguriert werden",
+  "Failed to configure TPM device in VM": "Das TPM-Gerät konnte in der VM nicht konfiguriert werden",
+  "Failed to configure repositories.": "Die Repositorys konnten nicht konfiguriert werden.",
+  "Failed to configure repositories. Installation aborted.": "Die Repositorys konnten nicht konfiguriert werden. Installation abgebrochen.",
+  "Failed to connect to": "Es konnte keine Verbindung hergestellt werden",
+  "Failed to connect to server.": "Verbindung zum Server fehlgeschlagen.",
+  "Failed to copy sources into": "Quellen konnten nicht kopiert werden",
+  "Failed to create EFI disk": "Fehler beim Erstellen des EFI-Datenträgers",
+  "Failed to create OVA archive.": "Das OVA-Archiv konnte nicht erstellt werden.",
+  "Failed to create TPM state disk": "Fehler beim Erstellen der TPM-Statusfestplatte",
+  "Failed to create VM": "VM konnte nicht erstellt werden",
+  "Failed to create base VM. Check VM ID and host configuration.": "Basis-VM konnte nicht erstellt werden. Überprüfen Sie die VM-ID und die Hostkonfiguration.",
+  "Failed to create directory on host:": "Verzeichnis auf Host konnte nicht erstellt werden:",
+  "Failed to create directory:": "Verzeichnis konnte nicht erstellt werden:",
+  "Failed to create disk": "Fehler beim Erstellen des Datenträgers",
+  "Failed to create encryption key. Backup cancelled — fix the underlying issue and retry.": "Fehler beim Erstellen des Verschlüsselungsschlüssels.Sicherung abgebrochen – beheben Sie das zugrunde liegende Problem und versuchen Sie es erneut.",
+  "Failed to create group:": "Gruppe konnte nicht erstellt werden:",
+  "Failed to create mount point.": "Mountpunkt konnte nicht erstellt werden.",
+  "Failed to create mount point:": "Mountpunkt konnte nicht erstellt werden:",
+  "Failed to create partition table": "Die Partitionstabelle konnte nicht erstellt werden",
+  "Failed to create partition table on disk": "Die Partitionstabelle auf der Festplatte konnte nicht erstellt werden",
+  "Failed to create partition.": "Partition konnte nicht erstellt werden.",
+  "Failed to create temporary directory:": "Temporäres Verzeichnis konnte nicht erstellt werden:",
+  "Failed to create/update ZFS ARC configuration file": "Die ZFS ARC-Konfigurationsdatei konnte nicht erstellt/aktualisiert werden",
+  "Failed to destroy LXC:": "LXC konnte nicht zerstört werden:",
+  "Failed to destroy VM:": "VM konnte nicht zerstört werden:",
+  "Failed to detect RAM size. Using default value of 16GB for ZFS ARC optimization.": "Die RAM-Größe konnte nicht erkannt werden. Verwendung des Standardwerts von 16 GB für die ZFS ARC-Optimierung.",
+  "Failed to detect installed NVIDIA driver version.": "Die installierte NVIDIA-Treiberversion konnte nicht erkannt werden.",
+  "Failed to detect partition on disk": "Die Partition auf der Festplatte konnte nicht erkannt werden",
+  "Failed to determine timezone from IP address - keeping current timezone settings": "Die Zeitzone konnte nicht anhand der IP-Adresse ermittelt werden. Die aktuellen Zeitzoneneinstellungen werden beibehalten",
+  "Failed to disable Start on boot for LXC": "Start beim Booten für LXC konnte nicht deaktiviert werden",
+  "Failed to disable Start on boot for VM": "Start beim Booten für VM konnte nicht deaktiviert werden",
+  "Failed to disable ZFS autotrim for pool:": "Die ZFS-Autotrim-Funktion für den Pool konnte nicht deaktiviert werden:",
+  "Failed to download Borg.": "Borg konnte nicht heruntergeladen werden.",
+  "Failed to download Figurine": "Figur konnte nicht heruntergeladen werden",
+  "Failed to download Helper-Scripts logo": "Das Herunterladen des Helper-Scripts-Logos ist fehlgeschlagen",
+  "Failed to download Home-Lab-Club logo": "Das Home-Lab-Club-Logo konnte nicht heruntergeladen werden",
+  "Failed to download ISO image": "Das Herunterladen des ISO-Images ist fehlgeschlagen",
+  "Failed to download JC Channel logo": "Das JC-Channel-Logo konnte nicht heruntergeladen werden",
+  "Failed to download NVIDIA installer": "Das NVIDIA-Installationsprogramm konnte nicht heruntergeladen werden",
+  "Failed to download ProxMenux logo": "Das ProxMenux-Logo konnte nicht heruntergeladen werden",
+  "Failed to download Proxmology logo": "Das Proxmology-Logo konnte nicht heruntergeladen werden",
+  "Failed to download VirtIO driver ISO.": "Das Herunterladen der VirtIO-Treiber-ISO ist fehlgeschlagen.",
+  "Failed to download amdgpu_top": "amdgpu_top konnte nicht heruntergeladen werden",
+  "Failed to edit /etc/fstab — remove the line manually.": "Die Bearbeitung von /etc/fstab ist fehlgeschlagen. Entfernen Sie die Zeile manuell.",
+  "Failed to enable ZFS autotrim for pool:": "Die ZFS-Autotrim-Funktion für den Pool konnte nicht aktiviert werden:",
+  "Failed to enable automatic time synchronization": "Die automatische Zeitsynchronisierung konnte nicht aktiviert werden",
+  "Failed to extract OVA file:": "Die OVA-Datei konnte nicht extrahiert werden:",
+  "Failed to extract package": "Paket konnte nicht extrahiert werden",
+  "Failed to fetch the Google Coral GPG key. Check": "Der Google Coral GPG-Schlüssel konnte nicht abgerufen werden. Überprüfen",
+  "Failed to format disk as": "Formatierung des Datenträgers als fehlgeschlagen",
+  "Failed to format partition": "Partition konnte nicht formatiert werden",
+  "Failed to format the partition.": "Die Partition konnte nicht formatiert werden.",
+  "Failed to get .deb download URL": "Die .deb-Download-URL konnte nicht abgerufen werden",
+  "Failed to get latest version from GitHub": "Die neueste Version konnte nicht von GitHub abgerufen werden",
+  "Failed to get release information from GitHub": "Versionsinformationen konnten nicht von GitHub abgerufen werden",
+  "Failed to get shares": "Es konnten keine Freigaben abgerufen werden",
+  "Failed to get shares from": "Es konnten keine Freigaben abgerufen werden",
+  "Failed to import": "Import fehlgeschlagen",
+  "Failed to initialize Borg repository at:": "Fehler beim Initialisieren des Borg-Repositorys unter:",
+  "Failed to install Coral TPU driver inside the container.": "Der Coral TPU-Treiber konnte nicht im Container installiert werden.",
+  "Failed to install Fail2Ban": "Fail2Ban konnte nicht installiert werden",
+  "Failed to install Fastfetch.": "Fastfetch konnte nicht installiert werden.",
+  "Failed to install NFS client packages.": "NFS-Client-Pakete konnten nicht installiert werden.",
+  "Failed to install OVH RTM": "Die Installation von OVH RTM ist fehlgeschlagen",
+  "Failed to install OpenVSwitch": "OpenVSwitch konnte nicht installiert werden",
+  "Failed to install Samba client packages.": "Samba-Client-Pakete konnten nicht installiert werden.",
+  "Failed to install amdgpu_top": "Die Installation von amdgpu_top ist fehlgeschlagen",
+  "Failed to install dependencies": "Abhängigkeiten konnten nicht installiert werden",
+  "Failed to install gawk": "Gawk konnte nicht installiert werden",
+  "Failed to install intel-gpu-tools": "Intel-GPU-Tools konnten nicht installiert werden",
+  "Failed to install libedgetpu1-std. Check": "Die Installation von libedgetpu1-std ist fehlgeschlagen. Überprüfen",
+  "Failed to install pigz": "Pigz konnte nicht installiert werden",
+  "Failed to install zfs-auto-snapshot": "Die Installation von zfs-auto-snapshot ist fehlgeschlagen",
+  "Failed to mount CIFS share on host.": "Die Bereitstellung der CIFS-Freigabe auf dem Host ist fehlgeschlagen.",
+  "Failed to mount NFS share on host.": "Die Bereitstellung der NFS-Freigabe auf dem Host ist fehlgeschlagen.",
+  "Failed to mount NFS share.": "Die NFS-Freigabe konnte nicht gemountet werden.",
+  "Failed to mount Samba share.": "Die Samba-Freigabe konnte nicht gemountet werden.",
+  "Failed to mount container filesystem.": "Das Mounten des Container-Dateisystems ist fehlgeschlagen.",
+  "Failed to mount disk": "Das Mounten der Festplatte ist fehlgeschlagen",
+  "Failed to obtain public IP address - keeping current timezone settings": "Es konnte keine öffentliche IP-Adresse abgerufen werden. Die aktuellen Zeitzoneneinstellungen werden beibehalten",
+  "Failed to refresh boot configuration": "Die Aktualisierung der Startkonfiguration ist fehlgeschlagen",
+  "Failed to refresh proxmox-boot-tool": "Das Aktualisieren des Proxmox-Boot-Tools ist fehlgeschlagen",
+  "Failed to reinstall Proxmox packages": "Die Neuinstallation der Proxmox-Pakete ist fehlgeschlagen",
+  "Failed to reinstall packages": "Die Neuinstallation der Pakete ist fehlgeschlagen",
+  "Failed to remove gateway.": "Das Gateway konnte nicht entfernt werden.",
+  "Failed to remove mount point": "Der Mountpunkt konnte nicht entfernt werden",
+  "Failed to remove storage from Proxmox.": "Der Speicher konnte nicht aus Proxmox entfernt werden.",
+  "Failed to remove storage.": "Der Speicher konnte nicht entfernt werden.",
+  "Failed to resolve group GID for": "Die Gruppen-GID für konnte nicht aufgelöst werden",
+  "Failed to restart": "Neustart fehlgeschlagen",
+  "Failed to restart container — restart manually": "Container konnte nicht neu gestartet werden – manuell neu starten",
+  "Failed to restart gateway.": "Gateway konnte nicht neu gestartet werden.",
+  "Failed to restart network service": "Netzwerkdienst konnte nicht neu gestartet werden",
+  "Failed to restart — restart manually to activate mount": "Neustart fehlgeschlagen – manuell neu starten, um die Bereitstellung zu aktivieren",
+  "Failed to restore subscription banner completely": "Das Abonnementbanner konnte nicht vollständig wiederhergestellt werden",
+  "Failed to retrieve Fastfetch download URL.": "Die Fastfetch-Download-URL konnte nicht abgerufen werden.",
+  "Failed to run log2ram installer. Check /tmp/log2ram_install.log": "Das Log2ram-Installationsprogramm konnte nicht ausgeführt werden. Überprüfen Sie /tmp/log2ram_install.log",
+  "Failed to set VM description": "Die VM-Beschreibung konnte nicht festgelegt werden",
+  "Failed to set timezone - keeping current settings": "Zeitzone konnte nicht festgelegt werden – aktuelle Einstellungen werden beibehalten",
+  "Failed to start CT": "CT konnte nicht gestartet werden",
+  "Failed to start container — start manually and check the mount": "Container konnte nicht gestartet werden – starten Sie ihn manuell und überprüfen Sie die Bereitstellung",
+  "Failed to start gateway.": "Gateway konnte nicht gestartet werden.",
+  "Failed to start long self-test on": "Langer Selbsttest konnte nicht gestartet werden",
+  "Failed to start self-test on": "Der Selbsttest konnte nicht gestartet werden",
+  "Failed to start the CT.": "Der CT konnte nicht gestartet werden.",
+  "Failed to start the container.": "Der Container konnte nicht gestartet werden.",
+  "Failed to stop gateway.": "Gateway konnte nicht gestoppt werden.",
+  "Failed to stop the container.": "Der Container konnte nicht gestoppt werden.",
+  "Failed to uninstall amdgpu_top": "Amdgpu_top konnte nicht deinstalliert werden",
+  "Failed to uninstall intel-gpu-tools": "Die Deinstallation der Intel-GPU-Tools ist fehlgeschlagen",
+  "Failed to update GRUB": "GRUB konnte nicht aktualisiert werden",
+  "Failed to update GRUB configuration": "Die GRUB-Konfiguration konnte nicht aktualisiert werden",
+  "Failed to update Lynis": "Lynis konnte nicht aktualisiert werden",
+  "Failed to update amdgpu_top": "Aktualisierung von amdgpu_top fehlgeschlagen",
+  "Failed to update auth.json — restoring backup.": "Aktualisierung von auth.json fehlgeschlagen – Sicherung wird wiederhergestellt.",
+  "Failed to update cluster certificates (might not be in a cluster)": "Cluster-Zertifikate konnten nicht aktualisiert werden (möglicherweise nicht in einem Cluster)",
+  "Failed to update intel-gpu-tools": "Aktualisierung der Intel-GPU-Tools fehlgeschlagen",
+  "Failed to update package list.": "Paketliste konnte nicht aktualisiert werden.",
+  "Failed to update package lists": "Paketlisten konnten nicht aktualisiert werden",
+  "Failed to write": "Schreiben fehlgeschlagen",
+  "Failed transitions from D3cold to D0": "Fehlgeschlagene Übergänge von D3cold zu D0",
+  "Failed. See log:": "Fehlgeschlagen. Siehe Protokoll:",
+  "Falling back to manual paste mode.": "Zurück zum manuellen Einfügemodus.",
+  "Fastfetch Logo Selection": "Auswahl des Fastfetch-Logos",
+  "Fastfetch configuration updated": "Fastfetch-Konfiguration aktualisiert",
+  "Fastfetch download URL retrieved successfully.": "Fastfetch-Download-URL erfolgreich abgerufen.",
+  "Fastfetch installation and configuration completed": "Fastfetch-Installation und -Konfiguration abgeschlossen",
+  "Fastfetch installed successfully": "Fastfetch erfolgreich installiert",
+  "Fastfetch is not installed correctly.": "Fastfetch ist nicht korrekt installiert.",
+  "Fastfetch is not installed.": "Fastfetch ist nicht installiert.",
+  "Fastfetch is not installed. Run: apt install fastfetch": "Fastfetch ist nicht installiert. Führen Sie Folgendes aus: apt install fastfetch",
+  "Fastfetch now displays: System optimised by: ProxMenux": "Fastfetch zeigt jetzt an: System optimiert von: ProxMenux",
+  "Fastfetch removed from system": "Fastfetch wurde aus dem System entfernt",
+  "Fastfetch will start automatically in the console": "Fastfetch wird automatisch in der Konsole gestartet",
+  "Figurine installation and configuration completed successfully.": "Die Installation und Konfiguration der Figur wurde erfolgreich abgeschlossen.",
+  "Figurine is not installed.": "Figur ist nicht installiert.",
+  "Figurine removed from system": "Figur aus dem System entfernt",
+  "File:": "Datei:",
+  "Filesystem": "Dateisystem",
+  "Filesystem Tools Required": "Dateisystem-Tools erforderlich",
+  "Filesystem:": "Dateisystem:",
+  "Final Confirmation": "Endgültige Bestätigung",
+  "Final confirmation": "Endgültige Bestätigung",
+  "Final storage health/status check": "Endgültige Überprüfung des Speicherzustands/-status",
+  "Find your device using https://finds.synology.com": "Finden Sie Ihr Gerät über https://finds.synology.com",
+  "Fingerprint:": "Fingerabdruck:",
+  "Firewall allows port": "Firewall erlaubt Port",
+  "Firewall settings": "Firewall-Einstellungen",
+  "Firmware :": "Firmware:",
+  "First complete DSM setup and verify Web UI/SSH access.": "Schließen Sie zunächst die DSM-Einrichtung ab und überprüfen Sie den Web-UI-/SSH-Zugriff.",
+  "First complete ZimaOS setup and verify remote access (web/SSH).": "Schließen Sie zunächst das ZimaOS-Setup ab und überprüfen Sie den Fernzugriff (Web/SSH).",
+  "First install the GPU drivers inside the guest and verify remote access (RDP/SSH).": "Installieren Sie zunächst die GPU-Treiber im Gast und überprüfen Sie den Remotezugriff (RDP/SSH).",
+  "Fix CIFS Permissions": "Korrigieren Sie die CIFS-Berechtigungen",
+  "Fix Ceph version:": "Ceph-Version reparieren:",
+  "Fix NFS Access for Unprivileged LXC": "Korrigieren Sie den NFS-Zugriff für nicht privilegiertes LXC",
+  "Fix disk space:": "Speicherplatz reparieren:",
+  "Fix kernel version:": "Kernel-Version reparieren:",
+  "Fix network connectivity": "Netzwerkkonnektivität reparieren",
+  "Fix network:": "Netzwerk reparieren:",
+  "Fix package conflicts:": "Paketkonflikte beheben:",
+  "Fix repositories:": "Repositorys reparieren:",
+  "Fix repository configuration": "Korrigieren Sie die Repository-Konfiguration",
+  "Fix systemd-boot meta-package conflict": "Beheben Sie den systemd-boot-Metapaketkonflikt",
+  "Fix systemd-boot:": "Systemd-Boot reparieren:",
+  "Fix: on the host, run": "Fix: Auf dem Host ausführen",
+  "Fixing GPG key issues...": "GPG-Schlüsselprobleme werden behoben...",
+  "Folder Name": "Ordnername",
+  "Folders in /mnt": "Ordner in /mnt",
+  "Follow post-restore progress live from ProxMenux Monitor → Backups tab after the reboot.": "Verfolgen Sie den Fortschritt nach der Wiederherstellung nach dem Neustart live über ProxMenux Monitor → Registerkarte „Backups“.",
+  "For LVM - Create mount directory and mount:": "Für LVM – Mount-Verzeichnis erstellen und mounten:",
+  "For ZFS, storage ID must start with a letter and use only letters, numbers, dot, dash, underscore or colon.": "Für ZFS muss die Speicher-ID mit einem Buchstaben beginnen und darf nur Buchstaben, Zahlen, Punkte, Bindestriche, Unterstriche oder Doppelpunkte enthalten.",
+  "For ZFS/BTRFS - Set the mount path:": "Für ZFS/BTRFS – Legen Sie den Mount-Pfad fest:",
+  "For a consistent export, the VM should be stopped.": "Für einen konsistenten Export sollte die VM gestoppt werden.",
+  "For any question, issue or bug report, please use the official repository": "Für Fragen, Probleme oder Fehlerberichte nutzen Sie bitte das offizielle Repository",
+  "For dedicated GPUs, FLR is required by this policy to reduce VM": "Für dedizierte GPUs ist gemäß dieser Richtlinie FLR erforderlich, um VM zu reduzieren",
+  "For example: pct enter 101": "Beispiel: pct Geben Sie 101 ein",
+  "For guest shares add: --options guest": "Für Gastfreigaben hinzufügen: --options Guest",
+  "For security reasons, the system cannot format it.": "Aus Sicherheitsgründen kann das System es nicht formatieren.",
+  "For unprivileged containers, use instead:": "Verwenden Sie für nichtprivilegierte Container stattdessen:",
+  "For your safety, a backup of the current configuration will be created automatically before restoring.": "Zu Ihrer Sicherheit wird vor der Wiederherstellung automatisch ein Backup der aktuellen Konfiguration erstellt.",
+  "Force APT to use IPv4": "Erzwingen Sie, dass APT IPv4 verwendet",
+  "Force NFSv3:": "NFSv3 erzwingen:",
+  "Force NFSv4:": "NFSv4 erzwingen:",
+  "Force stop VM now?": "Stoppen der VM jetzt erzwingen?",
+  "Force stop a container. Use the correct <ctid>": "Stoppen eines Containers erzwingen. Verwenden Sie die richtige <ctid>",
+  "Force stop a virtual machine. Use the correct <vmid>": "Erzwingen Sie das Stoppen einer virtuellen Maschine. Verwenden Sie die richtige <vmid>",
+  "Forcing removal...": "Entfernung erzwingen...",
+  "Format / Wipe Physical Disk (Safe)": "Physische Festplatte formatieren/löschen (sicher)",
+  "Format Mode": "Formatmodus",
+  "Format USB disk?": "USB-Datenträger formatieren?",
+  "Format disk (ERASE all data)": "Festplatte formatieren (alle Daten LÖSCHEN)",
+  "Format failed": "Formatierung fehlgeschlagen",
+  "Format filesystem": "Dateisystem formatieren",
+  "Format partition:": "Partition formatieren:",
+  "Format — erase and create new filesystem": "Formatieren – Dateisystem löschen und neues erstellen",
+  "Format:": "Format:",
+  "Format: ERASE all data and create new filesystem": "Format: Alle Daten LÖSCHEN und neues Dateisystem erstellen",
+  "Formatted and mounted": "Formatiert und gemountet",
+  "Formatting": "Formatierung",
+  "Formatting as": "Formatieren als",
+  "Formatting partition": "Partition formatieren",
+  "Found": "Gefunden",
+  "Found guest-accessible shares:": "Für Gäste zugängliche Freigaben gefunden:",
+  "Free public Proxmox repository enabled": "Kostenloses öffentliches Proxmox-Repository aktiviert",
+  "Free space OK:": "Freier Speicherplatz OK:",
+  "Free up disk space": "Geben Sie Speicherplatz frei",
+  "Free:": "Frei:",
+  "French": "Französisch",
+  "Full SMART Report": "Vollständiger SMART-Bericht",
+  "Full SMART info and attributes": "Vollständige SMART-Informationen und -Attribute",
+  "Full format       — new GPT partition + filesystem": "Vollformat – neue GPT-Partition + Dateisystem",
+  "Full format — new GPT partition + filesystem": "Vollformat – neue GPT-Partition + Dateisystem",
+  "Full format: clean + new GPT partition + filesystem": "Vollformat: sauber + neue GPT-Partition + Dateisystem",
+  "Full log:": "Vollständiges Protokoll:",
+  "Full report           — complete SMART data (scrollable)": "Vollständiger Bericht – vollständige SMART-Daten (scrollbar)",
+  "Full system upgrade, including dependencies": "Vollständiges System-Upgrade, einschließlich Abhängigkeiten",
+  "Function Level Reset (FLR) not available": "Function Level Reset (FLR) nicht verfügbar",
+  "GID already in use:": "GID bereits verwendet:",
+  "GID in CT": "GID im CT",
+  "GPU": "GPU",
+  "GPU -> VM Mode Detected": "GPU -> VM-Modus erkannt",
+  "GPU Already Added": "GPU bereits hinzugefügt",
+  "GPU Already Assigned to Another VM": "GPU bereits einer anderen VM zugewiesen",
+  "GPU Already Assigned to This VM": "GPU ist dieser VM bereits zugewiesen",
+  "GPU Busy in Running VM": "GPU ist beim Ausführen der VM ausgelastet",
+  "GPU Not Available for Reliable VM Passthrough": "GPU für zuverlässiges VM-Passthrough nicht verfügbar",
+  "GPU Not Compatible with VM Passthrough": "GPU nicht kompatibel mit VM-Passthrough",
+  "GPU Passthrough Commands": "GPU-Passthrough-Befehle",
+  "GPU Passthrough Not Configured": "GPU-Passthrough nicht konfiguriert",
+  "GPU Passthrough to VM": "GPU-Passthrough zur VM",
+  "GPU Passthrough to VM (from LXC)": "GPU-Passthrough zur VM (von LXC)",
+  "GPU Passthrough to VM (reassign from LXC and another VM)": "GPU-Passthrough zur VM (Neuzuweisung von LXC und einer anderen VM)",
+  "GPU Passthrough to VM (reassign from another VM)": "GPU-Passthrough zur VM (Neuzuweisung von einer anderen VM)",
+  "GPU ROM dump to /usr/share/kvm/": "GPU-ROM-Dump nach /usr/share/kvm/",
+  "GPU ROM dumped to": "GPU-ROM wurde ausgegeben",
+  "GPU ROM extracted from ACPI VFCT table to": "GPU-ROM aus der ACPI-VFCT-Tabelle extrahiert nach",
+  "GPU Switch Mode": "GPU-Switch-Modus",
+  "GPU Switch Mode Blocked": "GPU-Switch-Modus blockiert",
+  "GPU Used in LXC Containers": "GPU wird in LXC-Containern verwendet",
+  "GPU access removed from LXC": "GPU-Zugriff von LXC entfernt",
+  "GPU added": "GPU hinzugefügt",
+  "GPU already present in target VM — existing hostpci entry reused": "GPU bereits in der Ziel-VM vorhanden – vorhandener Hostpci-Eintrag wiederverwendet",
+  "GPU audio added": "GPU-Audio hinzugefügt",
+  "GPU audio already present in target VM — existing hostpci entry reused": "GPU-Audio ist bereits in der Ziel-VM vorhanden – vorhandener Hostpci-Eintrag wiederverwendet",
+  "GPU driver blacklisted": "GPU-Treiber auf der schwarzen Liste",
+  "GPU guard hook will block concurrent start when another VM is already using this GPU": "Der GPU-Guard-Hook blockiert den gleichzeitigen Start, wenn eine andere VM diese GPU bereits verwendet",
+  "GPU host driver blacklisted in /etc/modprobe.d/blacklist.conf": "GPU-Hosttreiber auf der schwarzen Liste in /etc/modprobe.d/blacklist.conf",
+  "GPU in VM Passthrough Mode": "GPU im VM-Passthrough-Modus",
+  "GPU kept in source VM config": "GPU wird in der Quell-VM-Konfiguration beibehalten",
+  "GPU not found with slot": "GPU mit Steckplatz nicht gefunden",
+  "GPU passthrough assistant not found. You can run it later from Hardware Graphics.": "GPU-Passthrough-Assistent nicht gefunden. Sie können es später über Hardware Graphics ausführen.",
+  "GPU passthrough changes require a host reboot.": "GPU-Passthrough-Änderungen erfordern einen Neustart des Hosts.",
+  "GPU passthrough configuration will continue now and will become effective after host reboot.": "Die GPU-Passthrough-Konfiguration wird jetzt fortgesetzt und nach dem Neustart des Hosts wirksam.",
+  "GPU passthrough configured for LXC": "GPU-Passthrough für LXC konfiguriert",
+  "GPU passthrough configured for VM": "GPU-Passthrough für VM konfiguriert",
+  "GPU passthrough to VMs requires IOMMU to be enabled in the kernel.": "GPU-Passthrough zu VMs erfordert die Aktivierung von IOMMU im Kernel.",
+  "GPU passthrough was not applied.": "GPU-Passthrough wurde nicht angewendet.",
+  "GPU passthrough was skipped (no compatible GPU detected).": "GPU-Passthrough wurde übersprungen (keine kompatible GPU erkannt).",
+  "GPU removed from VM": "GPU von VM entfernt",
+  "GPU removed from VM config": "GPU aus VM-Konfiguration entfernt",
+  "GPU switch complete: LXC mode prepared.": "GPU-Umstellung abgeschlossen: LXC-Modus vorbereitet.",
+  "GPU switch complete: VM mode prepared.": "GPU-Umstellung abgeschlossen: VM-Modus vorbereitet.",
+  "GPU switch mode completed. No reboot required.": "GPU-Umschaltmodus abgeschlossen. Kein Neustart erforderlich.",
+  "GPU will be removed from source VM config": "Die GPU wird aus der Quell-VM-Konfiguration entfernt",
+  "GPU will remain configured in source VM": "Die GPU bleibt in der Quell-VM konfiguriert",
+  "GPU/TPU - Manual CLI Guide": "GPU/TPU – Manueller CLI-Leitfaden",
+  "GPU/TPU Passthrough Commands": "GPU/TPU-Passthrough-Befehle",
+  "GPUs and Coral-TPU Menu": "GPUs und Coral-TPU-Menü",
+  "GRUB config file not found; skipping GRUB changes": "GRUB-Konfigurationsdatei nicht gefunden; Überspringen von GRUB-Änderungen",
+  "GRUB configuration updated": "GRUB-Konfiguration aktualisiert",
+  "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT wurde in der GRUB-Konfiguration nicht gefunden",
+  "GUI mode (if available)": "GUI-Modus (falls verfügbar)",
+  "Gateway is not installed.": "Gateway ist nicht installiert.",
+  "Gateway removed.": "Gateway entfernt.",
+  "Gateway restarted.": "Gateway neu gestartet.",
+  "Gateway started.": "Gateway gestartet.",
+  "Gateway stopped.": "Gateway gestoppt.",
+  "Gathering container privilege information...": "Informationen zu Containerprivilegien werden gesammelt...",
+  "Generate a new key and authorize it on the server automatically (recommended)": "Einen neuen Schlüssel generieren und automatisch auf dem Server autorisieren (empfohlen)",
+  "Generate a new key, show me the line to paste manually": "Erzeugen Sie einen neuen Schlüssel und zeigen Sie mir die Zeile, die manuell eingefügt werden soll",
+  "Generate a new keyfile": "Erzeugen Sie eine neue Schlüsseldatei",
+  "Generating OVF descriptor...": "OVF-Deskriptor wird generiert...",
+  "Generating dkms.conf...": "dkms.conf wird generiert...",
+  "Generating manifest...": "Manifest wird erstellt...",
+  "Generating missing locale:": "Fehlendes Gebietsschema wird generiert:",
+  "German": "Deutsch",
+  "Get a list of all your containers:": "Erhalten Sie eine Liste aller Ihrer Container:",
+  "Get the actual disk path:": "Ermitteln Sie den tatsächlichen Festplattenpfad:",
+  "Get the container's storage information:": "Rufen Sie die Speicherinformationen des Containers ab:",
+  "Git installed": "Git installiert",
+  "Global settings and SSH jail configured": "Globale Einstellungen und SSH-Gefängnis konfiguriert",
+  "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "Gehen Sie zu „Benutzerdefinierte Pfade verwalten“ und entfernen Sie Ihren benutzerdefinierten Eintrag, der das Ziel enthält",
+  "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "Google liefert nur ein offizielles libedgetpu APT-Repository für Debian/Ubuntu. Auf Hardware-Passthrough wurde bereits geschrieben",
+  "Graceful shutdown timed out.": "Zeitüberschreitung beim ordnungsgemäßen Herunterfahren.",
+  "Group": "Gruppe",
+  "Group 'sharedfiles' already exists inside the CT": "Die Gruppe „sharedfiles“ existiert bereits im CT",
+  "Group GID:": "Gruppen-GID:",
+  "Group created:": "Gruppe erstellt:",
+  "Group name cannot be empty.": "Der Gruppenname darf nicht leer sein.",
+  "Group:": "Gruppe:",
+  "Groups": "Gruppen",
+  "Groups:": "Gruppen:",
+  "Guest Access Denied": "Gastzugriff verweigert",
+  "Guest Access Error": "Fehler beim Gastzugriff",
+  "Guest Access Failed": "Gastzugriff fehlgeschlagen",
+  "Guest Access Validation Results:": "Ergebnisse der Gastzugriffsvalidierung:",
+  "Guest Agent configuration applied": "Gast-Agent-Konfiguration angewendet",
+  "Guest access (no authentication)": "Gastzugang (keine Authentifizierung)",
+  "Guest access confirmed for share:": "Gastzugang für Freigabe bestätigt:",
+  "Guest access denied for share:": "Gastzugang für Freigabe verweigert:",
+  "Guest access failed.": "Der Gastzugang ist fehlgeschlagen.",
+  "Guest access is not allowed on this server.": "Auf diesem Server ist kein Gastzugriff erlaubt.",
+  "Guest access test:": "Gastzugangstest:",
+  "Guest access validated successfully!": "Gastzugang erfolgreich validiert!",
+  "Guest access works for listing, but no shares are available.": "Der Gastzugang funktioniert für die Auflistung, es sind jedoch keine Freigaben verfügbar.",
+  "Guest accessible share": "Für Gäste zugänglicher Anteil",
+  "Guest accessible:": "Für Gäste zugänglich:",
+  "Guest agent detection completed": "Die Erkennung des Gastagenten ist abgeschlossen",
+  "Guest agent installation process completed": "Der Installationsprozess des Gastagenten ist abgeschlossen",
+  "Guest agent packages removed": "Gastagentenpakete entfernt",
+  "Guest configs restored:": "Gastkonfigurationen wiederhergestellt:",
+  "Guest share listing successful": "Auflistung der Gastfreigabe erfolgreich",
+  "Guided Cleanup Available": "Geführte Bereinigung verfügbar",
+  "Guided Repair Available": "Geführte Reparatur verfügbar",
+  "HA groups will be migrated to HA rules automatically": "HA-Gruppen werden automatisch zu HA-Regeln migriert",
+  "HA services disabled (configs preserved)": "HA-Dienste deaktiviert (Konfigurationen bleiben erhalten)",
+  "Hardening SSH: setting MaxAuthTries to 3...": "SSH härten: MaxAuthTries auf 3 setzen ...",
+  "Hardware": "Hardware",
+  "Hardware compatibility — these items will be skipped to keep the boot safe:": "Hardwarekompatibilität – diese Elemente werden übersprungen, um den Start zu gewährleisten:",
+  "Hardware passthrough is already configured — the Coral device is visible inside the container as /dev/apex_0 (M.2) and/or /dev/bus/usb (USB).": "Hardware-Passthrough ist bereits konfiguriert – das Coral-Gerät ist im Container als /dev/apex_0 (M.2) und/oder /dev/bus/usb (USB) sichtbar.",
+  "Hardware: GPUs and Coral-TPU": "Hardware: GPUs und Coral-TPU",
+  "Have valid backups of all VMs and containers": "Verfügen Sie über gültige Backups aller VMs und Container",
+  "Help & Info (commands)": "Hilfe & Info (Befehle)",
+  "Help & Information": "Hilfe und Informationen",
+  "Help and Info": "Hilfe und Informationen",
+  "Help and Info Commands": "Hilfe- und Infobefehle",
+  "Helper-Scripts logo applied": "Helper-Scripts-Logo angewendet",
+  "Hidden for safety": "Aus Sicherheitsgründen versteckt",
+  "Hidden:": "Versteckt:",
+  "High Availability services have been enabled successfully": "Hochverfügbarkeitsdienste wurden erfolgreich aktiviert",
+  "High Availability setup completed": "Hochverfügbarkeitseinrichtung abgeschlossen",
+  "High risk confirmation": "Bestätigung mit hohem Risiko",
+  "High-Risk GPU Power State": "GPU-Energiezustand mit hohem Risiko",
+  "Home-Lab-Club logo applied": "Logo des Home-Lab-Clubs angebracht",
+  "Host": "Gastgeber",
+  "Host Backup  →  Borg": "Host-Backup → Borg",
+  "Host Backup  →  Local archive": "Host-Backup → Lokales Archiv",
+  "Host Backup  →  PBS": "Host-Backup → PBS",
+  "Host Backup & Restore": "Host-Sicherung und -Wiederherstellung",
+  "Host Config Backup": "Sicherung der Hostkonfiguration",
+  "Host Config Backup / Restore": "Sicherung/Wiederherstellung der Host-Konfiguration",
+  "Host Config Restore": "Wiederherstellung der Hostkonfiguration",
+  "Host Directory": "Hostverzeichnis",
+  "Host Directory to LXC Mount Point": "Hostverzeichnis zum LXC-Mountpunkt",
+  "Host Directory:": "Hostverzeichnis:",
+  "Host GPU binding changed — reboot required.": "Host-GPU-Bindung geändert – Neustart erforderlich.",
+  "Host GPU detected": "Host-GPU erkannt",
+  "Host GPU is already bound to vfio-pci. Host reconfiguration/reboot should not be required for this VM-to-VM reassignment.": "Die Host-GPU ist bereits an vfio-pci gebunden. Für diese VM-zu-VM-Neuzuweisung sollte keine Host-Neukonfiguration/Neustart erforderlich sein.",
+  "Host IP": "Host-IP",
+  "Host Mount Path": "Host-Mount-Pfad",
+  "Host NFS/Samba as Proxmox Storage (pvesm)": "NFS/Samba als Proxmox-Speicher hosten (pvesm)",
+  "Host Path": "Hostpfad",
+  "Host Path:": "Hostpfad:",
+  "Host Storage (NFS / Samba via Proxmox)": "Hostspeicher (NFS / Samba über Proxmox)",
+  "Host VFIO config was already up to date — no reboot needed.": "Die Host-VFIO-Konfiguration war bereits auf dem neuesten Stand – kein Neustart erforderlich.",
+  "Host VFIO configuration already up to date": "Host-VFIO-Konfiguration bereits auf dem neuesten Stand",
+  "Host VFIO configuration changed (initramfs updated). Reboot required before starting the VM.": "Host-VFIO-Konfiguration geändert (initramfs aktualisiert). Vor dem Starten der VM ist ein Neustart erforderlich.",
+  "Host VFIO configuration changed — reboot required before starting the VM.": "Host-VFIO-Konfiguration geändert – Neustart erforderlich, bevor die VM gestartet wird.",
+  "Host already in VFIO mode — skipping host reconfiguration for VM reassignment": "Host bereits im VFIO-Modus – Host-Neukonfiguration für VM-Neuzuweisung wird übersprungen",
+  "Host backup attached to PVE job": "Host-Backup an PVE-Job angehängt",
+  "Host directory access for unprivileged containers has been prepared above": "Der Host-Verzeichniszugriff für unprivilegierte Container wurde oben vorbereitet",
+  "Host directory permissions updated — unprivileged containers can now access it": "Host-Verzeichnisberechtigungen aktualisiert – nicht privilegierte Container können jetzt darauf zugreifen",
+  "Host directory:": "Hostverzeichnis:",
+  "Host fstab CIFS Mounts:": "Host fstab CIFS-Mounts:",
+  "Host fstab CIFS mounts (not registered with pvesm):": "Host fstab CIFS-Mounts (nicht bei pvesm registriert):",
+  "Host fstab CIFS mounts:": "Host fstab CIFS-Mounts:",
+  "Host fstab Mount:": "Host-fstab-Mount:",
+  "Host fstab NFS Mounts:": "Host-fstab-NFS-Mounts:",
+  "Host fstab NFS mounts (not registered with pvesm):": "Host-fstab-NFS-Mounts (nicht bei pvesm registriert):",
+  "Host fstab NFS mounts:": "Host-fstab-NFS-Mounts:",
+  "Host fstab mounts (not registered as Proxmox storage):": "Host-fstab-Mounts (nicht als Proxmox-Speicher registriert):",
+  "Host identity (hostname, hosts)": "Hostidentität (Hostname, Hosts)",
+  "Host permissions applied (o+rwx + default ACL) — unprivileged LXCs can read/write through bind-mounts": "Angewandte Host-Berechtigungen (o+rwx + Standard-ACL) – nicht privilegierte LXCs können über Bind-Mounts lesen/schreiben",
+  "Host write access confirmed.": "Host-Schreibzugriff bestätigt.",
+  "Hostname": "Hostname",
+  "Hot changes applied. No reboot needed for these paths.": "Heiße Änderungen angewendet. Für diese Pfade ist kein Neustart erforderlich.",
+  "How do you want to add it?": "Wie möchten Sie es hinzufügen?",
+  "How do you want to authenticate this backup target?": "Wie möchten Sie dieses Sicherungsziel authentifizieren?",
+  "How do you want to select the": "Wie möchten Sie das auswählen?",
+  "How do you want to select the HOST folder to mount?": "Wie möchten Sie den HOST-Ordner zum Mounten auswählen?",
+  "How do you want to select the NFS server?": "Wie möchten Sie den NFS-Server auswählen?",
+  "How do you want to select the Samba server?": "Wie möchten Sie den Samba-Server auswählen?",
+  "How do you want to select the folder to export?": "Wie möchten Sie den zu exportierenden Ordner auswählen?",
+  "How do you want to select the folder to share?": "Wie möchten Sie den Ordner zur Freigabe auswählen?",
+  "How to Access an LXC Terminal": "So greifen Sie auf ein LXC-Terminal zu",
+  "How to Access an LXC Terminal from Proxmox Host": "So greifen Sie vom Proxmox-Host auf ein LXC-Terminal zu",
+  "How to schedule": "So planen Sie",
+  "I have read this": "Ich habe das gelesen",
+  "I/O priority configured": "E/A-Priorität konfiguriert",
+  "ID already in use. Please choose another.": "ID bereits verwendet. Bitte wählen Sie eine andere.",
+  "IMPORTANT": "WICHTIG",
+  "IMPORTANT NOTES:": "WICHTIGE HINWEISE:",
+  "IMPORTANT PREREQUISITES:": "WICHTIGE VORAUSSETZUNGEN:",
+  "IMPORTANT — Save this passphrase": "WICHTIG – Speichern Sie diese Passphrase",
+  "IOMMU Group": "IOMMU-Gruppe",
+  "IOMMU Group Error": "IOMMU-Gruppenfehler",
+  "IOMMU Group Pending": "IOMMU-Gruppe ausstehend",
+  "IOMMU Pending Reboot": "IOMMU wartet auf Neustart",
+  "IOMMU Required": "IOMMU erforderlich",
+  "IOMMU already configured in /etc/kernel/cmdline": "IOMMU ist bereits in /etc/kernel/cmdline konfiguriert",
+  "IOMMU already configured in GRUB": "IOMMU ist bereits in GRUB konfiguriert",
+  "IOMMU already configured in kernel parameters": "IOMMU ist bereits in den Kernel-Parametern konfiguriert",
+  "IOMMU already enabled in GRUB configuration": "IOMMU ist bereits in der GRUB-Konfiguration aktiviert",
+  "IOMMU and VFIO setup completed": "IOMMU- und VFIO-Einrichtung abgeschlossen",
+  "IOMMU configured successfully.": "IOMMU erfolgreich konfiguriert.",
+  "IOMMU configured. GPU passthrough setup will continue now and will be effective after reboot.": "IOMMU konfiguriert. Das GPU-Passthrough-Setup wird jetzt fortgesetzt und ist nach dem Neustart wirksam.",
+  "IOMMU enabled in GRUB configuration": "IOMMU in der GRUB-Konfiguration aktiviert",
+  "IOMMU groups are not available yet because reboot is pending.": "IOMMU-Gruppen sind noch nicht verfügbar, da ein Neustart aussteht.",
+  "IOMMU has been enabled on this system.": "IOMMU wurde auf diesem System aktiviert.",
+  "IOMMU has been enabled on this system. A reboot is required to apply the changes. Reboot now?": "IOMMU wurde auf diesem System aktiviert. Um die Änderungen zu übernehmen, ist ein Neustart erforderlich. Jetzt neu starten?",
+  "IOMMU has been enabled — a system reboot is required": "IOMMU wurde aktiviert – ein Systemneustart ist erforderlich",
+  "IOMMU interrupt remapping configured": "IOMMU-Interrupt-Neuzuordnung konfiguriert",
+  "IOMMU is already active on this system": "IOMMU ist auf diesem System bereits aktiv",
+  "IOMMU is already configured for next boot, but it is not active yet.": "IOMMU ist bereits für den nächsten Start konfiguriert, aber noch nicht aktiv.",
+  "IOMMU is enabled on the system": "IOMMU ist auf dem System aktiviert",
+  "IOMMU is not active on this host.": "IOMMU ist auf diesem Host nicht aktiv.",
+  "IOMMU is not active on this system.": "IOMMU ist auf diesem System nicht aktiv.",
+  "IOMMU is not active. Skipping Controller + NVMe assignment.": "IOMMU ist nicht aktiv. Überspringen der Controller- und NVMe-Zuweisung.",
+  "IOMMU kernel parameters configured": "IOMMU-Kernelparameter konfiguriert",
+  "IOMMU parameters added to /etc/kernel/cmdline": "IOMMU-Parameter zu /etc/kernel/cmdline hinzugefügt",
+  "IOMMU parameters added to GRUB": "IOMMU-Parameter zu GRUB hinzugefügt",
+  "IOMMU parameters removed from /etc/kernel/cmdline": "IOMMU-Parameter aus /etc/kernel/cmdline entfernt",
+  "IOMMU parameters removed from GRUB": "IOMMU-Parameter aus GRUB entfernt",
+  "IOMMU was configured during this wizard and a reboot is pending.": "IOMMU wurde während dieses Assistenten konfiguriert und ein Neustart steht aus.",
+  "IOMMU/VFIO configuration reverted": "IOMMU/VFIO-Konfiguration wurde zurückgesetzt",
+  "IP": "IP",
+  "IP or hostname of the PVE node hosting the Borg server LXC:": "IP oder Hostname des PVE-Knotens, der den Borg-Server LXC hostet:",
+  "ISO": "ISO",
+  "ISO created successfully:": "ISO erfolgreich erstellt:",
+  "ISO image         — installation images": "ISO-Image – Installationsimages",
+  "ISO image downloaded": "ISO-Image heruntergeladen",
+  "ISO not found to mount on device": "ISO zum Mounten auf dem Gerät nicht gefunden",
+  "Identical:": "Identisch:",
+  "Identify candidate disk (never use system disk):": "Identifizieren Sie den Kandidatendatenträger (verwenden Sie niemals den Systemdatenträger):",
+  "Identify persistent disk paths": "Identifizieren Sie persistente Festplattenpfade",
+  "If 'proxmox-ve' removal warning:": "Wenn Warnung zum Entfernen von „proxmox-ve“:",
+  "If Code 43 error appears, KVM hiding is already configured.": "Wenn der Fehler Code 43 auftritt, ist das KVM-Ausblenden bereits konfiguriert.",
+  "If GUI does not load:": "Wenn die GUI nicht geladen wird:",
+  "If ZFS errors occur:": "Wenn ZFS-Fehler auftreten:",
+  "If booting in EFI mode with root on LVM: install GRUB for EFI": "If booting in EFI mode with root on LVM: install GRUB for EFI",
+  "If config issues occur:": "Wenn Konfigurationsprobleme auftreten:",
+  "If container won't start:": "Wenn der Container nicht startet:",
+  "If imported from ESXi: install qemu-guest-agent inside the guest OS": "Bei Import aus ESXi: Installieren Sie qemu-guest-agent im Gastbetriebssystem",
+  "If it still fails, the NFS server export options must be changed on the server.": "Wenn dies immer noch fehlschlägt, müssen die NFS-Server-Exportoptionen auf dem Server geändert werden.",
+  "If it warns about 'systemd-boot' meta-package, remove it:": "Wenn eine Warnung vor dem Metapaket „systemd-boot“ angezeigt wird, entfernen Sie es:",
+  "If mount fails (LVM):": "Wenn die Bereitstellung fehlschlägt (LVM):",
+  "If needed again, re-add GPU to LXC from GPUs and Coral-TPU Menu → Add GPU to LXC.": "Bei Bedarf erneut GPU zu LXC hinzufügen über GPUs und Coral-TPU-Menü → GPU zu LXC hinzufügen.",
+  "If network does not work:": "Wenn das Netzwerk nicht funktioniert:",
+  "If not 19.x, upgrade Ceph (Reef→Squid) first per the official guide:": "Wenn nicht 19.x, aktualisieren Sie zuerst Ceph (Reef→Squid) gemäß der offiziellen Anleitung:",
+  "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.": "Wenn Benachrichtigungen aktiviert sind (Telegram/Discord/ntfy/...), erhalten Sie die Meldung „Host-Wiederherstellung abgeschlossen“, wenn alle Hintergrundaufgaben abgeschlossen sind.",
+  "If passthrough fails on Windows: install RadeonResetBugFix.": "Wenn Passthrough unter Windows fehlschlägt: Installieren Sie RadeonResetBugFix.",
+  "If path not accessible (ZFS/BTRFS):": "Wenn der Pfad nicht zugänglich ist (ZFS/BTRFS):",
+  "If pvesm path returned a DEVICE (LVM):": "Wenn der pvesm-Pfad ein GERÄT (LVM) zurückgegeben hat:",
+  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Wenn der pvesm-Pfad ein VERZEICHNIS (ZFS/BTRFS) zurückgegeben hat:",
+  "If repositories error:": "Bei Repository-Fehler:",
+  "If the host freezes, remove hostpci entries from": "Wenn der Host einfriert, entfernen Sie die Hostpci-Einträge aus",
+  "If this happens, you can restore the backup from the 'Subscription Banner Removal' option in 'Uninstall optimizations'.": "In diesem Fall können Sie die Sicherung über die Option „Entfernung des Abonnementbanners“ unter „Optimierungen deinstallieren“ wiederherstellen.",
+  "If this node runs hyper-converged Ceph: ensure Ceph is 19.x (Squid) BEFORE upgrading PVE.": "Wenn dieser Knoten hyperkonvergentes Ceph ausführt: Stellen Sie sicher, dass Ceph 19.x (Squid) ist, BEVOR Sie PVE aktualisieren.",
+  "If upgrade fails:": "Wenn das Upgrade fehlschlägt:",
+  "If you are sure you want to use it, please remove the": "Wenn Sie sicher sind, dass Sie es verwenden möchten, entfernen Sie bitte das",
+  "If you choose No, install": "Wenn Sie „Nein“ wählen, installieren Sie es",
+  "If you continue, some adjustments may be duplicated or conflict with those already made by xshok.": "Wenn Sie fortfahren, werden möglicherweise einige Anpassungen dupliziert oder stehen in Konflikt mit den bereits von xshok vorgenommenen.",
+  "If you lose connectivity, you can restore from backup using the console.": "Wenn die Verbindung unterbrochen wird, können Sie über die Konsole eine Wiederherstellung aus dem Backup durchführen.",
+  "If you lose or reinstall this host without a copy of the passphrase somewhere else (password manager, offline note, another host, USB stick...), every encrypted archive in this Borg repository becomes UNRECOVERABLE.": "Wenn Sie diesen Host verlieren oder ohne eine Kopie der Passphrase woanders (Passwort-Manager, Offline-Notiz, anderer Host, USB-Stick...) neu installieren, wird jedes verschlüsselte Archiv in diesem Borg-Repository UNWIEDERHERSTELLBAR.",
+  "If you want HDMI/analog audio inside the VM, select the audio controller(s) to pass through along with the GPU.": "Wenn Sie HDMI/analoges Audio innerhalb der VM wünschen, wählen Sie die Audio-Controller aus, die zusammen mit der GPU weitergeleitet werden sollen.",
+  "If you want to use a physical monitor on the passthrough GPU:": "Wenn Sie einen physischen Monitor auf der Passthrough-GPU verwenden möchten:",
+  "If your DHCP has a static reservation for the old MAC, update it.": "Wenn Ihr DHCP eine statische Reservierung für den alten MAC hat, aktualisieren Sie diese.",
+  "Image Source Directory": "Bildquellenverzeichnis",
+  "Image directory:": "Bildverzeichnis:",
+  "Image file not found:": "Bilddatei nicht gefunden:",
+  "Image imported:": "Bild importiert:",
+  "Images to import:": "Zu importierende Bilder:",
+  "Import            — disk image imports": "Importieren – Disk-Image-Importe",
+  "Import Disk Image to VM": "Disk-Image in VM importieren",
+  "Import Disk to LXC": "Datenträger in LXC importieren",
+  "Import Disk to VM": "Datenträger in VM importieren",
+  "Import Disks Selected:": "Ausgewählte Datenträger importieren:",
+  "Import PBS keyfile": "PBS-Schlüsseldatei importieren",
+  "Import Summary": "Zusammenfassung importieren",
+  "Import VM from OVA or OVF": "VM aus OVA oder OVF importieren",
+  "Import a ZFS pool": "Importieren Sie einen ZFS-Pool",
+  "Import a keyfile from an absolute path (replaces the current one)": "Importieren Sie eine Schlüsseldatei aus einem absoluten Pfad (ersetzt den aktuellen)",
+  "Import disk assigned": "Importdatenträger zugewiesen",
+  "Import disk image to VM": "Disk-Image in VM importieren",
+  "Import disks": "Datenträger importieren",
+  "Import encryption keyfile": "Verschlüsselungsschlüsseldatei importieren",
+  "Import failed": "Import fehlgeschlagen",
+  "Import failed for:": "Der Import ist fehlgeschlagen für:",
+  "Important: both VMs cannot be running at the same time with the same GPU.": "Wichtig: Beide VMs können nicht gleichzeitig mit derselben GPU ausgeführt werden.",
+  "Important: some GPUs may still fail in passthrough and can affect host stability or overall performance depending on hardware/firmware quality.": "Wichtig: Einige GPUs können beim Passthrough immer noch ausfallen und je nach Hardware-/Firmware-Qualität die Hoststabilität oder die Gesamtleistung beeinträchtigen.",
+  "Importing": "Importieren",
+  "Importing disk": "Datenträger importieren",
+  "Importing:": "Importieren:",
+  "Improve log rotation and limit log size to save space and extend disk life": "Verbessern Sie die Protokollrotation und begrenzen Sie die Protokollgröße, um Platz zu sparen und die Lebensdauer der Festplatte zu verlängern",
+  "In the loader interface, follow the instructions to select your Synology model": "Befolgen Sie in der Loader-Oberfläche die Anweisungen, um Ihr Synology-Modell auszuwählen",
+  "In use": "Im Einsatz",
+  "In use by VM/LXC config": "Wird von der VM/LXC-Konfiguration verwendet",
+  "In use by running VM/LXC — stop it first": "Wird durch die Ausführung von VM/LXC verwendet – stoppen Sie es zuerst",
+  "Inaccessible device during VM startup": "Während des VM-Starts ist kein Zugriff auf das Gerät möglich",
+  "Inactive": "Inaktiv",
+  "Inactive (entry in fstab, not currently mounted)": "Inaktiv (Eintrag in fstab, derzeit nicht gemountet)",
+  "Includes /etc/network (may drop SSH immediately)": "Enthält /etc/network (kann SSH sofort löschen)",
+  "Includes /etc/zfs": "Enthält /etc/zfs",
+  "Includes cluster data (/etc/pve, /var/lib/pve-cluster)": "Enthält Clusterdaten (/etc/pve, /var/lib/pve-cluster)",
+  "Incompatible GPU for VM Passthrough": "Inkompatible GPU für VM-Passthrough",
+  "Incompatible Machine Type": "Inkompatibler Maschinentyp",
+  "Incompatible Reset Capability for AMD dGPU": "Inkompatible Reset-Funktion für AMD dGPU",
+  "Incompatible Reset Capability for Intel GPU": "Inkompatible Reset-Funktion für Intel-GPU",
+  "Incompatible Reset Capability for Intel dGPU": "Inkompatible Reset-Funktion für Intel dGPU",
+  "Incompatible archive": "Inkompatibles Archiv",
+  "Increase container RAM temporarily to": "Erhöhen Sie den Container-RAM vorübergehend auf",
+  "Increase file and process limits for advanced workloads": "Erhöhen Sie die Datei- und Prozesslimits für erweiterte Workloads",
+  "Increase various system limits": "Verschiedene Systemgrenzen erhöhen",
+  "Increase vzdump backup speed": "Erhöhen Sie die Backup-Geschwindigkeit von vzdump",
+  "Increasing maximum file system open files...": "Die maximale Anzahl geöffneter Dateien im Dateisystem wird erhöht...",
+  "Increasing various system limits...": "Verschiedene Systemgrenzen erhöhen...",
+  "Inherited retention:": "Geerbte Aufbewahrung:",
+  "Inherited schedule:": "Geerbter Zeitplan:",
+  "Initializing Borg repository if needed...": "Initialisierung des Borg-Repositorys bei Bedarf ...",
+  "Initiator IQN is authorised on the target": "Der Initiator-IQN ist auf dem Ziel autorisiert",
+  "Initiator IQN:": "Initiator-IQN:",
+  "Inspect disks before any action": "Überprüfen Sie die Datenträger vor jeder Aktion",
+  "Inspect host device nodes": "Untersuchen Sie die Host-Geräteknoten",
+  "Inspect passthrough/kernel events": "Überprüfen Sie Passthrough-/Kernel-Ereignisse",
+  "Inspect storage config block:": "Überprüfen Sie den Speicherkonfigurationsblock:",
+  "Inspection commands run directly. Template commands [T] require parameter substitution.": "Inspektionsbefehle werden direkt ausgeführt. Vorlagenbefehle [T] erfordern eine Parameterersetzung.",
+  "Install": "Installieren",
+  "Install ALL utilities": "Installieren Sie ALLE Dienstprogramme",
+  "Install AMD GPU drivers inside the guest.": "Installieren Sie AMD-GPU-Treiber im Gast.",
+  "Install CIFS client packages inside CT:": "Installieren Sie CIFS-Client-Pakete in CT:",
+  "Install Coral TPU in LXC": "Installieren Sie Coral TPU in LXC",
+  "Install Fail2Ban": "Installieren Sie Fail2Ban",
+  "Install Figurine": "Figur installieren",
+  "Install Intel Graphics Driver inside the guest.": "Installieren Sie den Intel-Grafiktreiber im Gast.",
+  "Install Lynis": "Installieren Sie Lynis",
+  "Install NFS client packages inside CT:": "Installieren Sie NFS-Client-Pakete in CT:",
+  "Install NVIDIA Drivers on Host": "Installieren Sie NVIDIA-Treiber auf dem Host",
+  "Install NVIDIA drivers from nvidia.com inside the guest.": "Installieren Sie NVIDIA-Treiber von nvidia.com im Gast.",
+  "Install NVIDIA proprietary drivers": "Installieren Sie proprietäre NVIDIA-Treiber",
+  "Install OVH Real Time Monitoring": "Installieren Sie OVH Real Time Monitoring",
+  "Install Open vSwitch": "Open vSwitch installieren",
+  "Install Samba inside CT:": "Installieren Sie Samba in CT:",
+  "Install ZFS auto-snapshot": "ZFS-Auto-Snapshot installieren",
+  "Install analysis tools": "Analysetools installieren",
+  "Install and configure": "Installieren und konfigurieren",
+  "Install and configure Fastfetch": "Fastfetch installieren und konfigurieren",
+  "Install and configure Log2RAM": "Log2RAM installieren und konfigurieren",
+  "Install and start iSCSI initiator:": "iSCSI-Initiator installieren und starten:",
+  "Install basic utilities": "Installieren Sie grundlegende Dienstprogramme",
+  "Install common system utilities": "Allgemeine Systemdienstprogramme installieren",
+  "Install compression tools": "Installieren Sie Komprimierungstools",
+  "Install development tools": "Installieren Sie Entwicklungstools",
+  "Install maintainer's version (Y)": "Version des Betreuers installieren (Y)",
+  "Install manually and retry: apt-get install -y exfatprogs": "Manuell installieren und erneut versuchen: apt-get install -y exfatprogs",
+  "Install manually with:": "Manuell installieren mit:",
+  "Install network tools": "Installieren Sie Netzwerktools",
+  "Install podman or docker to continue.": "Installieren Sie Podman oder Docker, um fortzufahren.",
+  "Install relevant guest agent": "Relevanten Gastagenten installieren",
+  "Install server packages inside CT:": "Installieren Sie Serverpakete in CT:",
+  "Install terminal multiplexers": "Installieren Sie Terminal-Multiplexer",
+  "Install the Edge TPU runtime (libedgetpu1-std)": "Installieren Sie die Edge TPU-Laufzeit (libedgetpu1-std).",
+  "Install with Cloud-Init script": "Installation mit Cloud-Init-Skript",
+  "Install with ISO from UUP Dump": "Mit ISO von UUP Dump installieren",
+  "Install with personal ISO": "Mit persönlicher ISO installieren",
+  "Install with traditional method": "Mit herkömmlicher Methode installieren",
+  "Install with: apt-get install open-iscsi": "Installieren mit: apt-get install open-iscsi",
+  "Install/Update Coral TPU on Host": "Coral TPU auf dem Host installieren/aktualisieren",
+  "Install/Update NVIDIA Drivers (Host + LXC)": "NVIDIA-Treiber installieren/aktualisieren (Host + LXC)",
+  "Installation Complete": "Installation abgeschlossen",
+  "Installation completed.": "Installation abgeschlossen.",
+  "Installation completed. Please reboot the server manually as soon as possible.": "Installation abgeschlossen. Bitte starten Sie den Server so schnell wie möglich manuell neu.",
+  "Installation completed. Press Enter to continue...": "Installation abgeschlossen. Drücken Sie die Eingabetaste, um fortzufahren...",
+  "Installation failed": "Die Installation ist fehlgeschlagen",
+  "Installation finished but drivers are not loaded. A reboot may be required.": "Die Installation ist abgeschlossen, aber die Treiber sind nicht geladen. Möglicherweise ist ein Neustart erforderlich.",
+  "Installation log:": "Installationsprotokoll:",
+  "Installation summary": "Zusammenfassung der Installation",
+  "Installed": "Installiert",
+  "Installed at:": "Installiert unter:",
+  "Installed components:": "Installierte Komponenten:",
+  "Installed:": "Installiert:",
+  "Installer already downloaded and verified.": "Das Installationsprogramm wurde bereits heruntergeladen und überprüft.",
+  "Installer copied to container.": "Installer in Container kopiert.",
+  "Installer downloaded.": "Installer heruntergeladen.",
+  "Installer finished with errors.": "Installationsprogramm mit Fehlern abgeschlossen.",
+  "Installer not found:": "Installationsprogramm nicht gefunden:",
+  "Installing": "Installieren",
+  "Installing AMD mesa drivers in container...": "AMD-Mesa-Treiber werden im Container installiert...",
+  "Installing Ceph packages...": "Ceph-Pakete werden installiert...",
+  "Installing Ceph support...": "Ceph-Unterstützung wird installiert...",
+  "Installing Coral TPU driver inside the container...": "Coral TPU-Treiber wird im Container installiert ...",
+  "Installing Edge TPU runtime (libedgetpu1-std)...": "Edge TPU-Laufzeit wird installiert (libedgetpu1-std) ...",
+  "Installing Fail2Ban...": "Fail2Ban wird installiert...",
+  "Installing Git as a prerequisite...": "Git als Voraussetzung installieren...",
+  "Installing Intel VA-API drivers in container...": "Intel VA-API-Treiber werden im Container installiert...",
+  "Installing Log2RAM from GitHub...": "Log2RAM von GitHub installieren...",
+  "Installing Log2RAM from source...": "Log2RAM von der Quelle installieren...",
+  "Installing NFS Client in LXC": "NFS-Client in LXC installieren",
+  "Installing NFS client packages...": "NFS-Client-Pakete werden installiert...",
+  "Installing NFS client tools...": "NFS-Client-Tools werden installiert...",
+  "Installing NFS server packages inside the CT...": "NFS-Serverpakete im CT installieren...",
+  "Installing NVIDIA drivers in container. This may take several minutes...": "NVIDIA-Treiber im Container installieren. Dies kann einige Minuten dauern...",
+  "Installing NVIDIA udev rules and persistence service...": "NVIDIA udev-Regeln und Persistenzdienst werden installiert ...",
+  "Installing NVIDIA utils (Alpine)...": "NVIDIA-Dienstprogramme werden installiert (Alpine)...",
+  "Installing NVIDIA utils (Arch)...": "NVIDIA-Dienstprogramme werden installiert (Arch)...",
+  "Installing OVH RTM (Real Time Monitoring)...": "OVH RTM (Echtzeitüberwachung) installieren...",
+  "Installing OpenVSwitch for virtual internal network...": "OpenVSwitch für virtuelles internes Netzwerk installieren ...",
+  "Installing OpenVSwitch packages...": "OpenVSwitch-Pakete werden installiert...",
+  "Installing Samba Client": "Samba-Client installieren",
+  "Installing Samba Client in LXC": "Samba-Client in LXC installieren",
+  "Installing Samba client tools...": "Samba-Client-Tools werden installiert...",
+  "Installing Samba server packages inside the CT...": "Samba-Serverpakete im CT installieren...",
+  "Installing Samba/CIFS client packages...": "Samba/CIFS-Client-Pakete werden installiert...",
+  "Installing amdgpu_top...": "amdgpu_top wird installiert...",
+  "Installing and configuring Fail2Ban to protect Proxmox web interface and SSH...": "Installieren und Konfigurieren von Fail2Ban zum Schutz der Proxmox-Weboberfläche und SSH ...",
+  "Installing and configuring Fastfetch...": "Fastfetch installieren und konfigurieren...",
+  "Installing and configuring Figurine...": "Figur installieren und konfigurieren...",
+  "Installing and configuring ZFS auto-snapshot...": "Installieren und Konfigurieren des automatischen ZFS-Snapshots...",
+  "Installing build dependencies...": "Build-Abhängigkeiten werden installiert...",
+  "Installing dependency:": "Abhängigkeit installieren:",
+  "Installing essential Proxmox packages...": "Wichtige Proxmox-Pakete werden installiert...",
+  "Installing gawk (required for OVF parsing)...": "Gawk wird installiert (erforderlich für OVF-Parsing) ...",
+  "Installing group": "Gruppe installieren",
+  "Installing host drivers while the GPU is assigned to a VM could break passthrough and destabilize the system.": "Die Installation von Hosttreibern, während die GPU einer VM zugewiesen ist, könnte den Passthrough unterbrechen und das System destabilisieren.",
+  "Installing iSCSI initiator tools...": "iSCSI-Initiator-Tools werden installiert...",
+  "Installing intel-gpu-tools...": "Intel-GPU-Tools werden installiert...",
+  "Installing kexec-tools...": "Kexec-Tools werden installiert...",
+  "Installing latest Lynis security scan tool...": "Das neueste Lynis-Sicherheitsscantool wird installiert ...",
+  "Installing packages...": "Pakete werden installiert...",
+  "Installing pigz...": "Pigz wird installiert...",
+  "Installing required dependencies...": "Erforderliche Abhängigkeiten werden installiert...",
+  "Installing required package: git": "Erforderliches Paket installieren: git",
+  "Installing required tools...": "Erforderliche Tools werden installiert...",
+  "Installing selected utilities": "Ausgewählte Dienstprogramme installieren",
+  "Installing system utilities...": "Systemdienstprogramme werden installiert...",
+  "Installing zfs-auto-snapshot package...": "ZFS-Auto-Snapshot-Paket wird installiert...",
+  "Installs essential packages if missing": "Installiert wichtige Pakete, falls diese fehlen",
+  "Insufficient Disk Space": "Nicht genügend Speicherplatz",
+  "Insufficient disk space. Skipping LXC": "Nicht genügend Speicherplatz. LXC überspringen",
+  "Insufficient memory. NVIDIA install aborted.": "Unzureichender Speicher. NVIDIA-Installation abgebrochen.",
+  "Insufficient memory. Skipping LXC": "Unzureichender Speicher. LXC überspringen",
+  "Insufficient space:": "Nicht genügend Platz:",
+  "Integrity check failed on": "Die Integritätsprüfung ist fehlgeschlagen",
+  "Intel CPU detected": "Intel-CPU erkannt",
+  "Intel GPU Tools installation completed!": "Die Installation der Intel GPU Tools ist abgeschlossen!",
+  "Intel GPU(s) detected:": "Erkannte Intel-GPU(s):",
+  "Intel VA-API drivers installed.": "Intel VA-API-Treiber installiert.",
+  "Intel iGPU passthrough configured.": "Intel iGPU-Passthrough konfiguriert.",
+  "Interactive (guided, prompts visible)": "Interaktiv (geführt, Eingabeaufforderungen sichtbar)",
+  "Interactive process viewer (press q to exit)": "Interaktiver Prozess-Viewer (zum Beenden q drücken)",
+  "Interface": "Schnittstelle",
+  "Interface MTU": "Schnittstellen-MTU",
+  "Interface Names (persistent)": "Schnittstellennamen (persistent)",
+  "Interface Type": "Schnittstellentyp",
+  "Interface names will return to default systemd behavior.": "Schnittstellennamen kehren zum Standardverhalten von systemd zurück.",
+  "Interface type:": "Schnittstellentyp:",
+  "Interfaces configured": "Schnittstellen konfiguriert",
+  "Interfaces defined with 'auto' but no 'iface' block": "Schnittstellen, die mit „auto“, aber ohne „iface“-Block definiert sind",
+  "Interfaces to Remove": "Zu entfernende Schnittstellen",
+  "Internal error: NVIDIA installer path is empty or file not found.": "Interner Fehler: Der NVIDIA-Installationspfad ist leer oder die Datei wurde nicht gefunden.",
+  "Internal error: missing arguments in pmx_prepare_host_shared_dir": "Interner Fehler: fehlende Argumente in pmx_prepare_host_shared_dir",
+  "Invalid 'proxmox-ve' candidate (not 9.x or none). Please verify your repository configuration and network, then retry.": "Ungültiger „proxmox-ve“-Kandidat (nicht 9.x oder keiner). Bitte überprüfen Sie Ihre Repository-Konfiguration und Ihr Netzwerk und versuchen Sie es dann erneut.",
+  "Invalid ID": "Ungültige ID",
+  "Invalid Option": "Ungültige Option",
+  "Invalid Path": "Ungültiger Pfad",
+  "Invalid VMID": "Ungültige VMID",
+  "Invalid ZFS pool name.": "Ungültiger ZFS-Poolname.",
+  "Invalid group name. Use letters, digits, underscore or hyphen, and start with a letter or underscore.": "Ungültiger Gruppenname. Verwenden Sie Buchstaben, Ziffern, Unterstrich oder Bindestrich und beginnen Sie mit einem Buchstaben oder Unterstrich.",
+  "Invalid input": "Ungültige Eingabe",
+  "Invalid name": "Ungültiger Name",
+  "Invalid name. Use only letters, numbers, hyphens and underscores.": "Ungültiger Name. Verwenden Sie nur Buchstaben, Zahlen, Bindestriche und Unterstriche.",
+  "Invalid option": "Ungültige Option",
+  "Invalid option, please try again.": "Ungültige Option, bitte versuchen Sie es erneut.",
+  "Invalid option. Skipping.": "Ungültige Option. Überspringen.",
+  "Invalid parameters for bind mount": "Ungültige Parameter für Bind Mount",
+  "Invalid selection": "Ungültige Auswahl",
+  "Invalid size. Please enter a number in MB (e.g., 128, 256, 512).": "Ungültige Größe. Bitte geben Sie eine Zahl in MB ein (z. B. 128, 256, 512).",
+  "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "Ungültige Speicher-ID. Verwenden Sie nur Buchstaben, Zahlen, Bindestriche und Unterstriche.",
+  "Invalid username or password.": "Ungültiger Benutzername oder Passwort.",
+  "Issue": "Ausgabe",
+  "Issues found": "Probleme gefunden",
+  "Issues were found. Would you like to use the Guided Cleanup Assistant?": "Es wurden Probleme gefunden. Möchten Sie den Guided Cleanup Assistant verwenden?",
+  "Issues were found. Would you like to use the Guided Repair Assistant?": "Es wurden Probleme gefunden. Möchten Sie den Guided Repair Assistant nutzen?",
+  "It appears that you have already executed the xshok-proxmox post-install script on this system.": "Es scheint, dass Sie das Nachinstallationsskript xshok-proxmox bereits auf diesem System ausgeführt haben.",
+  "It is recommended to create a backup before continuing.": "Es wird empfohlen, vor dem Fortfahren ein Backup zu erstellen.",
+  "It is strongly recommended to create a backup of your container before proceeding with the conversion.": "Es wird dringend empfohlen, ein Backup Ihres Containers zu erstellen, bevor Sie mit der Konvertierung fortfahren.",
+  "It will be installed from the official GitHub repository.": "Es wird aus dem offiziellen GitHub-Repository installiert.",
+  "Italian": "Italienisch",
+  "JC Channel logo applied": "JC Channel-Logo angebracht",
+  "JSON output for scripts": "JSON-Ausgabe für Skripte",
+  "Job ID (letters, numbers, - _)": "Job-ID (Buchstaben, Zahlen, - _)",
+  "Job ID:": "Job-ID:",
+  "Job deleted:": "Job gelöscht:",
+  "Job disabled:": "Job deaktiviert:",
+  "Job enabled:": "Job aktiviert:",
+  "Job selection returned empty id — aborting.": "Die Jobauswahl hat eine leere ID zurückgegeben – Abbruch.",
+  "Journald configuration adjusted to": "Journald-Konfiguration angepasst an",
+  "Journald configuration is already optimized": "Die Journald-Konfiguration ist bereits optimiert",
+  "Journald configuration updated and service restarted": "Journald-Konfiguration aktualisiert und Dienst neu gestartet",
+  "Journald optimization completed": "Journald-Optimierung abgeschlossen",
+  "Journald optimized - Max size: 64M": "Journald optimiert – Maximale Größe: 64 MB",
+  "KDF:": "KDF:",
+  "KVM MSR options added to /etc/modprobe.d/kvm.conf": "KVM-MSR-Optionen zu /etc/modprobe.d/kvm.conf hinzugefügt",
+  "KVM MSR options ensured in /etc/modprobe.d/kvm.conf": "KVM-MSR-Optionen werden in /etc/modprobe.d/kvm.conf sichergestellt",
+  "KVM MSR options not present, nothing to revert": "KVM-MSR-Optionen sind nicht vorhanden, es kann nichts zurückgesetzt werden",
+  "Keep GPU in LXC config (disable Start on boot)": "Behalten Sie die GPU in der LXC-Konfiguration bei (deaktivieren Sie „Start beim Booten“).",
+  "Keep GPU in LXC config + disable Start on boot": "Behalten Sie die GPU in der LXC-Konfiguration bei und deaktivieren Sie „Start beim Booten“.",
+  "Keep GPU in VM config (disable Start on boot)": "GPU in VM-Konfiguration belassen (Start beim Booten deaktivieren)",
+  "Keep GPU in source VM config (disable Start on boot if enabled)": "Behalten Sie die GPU in der Quell-VM-Konfiguration bei (deaktivieren Sie „Beim Booten starten“, falls aktiviert).",
+  "Keep GPU in source VM config + disable Start on boot if enabled": "Behalten Sie die GPU in der Quell-VM-Konfiguration bei und deaktivieren Sie „Beim Booten starten“, falls aktiviert",
+  "Keep current version (N)": "Aktuelle Version behalten (N)",
+  "Keep current version (N) if modified": "Bei Änderungen die aktuelle Version (N) beibehalten",
+  "Keep in source VM(s) + disable onboot + add to target VM": "In Quell-VM(s) behalten + Onboot deaktivieren + zur Ziel-VM hinzufügen",
+  "Keeping GPU in source VM config": "GPU in der Quell-VM-Konfiguration belassen",
+  "Kept sharedfiles group (has regular users assigned).": "Sharedfiles-Gruppe beibehalten (mit regulären Benutzern).",
+  "Kernel and architecture info": "Kernel- und Architekturinformationen",
+  "Kernel headers and build tools verified.": "Kernel-Header und Build-Tools überprüft.",
+  "Kernel max Key limit configured": "Maximales Kernel-Schlüssellimit konfiguriert",
+  "Kernel panic behavior configuration completed": "Die Konfiguration des Kernel-Panic-Verhaltens ist abgeschlossen",
+  "Kernel panic configuration removed": "Kernel-Panic-Konfiguration entfernt",
+  "Kernel panic configuration updated and applied": "Kernel-Panic-Konfiguration aktualisiert und angewendet",
+  "Kernel, modules and boot config": "Kernel, Module und Bootkonfiguration",
+  "Kernel/boot-tied files (boot config, /etc/systemd/system, initramfs config, apt sources, ZFS state, ...) are NOT copied verbatim to keep the target's boot safe. The operator's own tuning inside them (IOMMU cmdline, VFIO IDs, custom quirks, GRUB timeout, ...) is merged into the target's fresh copies automatically via kernel-agnostic merge.": "Kernel-/Boot-gebundene Dateien (Boot-Konfiguration, /etc/systemd/system, initramfs-Konfiguration, Apt-Quellen, ZFS-Status usw.) werden NICHT wörtlich kopiert, um den Start des Ziels zu schützen.Die darin enthaltenen Einstellungen des Betreibers (IOMMU-Cmdline, VFIO-IDs, benutzerdefinierte Macken, GRUB-Timeout usw.) werden über eine Kernel-unabhängige Zusammenführung automatisch in die neuen Kopien des Ziels eingefügt.",
+  "Keyfile copied": "Schlüsseldatei kopiert",
+  "Keyfile copied to:": "Schlüsseldatei kopiert nach:",
+  "Keyfile passphrase": "Schlüsseldatei-Passphrase",
+  "Keyfile passphrase stored:": "Schlüsseldatei-Passphrase gespeichert:",
+  "Keyfile recovered": "Schlüsseldatei wiederhergestellt",
+  "Keyfile recovered successfully.": "Schlüsseldatei erfolgreich wiederhergestellt.",
+  "Keyfile recovery available": "Schlüsseldateiwiederherstellung verfügbar",
+  "Keyfile recovery — pick source host": "Wiederherstellung der Schlüsseldatei – Quellhost auswählen",
+  "Keyfile removed.": "Schlüsseldatei entfernt.",
+  "Keyrings method failed; trying apt-key fallback": "Keyrings-Methode fehlgeschlagen; Ich versuche einen Apt-Key-Fallback",
+  "LUNs appear as block devices assignable to VMs": "LUNs erscheinen als Blockgeräte, die VMs zugewiesen werden können",
+  "LVM PV headers check completed": "Prüfung der LVM-PV-Header abgeschlossen",
+  "LVM physical volume detected": "Physisches LVM-Volume erkannt",
+  "LVM tools not available, skipping LVM check": "LVM-Tools nicht verfügbar, LVM-Prüfung wird übersprungen",
+  "LVM:": "LVM:",
+  "LXC Conflict Policy": "LXC-Konfliktrichtlinie",
+  "LXC Container Privilege Status": "LXC-Container-Berechtigungsstatus",
+  "LXC Conversion Manual Guides": "Handbücher zur LXC-Konvertierung",
+  "LXC Management": "LXC-Management",
+  "LXC Mount Manager": "LXC Mount Manager",
+  "LXC Privileged to Unprivileged conversion": "Konvertierung von LXC Privileged zu Unprivileged",
+  "LXC Unprivileged to Privileged conversion": "Konvertierung von LXC Unprivileged zu Privileged",
+  "LXC already stopped": "LXC wurde bereits gestoppt",
+  "LXC containers with NVIDIA passthrough:": "LXC-Container mit NVIDIA-Passthrough:",
+  "LXC conversion from privileged to unprivileged completed successfully!": "LXC-Konvertierung von privilegiert zu unprivilegiert erfolgreich abgeschlossen!",
+  "LXC conversion from unprivileged to privileged completed successfully!": "LXC-Konvertierung von unprivilegiert zu privilegiert erfolgreich abgeschlossen!",
+  "LXC removed:": "LXC entfernt:",
+  "LXC stopped": "LXC hat angehalten",
+  "LXC update skipped by user.": "LXC-Update vom Benutzer übersprungen.",
+  "LXCs to destroy:": "Zu zerstörende LXCs:",
+  "Label:": "Etikett:",
+  "Language Change": "Sprachwechsel",
+  "Language changed to": "Sprache geändert zu",
+  "Last 50 kernel log lines": "Letzte 50 Kernel-Protokollzeilen",
+  "Last run:": "Letzte Ausführung:",
+  "Last system boot time": "Letzte Systemstartzeit",
+  "Latest available": "Neueste verfügbar",
+  "Latest version:": "Neueste Version:",
+  "Launching GPU passthrough assistant for VM": "GPU-Passthrough-Assistent für VM wird gestartet",
+  "Legacy PVE 8 .list files commented or not present": "Ältere PVE 8 .list-Dateien sind kommentiert oder nicht vorhanden",
+  "Legacy ceph.list commented or not present": "Die alte ceph.list wurde kommentiert oder ist nicht vorhanden",
+  "Legacy network tools (e.g., ifconfig)": "Ältere Netzwerk-Tools (z. B. ifconfig)",
+  "Legend:": "Legende:",
+  "Let's review your current network configuration.": "Lassen Sie uns Ihre aktuelle Netzwerkkonfiguration überprüfen.",
+  "Likely cause: host directory permissions deny the container's mapped UID.": "Wahrscheinliche Ursache: Hostverzeichnisberechtigungen verweigern die zugeordnete UID des Containers.",
+  "Limiting size and optimizing journald": "Begrenzung der Größe und Optimierung des Journals",
+  "Limiting size and optimizing journald...": "Größe begrenzen und Journal optimieren...",
+  "Line to paste (single line, including \"command=...\" prefix):": "Einzufügende Zeile (einzelne Zeile, einschließlich „command=…“-Präfix):",
+  "Linux Installation Options": "Linux-Installationsoptionen",
+  "Linux/Mac path:": "Linux/Mac-Pfad:",
+  "List Available Disks": "Verfügbare Festplatten auflisten",
+  "List IOMMU group mapping": "IOMMU-Gruppenzuordnung auflisten",
+  "List NVMe devices": "NVMe-Geräte auflisten",
+  "List SMART-capable devices": "Listen Sie SMART-fähige Geräte auf",
+  "List VM/CT IDs to operate on": "Listen Sie die VM/CT-IDs auf, die bearbeitet werden sollen",
+  "List ZFS datasets and snapshots": "Listen Sie ZFS-Datensätze und Snapshots auf",
+  "List all LXC containers": "Listen Sie alle LXC-Container auf",
+  "List all ZFS pools": "Listen Sie alle ZFS-Pools auf",
+  "List all containers to identify the privileged one:": "Listen Sie alle Container auf, um den privilegierten Container zu identifizieren:",
+  "List all containers to identify the unprivileged one:": "Listen Sie alle Container auf, um den unprivilegierten zu identifizieren:",
+  "List all virtual machines": "Listen Sie alle virtuellen Maschinen auf",
+  "List backups in a specific storage": "Listen Sie Backups in einem bestimmten Speicher auf",
+  "List block devices and partitions": "Blockgeräte und Partitionen auflisten",
+  "List configured storages:": "Konfigurierte Speicher auflisten:",
+  "List containers:": "Container auflisten:",
+  "List content of specific storage": "Listen Sie den Inhalt eines bestimmten Speichers auf",
+  "List disk persistent identifiers": "Listen Sie persistente Festplattenkennungen auf",
+  "List disks with detailed info": "Listen Sie Festplatten mit detaillierten Informationen auf",
+  "List importable ZFS pools": "Listen Sie importierbare ZFS-Pools auf",
+  "List local backups": "Lokale Backups auflisten",
+  "List storages valid for image import": "Für den Bildimport gültige Speicher auflisten",
+  "Listening Ports": "Abhörports",
+  "Listening on:": "Anhören:",
+  "Listening ports:": "Abhörports:",
+  "Listing relevant CT users and their mapped UID/GID on host...": "Auflistung relevanter CT-Benutzer und ihrer zugeordneten UID/GID auf dem Host ...",
+  "Loading modules...": "Module werden geladen...",
+  "Local Disk Manager - Proxmox Host": "Lokaler Festplattenmanager – Proxmox-Host",
+  "Local Disk Storages": "Lokale Festplattenspeicher",
+  "Local Shared Directory on Host": "Lokales freigegebenes Verzeichnis auf dem Host",
+  "Local archive targets (paths + USB mount/unmount)": "Lokale Archivziele (Pfade + USB-Mount/Unmount)",
+  "Local backup error log": "Lokales Backup-Fehlerprotokoll",
+  "Local backup failed.": "Die lokale Sicherung ist fehlgeschlagen.",
+  "Local directory  (single-machine — only use if it is a SEPARATE disk)": "Lokales Verzeichnis (einzelne Maschine – nur verwenden, wenn es sich um eine SEPARATE Festplatte handelt)",
+  "Local keyfile is missing but a recovery copy was found in PBS.": "Die lokale Schlüsseldatei fehlt, aber in PBS wurde eine Wiederherstellungskopie gefunden.",
+  "Local network only (192.168.0.0/16)": "Nur lokales Netzwerk (192.168.0.0/16)",
+  "Local restore error log": "Fehlerprotokoll für die lokale Wiederherstellung",
+  "Locale generated": "Gebietsschema generiert",
+  "Location:": "Standort:",
+  "Log": "Protokoll",
+  "Log file": "Protokolldatei",
+  "Log2RAM already registered — updating to latest configuration": "Log2RAM bereits registriert – Aktualisierung auf die neueste Konfiguration",
+  "Log2RAM installation and configuration completed successfully.": "Die Installation und Konfiguration von Log2RAM wurde erfolgreich abgeschlossen.",
+  "Log2RAM installation cancelled by user": "Die Log2RAM-Installation wurde vom Benutzer abgebrochen",
+  "Log2RAM installation verification failed. Check /tmp/log2ram_install.log": "Die Überprüfung der Log2RAM-Installation ist fehlgeschlagen. Überprüfen Sie /tmp/log2ram_install.log",
+  "Log2RAM installed successfully": "Log2RAM erfolgreich installiert",
+  "Log2RAM size set to:": "Log2RAM-Größe eingestellt auf:",
+  "Log2RAM write scheduled every": "Log2RAM-Schreibvorgang alle geplant",
+  "Log:": "Protokoll:",
+  "Logged-in users": "Angemeldete Benutzer",
+  "Logrotate optimization completed": "Logrotate-Optimierung abgeschlossen",
+  "Logrotate service restarted successfully": "Der Logrotate-Dienst wurde erfolgreich neu gestartet",
+  "Long Test — Background": "Langer Test – Hintergrund",
+  "Long self-test started on": "Langer Selbsttest begann am",
+  "Long test             — full scan, runs in background if closed": "Langer Test – vollständiger Scan, läuft im Hintergrund, wenn er geschlossen ist",
+  "Look for containers with 'unprivileged: 1' in their config": "Suchen Sie nach Containern mit „unprivileged: 1“ in ihrer Konfiguration",
+  "Look for containers without 'unprivileged: 1' in their config": "Suchen Sie nach Containern ohne „unprivileged: 1“ in ihrer Konfiguration",
+  "Lookup domain registration info": "Suchen Sie nach Domain-Registrierungsinformationen",
+  "Low Container Memory": "Geringer Containerspeicher",
+  "Low free space warning": "Warnung: Wenig freier Speicherplatz",
+  "Low-power CPU platform": "CPU-Plattform mit geringem Stromverbrauch",
+  "Lynis - Security Audit": "Lynis – Sicherheitsaudit",
+  "Lynis Management": "Lynis-Management",
+  "Lynis command not found": "Lynis-Befehl nicht gefunden",
+  "Lynis has been removed": "Lynis wurde entfernt",
+  "Lynis installation could not be verified": "Die Lynis-Installation konnte nicht überprüft werden",
+  "Lynis installed successfully from GitHub": "Lynis wurde erfolgreich von GitHub installiert",
+  "Lynis is a security auditing tool that performs comprehensive system scans including:": "Lynis ist ein Sicherheitsüberwachungstool, das umfassende Systemscans durchführt, darunter:",
+  "Lynis is currently installed.": "Lynis ist derzeit installiert.",
+  "Lynis is not installed on this system.": "Lynis ist auf diesem System nicht installiert.",
+  "Lynis is not installed. Run: apt install lynis": "Lynis ist nicht installiert. Führen Sie Folgendes aus: apt install lynis",
+  "Lynis is ready to use": "Lynis ist gebrauchsfertig",
+  "Lynis updated to version:": "Lynis wurde auf Version aktualisiert:",
+  "Lynis version:": "Lynis-Version:",
+  "Lynis was not installed from Git. Reinstalling...": "Lynis wurde nicht von Git installiert. Neuinstallation...",
+  "M.2 / PCIe devices:": "M.2 / PCIe-Geräte:",
+  "MAC Address": "MAC-Adresse",
+  "MACHINE TYPE": "MASCHINENTYP",
+  "MOTD configuration updated successfully": "MOTD-Konfiguration erfolgreich aktualisiert",
+  "Machine Type": "Maschinentyp",
+  "Machine type: q35": "Maschinentyp: q35",
+  "Machine: q35": "Maschine: q35",
+  "Major version differs:": "Hauptversion unterscheidet sich:",
+  "Make sure IOMMU is properly enabled and the system has been rebooted after activation.": "Stellen Sie sicher, dass IOMMU ordnungsgemäß aktiviert ist und das System nach der Aktivierung neu gestartet wurde.",
+  "Make sure there are no critical services running as they will be interrupted. Ensure your server can be safely rebooted.": "Stellen Sie sicher, dass keine kritischen Dienste ausgeführt werden, da diese unterbrochen werden. Stellen Sie sicher, dass Ihr Server sicher neu gestartet werden kann.",
+  "Make sure you have SSH or Web UI access before rebooting.": "Stellen Sie vor dem Neustart sicher, dass Sie über SSH- oder Web-UI-Zugriff verfügen.",
+  "Makefile missing in": "Makefile fehlt in",
+  "Malformed repository entries cleaned": "Fehlerhafte Repository-Einträge wurden bereinigt",
+  "Manage PBS encryption keyfile": "PBS-Verschlüsselungsschlüsseldatei verwalten",
+  "Manage Secure Gateway": "Secure Gateway verwalten",
+  "Manage and inspect VM disk images": "Verwalten und überprüfen Sie VM-Festplatten-Images",
+  "Manage custom backup paths": "Benutzerdefinierte Sicherungspfade verwalten",
+  "Manage custom paths (add / remove your folders)": "Benutzerdefinierte Pfade verwalten (Ordner hinzufügen/entfernen)",
+  "Manage local backup target": "Lokales Backup-Ziel verwalten",
+  "Manual CLI Guide (Disk and Storage Manager)": "Manueller CLI-Leitfaden (Disk and Storage Manager)",
+  "Manual CLI Guide (GPU/TPU)": "Manueller CLI-Leitfaden (GPU/TPU)",
+  "Manual Guide: Convert LXC Privileged to Unprivileged": "Manuelle Anleitung: Konvertieren Sie LXC Privileged in Unprivileged",
+  "Manual Guide: Convert LXC Unprivileged to Privileged": "Manuelle Anleitung: Konvertieren Sie LXC Unprivileged in Privileged",
+  "Manual Path Entry": "Manuelle Pfadeingabe",
+  "Manual backup of a VM or CT": "Manuelles Backup einer VM oder CT",
+  "Manual command template (copy/paste):": "Manuelle Befehlsvorlage (Kopieren/Einfügen):",
+  "Manual destination path": "Manueller Zielpfad",
+  "Manual guide script not found": "Manuelles Anleitungsskript nicht gefunden",
+  "Manual install required inside CT": "Manuelle Installation im CT erforderlich",
+  "Manual path entry": "Manuelle Pfadeingabe",
+  "Manual steps recommended after import": "Nach dem Import werden manuelle Schritte empfohlen",
+  "Manual upgrade guide step by step": "Manuelle Upgrade-Anleitung Schritt für Schritt",
+  "Mapped GID on host": "Zugeordnete GID auf dem Host",
+  "Mapped UID on host": "Zugeordnete UID auf dem Host",
+  "Max FD limit / ulimit configured": "Maximaler FD-Grenzwert / ulimit konfiguriert",
+  "Max FS open files configuration created successfully": "Max. FS-Konfiguration für offene Dateien erfolgreich erstellt",
+  "Max user watches configured": "Maximale Benutzerüberwachungen konfiguriert",
+  "Maximum auto-repair attempts reached (3). Please review the log and run any remaining commands manually.": "Maximale Anzahl automatischer Reparaturversuche erreicht (3). Bitte überprüfen Sie das Protokoll und führen Sie alle verbleibenden Befehle manuell aus.",
+  "May need to restart terminal": "Möglicherweise muss das Terminal neu gestartet werden",
+  "Memory optimization completed.": "Speicheroptimierung abgeschlossen.",
+  "Memory optimizations removed": "Speicheroptimierungen entfernt",
+  "Memory restored.": "Speicher wiederhergestellt.",
+  "Memory settings optimized successfully": "Speichereinstellungen erfolgreich optimiert",
+  "Memory:": "Erinnerung:",
+  "Method:": "Verfahren:",
+  "Migrate VMs away from node being upgraded": "Migrieren Sie VMs vom zu aktualisierenden Knoten weg",
+  "Migrate away any guests that must keep running": "Migrieren Sie alle Gäste weg, die weiter ausgeführt werden müssen",
+  "Migrated legacy ProxMenux NVIDIA blacklist state — module will reload after reboot": "Migrierter Legacy-ProxMenux-NVIDIA-Blacklist-Status – Modul wird nach dem Neustart neu geladen",
+  "Mirror URL not available for this script.": "Die Spiegel-URL ist für dieses Skript nicht verfügbar.",
+  "Missing": "Fehlen",
+  "Missing commands after installation:": "Fehlende Befehle nach der Installation:",
+  "Missing dependency": "Fehlende Abhängigkeit",
+  "Missing on target:": "Ziel verfehlt:",
+  "Missing or invalid parameter": "Fehlender oder ungültiger Parameter",
+  "Missing required parameter": "Fehlender erforderlicher Parameter",
+  "Mixed GPU Modes": "Gemischte GPU-Modi",
+  "Mixed current mode detected in selected GPU(s).": "Gemischter Strommodus in ausgewählten GPU(s) erkannt.",
+  "Mobile UI backup created": "Backup der mobilen Benutzeroberfläche erstellt",
+  "Mode": "Modus",
+  "Model": "Modell",
+  "Modern resource monitor (press q to exit)": "Moderner Ressourcenmonitor (zum Beenden q drücken)",
+  "Modifying Fastfetch configuration...": "Fastfetch-Konfiguration wird geändert...",
+  "Modules configuration updated.": "Modulkonfiguration aktualisiert.",
+  "Modules loaded.": "Module geladen.",
+  "Monitor Activated": "Monitor aktiviert",
+  "Monitor Deactivated": "Monitor deaktiviert",
+  "Monitor URL": "Überwachen Sie die URL",
+  "Monitor disk I/O usage (press q to exit)": "Überwachen Sie die E/A-Nutzung der Festplatte (drücken Sie q, um den Vorgang zu beenden)",
+  "Monitor progress:": "Fortschritt überwachen:",
+  "Monitoring": "Überwachung",
+  "Most common cause: the archive is corrupted (interrupted write, partial copy, or storage issue).": "Häufigste Ursache: Das Archiv ist beschädigt (unterbrochener Schreibvorgang, teilweises Kopieren oder Speicherproblem).",
+  "Mount Added Successfully:": "Mount erfolgreich hinzugefügt:",
+  "Mount CIFS share:": "CIFS-Freigabe bereitstellen:",
+  "Mount Configuration Summary:": "Zusammenfassung der Mount-Konfiguration:",
+  "Mount Details:": "Details zur Halterung:",
+  "Mount Examples:": "Beispiele für Halterungen:",
+  "Mount Host Directory to LXC": "Mounten Sie das Host-Verzeichnis in LXC",
+  "Mount Host Directory to LXC Container": "Mounten Sie das Hostverzeichnis im LXC-Container",
+  "Mount Information:": "Mount-Informationen:",
+  "Mount Method": "Mount-Methode",
+  "Mount NFS Client in LXC": "Mounten Sie den NFS-Client in LXC",
+  "Mount NFS Share": "Mounten Sie die NFS-Freigabe",
+  "Mount NFS Share on Host": "Mounten Sie die NFS-Freigabe auf dem Host",
+  "Mount NFS share:": "NFS-Freigabe mounten:",
+  "Mount Name": "Mount-Name",
+  "Mount Name:": "Mount-Name:",
+  "Mount Options": "Mount-Optionen",
+  "Mount Path": "Mount-Pfad",
+  "Mount Path:": "Mount-Pfad:",
+  "Mount Point": "Mount Point",
+  "Mount Point ID": "Mountpunkt-ID",
+  "Mount Point Removal Summary:": "Zusammenfassung zum Entfernen des Mount-Punkts:",
+  "Mount Point:": "Einhängepunkt:",
+  "Mount Samba Share": "Mount Samba Share",
+  "Mount Samba Share on Host": "Mounten Sie die Samba-Freigabe auf dem Host",
+  "Mount USB disk?": "USB-Datenträger mounten?",
+  "Mount a USB drive now": "Mounten Sie jetzt ein USB-Laufwerk",
+  "Mount all datasets": "Hängen Sie alle Datensätze ein",
+  "Mount already exists for this path in container": "Für diesen Pfad im Container ist bereits ein Mount vorhanden",
+  "Mount and persist with UUID:": "Mounten und mit UUID beibehalten:",
+  "Mount failed": "Die Montage ist fehlgeschlagen",
+  "Mount options:": "Montageoptionen:",
+  "Mount path must be an absolute path starting with /": "Der Mount-Pfad muss ein absoluter Pfad sein, der mit / beginnt.",
+  "Mount path:": "Mount-Pfad:",
+  "Mount point created": "Mountpunkt erstellt",
+  "Mount point created.": "Mountpunkt erstellt.",
+  "Mount point is visible but NOT writable from inside the container": "Der Einhängepunkt ist sichtbar, aber NICHT aus dem Container heraus beschreibbar",
+  "Mount point is writable from inside the container": "Der Mountpunkt ist aus dem Inneren des Containers beschreibbar",
+  "Mount point not visible inside the container yet": "Der Mountpunkt ist im Container noch nicht sichtbar",
+  "Mount point ready:": "Mountpunkt bereit:",
+  "Mount point removed successfully": "Der Mountpunkt wurde erfolgreich entfernt",
+  "Mount point:": "Einhängepunkt:",
+  "Mount shares on HOST first": "Mounten Sie zuerst Freigaben auf HOST",
+  "Mount specific dataset": "Mounten Sie einen bestimmten Datensatz",
+  "Mount status:": "Mount-Status:",
+  "Mount this device and use it as the backup destination?": "Dieses Gerät mounten und als Backup-Ziel verwenden?",
+  "Mount was busy — performed lazy unmount": "Mount war beschäftigt – träges Unmounten wurde durchgeführt",
+  "Mounted": "Montiert",
+  "Mounted ISO on device": "ISO auf dem Gerät installiert",
+  "Mounted at": "Montiert bei",
+  "Mounted external disk": "Externe Festplatte gemountet",
+  "Mounted external disk  (offline-safe, single-machine dedup)": "Gemountete externe Festplatte (offlinesicher, Einzelmaschinen-Deduplizierung)",
+  "Mounted filesystem detected": "Gemountetes Dateisystem erkannt",
+  "Mounting CIFS share...": "CIFS-Freigabe wird gemountet...",
+  "Mounting NFS share...": "NFS-Freigabe wird gemountet...",
+  "Mounting container filesystem": "Container-Dateisystem mounten",
+  "Mounting disk...": "Montagescheibe...",
+  "Mounting existing": "Montage vorhanden",
+  "Mounting here will hide existing files until unmounted.": "Beim Mounten hier werden vorhandene Dateien ausgeblendet, bis die Bereitstellung aufgehoben wird.",
+  "Move that copy offsite (USB, password manager, another host). Delete it from this path when done.": "Verschieben Sie diese Kopie an einen anderen Standort (USB, Passwort-Manager, ein anderer Host).Löschen Sie es aus diesem Pfad, wenn Sie fertig sind.",
+  "Move to target VM (remove from source VM config)": "Zur Ziel-VM verschieben (aus der Quell-VM-Konfiguration entfernen)",
+  "Multiple recovery groups found in PBS. Pick the one that originally created the keyfile:": "In PBS wurden mehrere Wiederherstellungsgruppen gefunden. Wählen Sie diejenige aus, die ursprünglich die Schlüsseldatei erstellt hat:",
+  "Multiple rootfs directories were found in this archive. Restore cannot continue automatically.": "In diesem Archiv wurden mehrere Rootfs-Verzeichnisse gefunden. Die Wiederherstellung kann nicht automatisch fortgesetzt werden.",
+  "NAS Systems": "NAS-Systeme",
+  "NETWORK CONFIGURATION ANALYSIS": "NETZWERKKONFIGURATIONSANALYSE",
+  "NFS Access Restricted": "NFS-Zugriff eingeschränkt",
+  "NFS Client Error": "NFS-Client-Fehler",
+  "NFS Client Manager - CT": "NFS-Client-Manager – CT",
+  "NFS Client Status in CT": "NFS-Client-Status in CT",
+  "NFS Client Tools: AVAILABLE": "NFS-Client-Tools: VERFÜGBAR",
+  "NFS Client Tools: NOT AVAILABLE": "NFS-Client-Tools: NICHT VERFÜGBAR",
+  "NFS Client in LXC (Privileged)": "NFS-Client in LXC (privilegiert)",
+  "NFS Client in LXC (privileged)": "NFS-Client in LXC (privilegiert)",
+  "NFS Client: INSTALLED": "NFS-Client: INSTALLIERT",
+  "NFS Client: NOT INSTALLED": "NFS-Client: NICHT INSTALLIERT",
+  "NFS Error": "NFS-Fehler",
+  "NFS Host Manager - Proxmox Host": "NFS-Host-Manager – Proxmox-Host",
+  "NFS LXC Manager - CT": "NFS LXC Manager – CT",
+  "NFS Mounts on Host": "NFS wird auf dem Host bereitgestellt",
+  "NFS Not Installed": "NFS nicht installiert",
+  "NFS Port Error": "NFS-Portfehler",
+  "NFS Proxmox storages (pvesm):": "NFS Proxmox-Speicher (pvesm):",
+  "NFS Server": "NFS-Server",
+  "NFS Server Selection": "NFS-Serverauswahl",
+  "NFS Server in LXC (Privileged)": "NFS-Server in LXC (privilegiert)",
+  "NFS Server in LXC (privileged)": "NFS-Server in LXC (privilegiert)",
+  "NFS Server: INSTALLED": "NFS-Server: INSTALLIERT",
+  "NFS Server: NOT INSTALLED": "NFS-Server: NICHT INSTALLIERT",
+  "NFS Service Status in CT": "NFS-Dienststatus in CT",
+  "NFS Service: RUNNING": "NFS-Dienst: LÄUFT",
+  "NFS Service: STOPPED": "NFS-Dienst: BEENDET",
+  "NFS Version Configuration:": "NFS-Versionskonfiguration:",
+  "NFS Version:": "NFS-Version:",
+  "NFS Version: Auto-negotiation (NFSv3/NFSv4)": "NFS-Version: Auto-Negotiation (NFSv3/NFSv4)",
+  "NFS client installed successfully.": "NFS-Client erfolgreich installiert.",
+  "NFS client tools installed": "NFS-Client-Tools installiert",
+  "NFS directory permissions set — containers should now be able to write": "NFS-Verzeichnisberechtigungen festgelegt – Container sollten jetzt schreiben können",
+  "NFS export": "NFS-Export",
+  "NFS export Selected": "NFS-Export Ausgewählt",
+  "NFS export created successfully!": "NFS-Export erfolgreich erstellt!",
+  "NFS export:": "NFS-Export:",
+  "NFS is recommended for VM disk image storage.": "NFS wird für die Speicherung von VM-Disk-Images empfohlen.",
+  "NFS mounts in CT": "NFS wird im CT bereitgestellt",
+  "NFS packages removed.": "NFS-Pakete entfernt.",
+  "NFS port (2049) is not accessible on": "Auf den NFS-Port (2049) kann nicht zugegriffen werden",
+  "NFS port 2049": "NFS-Port 2049",
+  "NFS server Selected": "NFS-Server Ausgewählt",
+  "NFS server installed successfully.": "NFS-Server erfolgreich installiert.",
+  "NFS server is already installed.": "Der NFS-Server ist bereits installiert.",
+  "NFS server is not installed in this CT.": "In diesem CT ist kein NFS-Server installiert.",
+  "NFS server is running": "Der NFS-Server läuft",
+  "NFS server:": "NFS-Server:",
+  "NFS servers detected": "NFS-Server erkannt",
+  "NFS service is enabled": "Der NFS-Dienst ist aktiviert",
+  "NFS services stopped and disabled.": "NFS-Dienste wurden gestoppt und deaktiviert.",
+  "NFS share mounted at:": "NFS-Freigabe gemountet unter:",
+  "NFS share mounted successfully!": "NFS-Freigabe erfolgreich gemountet!",
+  "NFS share unmount completed.": "Das Aufheben der Bereitstellung der NFS-Freigabe ist abgeschlossen.",
+  "NFS storage added successfully!": "NFS-Speicher erfolgreich hinzugefügt!",
+  "NFS storage adding in progress...": "NFS-Speicher wird hinzugefügt.",
+  "NIC": "NIC",
+  "NIC changes detected — adjusted automatically": "NIC-Änderungen erkannt – automatisch angepasst",
+  "NICs:": "Netzwerkkarten:",
+  "NOT FOUND": "NICHT GEFUNDEN",
+  "NOTE: The host directory and its contents will remain unchanged.": "HINWEIS: Das Hostverzeichnis und sein Inhalt bleiben unverändert.",
+  "NVENC patch detected — list narrowed to versions supported by keylase/nvidia-patch.": "NVENC-Patch erkannt – Liste eingegrenzt auf Versionen, die von keylase/nvidia-patch unterstützt werden.",
+  "NVIDIA Actions": "NVIDIA-Aktionen",
+  "NVIDIA CPU hiding already configured": "NVIDIA-CPU-Ausblendung bereits konfiguriert",
+  "NVIDIA DKMS entries removed.": "NVIDIA DKMS-Einträge entfernt.",
+  "NVIDIA Driver Uninstall": "Deinstallation des NVIDIA-Treibers",
+  "NVIDIA Driver Version": "NVIDIA-Treiberversion",
+  "NVIDIA Drivers": "NVIDIA-Treiber",
+  "NVIDIA Drivers Not Found": "NVIDIA-Treiber nicht gefunden",
+  "NVIDIA GPU Driver Installation": "Installation des NVIDIA GPU-Treibers",
+  "NVIDIA GPU passthrough configured.": "NVIDIA GPU-Passthrough konfiguriert.",
+  "NVIDIA KVM args configured (kvm=off, vendor_id spoof)": "NVIDIA KVM-Argumente konfiguriert (kvm=off, Vendor_ID-Spoof)",
+  "NVIDIA KVM hiding (cpu hidden=1)": "NVIDIA KVM versteckt (CPU versteckt=1)",
+  "NVIDIA KVM hiding already configured": "NVIDIA KVM-Versteckung bereits konfiguriert",
+  "NVIDIA Patch": "NVIDIA-Patch",
+  "NVIDIA driver": "NVIDIA-Treiber",
+  "NVIDIA driver installed successfully.": "NVIDIA-Treiber erfolgreich installiert.",
+  "NVIDIA driver installed:": "NVIDIA-Treiber installiert:",
+  "NVIDIA driver verification in container:": "Überprüfung des NVIDIA-Treibers im Container:",
+  "NVIDIA drivers are not installed or not loaded on this host.": "NVIDIA-Treiber sind auf diesem Host nicht installiert oder nicht geladen.",
+  "NVIDIA host services already aligned for VFIO mode": "NVIDIA-Hostdienste sind bereits für den VFIO-Modus ausgerichtet",
+  "NVIDIA host services disabled for VFIO mode": "NVIDIA-Hostdienste für VFIO-Modus deaktiviert",
+  "NVIDIA host services/autoload already aligned for VFIO mode": "NVIDIA-Hostdienste/Autoload sind bereits für den VFIO-Modus ausgerichtet",
+  "NVIDIA host services/autoload already aligned for native mode": "NVIDIA-Hostdienste/Autoload sind bereits für den nativen Modus ausgerichtet",
+  "NVIDIA host services/autoload disabled for VFIO mode": "NVIDIA-Hostdienste/Autoload für VFIO-Modus deaktiviert",
+  "NVIDIA host services/autoload restored for native mode": "NVIDIA-Hostdienste/Autoload für nativen Modus wiederhergestellt",
+  "NVIDIA install incomplete. Check log:": "NVIDIA-Installation unvollständig. Protokoll prüfen:",
+  "NVIDIA installer downloaded successfully": "NVIDIA-Installationsprogramm erfolgreich heruntergeladen",
+  "NVIDIA installer extracted.": "NVIDIA-Installationsprogramm extrahiert.",
+  "NVIDIA installer not found at": "NVIDIA-Installationsprogramm nicht gefunden unter",
+  "NVIDIA installer reported an error. Check /tmp/nvidia_install.log": "Das NVIDIA-Installationsprogramm hat einen Fehler gemeldet. Überprüfen Sie /tmp/nvidia_install.log",
+  "NVIDIA installer returned error": "Das NVIDIA-Installationsprogramm hat einen Fehler zurückgegeben",
+  "NVIDIA kernel modules unloaded successfully.": "NVIDIA-Kernelmodule wurden erfolgreich entladen.",
+  "NVIDIA libs require approximately 1.5GB of free space.": "NVIDIA-Bibliotheken erfordern etwa 1,5 GB freien Speicherplatz.",
+  "NVIDIA patch applied - check README for supported versions.": "NVIDIA-Patch angewendet – überprüfen Sie die README-Datei auf unterstützte Versionen.",
+  "NVIDIA patch not applied.": "NVIDIA-Patch nicht angewendet.",
+  "NVIDIA per-BDF VFIO binding configured": "NVIDIA pro-BDF-VFIO-Bindung konfiguriert",
+  "NVIDIA services stopped and disabled.": "NVIDIA-Dienste wurden angehalten und deaktiviert.",
+  "NVIDIA udev rules and persistence service installed.": "NVIDIA udev-Regeln und Persistenzdienst installiert.",
+  "NVIDIA uninstallation steps completed.": "NVIDIA-Deinstallationsschritte abgeschlossen.",
+  "NVIDIA uninstaller completed.": "NVIDIA-Deinstallationsprogramm abgeschlossen.",
+  "NVIDIA update failed for LXC": "NVIDIA-Update für LXC fehlgeschlagen",
+  "NVIDIA userspace libraries installed.": "NVIDIA-Userspace-Bibliotheken installiert.",
+  "NVMe Disk Detected": "NVMe-Festplatte erkannt",
+  "NVMe health status: PASSED": "NVMe-Gesundheitsstatus: BESTANDEN",
+  "NVMe health status: WARNING (critical_warning =": "NVMe-Gesundheitsstatus: WARNUNG (critical_warning =",
+  "NVMe skipped (to add as PCIe use 'Add Controller or NVMe PCIe to VM'):": "NVMe übersprungen (zum Hinzufügen als PCIe verwenden Sie „Controller oder NVMe PCIe zur VM hinzufügen“):",
+  "NVMe-specific SMART log": "NVMe-spezifisches SMART-Protokoll",
+  "Name for this target:": "Name für dieses Ziel:",
+  "Name:": "Name:",
+  "Neither /etc/kernel/cmdline nor /etc/default/grub found.": "Weder /etc/kernel/cmdline noch /etc/default/grub gefunden.",
+  "Nesting feature enabled": "Verschachtelungsfunktion aktiviert",
+  "NetBIOS Service: RUNNING": "NetBIOS-Dienst: LÄUFT",
+  "NetBIOS Service: STOPPED": "NetBIOS-Dienst: BEENDET",
+  "NetBIOS port 139:": "NetBIOS-Port 139:",
+  "Network": "Netzwerk",
+  "Network  :": "Netzwerk:",
+  "Network (interfaces, DNS)": "Netzwerk (Schnittstellen, DNS)",
+  "Network Bridge": "Netzwerkbrücke",
+  "Network Commands": "Netzwerkbefehle",
+  "Network Configuration": "Netzwerkkonfiguration",
+  "Network Configuration Analysis": "Netzwerkkonfigurationsanalyse",
+  "Network Configuration File": "Netzwerkkonfigurationsdatei",
+  "Network Diagnostics": "Netzwerkdiagnose",
+  "Network Error": "Netzwerkfehler",
+  "Network Interface Setup": "Einrichtung der Netzwerkschnittstelle",
+  "Network Interfaces": "Netzwerkschnittstellen",
+  "Network Management": "Netzwerkmanagement",
+  "Network Management - SAFE MODE": "Netzwerkverwaltung – SICHERER MODUS",
+  "Network Restart": "Netzwerk-Neustart",
+  "Network Restart Failed": "Netzwerkneustart fehlgeschlagen",
+  "Network Restarted": "Netzwerk neu gestartet",
+  "Network Tools": "Netzwerk-Tools",
+  "Network access:": "Netzwerkzugriff:",
+  "Network configuration backed up": "Netzwerkkonfiguration gesichert",
+  "Network configuration has been restored from backup.": "Die Netzwerkkonfiguration wurde aus der Sicherung wiederhergestellt.",
+  "Network connection failed to": "Die Netzwerkverbindung konnte nicht hergestellt werden",
+  "Network connectivity": "Netzwerkkonnektivität",
+  "Network connectivity to": "Netzwerkkonnektivität zu",
+  "Network interfaces added:": "Netzwerkschnittstellen hinzugefügt:",
+  "Network monitoring tool (iptraf-ng)": "Netzwerküberwachungstool (iptraf-ng)",
+  "Network optimization completed": "Netzwerkoptimierung abgeschlossen",
+  "Network optimizations removed": "Netzwerkoptimierungen entfernt",
+  "Network service restarted successfully": "Der Netzwerkdienst wurde erfolgreich neu gestartet",
+  "Network service restarted successfully.": "Der Netzwerkdienst wurde erfolgreich neu gestartet.",
+  "Network share mounting (NFS/Samba) requires a PRIVILEGED container.": "Für das Mounten von Netzwerkfreigaben (NFS/Samba) ist ein PRIVILEGED-Container erforderlich.",
+  "Network throughput test (client/server)": "Netzwerkdurchsatztest (Client/Server)",
+  "NetworkManager Detected": "NetworkManager erkannt",
+  "NetworkManager has been removed successfully": "NetworkManager wurde erfolgreich entfernt",
+  "NetworkManager is running (may cause conflicts)": "NetworkManager wird ausgeführt (kann zu Konflikten führen)",
+  "NetworkManager is running, which may conflict with Proxmox.": "NetworkManager wird ausgeführt, was zu Konflikten mit Proxmox führen kann.",
+  "NetworkManager not running": "NetworkManager läuft nicht",
+  "New Folder in /mnt": "Neuer Ordner in /mnt",
+  "New Group": "Neue Gruppe",
+  "New Search": "Neue Suche",
+  "New VM:": "Neue VM:",
+  "New Virtual Machine": "Neue virtuelle Maschine",
+  "New backup job": "Neuer Sicherungsauftrag",
+  "New backups on this host will be unencrypted until a new keyfile is set up.": "Neue Backups auf diesem Host werden unverschlüsselt sein, bis eine neue Schlüsseldatei eingerichtet wird.",
+  "New mount options to apply:": "Neue Mount-Optionen zur Anwendung:",
+  "New scheduled job (own timer + retention)": "Neuer geplanter Job (eigener Timer + Aufbewahrung)",
+  "New version available": "Neue Version verfügbar",
+  "New version:": "Neue Version:",
+  "Next Step Required": "Nächster Schritt erforderlich",
+  "Next Steps:": "Nächste Schritte:",
+  "Next step: stop that VM first, then run": "Nächster Schritt: Stoppen Sie zuerst die VM und führen Sie sie dann aus",
+  "No": "NEIN",
+  "No .link files found in": "Es wurden keine .link-Dateien gefunden",
+  "No .ova or .ovf files found in:": "Keine .ova- oder .ovf-Dateien gefunden in:",
+  "No .ovf descriptor found inside OVA.": "In OVA wurde kein .ovf-Deskriptor gefunden.",
+  "No .pxar archives were found in this backup:": "In diesem Backup wurden keine .pxar-Archive gefunden:",
+  "No AMD CPU detected. Skipping AMD fixes.": "Keine AMD-CPU erkannt. Überspringen von AMD-Korrekturen.",
+  "No AMD GPU detected on this system.": "Auf diesem System wurde keine AMD-GPU erkannt.",
+  "No Available Exports": "Keine verfügbaren Exporte",
+  "No Available Shares": "Keine verfügbaren Aktien",
+  "No Backups": "Keine Backups",
+  "No CIFS Proxmox storage and no CIFS fstab mount found on this host.": "Auf diesem Host wurde kein CIFS-Proxmox-Speicher und kein CIFS-fstab-Mount gefunden.",
+  "No CIFS Proxmox storage configured.": "Kein CIFS-Proxmox-Speicher konfiguriert.",
+  "No CIFS Proxmox storages configured.": "Keine CIFS-Proxmox-Speicher konfiguriert.",
+  "No CIFS mounts active.": "Keine CIFS-Mounts aktiv.",
+  "No CT was selected.": "Es wurde kein CT ausgewählt.",
+  "No CTs available in the system.": "Im System sind keine CTs verfügbar.",
+  "No Changes Needed": "Keine Änderungen erforderlich",
+  "No Cleanup Needed": "Keine Reinigung erforderlich",
+  "No Controller/NVMe selected for now.": "Derzeit ist kein Controller/NVMe ausgewählt.",
+  "No Coral Detected": "Keine Koralle entdeckt",
+  "No Coral TPU device was found on this host (neither PCIe/M.2 nor USB).": "Auf diesem Host wurde kein Coral TPU-Gerät gefunden (weder PCIe/M.2 noch USB).",
+  "No Custom Logos Found": "Keine benutzerdefinierten Logos gefunden",
+  "No Disk Images Found": "Keine Disk-Images gefunden",
+  "No Disk Storage": "Kein Festplattenspeicher",
+  "No Disks Available": "Keine Datenträger verfügbar",
+  "No Disks Found": "Keine Datenträger gefunden",
+  "No Exports": "Keine Exporte",
+  "No Exports Found": "Keine Exporte gefunden",
+  "No Folders": "Keine Ordner",
+  "No GPU Detected": "Keine GPU erkannt",
+  "No GPU selected.": "Keine GPU ausgewählt.",
+  "No GPU selected. Please select at least one GPU to continue.": "Keine GPU ausgewählt. Bitte wählen Sie mindestens eine GPU aus, um fortzufahren.",
+  "No GPUs detected on this host.": "Auf diesem Host wurden keine GPUs erkannt.",
+  "No Guest Shares": "Keine Gastfreigaben",
+  "No IP": "Keine IP",
+  "No IP assigned": "Keine IP zugewiesen",
+  "No ISO file detected after UUP Dump process.": "Nach dem UUP-Dump-Vorgang wurde keine ISO-Datei erkannt.",
+  "No ISO images found in Proxmox ISO storages.": "In Proxmox ISO-Speichern wurden keine ISO-Images gefunden.",
+  "No ISO selected.": "Kein ISO ausgewählt.",
+  "No ISO was generated.": "Es wurde keine ISO generiert.",
+  "No Images Found": "Keine Bilder gefunden",
+  "No Intel GPU detected on this system.": "Auf diesem System wurde keine Intel-GPU erkannt.",
+  "No LXC containers available": "Keine LXC-Container verfügbar",
+  "No LXC containers found": "Keine LXC-Container gefunden",
+  "No LXC containers found on this system.": "Auf diesem System wurden keine LXC-Container gefunden.",
+  "No MAC": "Kein MAC",
+  "No Method Selected": "Keine Methode ausgewählt",
+  "No Mounts": "Keine Halterungen",
+  "No NFS Proxmox storage and no NFS fstab mount found on this host.": "Auf diesem Host wurde kein NFS-Proxmox-Speicher und kein NFS-fstab-Mount gefunden.",
+  "No NFS Proxmox storage configured.": "Kein NFS-Proxmox-Speicher konfiguriert.",
+  "No NFS Proxmox storages configured.": "Keine NFS-Proxmox-Speicher konfiguriert.",
+  "No NFS mounts active.": "Keine NFS-Mounts aktiv.",
+  "No NFS mounts found.": "Keine NFS-Mounts gefunden.",
+  "No NFS ports found": "Keine NFS-Ports gefunden",
+  "No NFS servers configured to test.": "Keine NFS-Server zum Testen konfiguriert.",
+  "No NFS servers found on the network.": "Im Netzwerk wurden keine NFS-Server gefunden.",
+  "No NFS shares currently mounted.": "Derzeit sind keine NFS-Freigaben gemountet.",
+  "No NVIDIA GPU detected on this system.": "Auf diesem System wurde keine NVIDIA-GPU erkannt.",
+  "No NVIDIA GPU has been detected on this system. The installer will now exit.": "Auf diesem System wurde keine NVIDIA-GPU erkannt. Das Installationsprogramm wird nun beendet.",
+  "No NVIDIA driver installed.": "Kein NVIDIA-Treiber installiert.",
+  "No PBS keyfile is installed on this host and no automatic recovery was possible.": "Auf diesem Host ist keine PBS-Schlüsseldatei installiert und es war keine automatische Wiederherstellung möglich.",
+  "No PVE vzdump job uses a": "Kein PVE-vzdump-Job verwendet a",
+  "No PVs with old headers found.": "Keine PVs mit alten Headern gefunden.",
+  "No ProxMenux ZFS autotrim state file found.": "Keine ProxMenux ZFS-Autotrim-Statusdatei gefunden.",
+  "No ProxMenux host-backup archives were found in:": "Es wurden keine ProxMenux-Host-Backup-Archive gefunden in:",
+  "No Recent Servers": "Keine aktuellen Server",
+  "No Samba mounts found.": "Keine Samba-Mounts gefunden.",
+  "No Samba ports found": "Keine Samba-Ports gefunden",
+  "No Samba servers configured to test.": "Keine Samba-Server zum Testen konfiguriert.",
+  "No Samba servers found on the network.": "Im Netzwerk wurden keine Samba-Server gefunden.",
+  "No Samba shares currently mounted.": "Derzeit sind keine Samba-Freigaben gemountet.",
+  "No Samba users found": "Keine Samba-Benutzer gefunden",
+  "No Selection": "Keine Auswahl",
+  "No Servers Found": "Keine Server gefunden",
+  "No Shares": "Keine Aktien",
+  "No Shares Available": "Keine Aktien verfügbar",
+  "No Shares Found": "Keine Aktien gefunden",
+  "No Storage Found": "Kein Speicher gefunden",
+  "No USB drives detected. Enter the mountpoint path manually:": "Keine USB-Laufwerke erkannt. Geben Sie den Mountpoint-Pfad manuell ein:",
+  "No USB drives mounted by ProxMenux yet. Mount one first to use it as a target.": "Noch keine USB-Laufwerke von ProxMenux gemountet.Montieren Sie zuerst eines, um es als Ziel zu verwenden.",
+  "No UUP folder found.": "Kein UUP-Ordner gefunden.",
+  "No VM was selected.": "Es wurde keine VM ausgewählt.",
+  "No VMID defined. Cannot apply guest agent config.": "Keine VMID definiert. Gast-Agent-Konfiguration kann nicht angewendet werden.",
+  "No VMs Found": "Keine VMs gefunden",
+  "No VMs available in the system.": "Im System sind keine VMs verfügbar.",
+  "No VMs available on this host.": "Auf diesem Host sind keine VMs verfügbar.",
+  "No VMs found": "Keine VMs gefunden",
+  "No Valid Servers": "Keine gültigen Server",
+  "No VirtIO ISO found. Please download one.": "Keine VirtIO-ISO gefunden. Bitte laden Sie eines herunter.",
+  "No VirtIO ISO selected. Please choose again.": "Kein VirtIO ISO ausgewählt. Bitte wählen Sie erneut.",
+  "No Virtual Machines found on this system.": "Auf diesem System wurden keine virtuellen Maschinen gefunden.",
+  "No ZFS pools detected. Skipping ZFS autotrim.": "Keine ZFS-Pools erkannt. ZFS-Autotrim wird übersprungen.",
+  "No accessible": "Nicht zugänglich",
+  "No accessible NFS servers found.": "Es wurden keine zugänglichen NFS-Server gefunden.",
+  "No accessible Samba servers found.": "Keine erreichbaren Samba-Server gefunden.",
+  "No accessible exports found.": "Keine zugänglichen Exporte gefunden.",
+  "No accessible shares found.": "Keine zugänglichen Freigaben gefunden.",
+  "No active exports or showmount not available": "Keine aktiven Exporte oder Showmount nicht verfügbar",
+  "No active session": "Keine aktive Sitzung",
+  "No additional GPU can be added.": "Es kann keine zusätzliche GPU hinzugefügt werden.",
+  "No additional device needs to be added.": "Es muss kein zusätzliches Gerät hinzugefügt werden.",
+  "No archives": "Keine Archive",
+  "No archives found in this Borg repository.": "In diesem Borg-Repository wurden keine Archive gefunden.",
+  "No available Controllers/NVMe devices were found.": "Es wurden keine verfügbaren Controller/NVMe-Geräte gefunden.",
+  "No available disks found.": "Keine verfügbaren Datenträger gefunden.",
+  "No backup found, logrotate configuration not changed": "Kein Backup gefunden, Logrotate-Konfiguration nicht geändert",
+  "No backups": "Keine Backups",
+  "No backups found": "Keine Backups gefunden",
+  "No bridge configuration issues found": "Es wurden keine Probleme mit der Bridge-Konfiguration gefunden",
+  "No bridges found in system": "Im System wurden keine Brücken gefunden",
+  "No changes are required for": "Es sind keine Änderungen erforderlich",
+  "No changes are required.": "Es sind keine Änderungen erforderlich.",
+  "No changes have been made to your system": "Es wurden keine Änderungen an Ihrem System vorgenommen",
+  "No changes will be made to the running system.": "Es werden keine Änderungen am laufenden System vorgenommen.",
+  "No compatible GPU detected for VM passthrough. Skipping GPU wizard option.": "Für VM-Passthrough wurde keine kompatible GPU erkannt. Option des GPU-Assistenten überspringen.",
+  "No compatible GPU was detected on this host.": "Auf diesem Host wurde keine kompatible GPU erkannt.",
+  "No compatible GPUs detected on this host.": "Auf diesem Host wurden keine kompatiblen GPUs erkannt.",
+  "No compatible GPUs were detected on this host.": "Auf diesem Host wurden keine kompatiblen GPUs erkannt.",
+  "No compatible PVE jobs": "Keine kompatiblen PVE-Jobs",
+  "No compatible disk images found in:": "Keine kompatiblen Disk-Images gefunden in:",
+  "No compatible versions found for your kernel": "Für Ihren Kernel wurden keine kompatiblen Versionen gefunden",
+  "No configuration issues found": "Es wurden keine Konfigurationsprobleme gefunden",
+  "No container runtime available.": "Keine Containerlaufzeit verfügbar.",
+  "No container selected. Exiting.": "Kein Container ausgewählt. Verlassen.",
+  "No controller/NVMe selected.": "Kein Controller/NVMe ausgewählt.",
+  "No controllers remaining after conflict resolution.": "Nach der Konfliktlösung sind keine Verantwortlichen mehr übrig.",
+  "No custom key (rely on default SSH config)": "Kein benutzerdefinierter Schlüssel (verlassen Sie sich auf die Standard-SSH-Konfiguration)",
+  "No custom logos were found in /usr/local/share/fastfetch/logos/.\n\nPlease add a logo and try again.": "In /usr/local/share/fastfetch/logos/ wurden keine benutzerdefinierten Logos gefunden.\n\nBitte fügen Sie ein Logo hinzu und versuchen Sie es erneut.",
+  "No desktop UI backup found, will reinstall packages": "Es wurde keine Sicherung der Desktop-Benutzeroberfläche gefunden. Die Pakete werden neu installiert",
+  "No directories found in": "Keine Verzeichnisse gefunden in",
+  "No disk images found in /var/lib/vz/images/. Please add an image first.": "In /var/lib/vz/images/ wurden keine Disk-Images gefunden. Bitte fügen Sie zuerst ein Bild hinzu.",
+  "No disks available for this CT.": "Für diesen CT sind keine Datenträger verfügbar.",
+  "No disks available for this VM.": "Für diese VM sind keine Festplatten verfügbar.",
+  "No disks were added.": "Es wurden keine Datenträger hinzugefügt.",
+  "No disks were configured for processing.": "Es wurden keine Datenträger für die Verarbeitung konfiguriert.",
+  "No disks were selected.": "Es wurden keine Datenträger ausgewählt.",
+  "No duplicate IP addresses": "Keine doppelten IP-Adressen",
+  "No duplicate repositories found": "Keine doppelten Repositorys gefunden",
+  "No eligible Controller/NVMe devices remain after SR-IOV filtering. Skipping.": "Nach der SR-IOV-Filterung bleiben keine berechtigten Controller/NVMe-Geräte übrig. Überspringen.",
+  "No eligible controllers remain after SR-IOV filtering.": "Nach der SR-IOV-Filterung bleiben keine berechtigten Controller übrig.",
+  "No encryption key is stored on this host. Choose how to set one up:": "Auf diesem Host ist kein Verschlüsselungsschlüssel gespeichert.Wählen Sie aus, wie Sie eines einrichten möchten:",
+  "No exportable VM disks were found (CD-ROM/cloud-init are excluded).": "Es wurden keine exportierbaren VM-Festplatten gefunden (CD-ROM/Cloud-Init sind ausgeschlossen).",
+  "No exportable disks": "Keine exportierbaren Datenträger",
+  "No exports configured.": "Keine Exporte konfiguriert.",
+  "No exports file found.": "Keine Exportdatei gefunden.",
+  "No exports found in /etc/exports.": "Keine Exporte in /etc/exports gefunden.",
+  "No exports found on server": "Auf dem Server wurden keine Exporte gefunden",
+  "No files found": "Keine Dateien gefunden",
+  "No folders found in /mnt.": "Keine Ordner in /mnt gefunden.",
+  "No folders found in /mnt. Please create a new folder.": "Keine Ordner in /mnt gefunden. Bitte erstellen Sie einen neuen Ordner.",
+  "No folders found inside /mnt in the CT.": "Keine Ordner in /mnt im CT gefunden.",
+  "No format-safe disks are available.": "Es sind keine formatsicheren Datenträger verfügbar.",
+  "No group creation required — uses world-writable sticky bit permissions.": "Keine Gruppenerstellung erforderlich – verwendet weltweit beschreibbare Sticky-Bit-Berechtigungen.",
+  "No host VFIO reconfiguration expected": "Keine Host-VFIO-Neukonfiguration erwartet",
+  "No host VFIO/native binding changes were required.": "Es waren keine Host-VFIO/native Bindungsänderungen erforderlich.",
+  "No host backups were found in this PBS repository:": "In diesem PBS-Repository wurden keine Host-Backups gefunden:",
+  "No host reboot expected": "Kein Neustart des Hosts erwartet",
+  "No host write access — server-side ACL or root_squash. Continuing anyway.": "Kein Host-Schreibzugriff – serverseitige ACL oder root_squash. Trotzdem weitermachen.",
+  "No host write access — server-side ACL. Continuing anyway.": "Kein Host-Schreibzugriff – serverseitige ACL. Trotzdem weitermachen.",
+  "No iSCSI Storage": "Kein iSCSI-Speicher",
+  "No iSCSI storage configured in Proxmox.": "In Proxmox ist kein iSCSI-Speicher konfiguriert.",
+  "No iSCSI storage configured.": "Kein iSCSI-Speicher konfiguriert.",
+  "No iSCSI storage found in Proxmox.": "In Proxmox wurde kein iSCSI-Speicher gefunden.",
+  "No iSCSI targets found on portal": "Im Portal wurden keine iSCSI-Ziele gefunden",
+  "No import disks selected for now.": "Derzeit sind keine Importdatenträger ausgewählt.",
+  "No importable disks available. System disks and protected disks are hidden.": "Keine importierbaren Datenträger verfügbar. Systemfestplatten und geschützte Festplatten werden ausgeblendet.",
+  "No installation information available.": "Keine Installationsinformationen verfügbar.",
+  "No interface type was selected for the disks.": "Für die Festplatten wurde kein Schnittstellentyp ausgewählt.",
+  "No jobs": "Keine Jobs",
+  "No language selected.": "Keine Sprache ausgewählt.",
+  "No local disk storage configured.": "Kein lokaler Festplattenspeicher konfiguriert.",
+  "No main sources.list present (skipped)": "Keine Hauptquellenliste vorhanden (übersprungen)",
+  "No mount point was specified.": "Es wurde kein Mountpunkt angegeben.",
+  "No mount points found in any container": "In keinem Container wurden Mount-Punkte gefunden",
+  "No mount points found in container": "Im Container wurden keine Mountpunkte gefunden",
+  "No network configuration backups found.": "Es wurden keine Sicherungen der Netzwerkkonfiguration gefunden.",
+  "No network interfaces configured (besides loopback)": "Keine Netzwerkschnittstellen konfiguriert (außer Loopback)",
+  "No new Controller/NVMe entries were added.": "Es wurden keine neuen Controller/NVMe-Einträge hinzugefügt.",
+  "No optimizations detected to uninstall.": "Es wurden keine zu deinstallierenden Optimierungen erkannt.",
+  "No partitions found on disk. Nothing was wiped.": "Keine Partitionen auf der Festplatte gefunden. Es wurde nichts gewischt.",
+  "No password provided.": "Kein Passwort angegeben.",
+  "No paths available": "Keine Pfade verfügbar",
+  "No paths selected. Select at least one path.": "Keine Pfade ausgewählt. Wählen Sie mindestens einen Pfad aus.",
+  "No pending paths to schedule for reboot.": "Keine ausstehenden Pfade zum Planen eines Neustarts.",
+  "No permanent NFS mounts configured.": "Keine permanenten NFS-Mounts konfiguriert.",
+  "No permanent Samba mounts configured.": "Keine permanenten Samba-Mounts konfiguriert.",
+  "No persistent path found for": "Kein persistenter Pfad gefunden für",
+  "No physical disks detected for SMART testing.": "Für den SMART-Test wurden keine physischen Festplatten erkannt.",
+  "No physical interfaces found": "Keine physischen Schnittstellen gefunden",
+  "No ports configured": "Keine Ports konfiguriert",
+  "No privileged containers available in Proxmox.": "In Proxmox sind keine privilegierten Container verfügbar.",
+  "No pve-enterprise.list present (skipped)": "Keine pve-enterprise.list vorhanden (übersprungen)",
+  "No recent": "Nicht aktuell",
+  "No recent Samba servers found.": "Keine aktuellen Samba-Server gefunden.",
+  "No routing information found.": "Keine Routing-Informationen gefunden.",
+  "No scheduled backup jobs configured.": "Keine geplanten Sicherungsjobs konfiguriert.",
+  "No scheduled backup jobs found.": "Keine geplanten Sicherungsjobs gefunden.",
+  "No scripts found for:": "Keine Skripte gefunden für:",
+  "No self-test history found for": "Kein Selbsttestverlauf gefunden für",
+  "No self-test log available for": "Kein Selbsttestprotokoll verfügbar für",
+  "No server IP or hostname provided.": "Keine Server-IP oder Hostname angegeben.",
+  "No shared mount detected. Applying standard local access.": "Kein gemeinsamer Mount erkannt. Anwenden des standardmäßigen lokalen Zugriffs.",
+  "No shares configured.": "Keine Freigaben konfiguriert.",
+  "No shares found in smb.conf.": "In smb.conf wurden keine Freigaben gefunden.",
+  "No shares found on server": "Auf dem Server wurden keine Freigaben gefunden",
+  "No smb.conf file found.": "Keine smb.conf-Datei gefunden.",
+  "No specific LXC action selected": "Keine bestimmte LXC-Aktion ausgewählt",
+  "No specific VM action selected": "Keine spezifische VM-Aktion ausgewählt",
+  "No storage": "Keine Lagerung",
+  "No storage volumes available for VM images.": "Für VM-Images sind keine Speichervolumes verfügbar.",
+  "No storage volumes available for disk images.": "Für Disk-Images sind keine Speichervolumes verfügbar.",
+  "No stored credentials found.": "Keine gespeicherten Anmeldeinformationen gefunden.",
+  "No suitable disks found.": "Keine passenden Datenträger gefunden.",
+  "No sysfs ROM entry — trying ACPI VFCT table...": "Kein sysfs-ROM-Eintrag – versuchen Sie es mit der ACPI-VFCT-Tabelle ...",
+  "No target configured.": "Kein Ziel konfiguriert.",
+  "No test currently running": "Derzeit läuft kein Test",
+  "No uninstaller found for:": "Kein Deinstallationsprogramm gefunden für:",
+  "No unprivileged containers available in Proxmox.": "In Proxmox sind keine unprivilegierten Container verfügbar.",
+  "No updates available — run a scan first or wait for the Monitor to refresh.": "Keine Updates verfügbar – führen Sie zuerst einen Scan durch oder warten Sie, bis der Monitor aktualisiert wird.",
+  "No updates or failed to fetch templates": "Keine Aktualisierungen oder Vorlagen konnten nicht abgerufen werden",
+  "No user groups found.": "Keine Benutzergruppen gefunden.",
+  "No user-created disk storage or fstab mount found.": "Kein vom Benutzer erstellter Festplattenspeicher oder fstab-Mount gefunden.",
+  "No username provided.": "Kein Benutzername angegeben.",
+  "No utilities selected": "Keine Dienstprogramme ausgewählt",
+  "No utilities were selected": "Es wurden keine Dienstprogramme ausgewählt",
+  "No valid containers found": "Keine gültigen Container gefunden",
+  "No valid mount points found": "Keine gültigen Mountpunkte gefunden",
+  "No version in this branch is currently supported by keylase/nvidia-patch — the NVENC patch will not reapply after reinstall.": "Derzeit wird keine Version in diesem Zweig von keylase/nvidia-patch unterstützt – der NVENC-Patch wird nach der Neuinstallation nicht erneut angewendet.",
+  "No virtual machines were found on this host.": "Auf diesem Host wurden keine virtuellen Maschinen gefunden.",
+  "No write permissions on:": "Keine Schreibrechte für:",
+  "No, keep local only": "Nein, nur lokal behalten",
+  "No-subscription repository present": "Kein Abonnement-Repository vorhanden",
+  "No: the key stays only at": "Nein: Der Schlüssel bleibt nur bei",
+  "Non-Debian container detected": "Nicht-Debian-Container erkannt",
+  "Non-free firmware warnings disabled": "Warnungen zu nicht kostenloser Firmware deaktiviert",
+  "None": "Keiner",
+  "Normalizing stable monitor service...": "Der stabile Monitordienst wird normalisiert...",
+  "Not Mounted": "Nicht montiert",
+  "Not all platforms support Controller/NVMe passthrough reliably.": "Nicht alle Plattformen unterstützen zuverlässig Controller/NVMe-Passthrough.",
+  "Not an OVH server, skipping RTM installation": "Kein OVH-Server, die RTM-Installation wird übersprungen",
+  "Not currently mounted": "Derzeit nicht gemountet",
+  "Not currently mounted — skipping umount.": "Derzeit nicht gemountet – umount wird übersprungen.",
+  "Not found": "Nicht gefunden",
+  "Not imported:": "Nicht importiert:",
+  "Not mounted": "Nicht montiert",
+  "Not portable:": "Nicht tragbar:",
+  "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "Nicht als Proxmox-Speicher registriert – verwenden Sie „LXC Mount Manager“ zum Bind-Mount",
+  "Note: A system reboot will be required after enabling IOMMU.": "Hinweis: Nach der Aktivierung von IOMMU ist ein Systemneustart erforderlich.",
+  "Note: this only works if the NFS server does NOT use 'all_squash' for root.": "Hinweis: Dies funktioniert nur, wenn der NFS-Server NICHT „all_squash“ als Root verwendet.",
+  "Notes": "Notizen",
+  "Nothing inside the container is modified": "Im Container wird nichts verändert",
+  "Nothing selectable": "Nichts auswählbar",
+  "Nothing selected": "Nichts ausgewählt",
+  "Nothing to apply — none of the selected updates have a runnable function on disk.": "Nichts anzuwenden – keines der ausgewählten Updates verfügt über eine ausführbare Funktion auf der Festplatte.",
+  "Nothing to remove": "Nichts zu entfernen",
+  "Nothing to restore": "Nichts zum Wiederherstellen",
+  "Nothing to schedule for reboot from selected paths.": "Für den Neustart von ausgewählten Pfaden ist nichts einzuplanen.",
+  "Nouveau module is loaded, attempting to unload...": "Das Nouveau-Modul ist geladen und versucht zu entladen ...",
+  "Number of CPU cores (default: 2)": "Anzahl der CPU-Kerne (Standard: 2)",
+  "OCI containers require Proxmox VE 9.1 or later.": "OCI-Container erfordern Proxmox VE 9.1 oder höher.",
+  "OK": "OK",
+  "OR add new PVE 9 no-subscription repository:": "ODER neues PVE 9-Repository ohne Abonnement hinzufügen:",
+  "OS hint:": "Hinweis zum Betriebssystem:",
+  "OS release details": "Details zur Betriebssystemversion",
+  "OS type  :": "Betriebssystemtyp:",
+  "OS type:": "Betriebssystemtyp:",
+  "OS:": "Betriebssystem:",
+  "OVA (single portable file)": "OVA (einzelne tragbare Datei)",
+  "OVF (descriptor + VMDK files)": "OVF (Deskriptor + VMDK-Dateien)",
+  "OVF parsed:": "OVF analysiert:",
+  "OVH RTM installed successfully": "OVH RTM erfolgreich installiert",
+  "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM entfernt (Marionettenartefakte müssen möglicherweise manuell bereinigt werden)",
+  "OVH server detected": "OVH-Server erkannt",
+  "OVH server detection and RTM installation process completed": "OVH-Servererkennung und RTM-Installationsprozess abgeschlossen",
+  "Offer as exit node?": "Angebot als Exit-Knoten?",
+  "Official Linux Distributions": "Offizielle Linux-Distributionen",
+  "Old debian.sources file removed to prevent duplication": "Alte debian.sources-Datei entfernt, um Duplikate zu verhindern",
+  "Old memory configuration detected. Replacing with balanced optimization...": "Alte Speicherkonfiguration erkannt. Ersetzen durch ausgewogene Optimierung...",
+  "Old time services removed successfully": "Alte Dienste erfolgreich entfernt",
+  "On a privileged CT the mount options carry the only permissions.": "Bei einem privilegierten CT sind die Mount-Optionen die einzigen Berechtigungen.",
+  "On some systems, when starting the VM the host may slow down for several minutes until it stabilizes, or freeze completely.": "Auf einigen Systemen kann es beim Starten der VM dazu kommen, dass der Host mehrere Minuten lang langsamer wird, bis er sich stabilisiert, oder vollständig einfriert.",
+  "On the Borg server, append the following line to:": "Hängen Sie auf dem Borg-Server die folgende Zeile an:",
+  "Once finished, re-run 'PVE 8 to 9 check' to verify that all issues are resolved \n    before executing the PVE 8 → PVE 9 upgrade.": "Wenn Sie fertig sind, führen Sie die „PVE 8 bis 9-Überprüfung“ erneut aus, um sicherzustellen, dass alle Probleme behoben sind \n    bevor Sie das PVE 8 → PVE 9-Upgrade durchführen.",
+  "Once finished, re-run the script 'PVE 8 to 9 check' to verify that all issues are resolved \n   before rebooting.": "Wenn Sie fertig sind, führen Sie das Skript „PVE 8 to 9 check“ erneut aus, um zu überprüfen, ob alle Probleme behoben sind \n   vor dem Neustart.",
+  "Once finished, re-run the script 'PVE 8 to 9 check' to verify that all issues.": "Wenn Sie fertig sind, führen Sie das Skript „PVE 8 to 9 check“ erneut aus, um zu überprüfen, ob alle Probleme vorliegen.",
+  "Once installed, open the VirtIO ISO and run the installer to complete driver setup.": "Öffnen Sie nach der Installation die VirtIO-ISO und führen Sie das Installationsprogramm aus, um die Treibereinrichtung abzuschließen.",
+  "One or more NVIDIA GPUs are currently configured for VM passthrough (vfio-pci):": "Eine oder mehrere NVIDIA-GPUs sind derzeit für VM-Passthrough (vfio-pci) konfiguriert:",
+  "Only convert to privileged if absolutely necessary for your use case.": "Konvertieren Sie nur dann in privilegiert, wenn dies für Ihren Anwendungsfall unbedingt erforderlich ist.",
+  "Only fully free disks are shown (not system-used and not referenced by VM/LXC).": "Es werden nur vollständig freie Festplatten angezeigt (nicht vom System verwendet und nicht von VM/LXC referenziert).",
+  "Only if using enterprise subscription": "Nur bei Verwendung eines Unternehmensabonnements",
+  "Only if using no-subscription repository": "Nur bei Verwendung eines Repositorys ohne Abonnement",
+  "Only needed if you mounted the filesystem in step 6b": "Wird nur benötigt, wenn Sie das Dateisystem in Schritt 6b gemountet haben",
+  "Only removes storage definition, not remote data.": "Entfernt nur die Speicherdefinition, keine Remote-Daten.",
+  "Only run this if you used LVM (step 6b):": "Führen Sie dies nur aus, wenn Sie LVM verwendet haben (Schritt 6b):",
+  "Only the host backup hook is removed — PVE vzdump jobs targeting this storage stay intact.": "Nur der Host-Backup-Hook wird entfernt – PVE-vzdump-Jobs, die auf diesen Speicher abzielen, bleiben intakt.",
+  "Open": "Offen",
+  "Open rwx + default inheritance for new files": "Öffnen Sie rwx + Standardvererbung für neue Dateien",
+  "Open the VM console and wait for the installer to boot": "Öffnen Sie die VM-Konsole und warten Sie, bis das Installationsprogramm startet",
+  "Open the VM console and wait for the loader to boot": "Öffnen Sie die VM-Konsole und warten Sie, bis der Loader startet",
+  "Open the dashboard from this host on port 8008 to create a new admin account.": "Öffnen Sie das Dashboard von diesem Host auf Port 8008, um ein neues Administratorkonto zu erstellen.",
+  "Open the dashboard to create a new admin account:": "Öffnen Sie das Dashboard, um ein neues Administratorkonto zu erstellen:",
+  "OpenVSwitch installation could not be verified": "Die OpenVSwitch-Installation konnte nicht überprüft werden",
+  "OpenVSwitch installed successfully": "OpenVSwitch erfolgreich installiert",
+  "OpenVSwitch is ready to use": "OpenVSwitch ist einsatzbereit",
+  "OpenVSwitch removed": "OpenVSwitch entfernt",
+  "Operation": "Betrieb",
+  "Operation cancelled by user": "Vorgang vom Benutzer abgebrochen",
+  "Operation cancelled by user to create backup.": "Der Vorgang wurde vom Benutzer abgebrochen, um ein Backup zu erstellen.",
+  "Operation cancelled by user.": "Vorgang vom Benutzer abgebrochen.",
+  "Operation cancelled. Cannot continue with an unprivileged container.": "Vorgang abgebrochen. Mit einem unprivilegierten Container kann nicht fortgefahren werden.",
+  "Operation log": "Betriebsprotokoll",
+  "Operator config re-applied via kernel-agnostic merge": "Operatorkonfiguration wurde über Kernel-agnostische Zusammenführung erneut angewendet",
+  "Operator config that WILL be re-applied via kernel-agnostic merge": "Operatorkonfiguration, die über eine Kernel-agnostische Zusammenführung erneut angewendet wird",
+  "Optimizations detected and ready to revert.": "Optimierungen erkannt und können wiederhergestellt werden.",
+  "Optimize": "Optimieren",
+  "Optimize Memory": "Speicher optimieren",
+  "Optimize ZFS ARC size": "ZFS ARC-Größe optimieren",
+  "Optimize journald": "Journal optimieren",
+  "Optimize logrotate": "Logrotate optimieren",
+  "Optimizing ZFS ARC size according to available memory...": "Optimieren der ZFS ARC-Größe entsprechend dem verfügbaren Speicher ...",
+  "Optimizing logrotate configuration...": "Optimierung der Logrotate-Konfiguration...",
+  "Optimizing memory settings...": "Speichereinstellungen optimieren...",
+  "Optimizing network settings...": "Netzwerkeinstellungen optimieren...",
+  "Optimizing vzdump backup speed...": "Optimierung der vzdump-Backup-Geschwindigkeit...",
+  "Optional": "Optional",
+  "Optional GPU Passthrough": "Optionaler GPU-Passthrough",
+  "Optional safety helper if you ever need to re-apply manually:": "Optionaler Sicherheitshelfer, falls Sie jemals manuell erneut anwenden müssen:",
+  "Optional: Modernize repository sources:": "Optional: Repository-Quellen modernisieren:",
+  "Optional: apply default ACL so new files inherit permissions:": "Optional: Standard-ACL anwenden, damit neue Dateien Berechtigungen erben:",
+  "Optional: register this path as Proxmox dir storage:": "Optional: Registrieren Sie diesen Pfad als Proxmox-Verzeichnisspeicher:",
+  "Optionally remove": "Optional entfernen",
+  "Optionally update NVIDIA libs in LXC containers with passthrough": "Aktualisieren Sie optional NVIDIA-Bibliotheken in LXC-Containern mit Passthrough",
+  "Options:": "Optionen:",
+  "Or press CTRL + D": "Oder drücken Sie STRG + D",
+  "Or re-run this script and accept the 'apply host permissions' prompt.": "Oder führen Sie dieses Skript erneut aus und akzeptieren Sie die Eingabeaufforderung „Hostberechtigungen anwenden“.",
+  "Or use ProxMenux update function": "Oder verwenden Sie die Update-Funktion von ProxMenux",
+  "Or, if your terminal can't select text, copy it from:": "Oder, wenn Ihr Terminal keinen Text auswählen kann, kopieren Sie ihn von:",
+  "Original ZFS ARC config restored from .bak": "Ursprüngliche ZFS ARC-Konfiguration aus .bak wiederhergestellt",
+  "Original bashrc restored": "Original-Bashrc restauriert",
+  "Original logrotate configuration restored": "Ursprüngliche Logrotate-Konfiguration wiederhergestellt",
+  "Other Prebuilt Linux VMs": "Andere vorgefertigte Linux-VMs",
+  "Output archive:": "Ausgabearchiv:",
+  "Owner:": "Eigentümer:",
+  "Ownership set to root:sharedfiles with 2775 on:": "Eigentümerschaft auf root:sharedfiles mit 2775 gesetzt auf:",
+  "PAM limits configured": "PAM-Grenzwerte konfiguriert",
+  "PBS backup error log": "PBS-Backup-Fehlerprotokoll",
+  "PBS backup failed.": "PBS-Sicherung fehlgeschlagen.",
+  "PBS encryption keyfile (show / replace / remove)": "PBS-Verschlüsselungsschlüsseldatei (anzeigen/ersetzen/entfernen)",
+  "PBS encryption keyfile — detailed info": "PBS-Verschlüsselungsschlüsseldatei – detaillierte Informationen",
+  "PBS extraction failed": "Die PBS-Extraktion ist fehlgeschlagen",
+  "PBS host or IP address:": "PBS-Host oder IP-Adresse:",
+  "PBS upload": "PBS-Upload",
+  "PCI Address": "PCI-Adresse",
+  "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "PCI-Passthrough, TPM-Status, Cloud-Init-Konfiguration, Proxmox-Hooks",
+  "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "PCI-Passthrough, TPM-Status, Cloud-Init, Snapshots, Proxmox-spezifische Hooks",
+  "PCI reset method": "PCI-Reset-Methode",
+  "PCIe GPU passthrough requires:": "PCIe-GPU-Passthrough erfordert:",
+  "PCIe/M.2 gasket-dkms": "PCIe/M.2-Dichtung-dkms",
+  "POSIX ACLs applied (access + default for inheritance).": "POSIX-ACLs angewendet (Zugriff + Standard für Vererbung).",
+  "PVE application manager updated": "PVE-Anwendungsmanager aktualisiert",
+  "PVE cache regenerated": "PVE-Cache neu generiert",
+  "PVE host (where the Borg LXC lives)": "PVE-Host (wo der Borg LXC lebt)",
+  "PVE host, VMID and password are all required for this mode.": "Für diesen Modus sind PVE-Host, VMID und Passwort erforderlich.",
+  "PVE9: udev rules reloaded — new interfaces will get correct names without reboot": "PVE9: udev-Regeln neu geladen – neue Schnittstellen erhalten ohne Neustart die korrekten Namen",
+  "Package Updates Available": "Paketaktualisierungen verfügbar",
+  "Package lists": "Paketlisten",
+  "Package lists updated after GPG fix": "Paketlisten nach GPG-Korrektur aktualisiert",
+  "Package lists updated successfully": "Paketlisten erfolgreich aktualisiert",
+  "Package update completed with warnings, continuing...": "Paketaktualisierung mit Warnungen abgeschlossen, Fortsetzung ...",
+  "Package update had issues, checking details...": "Bei der Paketaktualisierung gab es Probleme, beim Überprüfen der Details ...",
+  "Package update still has issues, continuing anyway...": "Bei der Paketaktualisierung treten immer noch Probleme auf, es wird trotzdem fortgesetzt ...",
+  "Packages from backup to install:": "Pakete vom Backup zur Installation:",
+  "Packages upgrade successfull": "Paketaktualisierung erfolgreich",
+  "Packages upgraded": "Pakete aktualisiert",
+  "Packages:": "Pakete:",
+  "Packaging OVA file...": "OVA-Datei verpacken...",
+  "Packing installer archive...": "Installationsarchiv packen...",
+  "Parsing OVF descriptor...": "OVF-Deskriptor wird geparst...",
+  "Partial VM removed": "Teilweise VM entfernt",
+  "Partition": "Partition",
+  "Partition created": "Partition erstellt",
+  "Partition created:": "Partition erstellt:",
+  "Partition table wiped": "Partitionstabelle gelöscht",
+  "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "Passphrase, die zum Entsperren der importierten Schlüsseldatei verwendet wird (leer lassen, wenn die Schlüsseldatei unverschlüsselt ist / kdf=none):",
+  "Passphrases do not match.": "Passphrasen stimmen nicht überein.",
+  "Passphrases do not match. Try again.": "Passphrasen stimmen nicht überein. Versuchen Sie es erneut.",
+  "Passthrough may fail depending on hardware/firmware implementation.": "Passthrough kann je nach Hardware-/Firmware-Implementierung fehlschlagen.",
+  "Passthrough may still work without a ROM file.": "Passthrough funktioniert möglicherweise auch ohne ROM-Datei.",
+  "Passthrough may work, but startup/restart reliability is not guaranteed.": "Passthrough funktioniert möglicherweise, aber die Start-/Neustartzuverlässigkeit kann nicht garantiert werden.",
+  "Password": "Passwort",
+  "Password Mismatch": "Passwortkonflikt",
+  "Password cannot be empty.": "Das Passwort darf nicht leer sein.",
+  "Password confirmation cannot be empty.": "Die Passwortbestätigung darf nicht leer sein.",
+  "Password confirmation is required.": "Eine Passwortbestätigung ist erforderlich.",
+  "Password for": "Passwort für",
+  "Password for:": "Passwort für:",
+  "Password is correct": "Das Passwort ist korrekt",
+  "Password or API token secret:": "Passwort oder API-Token-Geheimnis:",
+  "Password reset completed.": "Passwort-Reset abgeschlossen.",
+  "Passwords do not match. Please try again.": "Passwörter stimmen nicht überein. Bitte versuchen Sie es erneut.",
+  "Paste the UUP Dump URL here": "Fügen Sie hier die UUP-Dump-URL ein",
+  "Patching source for kernel compatibility...": "Patch-Quelle für Kernel-Kompatibilität...",
+  "Path does not exist.": "Pfad existiert nicht.",
+  "Path must be absolute (start with /)": "Der Pfad muss absolut sein (mit / beginnen)",
+  "Path must be absolute (start with /).": "Der Pfad muss absolut sein (beginnen Sie mit /).",
+  "Path not found": "Pfad nicht gefunden",
+  "Path:": "Weg:",
+  "Paths applied:": "Angewandte Pfade:",
+  "Paths included in backup": "Im Backup enthaltene Pfade",
+  "Paths not found at backup time": "Pfade wurden zum Backup-Zeitpunkt nicht gefunden",
+  "Paths skipped:": "Übersprungene Pfade:",
+  "Paths to back up:": "Zu sichernde Pfade:",
+  "Paths:": "Pfade:",
+  "Pending restore ID:": "Ausstehende Wiederherstellungs-ID:",
+  "Pending restore dir:": "Ausstehendes Wiederherstellungsverzeichnis:",
+  "Pending restore prepared. A reboot is required to complete it.": "Ausstehende Wiederherstellung vorbereitet. Zum Abschließen ist ein Neustart erforderlich.",
+  "Pending restore prepared. It will run automatically at next boot.": "Ausstehende Wiederherstellung vorbereitet. Es wird beim nächsten Start automatisch ausgeführt.",
+  "Pending restore script not found or not executable:": "Ausstehendes Wiederherstellungsskript nicht gefunden oder nicht ausführbar:",
+  "Pending upgrades detected on a clustered node.\n\nTo proceed safely, update this node to the latest Proxmox VE 8.x before switching to Trixie/PVE 9.\n\nSelect Yes for AUTOMATIC upgrade (recommended), or No for MANUAL instructions.": "Ausstehende Upgrades wurden auf einem geclusterten Knoten erkannt.\n\nUm sicher vorzugehen, aktualisieren Sie diesen Knoten auf die neueste Proxmox VE 8.x, bevor Sie auf Trixie/PVE 9 umsteigen.\n\nWählen Sie „Ja“ für AUTOMATISCHES Upgrade (empfohlen) oder „Nein“ für MANUELLE Anweisungen.",
+  "Pending upgrades detected on a clustered node. Perform AUTOMATIC upgrade now? (y = automatic, n = manual):": "Ausstehende Upgrades wurden auf einem geclusterten Knoten erkannt. Jetzt AUTOMATISCHES Upgrade durchführen? (y = automatisch, n = manuell):",
+  "Per official known issues; ensures proper boot after upgrade": "Laut offiziellen bekannten Problemen; stellt einen ordnungsgemäßen Start nach dem Upgrade sicher",
+  "Performance": "Leistung",
+  "Performance optimized": "Leistungsoptimiert",
+  "Performing complete package reinstallation...": "Komplette Neuinstallation des Pakets wird durchgeführt...",
+  "Performing packages upgrade...": "Paketaktualisierung wird durchgeführt...",
+  "Performing system cleanup...": "Systembereinigung wird durchgeführt...",
+  "Performs automatic cleanup after updating": "Führt nach der Aktualisierung eine automatische Bereinigung durch",
+  "Permanent Mount": "Permanente Halterung",
+  "Permanent Mounts (fstab):": "Permanente Mounts (fstab):",
+  "Permanent:": "Dauerhaft:",
+  "Permanently delete saved target:": "Gespeichertes Ziel dauerhaft löschen:",
+  "Permanently delete this archive and its sidecar?": "Dieses Archiv und seinen Sidecar dauerhaft löschen?",
+  "Permission error": "Berechtigungsfehler",
+  "Permissions:": "Berechtigungen:",
+  "Persist mount in CT /etc/fstab (optional):": "Mounten in CT /etc/fstab beibehalten (optional):",
+  "Persistent:": "Hartnäckig:",
+  "Physical Function with": "Körperliche Funktion mit",
+  "Physical interface": "Physische Schnittstelle",
+  "Physical interfaces available": "Physikalische Schnittstellen verfügbar",
+  "Pick PVE vzdump job": "PVE vzdump-Job auswählen",
+  "Pick USB target": "USB-Ziel auswählen",
+  "Pick Yes to destroy them now (before reboot). Pick No to keep the additive restore and clean up manually later.": "Wählen Sie „Ja“, um sie jetzt zu zerstören (vor dem Neustart).Wählen Sie „Nein“, um das Additiv wiederherzustellen und später manuell zu bereinigen.",
+  "Pick a USB disk:": "Wählen Sie ein USB-Laufwerk aus:",
+  "Pick a drive to unmount:": "Wählen Sie ein Laufwerk zum Aufheben der Bereitstellung aus:",
+  "Pick a mounted USB as target": "Wählen Sie einen gemounteten USB-Stick als Ziel",
+  "Pick a target to remove:": "Wählen Sie ein Ziel zum Entfernen aus:",
+  "Pick an SSH private key (auto-detected on this host):": "Wählen Sie einen privaten SSH-Schlüssel (wird auf diesem Host automatisch erkannt):",
+  "Pick an alternative way to authorize the new key:": "Wählen Sie eine alternative Möglichkeit zur Autorisierung des neuen Schlüssels:",
+  "Please check network connectivity.": "Bitte überprüfen Sie die Netzwerkkonnektivität.",
+  "Please check permissions and try again.": "Bitte überprüfen Sie die Berechtigungen und versuchen Sie es erneut.",
+  "Please check the installation.": "Bitte überprüfen Sie die Installation.",
+  "Please check:": "Überprüfen Sie bitte:",
+  "Please choose another path.": "Bitte wählen Sie einen anderen Pfad.",
+  "Please configure it manually and reboot.": "Bitte konfigurieren Sie es manuell und starten Sie neu.",
+  "Please expand the container disk and run this option again.": "Bitte erweitern Sie die Containerfestplatte und führen Sie diese Option erneut aus.",
+  "Please install the NVIDIA drivers first using the option:": "Bitte installieren Sie zuerst die NVIDIA-Treiber mit der Option:",
+  "Please mark at least one option, or press Cancel to exit.": "Bitte markieren Sie mindestens eine Option oder klicken Sie auf „Abbrechen“, um den Vorgang zu beenden.",
+  "Please reboot manually and run the passthrough step again.": "Bitte starten Sie manuell neu und führen Sie den Passthrough-Schritt erneut aus.",
+  "Please reboot manually to complete the switch.": "Bitte starten Sie manuell neu, um den Wechsel abzuschließen.",
+  "Please reboot the system manually to complete the GPU switch.": "Bitte starten Sie das System manuell neu, um den GPU-Wechsel abzuschließen.",
+  "Please reselect GPU(s) and choose only compatible devices for VM mode.": "Bitte wählen Sie die GPU(s) erneut aus und wählen Sie nur kompatible Geräte für den VM-Modus aus.",
+  "Please resolve the problem(s) as described above, then re-run the upgrade script.": "Bitte beheben Sie das/die Problem(e) wie oben beschrieben und führen Sie dann das Upgrade-Skript erneut aus.",
+  "Please select GPU(s) that are currently in the same mode and try again.": "Bitte wählen Sie GPU(s) aus, die sich derzeit im gleichen Modus befinden, und versuchen Sie es erneut.",
+  "Please select a valid option": "Bitte wählen Sie eine gültige Option aus",
+  "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Bitte verwenden Sie eine SSH-Sitzung (Linux, macOS, Windows/PuTTY) oder eine physische Konsole, um das Upgrade durchzuführen.",
+  "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "Der Pool scheint keine SSD/NVMe-Geräte mit Discard-Unterstützung zu verwenden. ZFS-Autotrim für Pool überspringen:",
+  "Pool exists": "Pool vorhanden",
+  "Pool name matches but GUID differs (fresh ZFS install):": "Poolname stimmt überein, aber GUID unterscheidet sich (neue ZFS-Installation):",
+  "Pool:": "Pool:",
+  "Port": "Hafen",
+  "Port:": "Hafen:",
+  "Portal IP and port are correct": "Portal-IP und Port sind korrekt",
+  "Portal is reachable": "Portal ist erreichbar",
+  "Portal:": "Portal:",
+  "Portuguese": "Portugiesisch",
+  "Post-Installation Options": "Optionen nach der Installation",
+  "Post-Installation Scripts": "Skripte nach der Installation",
+  "Postfix configuration": "Postfix-Konfiguration",
+  "Potential QEMU startup/assertion failures": "Potenzielle QEMU-Start-/Behauptungsfehler",
+  "Power state D3cold/D0 transitions may be inaccessible": "Auf die Übergänge des Energiezustands D3cold/D0 kann möglicherweise nicht zugegriffen werden",
+  "Pre-check found": "Vorabprüfung gefunden",
+  "Pre-configure destinations so you don't have to enter them every time you back up.": "Konfigurieren Sie Ziele vorab, damit Sie sie nicht bei jedem Backup erneut eingeben müssen.",
+  "Pre-existing gasket-dkms package removed.": "Vorhandenes „gasket-dkms“-Paket entfernt.",
+  "Pre-restore backup:": "Sicherung vor der Wiederherstellung:",
+  "Pre-upgrade check FAILED: the simulation shows that 'proxmox-ve' would be REMOVED.\n    This indicates a repository or dependency issue and upgrading now could break your Proxmox installation.": "Überprüfung vor dem Upgrade fehlgeschlagen: Die Simulation zeigt, dass „proxmox-ve“ ENTFERNT würde.\n    Dies weist auf ein Repository- oder Abhängigkeitsproblem hin und ein Upgrade jetzt könnte Ihre Proxmox-Installation beschädigen.",
+  "Pre-upgrade simulation passed: 'proxmox-ve' will be kept or upgraded safely.": "Simulation vor dem Upgrade bestanden: „proxmox-ve“ wird sicher beibehalten oder aktualisiert.",
+  "Preparing Log2RAM configuration": "Vorbereiten der Log2RAM-Konfiguration",
+  "Preparing files for backup...": "Dateien werden für die Sicherung vorbereitet...",
+  "Preparing host mount...": "Host-Mount wird vorbereitet...",
+  "Preparing pending restore (network-safe)": "Ausstehende Wiederherstellung vorbereiten (netzwerksicher)",
+  "Preparing staging area...": "Bereitstellungsbereich wird vorbereitet...",
+  "Preserving logs to /var/log.hdd before unmounting...": "Protokolle werden vor dem Aufheben der Bereitstellung in /var/log.hdd beibehalten ...",
+  "Press 'q' to exit": "Drücken Sie „q“, um den Vorgang zu beenden",
+  "Press Ctrl+C to stop the server and return to menu.": "Drücken Sie Strg+C, um den Server zu stoppen und zum Menü zurückzukehren.",
+  "Press ENTER to continue...": "Drücken Sie ENTER, um fortzufahren...",
+  "Press ENTER to return to the menu...": "Drücken Sie ENTER, um zum Menü zurückzukehren...",
+  "Press ENTER to return...": "Drücken Sie ENTER, um zurückzukehren...",
+  "Press Enter to close...": "Drücken Sie die Eingabetaste, um zu schließen...",
+  "Press Enter to continue": "Drücken Sie die Eingabetaste, um fortzufahren",
+  "Press Enter to continue...": "Drücken Sie die Eingabetaste, um fortzufahren...",
+  "Press Enter to exit and repair": "Drücken Sie die Eingabetaste, um den Vorgang zu beenden und zu reparieren",
+  "Press Enter to exit the script after reading instructions...": "Drücken Sie die Eingabetaste, um das Skript zu verlassen, nachdem Sie die Anweisungen gelesen haben ...",
+  "Press Enter to exit...": "Drücken Sie die Eingabetaste, um den Vorgang zu beenden...",
+  "Press Enter to return": "Drücken Sie die Eingabetaste, um zurückzukehren",
+  "Press Enter to return to menu...": "Drücken Sie die Eingabetaste, um zum Menü zurückzukehren...",
+  "Press Enter to return to the main menu...": "Drücken Sie die Eingabetaste, um zum Hauptmenü zurückzukehren...",
+  "Press Enter to return...": "Drücken Sie die Eingabetaste, um zurückzukehren...",
+  "Press Enter when the line has been pasted on the server...": "Drücken Sie die Eingabetaste, wenn die Zeile auf dem Server eingefügt wurde ...",
+  "Press OK to see the preview, then confirm": "Drücken Sie OK, um die Vorschau anzuzeigen, und bestätigen Sie dann",
+  "Pretty uptime format": "Hübsches Uptime-Format",
+  "Preview Backup": "Vorschau des Backups",
+  "Preview Changes": "Vorschau der Änderungen",
+  "Preview changes (diff)": "Vorschau der Änderungen (Unterschiede)",
+  "Preview: changes that would be applied": "Vorschau: Änderungen, die angewendet würden",
+  "Previous DKMS tree cleared.": "Vorheriger DKMS-Baum gelöscht.",
+  "Previous installation cleaned": "Vorherige Installation gereinigt",
+  "Previous installation removed": "Vorherige Installation entfernt",
+  "Previous shutdowns": "Frühere Abschaltungen",
+  "Privileged": "Privilegiert",
+  "Privileged Container": "Privilegierter Container",
+  "Privileged Container Required": "Privilegierter Container erforderlich",
+  "Privileged container": "Privilegierter Container",
+  "Privileged container selected:": "Privilegierter Container ausgewählt:",
+  "Privileged container — UID-shift remapping skipped (not applicable)": "Privilegierter Container – UID-Shift-Neuzuordnung übersprungen (nicht anwendbar)",
+  "Privileged container — direct root access": "Privilegierter Container – direkter Root-Zugriff",
+  "Privileged container — host root maps directly, no permission changes needed": "Privilegierter Container – Root-Maps direkt hosten, keine Berechtigungsänderungen erforderlich",
+  "Privileged containers can access host devices directly": "Privilegierte Container können direkt auf Hostgeräte zugreifen",
+  "Privileged containers have full root access to the host system!": "Privilegierte Container haben vollen Root-Zugriff auf das Hostsystem!",
+  "Privileged: Full host access (less secure)": "Privilegiert: Vollständiger Hostzugriff (weniger sicher)",
+  "Proceed": "Fortfahren",
+  "Proceed with removal": "Fahren Sie mit der Entfernung fort",
+  "Proceed?": "Fortfahren?",
+  "Proceeding with Log2RAM setup on non-SSD disk as requested by user.": "Fahren Sie mit der Log2RAM-Einrichtung auf einer Nicht-SSD-Festplatte fort, wie vom Benutzer gewünscht.",
+  "Process may take several minutes depending on container size": "Der Vorgang kann je nach Behältergröße mehrere Minuten dauern",
+  "Process may take several minutes for large containers": "Bei großen Behältern kann der Vorgang mehrere Minuten dauern",
+  "Processes using NVIDIA:": "Prozesse mit NVIDIA:",
+  "Profile": "Profil",
+  "Profile:": "Profil:",
+  "Proposed Changes": "Vorgeschlagene Änderungen",
+  "Provided by newer version — skipping": "Wird von einer neueren Version bereitgestellt – wird übersprungen",
+  "ProxMenux Information": "ProxMenux-Informationen",
+  "ProxMenux Monitor": "ProxMenux-Monitor",
+  "ProxMenux Monitor Service Verification": "Überprüfung des ProxMenux Monitor-Dienstes",
+  "ProxMenux Monitor authentication is not configured on this host — there is no password to reset.": "Die ProxMenux Monitor-Authentifizierung ist auf diesem Host nicht konfiguriert – es gibt kein Passwort zum Zurücksetzen.",
+  "ProxMenux Monitor filter configured": "ProxMenux Monitorfilter konfiguriert",
+  "ProxMenux Monitor has been activated.": "ProxMenux Monitor wurde aktiviert.",
+  "ProxMenux Monitor has been deactivated.": "ProxMenux Monitor wurde deaktiviert.",
+  "ProxMenux Monitor is not installed": "ProxMenux Monitor ist nicht installiert",
+  "ProxMenux Monitor is not installed.": "ProxMenux Monitor ist nicht installiert.",
+  "ProxMenux Monitor jail configured": "ProxMenux Monitor-Jail konfiguriert",
+  "ProxMenux Monitor protection": "ProxMenux Monitorschutz",
+  "ProxMenux Monitor unit repaired and restarted": "ProxMenux Monitor-Einheit repariert und neu gestartet",
+  "ProxMenux Monitor → Backups tab (live progress card with estimated time, logs, rollback delta)": "ProxMenux Monitor → Registerkarte „Backups“ (Live-Fortschrittskarte mit geschätzter Zeit, Protokollen, Rollback-Delta)",
+  "ProxMenux can apply open permissions on this NFS directory from the host so the container can read and write:": "ProxMenux kann vom Host aus Öffnungsberechtigungen für dieses NFS-Verzeichnis anwenden, sodass der Container lesen und schreiben kann:",
+  "ProxMenux can remount it with open permissions so any LXC can read and write.": "ProxMenux kann es mit offenen Berechtigungen erneut bereitstellen, sodass jeder LXC lesen und schreiben kann.",
+  "ProxMenux cannot override NFS server-side permissions from the host.": "ProxMenux kann serverseitige NFS-Berechtigungen vom Host nicht überschreiben.",
+  "ProxMenux customizations removed from bashrc": "ProxMenux-Anpassungen aus bashrc entfernt",
+  "ProxMenux does not validate the contents; any keyfile your PBS accepts is accepted here.": "ProxMenux validiert den Inhalt nicht;Jede von Ihrem PBS akzeptierte Schlüsseldatei wird hier akzeptiert.",
+  "ProxMenux files:": "ProxMenux-Dateien:",
+  "ProxMenux logo applied": "ProxMenux-Logo angewendet",
+  "ProxMenux only acts as a launcher — once the script starts, control leaves ProxMenux.": "ProxMenux fungiert nur als Startprogramm – sobald das Skript gestartet wird, verlässt ProxMenux die Steuerung.",
+  "ProxMenux saved it locally at:": "ProxMenux hat es lokal gespeichert unter:",
+  "Proxmology logo applied": "Proxmology-Logo angewendet",
+  "Proxmox 9 system update allready": "Proxmox 9 Systemupdate bereits",
+  "Proxmox APT repositories configured": "Proxmox APT-Repositorys konfiguriert",
+  "Proxmox Backup Server (PBS) destinations": "Proxmox Backup Server (PBS)-Ziele",
+  "Proxmox CIFS Storage Status:": "Proxmox CIFS-Speicherstatus:",
+  "Proxmox NFS Storage Status:": "Proxmox NFS-Speicherstatus:",
+  "Proxmox System Update": "Proxmox-Systemupdate",
+  "Proxmox Update": "Proxmox-Update",
+  "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 system update completed successfully": "Proxmox VE 8 Systemupdate erfolgreich abgeschlossen",
+  "Proxmox VE 8 to 9 Manual Upgrade Guide": "Manuelles Upgrade-Handbuch für Proxmox VE 8 auf 9",
+  "Proxmox VE 9.x no-subscription repository created": "Proxmox VE 9.x No-Subscription-Repository erstellt",
+  "Proxmox VE Helper Scripts": "Proxmox VE-Hilfsskripte",
+  "Proxmox VE configuration completed.": "Proxmox VE-Konfiguration abgeschlossen.",
+  "Proxmox auth logger service created and started": "Proxmox-Auth-Logger-Dienst erstellt und gestartet",
+  "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "Das Proxmox-Enterprise-Repository fehlt möglicherweise oder ist nicht zugänglich. Ich versuche, auf kein Abonnement umzustellen...",
+  "Proxmox filter configured": "Proxmox-Filter konfiguriert",
+  "Proxmox iSCSI Storage Status:": "Proxmox iSCSI-Speicherstatus:",
+  "Proxmox jail configured": "Proxmox-Jail konfiguriert",
+  "Proxmox local storages:": "Lokale Proxmox-Speicher:",
+  "Proxmox repository OK (candidate is 9.x)": "Proxmox-Repository OK (Kandidat ist 9.x)",
+  "Proxmox repository configuration completed": "Konfiguration des Proxmox-Repositorys abgeschlossen",
+  "Proxmox repository fixed (no-subscription, candidate is 9.x)": "Proxmox-Repository behoben (kein Abonnement, Kandidat ist 9.x)",
+  "Proxmox status:": "Proxmox-Status:",
+  "Proxmox storages:": "Proxmox-Speicher:",
+  "Proxmox system repair completed successfully!": "Proxmox-Systemreparatur erfolgreich abgeschlossen!",
+  "Proxmox system repair completed with some issues.": "Die Reparatur des Proxmox-Systems wurde mit einigen Problemen abgeschlossen.",
+  "Proxmox system update": "Proxmox-Systemupdate",
+  "Proxmox web interface protection": "Schutz der Proxmox-Weboberfläche",
+  "Proxmox web interface: Datacenter > Storage > Add > Directory": "Proxmox-Weboberfläche: Datencenter > Speicher > Hinzufügen > Verzeichnis",
+  "Proxmox web interface: Datacenter > Storage > Add > NFS": "Proxmox-Weboberfläche: Datencenter > Speicher > Hinzufügen > NFS",
+  "Proxmox web interface: Datacenter > Storage > Add > SMB/CIFS": "Proxmox-Weboberfläche: Rechenzentrum > Speicher > Hinzufügen > SMB/CIFS",
+  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Proxmox-Weboberfläche: Datencenter > Speicher > Hinzufügen > ZFS",
+  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Proxmox-Weboberfläche: Rechenzentrum > Speicher > Hinzufügen > iSCSI",
+  "Pulling latest changes from GitHub...": "Aktuelle Änderungen von GitHub abrufen...",
+  "Purging log2ram apt package...": "Log2ram-Apt-Paket wird gelöscht...",
+  "Quick health check (PASSED / FAILED)": "Schneller Gesundheitscheck (bestanden / nicht bestanden)",
+  "Quick health status   — overall SMART result + key attributes": "Schneller Gesundheitszustand – Gesamt-SMART-Ergebnis + Schlüsselattribute",
+  "RAID Detected": "RAID erkannt",
+  "RAID member detected": "RAID-Mitglied erkannt",
+  "RAM Size": "RAM-Größe",
+  "RAM and swap usage": "RAM- und Swap-Nutzung",
+  "REPAIR SUMMARY": "REPARATURÜBERSICHT",
+  "REQUIREMENTS:": "ANFORDERUNGEN:",
+  "ROM dump not available — configuring without romfile.": "ROM-Dump nicht verfügbar – Konfiguration ohne ROM-Datei.",
+  "ROM file used": "Verwendete ROM-Datei",
+  "RPC Bind Service: RUNNING": "RPC-Bindungsdienst: LÄUFT",
+  "RPC Bind Service: STOPPED": "RPC-Bindungsdienst: BEENDET",
+  "RPC Bind Service: STOPPED - starting...": "RPC-Bindungsdienst: GESTOPPT – startet...",
+  "Re-enter the BORG REPOKEY passphrase to confirm:": "Geben Sie die BORG REPOKEY-Passphrase erneut ein, um zu bestätigen:",
+  "Re-running pre-check after repairs...": "Nach der Reparatur wird die Vorkontrolle erneut durchgeführt...",
+  "Reachable": "Erreichbar",
+  "Read-Only": "Schreibgeschützt",
+  "Read-Only access": "Nur lesender Zugriff",
+  "Read-Write (universal)": "Lesen/Schreiben (universell)",
+  "Read-Write access": "Lese-/Schreibzugriff",
+  "Read-only": "Schreibgeschützt",
+  "Read-only access (or no write permissions).": "Nur-Lese-Zugriff (oder keine Schreibberechtigungen).",
+  "Read-only mount": "Schreibgeschützter Mount",
+  "Read/Write (default)": "Lesen/Schreiben (Standard)",
+  "Read/write CPU model-specific registers": "CPU-modellspezifische Register lesen/schreiben",
+  "Readable user table (UID, shell, etc.)": "Lesbare Benutzertabelle (UID, Shell usw.)",
+  "Reading NVMe SMART data...": "NVMe SMART-Daten werden gelesen...",
+  "Reading NVMe self-test log...": "NVMe-Selbsttestprotokoll wird gelesen...",
+  "Reading SMART data...": "SMART-Daten werden gelesen...",
+  "Reading SMART self-test log...": "SMART-Selbsttestprotokoll wird gelesen...",
+  "Reading full SMART report...": "Vollständigen SMART-Bericht lesen...",
+  "Real-time bandwidth usage (press q to exit)": "Echtzeit-Bandbreitennutzung (zum Beenden q drücken)",
+  "Real-time network monitoring (press q to exit)": "Echtzeit-Netzwerküberwachung (zum Beenden q drücken)",
+  "Real-time network usage (iftop)": "Netzwerknutzung in Echtzeit (iftop)",
+  "Reason: Access denied": "Grund: Zugriff verweigert",
+  "Reason: Authentication required": "Grund: Authentifizierung erforderlich",
+  "Reason: Permission denied": "Grund: Erlaubnis verweigert",
+  "Reboot Recommended": "Neustart empfohlen",
+  "Reboot Required": "Neustart erforderlich",
+  "Reboot is required to apply the scheduled restore.": "Um die geplante Wiederherstellung anzuwenden, ist ein Neustart erforderlich.",
+  "Reboot is required to complete the pending restore.": "Um die ausstehende Wiederherstellung abzuschließen, ist ein Neustart erforderlich.",
+  "Reboot now?": "Jetzt neu starten?",
+  "Reboot pending — changes will take full effect after the next restart.": "Neustart ausstehend – Änderungen werden nach dem nächsten Neustart vollständig wirksam.",
+  "Reboot the VM to complete the driver installation.": "Starten Sie die VM neu, um die Treiberinstallation abzuschließen.",
+  "Reboot the system:": "Starten Sie das System neu:",
+  "Rebooting the system...": "Neustart des Systems...",
+  "Rebuilding initramfs to apply nouveau blacklist before installation...": "Initramfs neu erstellen, um vor der Installation die Nouveau-Blacklist anzuwenden ...",
+  "Recent": "Jüngste",
+  "Recent Samba Servers": "Aktuelle Samba-Server",
+  "Recent Samba server": "Aktueller Samba-Server",
+  "Recent logs:": "Aktuelle Protokolle:",
+  "Recent test results:": "Aktuelle Testergebnisse:",
+  "Recommendation: reformat the disk to ext4 for a robust setup — see docs.": "Empfehlung: Formatieren Sie die Festplatte für ein stabiles Setup auf ext4 neu – siehe Dokumentation.",
+  "Recommendation: start with Complete restore.": "Empfehlung: Beginnen Sie mit der vollständigen Wiederherstellung.",
+  "Recommendation: use 'Export to file' for these paths and apply manually during a maintenance window.": "Empfehlung: Verwenden Sie für diese Pfade „In Datei exportieren“ und wenden Sie sie während eines Wartungsfensters manuell an.",
+  "Recommended diagnostic commands": "Empfohlene Diagnosebefehle",
+  "Recommended: Install the QEMU Guest Agent in the VM": "Empfohlen: Installieren Sie den QEMU Guest Agent in der VM",
+  "Recommended: run": "Empfohlen: Laufen",
+  "Recommended: schedule these paths for next boot to avoid immediate SSH disconnection.": "Empfohlen: Planen Sie diese Pfade für den nächsten Start ein, um eine sofortige SSH-Trennung zu vermeiden.",
+  "Recommended: use GPU -> LXC mode for these devices.": "Empfohlen: Verwenden Sie für diese Geräte den GPU->LXC-Modus.",
+  "Recommended: use GPU with LXC workloads instead of VM passthrough on this hardware.": "Empfohlen: Verwenden Sie auf dieser Hardware eine GPU mit LXC-Workloads anstelle von VM-Passthrough.",
+  "Recover the keyfile using your recovery passphrase?": "Die Schlüsseldatei mit Ihrer Wiederherstellungspassphrase wiederherstellen?",
+  "Recoverable:": "Wiederherstellbar:",
+  "Recovery blob upload failed — main backup is OK, but keyfile recovery from PBS will not be available for this backup.": "Hochladen des Wiederherstellungs-Blobs fehlgeschlagen – Hauptsicherung ist in Ordnung, aber die Wiederherstellung der Schlüsseldatei von PBS ist für diese Sicherung nicht verfügbar.",
+  "Recovery blob:": "Wiederherstellungs-Blob:",
+  "Recovery failed": "Die Wiederherstellung ist fehlgeschlagen",
+  "Recovery passphrase": "Wiederherstellungspassphrase",
+  "Recovery setup failed": "Die Wiederherstellungseinrichtung ist fehlgeschlagen",
+  "Refresh APT index and verify repositories:": "APT-Index aktualisieren und Repositorys überprüfen:",
+  "Refresh your browser (Ctrl+Shift+R) to see changes": "Aktualisieren Sie Ihren Browser (Strg+Umschalt+R), um die Änderungen anzuzeigen",
+  "Refresh your browser to see changes (server restart may be required)": "Aktualisieren Sie Ihren Browser, um Änderungen zu sehen (möglicherweise ist ein Neustart des Servers erforderlich).",
+  "Refreshing apt cache...": "Apt-Cache wird aktualisiert...",
+  "Regenerating PVE package cache...": "Der PVE-Paket-Cache wird neu generiert...",
+  "Regenerating boot artifacts for the merged kernel-agnostic changes...": "Boot-Artefakte für die zusammengeführten Kernel-agnostischen Änderungen werden neu generiert ...",
+  "Regenerating certificates and restarting services...": "Zertifikate werden neu generiert und Dienste neu gestartet...",
+  "Register mount path in Proxmox:": "Mount-Pfad in Proxmox registrieren:",
+  "Registering disk as Proxmox storage...": "Festplatte als Proxmox-Speicher registrieren...",
+  "Registering module with DKMS...": "Modul bei DKMS registrieren...",
+  "Reinstall / update Coral drivers": "Coral-Treiber neu installieren/aktualisieren",
+  "Reinstall Fail2Ban": "Installieren Sie Fail2Ban neu",
+  "Reinstall Lynis": "Lynis neu installieren",
+  "Reinstall and reconfigure Fail2Ban": "Installieren Sie Fail2Ban neu und konfigurieren Sie es neu",
+  "Reinstall/Update NVIDIA drivers": "NVIDIA-Treiber neu installieren/aktualisieren",
+  "Reinstalled": "Neu installiert",
+  "Reinstalled Proxmox packages successfully": "Proxmox-Pakete erfolgreich neu installiert",
+  "Reinstalling core Proxmox packages...": "Kernpakete von Proxmox werden neu installiert...",
+  "Release Channel": "Release-Kanal",
+  "Release channel set to Beta.": "Veröffentlichungskanal auf Beta eingestellt.",
+  "Release channel set to Stable.": "Der Release-Kanal ist auf „Stabil“ eingestellt.",
+  "Release channel:": "Veröffentlichungskanal:",
+  "Reload Proxmox firewall rules": "Laden Sie die Proxmox-Firewallregeln neu",
+  "Reload network configuration (ifupdown2)": "Netzwerkkonfiguration neu laden (ifupdown2)",
+  "Remapped Users:": "Neu zugeordnete Benutzer:",
+  "Remapped users:": "Neu zugeordnete Benutzer:",
+  "Reminder: You must install the QEMU Guest Agent inside the Windows VM": "Erinnerung: Sie müssen den QEMU-Gastagenten in der Windows-VM installieren",
+  "Remote repository path:": "Remote-Repository-Pfad:",
+  "Remote server via SSH  (recommended — off-host, dedup across machines)": "Remote-Server über SSH (empfohlen – Off-Host, maschinenübergreifende Deduplizierung)",
+  "Remounting CIFS share with open permissions...": "CIFS-Freigabe wird mit offenen Berechtigungen erneut bereitgestellt ...",
+  "Remove CIFS Mount": "Entfernen Sie den CIFS-Mount",
+  "Remove CIFS Mount (pvesm or fstab)": "CIFS-Mount entfernen (pvesm oder fstab)",
+  "Remove CIFS Storage": "Entfernen Sie den CIFS-Speicher",
+  "Remove CIFS fstab Mount": "Entfernen Sie den CIFS-fstab-Mount",
+  "Remove CIFS fstab mount:": "CIFS-fstab-Mount entfernen:",
+  "Remove CIFS storage:": "CIFS-Speicher entfernen:",
+  "Remove Disk Storage": "Entfernen Sie den Festplattenspeicher",
+  "Remove Disk from fstab": "Entfernen Sie die Festplatte aus fstab",
+  "Remove FS labels  — partitions and data preserved": "FS-Kennzeichnungen entfernen – Partitionen und Daten bleiben erhalten",
+  "Remove FS labels — partitions and data preserved": "FS-Kennzeichnungen entfernen – Partitionen und Daten bleiben erhalten",
+  "Remove Fail2Ban": "Entfernen Sie Fail2Ban",
+  "Remove GPU from LXC config (keep Start on boot)": "GPU aus der LXC-Konfiguration entfernen (Start beim Booten beibehalten)",
+  "Remove GPU from LXC config + keep Start on boot unchanged": "Entfernen Sie die GPU aus der LXC-Konfiguration und lassen Sie Start beim Booten unverändert",
+  "Remove GPU from VM config (keep Start on boot)": "GPU aus der VM-Konfiguration entfernen (Start beim Booten beibehalten)",
+  "Remove GPU from source VM config (keep Start on boot)": "GPU aus der Quell-VM-Konfiguration entfernen (Start beim Booten beibehalten)",
+  "Remove GPU from source VM config + keep Start on boot unchanged": "Entfernen Sie die GPU aus der Quell-VM-Konfiguration und lassen Sie „Start beim Booten“ unverändert",
+  "Remove LXC Mount Point": "Entfernen Sie den LXC-Mount-Punkt",
+  "Remove Lynis": "Lynis entfernen",
+  "Remove Mount Point": "Mountpunkt entfernen",
+  "Remove Mount Point Confirmation:": "Mount-Point-Bestätigung entfernen:",
+  "Remove NFS Mount": "Entfernen Sie den NFS-Mount",
+  "Remove NFS Mount (pvesm or fstab)": "NFS-Mount entfernen (pvesm oder fstab)",
+  "Remove NFS Storage": "Entfernen Sie den NFS-Speicher",
+  "Remove NFS fstab Mount": "Entfernen Sie den NFS-fstab-Mount",
+  "Remove NFS fstab mount:": "Entfernen Sie den NFS-fstab-Mount:",
+  "Remove NFS storage:": "NFS-Speicher entfernen:",
+  "Remove Proxmox CIFS storage:": "Entfernen Sie den Proxmox CIFS-Speicher:",
+  "Remove Proxmox NFS storage:": "Entfernen Sie den Proxmox NFS-Speicher:",
+  "Remove Proxmox iSCSI storage:": "Entfernen Sie den Proxmox iSCSI-Speicher:",
+  "Remove Secure Gateway? State will be preserved.": "Secure Gateway entfernen? Der Zustand bleibt erhalten.",
+  "Remove custom paths": "Benutzerdefinierte Pfade entfernen",
+  "Remove disk references from affected VM(s)/CT(s) config": "Entfernen Sie Festplattenverweise aus der Konfiguration der betroffenen VM(s)/CT(s).",
+  "Remove iSCSI Storage": "Entfernen Sie den iSCSI-Speicher",
+  "Remove iSCSI storage definition:": "Entfernen Sie die iSCSI-Speicherdefinition:",
+  "Remove invalid port": "Entfernen Sie den ungültigen Port",
+  "Remove invalid port(s)": "Ungültige Port(s) entfernen",
+  "Remove keyfile from this host": "Schlüsseldatei von diesem Host entfernen",
+  "Remove mount point:": "Mountpunkt entfernen:",
+  "Remove obsolete systemd-boot meta-package": "Entfernen Sie das veraltete systemd-boot-Metapaket",
+  "Remove old repository files:": "Alte Repository-Dateien entfernen:",
+  "Remove passthrough device from VM": "Entfernen Sie das Passthrough-Gerät von der VM",
+  "Remove subscription banner": "Abonnementbanner entfernen",
+  "Remove the unprivileged flag from configuration:": "Entfernen Sie das Unprivileged-Flag aus der Konfiguration:",
+  "Remove unused packages and their config": "Entfernen Sie nicht verwendete Pakete und deren Konfiguration",
+  "Removed": "ENTFERNT",
+  "Removed KVM MSR options from configuration": "KVM-MSR-Optionen aus der Konfiguration entfernt",
+  "Removed Mount:": "Entfernte Halterung:",
+  "Removed all .link files from": "Alle .link-Dateien entfernt von",
+  "Removed bwlimit/ionice tuning (no .bak found)": "bwlimit/ionice-Tuning entfernt (keine .bak gefunden)",
+  "Removed configurations for": "Konfigurationen für entfernt",
+  "Removed credentials file:": "Anmeldeinformationsdatei entfernt:",
+  "Removed empty KVM configuration file": "Leere KVM-Konfigurationsdatei entfernt",
+  "Removed empty mount directory:": "Leeres Mount-Verzeichnis entfernt:",
+  "Removed entry from /etc/fstab": "Eintrag aus /etc/fstab entfernt",
+  "Removed from /etc/fstab": "Aus /etc/fstab entfernt",
+  "Removed from /etc/fstab.": "Aus /etc/fstab entfernt.",
+  "Removed idle=nomwait from /etc/kernel/cmdline (ZFS)": "„Idle=nomwait“ aus /etc/kernel/cmdline (ZFS) entfernt",
+  "Removed idle=nomwait from GRUB configuration": "„Idle=nomwait“ aus der GRUB-Konfiguration entfernt",
+  "Removed remapped user:": "Neu zugeordneter Benutzer entfernt:",
+  "Removed sharedfiles group.": "Sharedfiles-Gruppe entfernt.",
+  "Removed:": "ENTFERNT:",
+  "Removing APT IPv4 configuration...": "APT IPv4-Konfiguration wird entfernt...",
+  "Removing Coral packages...": "Coral-Pakete werden entfernt...",
+  "Removing Fail2Ban...": "Fail2Ban wird entfernt...",
+  "Removing GPU from VM": "GPU von VM entfernen",
+  "Removing Lynis...": "Lynis wird entfernt...",
+  "Removing NVIDIA DKMS entries...": "NVIDIA DKMS-Einträge werden entfernt...",
+  "Removing NVIDIA packages...": "NVIDIA-Pakete werden entfernt...",
+  "Removing OVH RTM...": "OVH RTM wird entfernt...",
+  "Removing OpenVSwitch...": "OpenVSwitch wird entfernt...",
+  "Removing VFIO ownership for selected GPU(s)...": "VFIO-Besitz für ausgewählte GPU(s) wird entfernt...",
+  "Removing all .link files from": "Entfernen aller .link-Dateien von",
+  "Removing any pre-existing gasket-dkms package...": "Entfernen aller bereits vorhandenen Gasket-DKMS-Pakete ...",
+  "Removing conflicting utilities...": "In Konflikt stehende Dienstprogramme werden entfernt...",
+  "Removing entropy generation optimization...": "Optimierung der Entropieerzeugung wird entfernt...",
+  "Removing filesystem signatures...": "Dateisystemsignaturen werden entfernt...",
+  "Removing from /etc/fstab...": "Aus /etc/fstab entfernen...",
+  "Removing gasket DKMS modules...": "Dichtung DKMS-Module entfernen...",
+  "Removing gateway...": "Gateway wird entfernt...",
+  "Removing guest agent...": "Gastagent wird entfernt...",
+  "Removing invalid configurations...": "Ungültige Konfigurationen werden entfernt...",
+  "Removing invalid existing file...": "Ungültige vorhandene Datei wird entfernt...",
+  "Removing kernel panic configuration...": "Kernel-Panic-Konfiguration wird entfernt...",
+  "Removing memory optimizations...": "Speicheroptimierungen werden entfernt...",
+  "Removing mount point": "Mountpunkt wird entfernt",
+  "Removing network optimizations...": "Netzwerkoptimierungen werden entfernt...",
+  "Removing no longer required packages and purging old cached updates...": "Entfernen nicht mehr benötigter Pakete und Löschen alter zwischengespeicherter Updates ...",
+  "Removing partial VM": "Teilweise VM entfernen",
+  "Removing previous DKMS source tree...": "Vorheriger DKMS-Quellbaum wird entfernt...",
+  "Removing previous Lynis installation...": "Vorherige Lynis-Installation wird entfernt...",
+  "Removing remapped users...": "Neu zugeordnete Benutzer werden entfernt...",
+  "Removing storage from Proxmox...": "Speicher aus Proxmox wird entfernt...",
+  "Removing system limits optimizations...": "Systemlimitoptimierungen werden entfernt...",
+  "Removing zfs-auto-snapshot...": "ZFS-Auto-Snapshot wird entfernt...",
+  "Renamed": "Umbenannt",
+  "Renamed NIC:": "NIC umbenannt:",
+  "Repair Complete": "Reparatur abgeschlossen",
+  "Repair Options:": "Reparaturmöglichkeiten:",
+  "Repairs and optimizes repositories": "Repariert und optimiert Repositorys",
+  "Replace": "Ersetzen",
+  "Replace <container-id> with the actual ID.": "Ersetzen Sie <container-id> durch die tatsächliche ID.",
+  "Replace <container-id> with your actual container ID": "Ersetzen Sie <container-id> durch Ihre tatsächliche Container-ID",
+  "Replace <storage-identifier> with the value from step 4": "Ersetzen Sie <storage-identifier> durch den Wert aus Schritt 4",
+  "Replace invalid port(s)": "Ersetzen Sie ungültige Ports.",
+  "Replace it?": "Ersetzen?",
+  "Replace paths with your actual values from step 5": "Ersetzen Sie die Pfade durch Ihre tatsächlichen Werte aus Schritt 5",
+  "Replace with your actual path from step 5": "Ersetzen Sie ihn durch Ihren tatsächlichen Pfad aus Schritt 5",
+  "Replacing gzip with pigz wrapper...": "Ersetzen von gzip durch pigz Wrapper ...",
+  "Repositories switched to no-subscription": "Repositorys wurden auf „Kein Abonnement“ umgestellt",
+  "Repository ready.": "Repository bereit.",
+  "Repository:": "Repository:",
+  "Require reboot": "Neustart erforderlich",
+  "Required command not found:": "Erforderlicher Befehl nicht gefunden:",
+  "Required if using a VirtIO or SCSI disk.": "Erforderlich, wenn eine VirtIO- oder SCSI-Festplatte verwendet wird.",
+  "Required install helpers not available.": "Erforderliche Installationshilfen nicht verfügbar.",
+  "Requires acl package. Skip if setfacl is not available.": "Erfordert ein ACL-Paket. Überspringen, wenn setfacl nicht verfügbar ist.",
+  "Requires authentication": "Erfordert Authentifizierung",
+  "Reset Capability Blocked": "Reset-Funktion blockiert",
+  "Reset Capability Warning": "Warnung zum Zurücksetzen der Fähigkeit",
+  "Reset Monitor Password": "Monitor-Passwort zurücksetzen",
+  "Reset ProxMenux Monitor Password": "Setzen Sie das ProxMenux-Monitorkennwort zurück",
+  "Reset current storage selection": "Aktuelle Speicherauswahl zurücksetzen",
+  "Resetting time synchronization...": "Zeitsynchronisierung wird zurückgesetzt...",
+  "Residual Bookworm entries commented where applicable": "Verbleibende Bücherwurm-Einträge ggf. kommentiert",
+  "Resolve package conflicts": "Paketkonflikte lösen",
+  "Restart Network": "Netzwerk neu starten",
+  "Restart Network Service": "Starten Sie den Netzwerkdienst neu",
+  "Restart Web UI proxy": "Starten Sie den Web-UI-Proxy neu",
+  "Restart and enable Samba:": "Starten Sie Samba neu und aktivieren Sie es:",
+  "Restart container to activate mount?": "Container neu starten, um Mount zu aktivieren?",
+  "Restarting ProxMenux Monitor service...": "ProxMenux Monitor-Dienst wird neu gestartet...",
+  "Restarting Proxmox services...": "Proxmox-Dienste werden neu gestartet...",
+  "Restarting container...": "Container wird neu gestartet...",
+  "Restarting gateway...": "Gateway wird neu gestartet...",
+  "Restarting network service...": "Netzwerkdienst wird neu gestartet...",
+  "Restarting the server...": "Neustart des Servers...",
+  "Restore Backup": "Sicherung wiederherstellen",
+  "Restore Network Backup": "Netzwerksicherung wiederherstellen",
+  "Restore a CT from backup": "Stellen Sie einen CT aus einem Backup wieder her",
+  "Restore a VM from backup": "Stellen Sie eine VM aus einem Backup wieder her",
+  "Restore actions": "Aktionen wiederherstellen",
+  "Restore applied:": "Wiederherstellung angewendet:",
+  "Restore can now proceed.": "Die Wiederherstellung kann nun fortgesetzt werden.",
+  "Restore failed": "Wiederherstellung fehlgeschlagen",
+  "Restore from Borg  →  staging": "Von Borg wiederherstellen → Staging",
+  "Restore from Borg repository": "Aus dem Borg-Repository wiederherstellen",
+  "Restore from PBS  →  staging": "Wiederherstellung von PBS → Staging",
+  "Restore from Proxmox Backup Server (PBS)": "Wiederherstellung vom Proxmox Backup Server (PBS)",
+  "Restore from local archive  (.tar.gz / .tar.zst)": "Wiederherstellung aus lokalem Archiv (.tar.gz / .tar.zst)",
+  "Restore from local archive  →  staging": "Wiederherstellung aus lokalem Archiv → Staging",
+  "Restore host configuration": "Hostkonfiguration wiederherstellen",
+  "Restore it ONLY if the target host has the same pools and disks as the source. Otherwise Proxmox may try to import non-existent pools at next boot.": "Stellen Sie es NUR wieder her, wenn der Zielhost über dieselben Pools und Festplatten wie die Quelle verfügt. Andernfalls versucht Proxmox möglicherweise beim nächsten Start, nicht vorhandene Pools zu importieren.",
+  "Restore plan": "Plan wiederherstellen",
+  "Restore plan summary": "Zusammenfassung des Wiederherstellungsplans",
+  "Restore source location": "Quellspeicherort wiederherstellen",
+  "Restored config is on disk; reboot the host to apply.": "Die wiederhergestellte Konfiguration befindet sich auf der Festplatte. Starten Sie den Host neu, um ihn anzuwenden.",
+  "Restored original /bin/gzip": "Original /bin/gzip wiederhergestellt",
+  "Restored original /etc/vzdump.conf from .bak": "Original /etc/vzdump.conf aus .bak wiederhergestellt",
+  "Restoring APT language downloads...": "APT-Sprachdownloads werden wiederhergestellt...",
+  "Restoring container memory to": "Containerspeicher wird wiederhergestellt",
+  "Restoring default journald configuration...": "Standard-Journald-Konfiguration wird wiederhergestellt...",
+  "Restoring enterprise repositories...": "Unternehmensrepositorys werden wiederhergestellt...",
+  "Restoring guest configs (LXC + QEMU)...": "Gastkonfigurationen werden wiederhergestellt (LXC + QEMU)...",
+  "Restoring original bashrc...": "Original-bashrc wird wiederhergestellt...",
+  "Restoring original logrotate configuration...": "Die ursprüngliche Logrotate-Konfiguration wird wiederhergestellt...",
+  "Restoring subscription banner...": "Abonnementbanner wird wiederhergestellt...",
+  "Results will be saved automatically to:": "Die Ergebnisse werden automatisch gespeichert unter:",
+  "Results will be saved to:": "Die Ergebnisse werden gespeichert unter:",
+  "Retention": "Zurückbehaltung",
+  "Return": "Zurückkehren",
+  "Return to Main Menu": "Zurück zum Hauptmenü",
+  "Return to Share Menu": "Zurück zum Teilen-Menü",
+  "Return to main menu": "Zurück zum Hauptmenü",
+  "Reused the encryption key from the PVE storage entry.": "Der Verschlüsselungsschlüssel aus dem PVE-Speichereintrag wurde wiederverwendet.",
+  "Reverting AMD (Ryzen/EPYC) fixes...": "AMD (Ryzen/EPYC)-Korrekturen werden rückgängig gemacht...",
+  "Reverting IOMMU/VFIO configuration...": "IOMMU/VFIO-Konfiguration wird zurückgesetzt...",
+  "Reverting TCP BBR + Fast Open...": "TCP BBR + Fast Open wird zurückgesetzt...",
+  "Reverting ZFS ARC tuning...": "ZFS ARC-Tuning wird zurückgesetzt...",
+  "Reverting pigz wrapper...": "Pigz-Wrapper wird zurückgesetzt...",
+  "Reverting vzdump speed tuning...": "vzdump-Geschwindigkeitsoptimierung wird zurückgesetzt...",
+  "Review passthrough config files": "Überprüfen Sie die Passthrough-Konfigurationsdateien",
+  "Review what will be removed": "Überprüfen Sie, was entfernt wird",
+  "Rollback: nothing to remove (host matches backup)": "Rollback: nichts zu entfernen (Host stimmt mit Backup überein)",
+  "Root SSH keys/config": "Root-SSH-Schlüssel/Konfiguration",
+  "Root inside container = root on host system": "Root im Container = Root auf dem Hostsystem",
+  "Root shell/profile config": "Root-Shell-/Profilkonfiguration",
+  "Root user on the PVE host (default 'root'):": "Root-Benutzer auf dem PVE-Host (Standard „root“):",
+  "Rotate the recovery passphrase": "Drehen Sie die Wiederherstellungspassphrase",
+  "Routing Information": "Routing-Informationen",
+  "Routing Table": "Routing-Tabelle",
+  "Run 'Mount NFS Share' to install NFS client automatically.": "Führen Sie „NFS-Freigabe bereitstellen“ aus, um den NFS-Client automatisch zu installieren.",
+  "Run 'Mount Samba Share' to install CIFS client automatically.": "Führen Sie „Mount Samba Share“ aus, um den CIFS-Client automatisch zu installieren.",
+  "Run PVE 8 to 9": "Führen Sie PVE 8 bis 9 aus",
+  "Run PVE 8 to 9 check": "Führen Sie den PVE 8 bis 9-Check durch",
+  "Run \\\"Install NVIDIA Drivers on Host\\\" first so the installer is cached.": "Führen Sie zuerst „NVIDIA-Treiber auf Host installieren“ aus, damit das Installationsprogramm zwischengespeichert wird.",
+  "Run a full security audit": "Führen Sie eine vollständige Sicherheitsüberprüfung durch",
+  "Run a job now": "Führen Sie jetzt einen Job aus",
+  "Run as server or client? [s/c]:": "Als Server oder Client ausführen? [sc]:",
+  "Run checklist again to verify upgrade:": "Führen Sie die Checkliste erneut aus, um das Upgrade zu überprüfen:",
+  "Run from console, or SSH inside tmux/screen": "Führen Sie es über die Konsole oder SSH in tmux/screen aus",
+  "Run job now": "Job jetzt ausführen",
+  "Run mode selected: Automatic": "Ausgewählter Betriebsmodus: Automatisch",
+  "Run mode selected: Automatic/Unattended": "Ausgewählter Betriebsmodus: Automatisch/Unbeaufsichtigt",
+  "Run mode selected: Interactive": "Ausgewählter Ausführungsmodus: Interaktiv",
+  "Run mode: Unattended": "Betriebsmodus: Unbeaufsichtigt",
+  "Run security audit now": "Führen Sie jetzt ein Sicherheitsaudit durch",
+  "Run the following inside the VM:": "Führen Sie Folgendes in der VM aus:",
+  "Run upgrade checklist script:": "Führen Sie das Upgrade-Checklisten-Skript aus:",
+  "Running": "Läuft",
+  "Running Lynis security audit...": "Lynis-Sicherheitsaudit wird ausgeführt...",
+  "Running NVIDIA installer in container. This may take several minutes...": "NVIDIA-Installationsprogramm im Container ausführen. Dies kann einige Minuten dauern...",
+  "Running NVIDIA uninstaller...": "NVIDIA-Deinstallationsprogramm ausführen...",
+  "Running VM detected": "Laufende VM erkannt",
+  "Running backup job:": "Sicherungsjob ausführen:",
+  "Running containers detected": "Laufende Container erkannt",
+  "Running pre-upgrade simulation to verify 'proxmox-ve' will remain installed...": "Führen Sie eine Simulation vor dem Upgrade durch, um zu überprüfen, ob „proxmox-ve“ installiert bleibt ...",
+  "SATA   (standard - high compatibility)": "SATA (Standard – hohe Kompatibilität)",
+  "SCSI   (recommended for Linux and Windows)": "SCSI (empfohlen für Linux und Windows)",
+  "SCSI   (recommended for Linux)": "SCSI (empfohlen für Linux)",
+  "SECURITY CONSIDERATIONS:": "SICHERHEITSÜBERLEGUNGEN:",
+  "SECURITY WARNING:": "SICHERHEITSHINWEIS:",
+  "SMART Action": "SMART-Aktion",
+  "SMART Disk Health & Test": "SMART Disk-Zustand und -Test",
+  "SMART health status: PASSED": "SMART-Gesundheitsstatus: BESTANDEN",
+  "SMB Client Error": "SMB-Client-Fehler",
+  "SMB Client Tools: AVAILABLE": "SMB-Client-Tools: VERFÜGBAR",
+  "SMB Client Tools: NOT AVAILABLE": "SMB-Client-Tools: NICHT VERFÜGBAR",
+  "SMB Error": "SMB-Fehler",
+  "SMB port 445:": "SMB-Port 445:",
+  "SMB ports:": "SMB-Ports:",
+  "SR-IOV Configuration Detected": "SR-IOV-Konfiguration erkannt",
+  "SSD Emulation": "SSD-Emulation",
+  "SSH access (host + root)": "SSH-Zugriff (Host + Root)",
+  "SSH auth logger service created and started": "SSH-Authentifizierungsprotokollierungsdienst erstellt und gestartet",
+  "SSH hardening: MaxAuthTries set to 3 (Lynis recommendation)": "SSH-Härtung: MaxAuthTries auf 3 gesetzt (Lynis-Empfehlung)",
+  "SSH host or IP:": "SSH-Host oder IP:",
+  "SSH key strategy": "SSH-Schlüsselstrategie",
+  "SSH login failed": "SSH-Anmeldung fehlgeschlagen",
+  "SSH network risk": "SSH-Netzwerkrisiko",
+  "SSH password auth refused on server": "SSH-Passwortauthentifizierung auf dem Server abgelehnt",
+  "SSH protection (aggressive mode)": "SSH-Schutz (aggressiver Modus)",
+  "STEP 6: Choose commands based on your storage type": "SCHRITT 6: Wählen Sie Befehle basierend auf Ihrem Speichertyp aus",
+  "STEP 9: Cleanup (LVM only)": "SCHRITT 9: Bereinigung (nur LVM)",
+  "STORAGE TYPE IDENTIFICATION:": "IDENTIFIZIERUNG DES SPEICHERTYPS:",
+  "SUGGESTION FOR": "VORSCHLAG FÜR",
+  "Safe design: no automatic ACL/ownership mutation on host or CT.": "Sicheres Design: keine automatische ACL-/Besitzmutation auf Host oder CT.",
+  "Safe to apply now": "Jetzt sicher bewerben",
+  "Safety Backup": "Sicherheits-Backup",
+  "Safety backup created": "Sicherheits-Backup erstellt",
+  "Safety check failed: selected disk is now used by host/system.": "Sicherheitsprüfung fehlgeschlagen: Die ausgewählte Festplatte wird jetzt vom Host/System verwendet.",
+  "Safety check failed: selected disk is referenced by a VM/LXC config.": "Sicherheitsprüfung fehlgeschlagen: Ausgewählte Festplatte wird von einer VM/LXC-Konfiguration referenziert.",
+  "Samba Client Manager - CT": "Samba-Client-Manager – CT",
+  "Samba Client in LXC (Privileged)": "Samba-Client in LXC (privilegiert)",
+  "Samba Client in LXC (privileged)": "Samba-Client in LXC (privilegiert)",
+  "Samba Credentials": "Samba-Anmeldeinformationen",
+  "Samba Host Manager - Proxmox Host": "Samba-Host-Manager – Proxmox-Host",
+  "Samba LXC Manager": "Samba LXC-Manager",
+  "Samba Manager - CT": "Samba-Manager – CT",
+  "Samba Not Installed": "Samba nicht installiert",
+  "Samba Password": "Samba-Passwort",
+  "Samba Server": "Samba-Server",
+  "Samba Server Selection": "Auswahl des Samba-Servers",
+  "Samba Server in LXC (Privileged)": "Samba-Server in LXC (privilegiert)",
+  "Samba Server in LXC (privileged)": "Samba-Server in LXC (privilegiert)",
+  "Samba Server: INSTALLED": "Samba-Server: INSTALLIERT",
+  "Samba Server: NOT INSTALLED": "Samba-Server: NICHT INSTALLIERT",
+  "Samba Service Status in CT": "Samba-Dienststatus in CT",
+  "Samba Service: RUNNING": "Samba-Dienst: LÄUFT",
+  "Samba Service: STOPPED": "Samba-Dienst: GESTOPPT",
+  "Samba User": "Samba-Benutzer",
+  "Samba Username": "Samba-Benutzername",
+  "Samba client tools installed": "Samba-Client-Tools installiert",
+  "Samba configuration backed up.": "Samba-Konfiguration gesichert.",
+  "Samba group kept (has users assigned).": "Samba-Gruppe bleibt erhalten (Benutzer sind zugewiesen).",
+  "Samba group removed.": "Samba-Gruppe entfernt.",
+  "Samba packages removed.": "Samba-Pakete entfernt.",
+  "Samba server has been completely uninstalled!": "Samba-Server wurde komplett deinstalliert!",
+  "Samba server installed successfully.": "Samba-Server erfolgreich installiert.",
+  "Samba server is already installed.": "Der Samba-Server ist bereits installiert.",
+  "Samba server is not installed in this CT.": "In diesem CT ist kein Samba-Server installiert.",
+  "Samba server is running": "Der Samba-Server läuft",
+  "Samba servers detected": "Samba-Server erkannt",
+  "Samba services stopped and disabled.": "Samba-Dienste wurden gestoppt und deaktiviert.",
+  "Samba share": "Samba-Freigabe",
+  "Samba share created successfully!": "Samba-Freigabe erfolgreich erstellt!",
+  "Samba share mounted successfully!": "Samba-Freigabe erfolgreich gemountet!",
+  "Samba share unmount successfully. Reboot LXC required to take effect.": "Die Bereitstellung der Samba-Freigabe wurde erfolgreich aufgehoben. Um wirksam zu werden, ist ein Neustart von LXC erforderlich.",
+  "Samba users removed.": "Samba-Benutzer entfernt.",
+  "Samba users:": "Samba-Benutzer:",
+  "Samba/CIFS Client Status in CT": "Samba/CIFS-Client-Status in CT",
+  "Samba/CIFS client installed successfully.": "Samba/CIFS-Client erfolgreich installiert.",
+  "Samba/CIFS mounts in CT": "Samba/CIFS wird in CT bereitgestellt",
+  "Samba/NFS clients will likely receive 'permission denied'. Review the steps above.": "Samba/NFS-Clients werden wahrscheinlich die Meldung „Berechtigung verweigert“ erhalten. Überprüfen Sie die oben genannten Schritte.",
+  "Same Version Detected": "Gleiche Version erkannt",
+  "Same host:": "Gleicher Gastgeber:",
+  "Same major series:": "Gleiche Hauptserie:",
+  "Same major.minor:": "Gleiches Dur.Moll:",
+  "Sanitizing NVIDIA host services for VFIO mode...": "Bereinigen der NVIDIA-Hostdienste für den VFIO-Modus ...",
+  "Save the passphrase somewhere safe NOW, before continuing.": "Speichern Sie die Passphrase JETZT an einem sicheren Ort, bevor Sie fortfahren.",
+  "Save this Borg target so you don't need to enter the details again?": "Dieses Borg-Ziel speichern, damit Sie die Details nicht erneut eingeben müssen?",
+  "Scan storage for new content": "Durchsuchen Sie den Speicher nach neuen Inhalten",
+  "Scanning available physical disks...": "Verfügbare physische Festplatten werden gescannt...",
+  "Scanning network for NFS servers...": "Netzwerk nach NFS-Servern durchsuchen...",
+  "Scanning network for Samba servers...": "Netzwerk nach Samba-Servern durchsuchen...",
+  "Schedule": "Zeitplan",
+  "Schedule:": "Zeitplan:",
+  "Scheduled backup job created": "Geplanter Sicherungsauftrag erstellt",
+  "Scheduled backup jobs": "Geplante Sicherungsjobs",
+  "Scheduled backups and retention policies": "Geplante Backups und Aufbewahrungsrichtlinien",
+  "Scheduled tasks (cron)": "Geplante Aufgaben (cron)",
+  "Scheduler script not found:": "Scheduler-Skript nicht gefunden:",
+  "Script Information": "Skriptinformationen",
+  "Script not found:": "Skript nicht gefunden:",
+  "Scripts in": "Skripte in",
+  "Search Results for:": "Suchergebnisse für:",
+  "Search/Filter Scripts": "Such-/Filterskripte",
+  "Secure Disk Formatter": "Sicherer Festplattenformatierer",
+  "Secure Gateway (Tailscale VPN)": "Secure Gateway (Tailscale VPN)",
+  "Secure Gateway deployed successfully!": "Secure Gateway erfolgreich bereitgestellt!",
+  "Secure Gateway is already installed.": "Secure Gateway ist bereits installiert.",
+  "Security": "Sicherheit",
+  "Security Updates": "Sicherheitsupdates",
+  "Security Warning — read before applying": "Sicherheitswarnung – vor der Bewerbung lesen",
+  "See": "Siehe",
+  "See /tmp/proxmenux-mount.log for details.": "Weitere Informationen finden Sie unter /tmp/proxmenux-mount.log.",
+  "Select": "Wählen",
+  "Select Borg target": "Wählen Sie das Borg-Ziel aus",
+  "Select CPU model": "Wählen Sie das CPU-Modell aus",
+  "Select CT": "Wählen Sie CT",
+  "Select CT for destination disk": "Wählen Sie CT als Zielfestplatte",
+  "Select Disk": "Wählen Sie Datenträger",
+  "Select Disk Images": "Wählen Sie Disk-Images",
+  "Select Disk Interface": "Wählen Sie Festplattenschnittstelle",
+  "Select Disks": "Wählen Sie Festplatten aus",
+  "Select Existing Folder": "Wählen Sie Vorhandenen Ordner aus",
+  "Select Filesystem": "Wählen Sie Dateisystem",
+  "Select Folder": "Wählen Sie Ordner aus",
+  "Select GPU for VM Passthrough": "Wählen Sie GPU für VM-Passthrough aus",
+  "Select GPU(s)": "GPU(s) auswählen",
+  "Select Host Directory": "Wählen Sie Hostverzeichnis aus",
+  "Select Host Folder": "Wählen Sie Host-Ordner",
+  "Select LXC Container": "Wählen Sie LXC-Container",
+  "Select Mount Point": "Wählen Sie Mount Point",
+  "Select Mount Point to Remove": "Wählen Sie den zu entfernenden Mountpunkt aus",
+  "Select NFS Export": "Wählen Sie NFS-Export",
+  "Select NFS Server": "Wählen Sie NFS-Server",
+  "Select OVA/OVF file": "Wählen Sie eine OVA/OVF-Datei",
+  "Select PBS repository": "Wählen Sie das PBS-Repository aus",
+  "Select Privileged Container": "Wählen Sie Privilegierter Container aus",
+  "Select SSH private key": "Wählen Sie den privaten SSH-Schlüssel aus",
+  "Select SSH private key file": "Wählen Sie die private SSH-Schlüsseldatei aus",
+  "Select Samba Server": "Wählen Sie Samba-Server",
+  "Select Samba Share": "Wählen Sie Samba-Freigabe",
+  "Select Shared Directory Location": "Wählen Sie den Speicherort des freigegebenen Verzeichnisses aus",
+  "Select Storage": "Wählen Sie Speicher",
+  "Select Storage Volume": "Wählen Sie Speichervolume",
+  "Select System Type": "Wählen Sie Systemtyp",
+  "Select Unprivileged Container": "Wählen Sie „Unprivilegierter Container“ aus",
+  "Select VM": "Wählen Sie VM aus",
+  "Select VM to export:": "Wählen Sie die zu exportierende VM aus:",
+  "Select Virtual Machine": "Wählen Sie Virtuelle Maschine aus",
+  "Select a Custom Logo": "Wählen Sie ein benutzerdefiniertes Logo",
+  "Select a VirtIO ISO to use:": "Wählen Sie eine zu verwendende VirtIO-ISO aus:",
+  "Select a category of useful commands:": "Wählen Sie eine Kategorie nützlicher Befehle aus:",
+  "Select a category or search for scripts:": "Wählen Sie eine Kategorie oder suchen Sie nach Skripten:",
+  "Select a custom ISO to use:": "Wählen Sie eine benutzerdefinierte ISO zur Verwendung aus:",
+  "Select a job:": "Wählen Sie einen Job aus:",
+  "Select a network management option:": "Wählen Sie eine Netzwerkverwaltungsoption:",
+  "Select a new language for the menu:": "Wählen Sie eine neue Sprache für das Menü:",
+  "Select a post-installation script:": "Wählen Sie ein Nachinstallationsskript aus:",
+  "Select a pre-configured Linux VM script to execute:": "Wählen Sie ein vorkonfiguriertes Linux-VM-Skript zur Ausführung aus:",
+  "Select a script or action:": "Wählen Sie ein Skript oder eine Aktion aus:",
+  "Select a share to delete:": "Wählen Sie eine Freigabe zum Löschen aus:",
+  "Select access mode": "Wählen Sie den Zugriffsmodus",
+  "Select an existing group": "Wählen Sie eine vorhandene Gruppe aus",
+  "Select an existing group:": "Wählen Sie eine vorhandene Gruppe aus:",
+  "Select an export to delete:": "Wählen Sie einen Export zum Löschen aus:",
+  "Select an option": "Wählen Sie eine Option",
+  "Select an option:": "Wählen Sie eine Option:",
+  "Select another source path and try again.": "Wählen Sie einen anderen Quellpfad und versuchen Sie es erneut.",
+  "Select archive": "Archiv auswählen",
+  "Select archive to restore": "Wählen Sie das wiederherzustellende Archiv aus",
+  "Select at least one path to continue.": "Wählen Sie mindestens einen Pfad aus, um fortzufahren.",
+  "Select authentication mode:": "Authentifizierungsmodus auswählen:",
+  "Select authentication type:": "Wählen Sie den Authentifizierungstyp:",
+  "Select available Controllers/NVMe to add:": "Wählen Sie die verfügbaren Controller/NVMe zum Hinzufügen aus:",
+  "Select backup archive": "Backup-Archiv auswählen",
+  "Select backup archive to restore": "Wählen Sie das wiederherzustellende Sicherungsarchiv aus",
+  "Select backup backend:": "Backup-Backend auswählen:",
+  "Select backup method and profile:": "Wählen Sie Backup-Methode und Profil:",
+  "Select backup profile:": "Backup-Profil auswählen:",
+  "Select backup to restore": "Wählen Sie die wiederherzustellende Sicherung aus",
+  "Select backup to restore:": "Wählen Sie die wiederherzustellende Sicherung aus:",
+  "Select bridge for network interface(s):": "Wählen Sie eine Bridge für die Netzwerkschnittstelle(n):",
+  "Select container:": "Container auswählen:",
+  "Select content types for this storage:": "Wählen Sie Inhaltstypen für diesen Speicher aus:",
+  "Select conversion guide:": "Konvertierungsleitfaden auswählen:",
+  "Select conversion option:": "Konvertierungsoption auswählen:",
+  "Select destination": "Ziel auswählen",
+  "Select disk interface type:": "Wählen Sie den Typ der Festplattenschnittstelle:",
+  "Select driver version": "Wählen Sie die Treiberversion aus",
+  "Select export format:": "Exportformat auswählen:",
+  "Select export permissions:": "Exportberechtigungen auswählen:",
+  "Select from /mnt directories": "Wählen Sie aus /mnt-Verzeichnissen aus",
+  "Select from existing folders in /mnt": "Wählen Sie aus vorhandenen Ordnern in /mnt aus",
+  "Select from folders inside /mnt": "Wählen Sie aus den Ordnern in /mnt aus",
+  "Select from recent servers": "Wählen Sie einen der aktuellen Server aus",
+  "Select help topic:": "Hilfethema auswählen:",
+  "Select how to provide VirtIO drivers": "Wählen Sie aus, wie VirtIO-Treiber bereitgestellt werden sollen",
+  "Select iSCSI Target": "Wählen Sie iSCSI-Ziel aus",
+  "Select local archive format:": "Wählen Sie das lokale Archivformat:",
+  "Select machine type": "Maschinentyp auswählen",
+  "Select mount configuration:": "Mount-Konfiguration auswählen:",
+  "Select mount options. Open uid/gid/file_mode are always applied so unprivileged LXC bind-mounts can write:": "Wählen Sie Mount-Optionen aus. Open uid/gid/file_mode werden immer angewendet, damit unprivilegierte LXC-Bind-Mounts schreiben können:",
+  "Select mount options:": "Wählen Sie die Mount-Optionen aus:",
+  "Select mount point to remove from container": "Wählen Sie den Einhängepunkt aus, der aus dem Container entfernt werden soll",
+  "Select mount point to unmount:": "Wählen Sie den Einhängepunkt zum Aufheben der Bereitstellung aus:",
+  "Select network access level:": "Wählen Sie die Netzwerkzugriffsebene aus:",
+  "Select one of the ready-to-run Linux VMs:": "Wählen Sie eine der betriebsbereiten Linux-VMs aus:",
+  "Select one or more GPU(s) to switch mode:": "Wählen Sie eine oder mehrere GPU(s) aus, um den Modus zu wechseln:",
+  "Select one or more disk images to import:": "Wählen Sie ein oder mehrere Disk-Images zum Importieren aus:",
+  "Select operation:": "Vorgang auswählen:",
+  "Select optimizations to uninstall:": "Wählen Sie die zu deinstallierenden Optimierungen aus:",
+  "Select option": "Option auswählen",
+  "Select option [1-2] (default: 2):": "Wählen Sie Option [1-2] (Standard: 2):",
+  "Select option [1-3] (default: 3):": "Wählen Sie Option [1-3] (Standard: 3):",
+  "Select repository destination:": "Repository-Ziel auswählen:",
+  "Select restore source:": "Wählen Sie die Wiederherstellungsquelle:",
+  "Select run mode": "Wählen Sie den Ausführungsmodus",
+  "Select share permissions:": "Freigabeberechtigungen auswählen:",
+  "Select storage for imported disk(s):": "Wählen Sie den Speicher für importierte Datenträger aus:",
+  "Select storage to remove:": "Wählen Sie den zu entfernenden Speicher aus:",
+  "Select target IQN:": "Ziel-IQN auswählen:",
+  "Select target mode for selected GPU(s):": "Wählen Sie den Zielmodus für ausgewählte GPU(s):",
+  "Select the CT to manage NFS/Samba client:": "Wählen Sie den CT aus, um den NFS/Samba-Client zu verwalten:",
+  "Select the CT to which you want to add disks:": "Wählen Sie den CT aus, zu dem Sie Festplatten hinzufügen möchten:",
+  "Select the GPU to pass through to the VM:": "Wählen Sie die GPU aus, die an die VM weitergeleitet werden soll:",
+  "Select the GPU(s) to add to LXC": "Wählen Sie die GPU(s) aus, die Sie zu LXC hinzufügen möchten",
+  "Select the LXC container:": "Wählen Sie den LXC-Container aus:",
+  "Select the Linux distribution to install:": "Wählen Sie die zu installierende Linux-Distribution aus:",
+  "Select the NAS system to install:": "Wählen Sie das zu installierende NAS-System aus:",
+  "Select the NVIDIA driver version to install:": "Wählen Sie die zu installierende NVIDIA-Treiberversion aus:",
+  "Select the VM to add the GPU to:": "Wählen Sie die VM aus, zu der Sie die GPU hinzufügen möchten:",
+  "Select the VM to which you want to add disks:": "Wählen Sie die VM aus, zu der Sie Festplatten hinzufügen möchten:",
+  "Select the VM where you want to import the disk image:": "Wählen Sie die VM aus, in die Sie das Disk-Image importieren möchten:",
+  "Select the bus type for the disks:": "Wählen Sie den Bustyp für die Festplatten aus:",
+  "Select the directory containing disk images:": "Wählen Sie das Verzeichnis mit den Disk-Images aus:",
+  "Select the directory to bind to container:": "Wählen Sie das Verzeichnis aus, das an den Container gebunden werden soll:",
+  "Select the disk to add as Proxmox storage:": "Wählen Sie die Festplatte aus, die Sie als Proxmox-Speicher hinzufügen möchten:",
+  "Select the disk to test or inspect:": "Wählen Sie die Festplatte zum Testen oder Überprüfen aus:",
+  "Select the disk you want to format:": "Wählen Sie die Festplatte aus, die Sie formatieren möchten:",
+  "Select the disks you want to add:": "Wählen Sie die Festplatten aus, die Sie hinzufügen möchten:",
+  "Select the disks you want to import (use spacebar to toggle):": "Wählen Sie die Datenträger aus, die Sie importieren möchten (zum Umschalten die Leertaste verwenden):",
+  "Select the entry to remove. [pvesm] entries are removed from Proxmox storage; [fstab] entries are unmounted and removed from /etc/fstab.": "Wählen Sie den zu entfernenden Eintrag aus. [pvesm]-Einträge werden aus dem Proxmox-Speicher entfernt; [fstab]-Einträge werden ausgehängt und aus /etc/fstab entfernt.",
+  "Select the entry to remove. [pvesm] entries are removed from Proxmox storage; [fstab] entries are unmounted, removed from /etc/fstab and have their credentials file deleted.": "Wählen Sie den zu entfernenden Eintrag aus. [pvesm]-Einträge werden aus dem Proxmox-Speicher entfernt; [fstab]-Einträge werden ausgehängt, aus /etc/fstab entfernt und ihre Anmeldeinformationsdatei wird gelöscht.",
+  "Select the file to import:": "Wählen Sie die zu importierende Datei aus:",
+  "Select the filesystem for": "Wählen Sie das Dateisystem für aus",
+  "Select the folder to mount:": "Wählen Sie den Ordner zum Mounten aus:",
+  "Select the interface type for all disks:": "Wählen Sie den Schnittstellentyp für alle Festplatten aus:",
+  "Select the interface type for:": "Wählen Sie den Schnittstellentyp für:",
+  "Select the mounted USB to use as backup target:": "Wählen Sie den bereitgestellten USB-Stick aus, der als Sicherungsziel verwendet werden soll:",
+  "Select the optimizations to update. Each one re-runs its post-install function and registers the new version.": "Wählen Sie die zu aktualisierenden Optimierungen aus. Jeder führt seine Post-Install-Funktion erneut aus und registriert die neue Version.",
+  "Select the parent job to attach to:": "Wählen Sie den übergeordneten Job aus, an den Sie anhängen möchten:",
+  "Select the paths to restore (one per backup entry):": "Wählen Sie die wiederherzustellenden Pfade aus (einen pro Sicherungseintrag):",
+  "Select the privileged LXC container to convert:": "Wählen Sie den zu konvertierenden privilegierten LXC-Container aus:",
+  "Select the storage volume for disk import:": "Wählen Sie das Speichervolume für den Festplattenimport aus:",
+  "Select the sync interval (in hours):": "Wählen Sie das Synchronisierungsintervall (in Stunden):",
+  "Select the target VM for PCI passthrough:": "Wählen Sie die Ziel-VM für PCI-Passthrough aus:",
+  "Select the type of Linux installation:": "Wählen Sie den Typ der Linux-Installation aus:",
+  "Select the type of Windows installation:": "Wählen Sie die Art der Windows-Installation:",
+  "Select the unprivileged LXC container to convert:": "Wählen Sie den zu konvertierenden nichtprivilegierten LXC-Container aus:",
+  "Select utilities to install": "Wählen Sie die zu installierenden Dienstprogramme aus",
+  "Select what to do with this disk:": "Wählen Sie aus, was mit dieser Festplatte geschehen soll:",
+  "Select where to export VM files (OVA/OVF + temporary workspace):": "Wählen Sie aus, wohin VM-Dateien exportiert werden sollen (OVA/OVF + temporärer Arbeitsbereich):",
+  "Selected GPU function": "Ausgewählte GPU-Funktion",
+  "Selected GPU(s)": "Ausgewählte GPU(s)",
+  "Selected GPU(s):": "Ausgewählte GPU(s):",
+  "Selected LXC action": "Ausgewählte LXC-Aktion",
+  "Selected VM": "Ausgewählte VM",
+  "Selected VM action": "Ausgewählte VM-Aktion",
+  "Selected container": "Ausgewählter Container",
+  "Selected controller/NVMe is already assigned to other VM(s):": "Der ausgewählte Controller/NVMe ist bereits anderen VMs zugewiesen:",
+  "Selected device is already assigned to other VM(s):": "Das ausgewählte Gerät ist bereits anderen VMs zugewiesen:",
+  "Selected devices": "Ausgewählte Geräte",
+  "Selected optimizations have been uninstalled.": "Ausgewählte Optimierungen wurden deinstalliert.",
+  "Selected paths produced no entries to apply.": "Ausgewählte Pfade ergaben keine anzuwendenden Einträge.",
+  "Selected utilities installation completed": "Die Installation ausgewählter Dienstprogramme ist abgeschlossen",
+  "Sending backup to Borg repository...": "Backup wird an das Borg-Repository gesendet...",
+  "Sending backup to PBS...": "Backup an PBS senden...",
+  "Server": "Server",
+  "Server (listen for incoming tests on TCP 5201)": "Server (auf eingehende Tests auf TCP 5201 warten)",
+  "Server IP/hostname is correct": "Server-IP/Hostname ist korrekt",
+  "Server IP:": "Server-IP:",
+  "Server is accessible:": "Server ist erreichbar:",
+  "Server is online": "Server ist online",
+  "Server is running": "Server läuft",
+  "Server response:": "Serverantwort:",
+  "Server stopped. Press Enter to return to menu...": "Server gestoppt. Drücken Sie die Eingabetaste, um zum Menü zurückzukehren...",
+  "Server will listen on TCP port 5201.": "Der Server überwacht den TCP-Port 5201.",
+  "Server:": "Server:",
+  "Servers": "Server",
+  "Service Status": "Servicestatus",
+  "Service is active and running": "Der Dienst ist aktiv und wird ausgeführt",
+  "Service is inactive": "Der Dienst ist inaktiv",
+  "Service restarted.": "Dienst neu gestartet.",
+  "Service restarts:": "Dienst wird neu gestartet:",
+  "Service stopped.": "Der Dienst wurde gestoppt.",
+  "Services failed": "Dienste sind fehlgeschlagen",
+  "Services restarted": "Dienste neu gestartet",
+  "Services:": "Leistungen:",
+  "Set Display > Graphic card (VGA, SPICE or VirtIO) to match the guest": "Stellen Sie Anzeige > Grafikkarte (VGA, SPICE oder VirtIO) passend zum Gast ein",
+  "Set Hostname": "Hostnamen festlegen",
+  "Set Interface MTU Size (leave blank for default)": "Stellen Sie die MTU-Größe der Schnittstelle ein (für die Standardeinstellung leer lassen)",
+  "Set MAC Address (leave empty for automatic)": "MAC-Adresse festlegen (für automatisch leer lassen)",
+  "Set MTU (leave empty for default)": "MTU festlegen (für Standard leer lassen)",
+  "Set VLAN (leave empty for none)": "VLAN festlegen (leer lassen für keines)",
+  "Set VM boot order": "Legen Sie die VM-Startreihenfolge fest",
+  "Set Virtual Machine ID": "Legen Sie die ID der virtuellen Maschine fest",
+  "Set a Bridge": "Setzen Sie eine Brücke",
+  "Set a MAC Address": "Legen Sie eine MAC-Adresse fest",
+  "Set a Vlan(leave blank for default)": "Legen Sie ein VLAN fest (standardmäßig leer lassen)",
+  "Set network bridge (default: vmbr0)": "Netzwerkbrücke festlegen (Standard: vmbr0)",
+  "Set ownership and permissions:": "Besitz und Berechtigungen festlegen:",
+  "Set this disk as the primary boot disk?": "Diese Festplatte als primäre Startfestplatte festlegen?",
+  "Set up custom MOTD banner": "Richten Sie ein benutzerdefiniertes MOTD-Banner ein",
+  "Set up the apex group and udev rules": "Richten Sie die Apex-Gruppe und die udev-Regeln ein",
+  "Set up time synchronization and entropy generation": "Richten Sie Zeitsynchronisation und Entropieerzeugung ein",
+  "Setting APT language configuration...": "APT-Sprachkonfiguration wird festgelegt...",
+  "Setting VM description": "VM-Beschreibung festlegen",
+  "Setting boot order...": "Bootreihenfolge festlegen...",
+  "Setting directory ownership and permissions...": "Verzeichnisbesitz und Berechtigungen festlegen...",
+  "Setting sharedfiles group with UID remapping...": "Sharedfiles-Gruppe mit UID-Neuzuordnung festlegen ...",
+  "Setting systemd ulimits...": "Systemd-Ulimits werden festgelegt...",
+  "Setting ulimit for the shell user...": "ulimit für den Shell-Benutzer festlegen ...",
+  "Setting up persistent network interfaces": "Einrichten persistenter Netzwerkschnittstellen",
+  "Setting up persistent network interfaces successfully.": "Persistente Netzwerkschnittstellen erfolgreich einrichten.",
+  "Setting up the Google Coral APT repository...": "Einrichten des Google Coral APT-Repositorys...",
+  "Settings": "Einstellungen",
+  "Settings post-install Proxmox": "Einstellungen nach der Installation von Proxmox",
+  "Setup Persistent Network Names": "Persistente Netzwerknamen einrichten",
+  "Share Access Error": "Fehler beim Freigabezugriff",
+  "Share Name": "Teilen Sie den Namen",
+  "Share Options": "Freigabeoptionen",
+  "Share added successfully.": "Teilen erfolgreich hinzugefügt.",
+  "Share deleted and Samba service restarted.": "Freigabe gelöscht und Samba-Dienst neu gestartet.",
+  "Share exists:": "Freigabe existiert:",
+  "Share name:": "Freigabename:",
+  "Share not found on server:": "Freigabe nicht auf Server gefunden:",
+  "Share path:": "Freigabepfad:",
+  "Share updated successfully.": "Freigabe erfolgreich aktualisiert.",
+  "Share:": "Aktie:",
+  "Shared Directory Ready:": "Bereit für das freigegebene Verzeichnis:",
+  "Shared Group": "Geteilte Gruppe",
+  "Shared group: CONFIGURED": "Geteilte Gruppe: KONFIGURIERT",
+  "Shared group: sharedfiles (GID:": "Freigegebene Gruppe: sharedfiles (GID:",
+  "Sharedfiles group already exists (GID: 101000)": "Die Sharedfiles-Gruppe existiert bereits (GID: 101000)",
+  "Shares found:": "Gefundene Aktien:",
+  "Shell user ulimit set": "Ulimit-Satz für Shell-Benutzer",
+  "Short self-test started on": "Kurzer Selbsttest begann am",
+  "Short test            — ~2 minutes, basic surface check": "Kurzer Test – ca. 2 Minuten, grundlegende Oberflächenprüfung",
+  "Should show 'unprivileged: 0' or no unprivileged line": "Sollte „unprivileged: 0“ oder keine unprivilegierte Zeile anzeigen",
+  "Should show 'unprivileged: 1'": "Sollte „unprivilegiert: 1“ anzeigen",
+  "Should show 'unprivileged: 1' if it's unprivileged": "Sollte „unprivileged: 1“ anzeigen, wenn es nicht privilegiert ist",
+  "Should show fewer or no issues": "Sollte weniger oder gar keine Probleme aufweisen",
+  "Should show pve-manager/9.x.x": "Sollte pve-manager/9.x.x anzeigen",
+  "Show All Scripts": "Alle Skripte anzeigen",
+  "Show CT users in table format": "CT-Benutzer im Tabellenformat anzeigen",
+  "Show Container Privilege Status": "Container-Berechtigungsstatus anzeigen",
+  "Show DNS resolution status": "DNS-Auflösungsstatus anzeigen",
+  "Show Ethernet device info": "Informationen zum Ethernet-Gerät anzeigen",
+  "Show GPU frequency": "GPU-Frequenz anzeigen",
+  "Show GPU kernel driver in use": "Zeigt den verwendeten GPU-Kernel-Treiber an",
+  "Show GPU time": "GPU-Zeit anzeigen",
+  "Show Monitor Service Status": "Status des Überwachungsdienstes anzeigen",
+  "Show Network Config File": "Netzwerkkonfigurationsdatei anzeigen",
+  "Show Proxmox storage configuration": "Proxmox-Speicherkonfiguration anzeigen",
+  "Show Proxmox version": "Proxmox-Version anzeigen",
+  "Show Routing Table": "Routing-Tabelle anzeigen",
+  "Show UUID and filesystem type of block devices": "UUID und Dateisystemtyp von Blockgeräten anzeigen",
+  "Show VM configuration. Use the correct <vmid>": "VM-Konfiguration anzeigen. Verwenden Sie die richtige <vmid>",
+  "Show Version Information": "Versionsinformationen anzeigen",
+  "Show ZFS pool status": "ZFS-Poolstatus anzeigen",
+  "Show active firewall rules (iptables)": "Aktive Firewall-Regeln anzeigen (iptables)",
+  "Show all active mounts from the kernel": "Zeigt alle aktiven Mounts vom Kernel an",
+  "Show available Proxmox upgrades": "Verfügbare Proxmox-Upgrades anzeigen",
+  "Show configured network bridges": "Konfigurierte Netzwerkbrücken anzeigen",
+  "Show container configuration. Use the correct <ctid>": "Containerkonfiguration anzeigen. Verwenden Sie die richtige <ctid>",
+  "Show detailed keyfile info": "Detaillierte Informationen zur Schlüsseldatei anzeigen",
+  "Show disk usage by mount point": "Festplattennutzung nach Einhängepunkt anzeigen",
+  "Show jobs and last run status": "Jobs und Status der letzten Ausführung anzeigen",
+  "Show listening ports (TCP/UDP)": "Abhörports anzeigen (TCP/UDP)",
+  "Show manual repair commands": "Manuelle Reparaturbefehle anzeigen",
+  "Show me the line to paste manually on the server": "Zeigt mir die Zeile zum manuellen Einfügen auf dem Server",
+  "Show mounted storage devices": "Gemountete Speichergeräte anzeigen",
+  "Show network interfaces and IPs": "Netzwerkschnittstellen und IPs anzeigen",
+  "Show nftables rules": "Nftables-Regeln anzeigen",
+  "Show raw network configuration": "Rohe Netzwerkkonfiguration anzeigen",
+  "Show routing table": "Routing-Tabelle anzeigen",
+  "Show size of a directory": "Größe eines Verzeichnisses anzeigen",
+  "Show standard exclude patterns": "Standard-Ausschlussmuster anzeigen",
+  "Show status of all storage pools": "Status aller Speicherpools anzeigen",
+  "Show traffic statistics per interface": "Verkehrsstatistiken pro Schnittstelle anzeigen",
+  "Show vzdump backup configuration": "vzdump-Sicherungskonfiguration anzeigen",
+  "Shows status and type (nfs/cifs/dir/iscsi...).": "Zeigt Status und Typ an (nfs/cifs/dir/iscsi...).",
+  "Shutdown timeout": "Zeitüberschreitung beim Herunterfahren",
+  "Signatures removed. Partition table preserved.": "Unterschriften entfernt. Partitionstabelle bleibt erhalten.",
+  "Single GPU Warning": "Warnung vor einer einzelnen GPU",
+  "Single target found — selected automatically:": "Einzelnes Ziel gefunden – automatisch ausgewählt:",
+  "Size": "Größe",
+  "Size:": "Größe:",
+  "Skip downloading additional languages": "Das Herunterladen zusätzlicher Sprachen überspringen",
+  "Skip this device": "Überspringen Sie dieses Gerät",
+  "Skip this step for ZFS/BTRFS": "Überspringen Sie diesen Schritt für ZFS/BTRFS",
+  "Skip this step if using no-subscription repository": "Überspringen Sie diesen Schritt, wenn Sie ein Repository ohne Abonnement verwenden",
+  "Skip — I will add it as PCIe device": "Überspringen – Ich werde es als PCIe-Gerät hinzufügen",
+  "Skip — leave as-is": "Überspringen – unverändert lassen",
+  "Skipped device": "Übersprungenes Gerät",
+  "Skipped to protect target system (would cascade-remove packages)": "Übersprungen, um das Zielsystem zu schützen (würde Pakete kaskadierend entfernen)",
+  "Skipped, not in apt cache:": "Übersprungen, nicht im Apt-Cache:",
+  "Skipping LXC": "LXC überspringen",
+  "Skipping SR-IOV device": "SR-IOV-Gerät wird übersprungen",
+  "Skipping installation.": "Installation überspringen.",
+  "Skipping manual patches — feranick fork already supports this kernel.": "Manuelle Patches überspringen – Feranick Fork unterstützt diesen Kernel bereits.",
+  "Smart restore plan — hardware compatibility check": "Smart Restore Plan – Hardware-Kompatibilitätsprüfung",
+  "Snippets          — hook scripts / config": "Snippets – Hook-Skripte/Konfiguration",
+  "SoC-integrated GPU: tight coupling with other SoC components": "SoC-integrierte GPU: enge Kopplung mit anderen SoC-Komponenten",
+  "Some changes require a reboot to take effect. Do you want to restart now?": "Einige Änderungen erfordern einen Neustart, damit sie wirksam werden. Möchten Sie jetzt neu starten?",
+  "Some essential Proxmox packages may not have been installed": "Einige wichtige Proxmox-Pakete wurden möglicherweise nicht installiert",
+  "Some log2ram files may still exist. Manual cleanup may be required.": "Möglicherweise sind noch einige Log2RAM-Dateien vorhanden. Möglicherweise ist eine manuelle Bereinigung erforderlich.",
+  "Some old time services could not be removed (not installed)": "Einige alte Dienste konnten nicht entfernt (nicht installiert) werden.",
+  "Some operations failed — review messages above. Press Enter to continue...": "Einige Vorgänge sind fehlgeschlagen. Sehen Sie sich die Meldungen oben an. Drücken Sie die Eingabetaste, um fortzufahren...",
+  "Some repairs failed. Please fix manually and re-run the script.": "Einige Reparaturen schlugen fehl. Bitte beheben Sie den Fehler manuell und führen Sie das Skript erneut aus.",
+  "Some repositories are not available, continuing with available ones...": "Einige Repositorys sind nicht verfügbar. Fahren Sie mit den verfügbaren fort ...",
+  "Some selected GPUs are already configured in this container.": "Einige ausgewählte GPUs sind in diesem Container bereits konfiguriert.",
+  "Some signatures could not be removed (see warnings above).": "Einige Signaturen konnten nicht entfernt werden (siehe Warnungen oben).",
+  "Something is already mounted at": "Etwas ist bereits montiert",
+  "Something is already mounted at:": "Es ist bereits etwas montiert unter:",
+  "Source": "Quelle",
+  "Source VM": "Quell-VM",
+  "Source patched successfully.": "Quelle erfolgreich gepatcht.",
+  "Source:": "Quelle:",
+  "Sources copied to": "Quellen kopiert nach",
+  "Spanish": "Spanisch",
+  "Specific host (enter IP)": "Spezifischer Host (IP eingeben)",
+  "Specific subnet (enter manually)": "Spezifisches Subnetz (manuell eingeben)",
+  "Stable (main branch)": "Stabil (Hauptzweig)",
+  "Stable monitor service normalized.": "Stabiler Monitordienst normalisiert.",
+  "Staging directory:": "Staging-Verzeichnis:",
+  "Staging ready.": "Bühne bereit.",
+  "Staging source:": "Staging-Quelle:",
+  "Standard NAS   (backup, iso, vztmpl)": "Standard-NAS (Backup, ISO, vztmpl)",
+  "Start VM": "Starten Sie die VM",
+  "Start VM after creation": "Starten Sie die VM nach der Erstellung",
+  "Start VM after creation?": "VM nach Erstellung starten?",
+  "Start a container. Use the correct <ctid>": "Starten Sie einen Container. Verwenden Sie die richtige <ctid>",
+  "Start a virtual machine. Use the correct <vmid>": "Starten Sie eine virtuelle Maschine. Verwenden Sie die richtige <vmid>",
+  "Start long self-test (hours)": "Langer Selbsttest starten (Stunden)",
+  "Start long test now?": "Jetzt Langtest starten?",
+  "Start on boot already disabled for VM": "Beim Booten starten ist für die VM bereits deaktiviert",
+  "Start on boot disabled for LXC": "Beim Booten starten für LXC deaktiviert",
+  "Start on boot disabled for VM": "Start beim Booten für VM deaktiviert",
+  "Start on boot enabled": "Beim Booten starten aktiviert",
+  "Start on boot enabled (onboot=1)": "Beim Booten starten aktiviert (onboot=1)",
+  "Start on boot will be disabled on source VM only if currently enabled": "Beim Booten starten wird auf der Quell-VM nur dann deaktiviert, wenn es derzeit aktiviert ist",
+  "Start scrub for a ZFS pool": "Starten Sie Scrub für einen ZFS-Pool",
+  "Start short self-test (~2 min)": "Kurzen Selbsttest starten (~2 Min.)",
+  "Start terminal multiplexer (recommended):": "Terminal-Multiplexer starten (empfohlen):",
+  "Start the VM": "Starten Sie die VM",
+  "Start the VM to begin Windows installation from the mounted ISO.": "Starten Sie die VM, um die Windows-Installation von der gemounteten ISO aus zu starten.",
+  "Start the converted container:": "Starten Sie den konvertierten Container:",
+  "Start the main system upgrade:": "Starten Sie das Hauptsystem-Upgrade:",
+  "Start uploading to PBS — sets a recovery passphrase": "Hochladen auf PBS starten – legt eine Wiederherstellungspassphrase fest",
+  "Starting Borg backup...": "Borg-Backup wird gestartet...",
+  "Starting CT": "CT starten",
+  "Starting LXC Privileged to Unprivileged conversion process...": "Der Konvertierungsprozess von LXC Privileged zu Unprivileged wird gestartet ...",
+  "Starting LXC Unprivileged to Privileged conversion process...": "Der Konvertierungsprozess von LXC Unprivileged zu Privileged wird gestartet ...",
+  "Starting NVIDIA installer. This may take several minutes...": "NVIDIA-Installationsprogramm starten. Dies kann einige Minuten dauern...",
+  "Starting NVMe long self-test...": "Langer NVMe-Selbsttest wird gestartet...",
+  "Starting NVMe short self-test...": "Kurzer NVMe-Selbsttest wird gestartet...",
+  "Starting ProxMenux update...": "ProxMenux-Update wird gestartet...",
+  "Starting Proxmox storage integration...": "Proxmox-Speicherintegration wird gestartet...",
+  "Starting Proxmox system repair...": "Proxmox-Systemreparatur wird gestartet...",
+  "Starting SMART long self-test...": "Langer SMART-Selbsttest wird gestartet...",
+  "Starting SMART short self-test...": "SMART-Kurzselbsttest wird gestartet...",
+  "Starting container": "Startcontainer",
+  "Starting container...": "Startcontainer...",
+  "Starting direct conversion of container": "Direkte Konvertierung des Containers starten",
+  "Starting gateway...": "Gateway wird gestartet...",
+  "Starting installation...": "Installation wird gestartet...",
+  "Starting installer...": "Installationsprogramm starten...",
+  "Starting privileged container...": "Privilegierter Container wird gestartet...",
+  "Starting rpcbind service...": "Rpcbind-Dienst wird gestartet...",
+  "Starting unprivileged container...": "Unprivilegierter Container wird gestartet...",
+  "Status": "Status",
+  "Status:": "Status:",
+  "Step": "Schritt",
+  "Step 2: Testing actual share access with guest...": "Schritt 2: Testen des tatsächlichen Freigabezugriffs mit Gast ...",
+  "Steps that will run:": "Schritte, die ausgeführt werden:",
+  "Still has issues": "Es gibt immer noch Probleme",
+  "Stop it first and run this option again.": "Stoppen Sie es zuerst und führen Sie diese Option erneut aus.",
+  "Stop the CT, unmount the disk on the HOST, and remount with:": "Stoppen Sie den CT, unmounten Sie die Festplatte auf dem HOST und mounten Sie sie erneut mit:",
+  "Stop the VM/CT before formatting this disk.": "Stoppen Sie die VM/CT, bevor Sie diese Festplatte formatieren.",
+  "Stop the container if it's running:": "Stoppen Sie den Container, wenn er ausgeführt wird:",
+  "Stop them first and run this script again.": "Stoppen Sie sie zuerst und führen Sie dieses Skript erneut aus.",
+  "Stop uploading to PBS": "Hochladen auf PBS beenden",
+  "Stop uploading?": "Hochladen beenden?",
+  "Stopped": "Angehalten",
+  "Stopped and disabled": "Angehalten und deaktiviert",
+  "Stopping Coral kernel modules...": "Coral-Kernel-Module werden gestoppt...",
+  "Stopping LXC": "LXC stoppen",
+  "Stopping NFS services...": "NFS-Dienste werden gestoppt...",
+  "Stopping ProxMenux Monitor service...": "ProxMenux Monitor-Dienst wird gestoppt...",
+  "Stopping Samba services...": "Samba-Dienste werden gestoppt...",
+  "Stopping VM": "VM stoppen",
+  "Stopping and disabling NVIDIA services...": "NVIDIA-Dienste stoppen und deaktivieren...",
+  "Stopping container": "Behälter stoppen",
+  "Stopping gateway...": "Gateway wird gestoppt...",
+  "Stopping the container before applying configuration...": "Stoppen Sie den Container, bevor Sie die Konfiguration anwenden ...",
+  "Stopping the container before conversion...": "Stoppen des Containers vor der Konvertierung...",
+  "Storage": "Lagerung",
+  "Storage & Share Manager": "Speicher- und Freigabemanager",
+  "Storage Added:": "Speicher hinzugefügt:",
+  "Storage Exists": "Speicher vorhanden",
+  "Storage ID": "Speicher-ID",
+  "Storage ID already exists. Do you want to remove and recreate it?": "Die Speicher-ID ist bereits vorhanden. Möchten Sie es entfernen und neu erstellen?",
+  "Storage ID already exists:": "Speicher-ID existiert bereits:",
+  "Storage ID is available": "Speicher-ID ist verfügbar",
+  "Storage ID:": "Speicher-ID:",
+  "Storage and Disks Commands": "Speicher- und Festplattenbefehle",
+  "Storage controller: VirtIO SCSI": "Speichercontroller: VirtIO SCSI",
+  "Storage disk identifier:": "Kennung der Speicherplatte:",
+  "Storage is now available in Proxmox web interface under Datacenter > Storage": "Speicher ist jetzt in der Proxmox-Weboberfläche unter Datacenter > Speicher verfügbar",
+  "Storage plan selection cancelled.": "Auswahl des Speicherplans abgebrochen.",
+  "Storage plan selection failed or cancelled": "Die Auswahl des Speicherplans ist fehlgeschlagen oder wurde abgebrochen",
+  "Storage:": "Lagerung:",
+  "Stored Credentials:": "Gespeicherte Anmeldeinformationen:",
+  "Stored credentials:": "Gespeicherte Zugangsdaten:",
+  "Subnet": "Subnetz",
+  "Subscription banner removed successfully": "Das Abonnementbanner wurde erfolgreich entfernt",
+  "Subscription banner restored successfully (desktop and mobile)": "Abonnementbanner erfolgreich wiederhergestellt (Desktop und Mobilgerät)",
+  "Success": "Erfolg",
+  "Successful": "Erfolgreich",
+  "Supported formats: .img, .qcow2, .vmdk, .raw": "Unterstützte Formate: .img, .qcow2, .vmdk, .raw",
+  "Swap partition detected": "Swap-Partition erkannt",
+  "Swappiness configuration created successfully": "Swappiness-Konfiguration erfolgreich erstellt",
+  "Switch GPU Mode  (VM <-> LXC)": "GPU-Modus wechseln (VM <-> LXC)",
+  "Switch Script Not Found": "Switch-Skript nicht gefunden",
+  "Switch to GPU -> LXC (native driver mode)": "Wechseln Sie zu GPU -> LXC (nativer Treibermodus)",
+  "Switch to GPU -> VM (VFIO passthrough mode)": "Wechseln Sie zu GPU -> VM (VFIO-Passthrough-Modus)",
+  "Switches to the free no-subscription repository": "Wechselt zum kostenlosen Repository ohne Abonnement",
+  "Switching to GPU -> LXC mode removes VFIO exclusivity.": "Durch den Wechsel in den GPU->LXC-Modus wird die VFIO-Exklusivität aufgehoben.",
+  "Switching to GPU -> VM mode requires exclusive VFIO binding.": "Der Wechsel in den GPU -> VM-Modus erfordert eine exklusive VFIO-Bindung.",
+  "Synchronize time automatically": "Zeit automatisch synchronisieren",
+  "System": "System",
+  "System CLI Tools": "System-CLI-Tools",
+  "System Disk Size (GB)": "Größe der Systemfestplatte (GB)",
+  "System Update Information": "Informationen zur Systemaktualisierung",
+  "System Utilities Installer": "Installationsprogramm für Systemdienstprogramme",
+  "System disk is SSD or M.2. Proceeding with Log2RAM setup.": "Systemfestplatte ist SSD oder M.2. Fahren Sie mit der Einrichtung von Log2RAM fort.",
+  "System errors and logs": "Systemfehler und Protokolle",
+  "System group apex already exists.": "Der Systemgruppen-Apex ist bereits vorhanden.",
+  "System group apex created.": "Systemgruppen-Apex erstellt.",
+  "System hardening scoring (0-100)": "Bewertung der Systemhärtung (0–100)",
+  "System hostname and kernel info": "System-Hostname und Kernel-Informationen",
+  "System is already up to date": "Das System ist bereits auf dem neuesten Stand",
+  "System is already up to date. No update needed.": "Das System ist bereits auf dem neuesten Stand. Kein Update erforderlich.",
+  "System limits increase completed.": "Erhöhung der Systemlimits abgeschlossen.",
+  "System limits optimizations removed": "Systemlimitoptimierungen entfernt",
+  "System must be updated to latest PVE 8.4+ before starting": "Das System muss vor dem Start auf die neueste PVE 8.4+ aktualisiert werden",
+  "System reboot required": "Systemneustart erforderlich",
+  "System upgrade completed": "Systemaktualisierung abgeschlossen",
+  "System uptime": "Systemverfügbarkeit",
+  "Systemd ulimits set": "Systemd-Ulimits festgelegt",
+  "TCP BBR configuration created successfully": "TCP-BBR-Konfiguration erfolgreich erstellt",
+  "TCP Fast Open configuration created successfully": "TCP Fast Open-Konfiguration erfolgreich erstellt",
+  "TCP optimizations configuration completed": "Die Konfiguration der TCP-Optimierungen ist abgeschlossen",
+  "TCP optimizations reverted (defaults restored on next reboot)": "TCP-Optimierungen wurden zurückgesetzt (Standardeinstellungen werden beim nächsten Neustart wiederhergestellt)",
+  "TCP port 5201 is reachable (firewall on server)": "TCP-Port 5201 ist erreichbar (Firewall auf Server)",
+  "TPM device added to VM": "TPM-Gerät zur VM hinzugefügt",
+  "TPM storage selection failed or was cancelled. VM creation aborted.": "Die Auswahl des TPM-Speichers ist fehlgeschlagen oder wurde abgebrochen. VM-Erstellung wurde abgebrochen.",
+  "TROUBLESHOOTING:": "FEHLERBEHEBUNG:",
+  "TUI mode": "TUI-Modus",
+  "TUI mode (requires root)": "TUI-Modus (erfordert Root)",
+  "Target IQN:": "Ziel-IQN:",
+  "Target VM": "Ziel-VM",
+  "Target VM validated": "Ziel-VM validiert",
+  "Target channel:": "Zielkanal:",
+  "Target disk": "Zielfestplatte",
+  "Target host runs": "Zielhost wird ausgeführt",
+  "Target mode": "Zielmodus",
+  "Target server:": "Zielserver:",
+  "Target:": "Ziel:",
+  "Temporary working directory (if present):": "Temporäres Arbeitsverzeichnis (falls vorhanden):",
+  "Terminal Multiplexers": "Terminal-Multiplexer",
+  "Terminal multiplexer (Ctrl+b then d to detach, or type exit)": "Terminal-Multiplexer (Strg+B, dann D zum Trennen oder Exit eingeben)",
+  "Test Connectivity": "Konnektivität testen",
+  "Test NFS Connectivity": "Testen Sie die NFS-Konnektivität",
+  "Test Samba Connectivity": "Testen Sie die Samba-Konnektivität",
+  "Test iSCSI Connectivity": "Testen Sie die iSCSI-Konnektivität",
+  "Test in progress:": "Test läuft:",
+  "Test runs on the drive hardware — safe to close this terminal.": "Testläufe auf der Laufwerkshardware – dieses Terminal kann sicher geschlossen werden.",
+  "Test share visibility:": "Testen Sie die Sichtbarkeit der Freigabe:",
+  "Test typically completes in ~2 minutes.": "Der Test ist normalerweise in ca. 2 Minuten abgeschlossen.",
+  "Testing": "Testen",
+  "Testing NFS connection...": "NFS-Verbindung wird getestet...",
+  "Testing comprehensive guest access to server": "Testen eines umfassenden Gastzugriffs auf den Server",
+  "Testing connectivity to portal...": "Verbindung zum Portal wird getestet...",
+  "Testing network connectivity...": "Netzwerkkonnektivität testen...",
+  "Thank you for using ProxMenux. Goodbye!": "Vielen Dank, dass Sie ProxMenux verwenden. Auf Wiedersehen!",
+  "That VM is currently stopped, so the GPU can be reassigned now.": "Diese VM ist derzeit gestoppt, sodass die GPU jetzt neu zugewiesen werden kann.",
+  "That doesn't look like an SSH private key. Pick the private key file (no .pub extension, parseable by ssh-keygen).": "Das sieht nicht nach einem privaten SSH-Schlüssel aus.Wählen Sie die private Schlüsseldatei aus (keine .pub-Erweiterung, per ssh-keygen analysierbar).",
+  "The GPU has been moved out of VM": "Die GPU wurde aus der VM verschoben",
+  "The GPU is being detached from VM": "Die GPU wird von der VM getrennt",
+  "The NVIDIA installer needs at least": "Das NVIDIA-Installationsprogramm benötigt mindestens",
+  "The URL does not contain the required parameters (id, pack, edition).": "Die URL enthält nicht die erforderlichen Parameter (ID, Pack, Edition).",
+  "The VM also has these audio devices assigned via PCI passthrough — typically added together with the GPU. Remove them too?": "Der VM werden diese Audiogeräte auch über PCI-Passthrough zugewiesen – normalerweise zusammen mit der GPU hinzugefügt. Auch entfernen?",
+  "The VM guest will have exclusive access to the GPU.": "Der VM-Gast hat exklusiven Zugriff auf die GPU.",
+  "The VM is powered on. Turn it off before adding disks.": "Die VM ist eingeschaltet. Schalten Sie es aus, bevor Sie Festplatten hinzufügen.",
+  "The VM/LXC will lose access to this disk after formatting.": "Nach der Formatierung verliert die VM/LXC den Zugriff auf diese Festplatte.",
+  "The archive could not be extracted.": "Das Archiv konnte nicht extrahiert werden.",
+  "The archive destination directory is INSIDE one of the paths you are about to back up. Writing the archive there would copy the backup into itself — producing a corrupted archive, or growing without limit until the disk fills up.": "Das Zielverzeichnis des Archivs befindet sich INNERHALB eines der Pfade, die Sie sichern möchten. Wenn Sie das Archiv dorthin schreiben, wird das Backup in sich selbst kopiert – was zu einem beschädigten Archiv führt oder unbegrenzt wächst, bis die Festplatte voll ist.",
+  "The backup metadata was compared against this host. The following items will be SKIPPED to keep the boot safe:": "Die Backup-Metadaten wurden mit diesem Host verglichen.Die folgenden Elemente werden ÜBERSPRINGT, um die Sicherheit des Stiefels zu gewährleisten:",
+  "The backup was taken on a different PVE or kernel major.minor. These paths will be SKIPPED to keep the boot safe:": "Das Backup wurde auf einem anderen PVE oder Kernel-Major.Minor erstellt.Diese Pfade werden ÜBERSPRINGT, um die Boot-Sicherheit zu gewährleisten:",
+  "The compatibility check raised failures that may break the system after restore.": "Bei der Kompatibilitätsprüfung sind Fehler aufgetreten, die das System nach der Wiederherstellung beschädigen können.",
+  "The container is currently stopped. Do you want to start it now to install the package?": "Der Container ist derzeit gestoppt. Möchten Sie es jetzt starten, um das Paket zu installieren?",
+  "The container should now start as privileged": "Der Container sollte nun als privilegiert starten",
+  "The container should now start as unprivileged": "Der Container sollte nun als unprivilegiert starten",
+  "The current driver will be completely uninstalled before installing the new version. Continue?": "Der aktuelle Treiber wird vor der Installation der neuen Version vollständig deinstalliert. Weitermachen?",
+  "The directory does not exist in the CT.": "Das Verzeichnis ist im CT nicht vorhanden.",
+  "The disk": "Die Festplatte",
+  "The file does not exist, is empty or is not readable.": "Die Datei existiert nicht, ist leer oder nicht lesbar.",
+  "The filesystem": "Das Dateisystem",
+  "The following LXC containers have NVIDIA passthrough configured:": "Für die folgenden LXC-Container ist NVIDIA-Passthrough konfiguriert:",
+  "The following backup paths are kernel-tied and are excluded from the picker to keep the target's boot safe. The operator's own tuning inside these paths (IOMMU cmdline, VFIO IDs, custom quirks) is merged back automatically via kernel-agnostic merge:": "Die folgenden Sicherungspfade sind an den Kernel gebunden und werden von der Auswahl ausgeschlossen, um den Start des Ziels zu gewährleisten.Die eigene Abstimmung des Betreibers innerhalb dieser Pfade (IOMMU-Cmdline, VFIO-IDs, benutzerdefinierte Macken) wird automatisch über die Kernel-agnostische Zusammenführung wieder zusammengeführt:",
+  "The following changes will be applied": "Die folgenden Änderungen werden angewendet",
+  "The following devices were excluded because they are part of an SR-IOV configuration:": "Die folgenden Geräte wurden ausgeschlossen, da sie Teil einer SR-IOV-Konfiguration sind:",
+  "The following devices were excluded from Controller/NVMe passthrough because they are part of an SR-IOV configuration:": "Die folgenden Geräte wurden vom Controller/NVMe-Passthrough ausgeschlossen, da sie Teil einer SR-IOV-Konfiguration sind:",
+  "The following entries exist on the host but were NOT in the backup. To make the host EXACTLY match the backup state, they must be removed:": "Die folgenden Einträge sind auf dem Host vorhanden, waren aber NICHT in der Sicherung.Damit der Host GENAU mit dem Backup-Status übereinstimmt, müssen sie entfernt werden:",
+  "The following selected GPU(s) are currently in GPU -> VM mode (vfio-pci):": "Die folgenden ausgewählten GPU(s) befinden sich derzeit im GPU -> VM-Modus (vfio-pci):",
+  "The following selected device(s) are Physical Functions with active Virtual Functions:": "Bei den folgenden ausgewählten Geräten handelt es sich um physische Funktionen mit aktiven virtuellen Funktionen:",
+  "The following selected device(s) are SR-IOV Virtual Functions (VFs):": "Die folgenden ausgewählten Geräte sind SR-IOV Virtual Functions (VFs):",
+  "The fstab entry will still be removed; reboot or manual umount needed.": "Der fstab-Eintrag wird weiterhin entfernt; Neustart oder manuelles Umount erforderlich.",
+  "The gateway should appear in your Tailscale admin console shortly.": "Das Gateway sollte in Kürze in Ihrer Tailscale-Administratorkonsole erscheinen.",
+  "The host directory may not be accessible from an unprivileged container.": "Auf das Hostverzeichnis kann von einem unprivilegierten Container aus möglicherweise nicht zugegriffen werden.",
+  "The installation requires a server restart to apply changes. Do you want to restart now?": "Die Installation erfordert einen Serverneustart, um die Änderungen zu übernehmen. Möchten Sie jetzt neu starten?",
+  "The installation/changes require a server restart to apply correctly. Do you want to reboot now?": "Die Installation/Änderungen erfordern einen Serverneustart, um korrekt angewendet zu werden. Möchten Sie jetzt neu starten?",
+  "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "Der lokale Umschlag wird gelöscht und zukünftige Sicherungen laden nichts hoch.Bereits auf PBS hochgeladene Umschläge bleiben intakt und können mit ihrer ursprünglichen Passphrase wiederhergestellt werden.",
+  "The long test runs directly on the disk hardware.": "Der Langzeittest läuft direkt auf der Festplatten-Hardware.",
+  "The new SSH key was installed and is now authorized on the server.\nKey file:": "Der neue SSH-Schlüssel wurde installiert und ist nun auf dem Server autorisiert.\nSchlüsseldatei:",
+  "The new SSH key was pushed to the LXC via 'pct exec' on": "Der neue SSH-Schlüssel wurde über „pct exec“ an den LXC übertragen",
+  "The next visit to the dashboard will show the initial setup wizard.": "Beim nächsten Besuch des Dashboards wird der Ersteinrichtungsassistent angezeigt.",
+  "The passwords do not match. Please try again.": "Die Passwörter stimmen nicht überein. Bitte versuchen Sie es erneut.",
+  "The preselected VMID does not exist on this host:": "Die vorausgewählte VMID ist auf diesem Host nicht vorhanden:",
+  "The same GPU cannot be used by two VMs at the same time.": "Die gleiche GPU kann nicht von zwei VMs gleichzeitig verwendet werden.",
+  "The script clones the osx-proxmox.com repository and once the setup is complete, the server will automatically reboot.": "Das Skript klont das osx-proxmox.com-Repository und sobald die Einrichtung abgeschlossen ist, wird der Server automatisch neu gestartet.",
+  "The script will continue to restore VM passthrough mode on the host and reuse existing hostpci entries.": "Das Skript stellt weiterhin den VM-Passthrough-Modus auf dem Host wieder her und verwendet vorhandene Hostpci-Einträge wieder.",
+  "The script will preconfigure the selected GPU now and finalize hardware binding after reboot.": "Das Skript konfiguriert jetzt die ausgewählte GPU vor und schließt die Hardwarebindung nach dem Neustart ab.",
+  "The selected AMD GPU does not report FLR reset support": "Die ausgewählte AMD-GPU meldet keine FLR-Reset-Unterstützung",
+  "The selected AMD GPU is currently in power state D3cold": "Die ausgewählte AMD-GPU befindet sich derzeit im Energiezustand D3cold",
+  "The selected GPU configuration already exists in this container.": "Die ausgewählte GPU-Konfiguration ist bereits in diesem Container vorhanden.",
+  "The selected GPU has no dedicated .1 audio sibling function.": "Die ausgewählte GPU verfügt über keine dedizierte .1-Audio-Geschwisterfunktion.",
+  "The selected GPU is already assigned to another VM that is currently running:": "Die ausgewählte GPU ist bereits einer anderen VM zugewiesen, die derzeit ausgeführt wird:",
+  "The selected GPU is already assigned to this VM, but the host is not currently using vfio-pci for this device.": "Die ausgewählte GPU ist dieser VM bereits zugewiesen, aber der Host verwendet derzeit nicht vfio-pci für dieses Gerät.",
+  "The selected GPU is already assigned to this VM.": "Die ausgewählte GPU ist dieser VM bereits zugewiesen.",
+  "The selected GPU is already configured for passthrough to:": "Die ausgewählte GPU ist bereits für Passthrough konfiguriert zu:",
+  "The selected GPU is already present in this VM. Select another GPU to continue:": "Die ausgewählte GPU ist in dieser VM bereits vorhanden. Wählen Sie eine andere GPU aus, um fortzufahren:",
+  "The selected GPU is currently used by the following LXC container(s):": "Die ausgewählte GPU wird derzeit von den folgenden LXC-Containern verwendet:",
+  "The selected GPU(s) are configured in these VM(s)": "Die ausgewählten GPU(s) werden in diesen VM(s) konfiguriert.",
+  "The selected GPU(s) are configured in these VM(s):": "Die ausgewählten GPU(s) werden in diesen VM(s) konfiguriert:",
+  "The selected GPU(s) are used in these LXC container(s)": "Die ausgewählten GPU(s) werden in diesen LXC-Containern verwendet.",
+  "The selected GPU(s) are used in these LXC container(s):": "Die ausgewählten GPU(s) werden in diesen LXC-Containern verwendet:",
+  "The selected Intel GPU belongs to Apollo Lake generation and is blocked by policy for VM passthrough due to host instability risk.": "Die ausgewählte Intel-GPU gehört zur Apollo-Lake-Generation und ist aufgrund des Host-Instabilitätsrisikos durch die Richtlinie für VM-Passthrough blockiert.",
+  "The selected Intel GPU does not expose a PCI reset interface": "Die ausgewählte Intel-GPU stellt keine PCI-Reset-Schnittstelle zur Verfügung",
+  "The selected Intel GPU has non-FLR reset support and unknown subtype": "Die ausgewählte Intel-GPU verfügt über Nicht-FLR-Reset-Unterstützung und einen unbekannten Subtyp",
+  "The selected Intel GPU is currently in power state D3cold": "Die ausgewählte Intel-GPU befindet sich derzeit im Energiezustand D3cold",
+  "The selected VM": "Die ausgewählte VM",
+  "The selected VM is running.": "Die ausgewählte VM läuft.",
+  "The selected base folder does not exist and could not be created:": "Der ausgewählte Basisordner existiert nicht und konnte nicht erstellt werden:",
+  "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "Der ausgewählte Container ist nicht privilegiert. Für den direkten Geräte-Passthrough ist ein privilegierter Container erforderlich.",
+  "The selected device": "Das ausgewählte Gerät",
+  "The selected directory does not exist:": "Das ausgewählte Verzeichnis existiert nicht:",
+  "The selected disk has an active swap partition. Aborting.": "Die ausgewählte Festplatte verfügt über eine aktive Swap-Partition. Abbruch.",
+  "The selected disk is currently used by a RUNNING VM or CT. Stop it before formatting.": "Die ausgewählte Festplatte wird derzeit von einer LAUFENDEN VM oder CT verwendet. Stoppen Sie es vor dem Formatieren.",
+  "The selected disk is now part of the system ZFS pool. Aborting.": "Die ausgewählte Festplatte ist jetzt Teil des System-ZFS-Pools. Abbruch.",
+  "The selected disk now contains a system-critical mount. Aborting.": "Der ausgewählte Datenträger enthält nun einen systemkritischen Mount. Abbruch.",
+  "The selected path does not exist on this host:": "Der ausgewählte Pfad existiert auf diesem Host nicht:",
+  "The selected path is not a valid directory:": "Der ausgewählte Pfad ist kein gültiges Verzeichnis:",
+  "The server connected you as guest instead of the specified user.": "Der Server hat Sie als Gast und nicht als angegebenen Benutzer verbunden.",
+  "The server may not have accessible shares.": "Der Server verfügt möglicherweise nicht über zugängliche Freigaben.",
+  "The server may require authentication for actual share access.": "Der Server erfordert möglicherweise eine Authentifizierung für den tatsächlichen Freigabezugriff.",
+  "The server refused password authentication for": "Der Server hat die Passwortauthentifizierung abgelehnt",
+  "The server rejected": "Der Server hat abgelehnt",
+  "The share already exists in smb.conf:": "Die Freigabe existiert bereits in smb.conf:",
+  "The source VM also has these audio devices, likely added together with the GPU. Remove them too?": "Die Quell-VM verfügt ebenfalls über diese Audiogeräte, wahrscheinlich zusammen mit der GPU hinzugefügt. Auch entfernen?",
+  "The specified directory does not exist:": "Das angegebene Verzeichnis existiert nicht:",
+  "The storage has been removed and the disk unmounted.": "Der Speicher wurde entfernt und die Festplatte nicht bereitgestellt.",
+  "The test will continue even if you close this terminal.": "Der Test wird auch dann fortgesetzt, wenn Sie dieses Terminal schließen.",
+  "Then bind-mount to container": "Dann bind-mounten Sie es an den Container",
+  "Then change the VM display to none (vga: none) when the guest is stable.": "Ändern Sie dann die VM-Anzeige auf „Keine“ (vga: none), wenn der Gast stabil ist.",
+  "Then change the VM display to none (vga: none) when the system is stable.": "Ändern Sie dann die VM-Anzeige auf „Keine“ (vga: none), wenn das System stabil ist.",
+  "Then run this option again:": "Führen Sie dann diese Option erneut aus:",
+  "Then update /etc/fstab on the host with the same options.": "Aktualisieren Sie dann /etc/fstab auf dem Host mit denselben Optionen.",
+  "These are the changes that will be made": "Dies sind die Änderungen, die vorgenommen werden",
+  "These interface configurations will be removed": "Diese Schnittstellenkonfigurationen werden entfernt",
+  "These paths will not be restored live and will be extracted for manual recovery.": "Diese Pfade werden nicht live wiederhergestellt und zur manuellen Wiederherstellung extrahiert.",
+  "This CIFS share is mounted with restrictive permissions.": "Diese CIFS-Freigabe wird mit restriktiven Berechtigungen gemountet.",
+  "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Diese GPU gilt als inkompatibel mit GPU-Passthrough zu einer VM in ProxMenux.",
+  "This NFS share is fully restricted — even the host root cannot write to it.": "Diese NFS-Freigabe ist vollständig eingeschränkt – selbst der Host-Root kann nicht darauf schreiben.",
+  "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Für diese VM sind zusätzliche Installationsschritte erforderlich. Weitere Informationen finden Sie im Installationshandbuch unter:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
+  "This action will:": "Diese Aktion wird:",
+  "This archive does not contain a recognized backup layout.": "Dieses Archiv enthält kein anerkanntes Backup-Layout.",
+  "This backup does not contain any restorable paths.": "Dieses Backup enthält keine wiederherstellbaren Pfade.",
+  "This backup includes /etc/zfs/zpool.cache (host-specific ZFS state).": "Dieses Backup umfasst /etc/zfs/zpool.cache (hostspezifischer ZFS-Status).",
+  "This backup is encrypted.": "Dieses Backup ist verschlüsselt.",
+  "This backup was taken on kernel": "Dieses Backup wurde im Kernel erstellt",
+  "This container does not have apt-get. NFS client installation only supports Debian/Ubuntu containers.": "Dieser Container verfügt nicht über apt-get. Die NFS-Client-Installation unterstützt nur Debian/Ubuntu-Container.",
+  "This container does not have apt-get. Samba client installation only supports Debian/Ubuntu containers.": "Dieser Container verfügt nicht über apt-get. Die Samba-Client-Installation unterstützt nur Debian/Ubuntu-Container.",
+  "This container has no GPU configured. Coral TPU works best alongside hardware video decoding (Quick Sync, VA-API, NVENC) for apps like Frigate.": "Für diesen Container ist keine GPU konfiguriert. Coral TPU funktioniert am besten zusammen mit der Hardware-Videodekodierung (Quick Sync, VA-API, NVENC) für Apps wie Frigate.",
+  "This converts all directory UIDs/GIDs by adding 100000": "Dadurch werden alle Verzeichnis-UIDs/GIDs konvertiert, indem 100000 hinzugefügt wird",
+  "This converts all file UIDs/GIDs by adding 100000": "Dadurch werden alle Datei-UIDs/GIDs durch Addition von 100000 konvertiert",
+  "This creates a backup in case you need to revert changes": "Dadurch wird ein Backup erstellt, falls Sie Änderungen rückgängig machen müssen",
+  "This erases existing metadata.": "Dadurch werden vorhandene Metadaten gelöscht.",
+  "This explicitly marks the container as privileged": "Dadurch wird der Container explizit als privilegiert gekennzeichnet",
+  "This guarantees that device nodes are available before applying LXC GPU config.": "Dies garantiert, dass Geräteknoten verfügbar sind, bevor die LXC-GPU-Konfiguration angewendet wird.",
+  "This installation will:": "Diese Installation wird:",
+  "This installer will:": "Dieses Installationsprogramm wird:",
+  "This interface is configured but doesn't exist physically": "Diese Schnittstelle ist konfiguriert, aber physisch nicht vorhanden",
+  "This is IRREVERSIBLE.": "Das ist irreversibel.",
+  "This is a destructive action": "Dies ist eine destruktive Aktion",
+  "This is a simple configuration change": "Dies ist eine einfache Konfigurationsänderung",
+  "This is an external community script maintained by": "Dies ist ein externes Community-Skript, das von verwaltet wird",
+  "This is an external script that creates a macOS VM in Proxmox VE in just a few steps, whether you are using AMD or Intel hardware.": "Hierbei handelt es sich um ein externes Skript, das in wenigen Schritten eine macOS VM in Proxmox VE erstellt, egal ob Sie AMD- oder Intel-Hardware verwenden.",
+  "This is unexpected since credentials were validated.": "Dies ist unerwartet, da die Anmeldeinformationen validiert wurden.",
+  "This marks the container as unprivileged": "Dadurch wird der Container als nicht privilegiert markiert",
+  "This may be normal for a fresh installation": "Dies kann bei einer Neuinstallation normal sein",
+  "This may take a few seconds...": "Dies kann einige Sekunden dauern...",
+  "This may take several minutes...": "Dies kann einige Minuten dauern...",
+  "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "Das bedeutet, dass Proxmox den Mount-Lebenszyklus nativ verwaltet (für NFS/CIFS-Hostspeicher ist kein manuelles /etc/fstab erforderlich).",
+  "This means the credentials are incorrect.": "Dies bedeutet, dass die Anmeldeinformationen falsch sind.",
+  "This might indicate network connectivity issues.": "Dies könnte auf Probleme mit der Netzwerkverbindung hinweisen.",
+  "This operation may take several minutes and requires internet connectivity.": "Dieser Vorgang kann mehrere Minuten dauern und erfordert eine Internetverbindung.",
+  "This passphrase is the ONLY way to access encrypted Borg backups.": "Diese Passphrase ist die EINZIGE Möglichkeit, auf verschlüsselte Borg-Backups zuzugreifen.",
+  "This path is already used as a mount point in this container.": "Dieser Pfad wird in diesem Container bereits als Mountpunkt verwendet.",
+  "This path is not a registered mount point. Use it anyway?": "Dieser Pfad ist kein registrierter Mountpunkt. Trotzdem nutzen?",
+  "This process changes file ownership inside the container": "Dieser Prozess ändert den Dateieigentum innerhalb des Containers",
+  "This release channel is already active.": "Dieser Release-Kanal ist bereits aktiv.",
+  "This removes the 'unprivileged: 1' line from the config": "Dadurch wird die Zeile „unprivileged: 1“ aus der Konfiguration entfernt",
+  "This removes the storage from Proxmox. The iSCSI target is not affected.": "Dadurch wird der Speicher von Proxmox entfernt. Das iSCSI-Ziel ist nicht betroffen.",
+  "This replaces the currently installed keyfile.": "Dies ersetzt die aktuell installierte Schlüsseldatei.",
+  "This returns available IQNs.": "Dadurch werden verfügbare IQNs zurückgegeben.",
+  "This script cannot be executed from the Proxmox web terminal.": "Dieses Skript kann nicht über das Proxmox-Webterminal ausgeführt werden.",
+  "This script must be run as root.": "Dieses Skript muss als Root ausgeführt werden.",
+  "This script must be run on a Proxmox host.": "Dieses Skript muss auf einem Proxmox-Host ausgeführt werden.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Dieses Skript wendet die folgenden Optimierungen und erweiterten Anpassungen auf Ihren Proxmox VE-Server an",
+  "This script will update your Proxmox VE system with advanced options:": "Dieses Skript aktualisiert Ihr Proxmox VE-System mit erweiterten Optionen:",
+  "This shows the storage type and disk identifier": "Hier werden der Speichertyp und die Festplattenkennung angezeigt",
+  "This state has a high probability of VM startup/reset failures.": "In diesem Zustand besteht eine hohe Wahrscheinlichkeit für VM-Start-/Reset-Fehler.",
+  "This state indicates a high risk of passthrough failure due to": "Dieser Zustand weist auf ein hohes Risiko eines Passthrough-Fehlers hin",
+  "This tool is designed for systems with AMD GPUs.": "Dieses Tool ist für Systeme mit AMD-GPUs konzipiert.",
+  "This tool is designed for systems with Intel GPUs.": "Dieses Tool ist für Systeme mit Intel-GPUs konzipiert.",
+  "This will RESET the ProxMenux Monitor login credentials on this host:": "Dadurch werden die Anmeldeinformationen von ProxMenux Monitor auf diesem Host ZURÜCKGESETZT:",
+  "This will add the mount to /etc/fstab so it persists after reboot.": "Dadurch wird der Mount zu /etc/fstab hinzugefügt, sodass er nach dem Neustart bestehen bleibt.",
+  "This will completely remove Fail2Ban and its configuration. Continue?": "Dadurch wird Fail2Ban und seine Konfiguration vollständig entfernt. Weitermachen?",
+  "This will completely remove Lynis from the system. Continue?": "Dadurch wird Lynis vollständig aus dem System entfernt. Weitermachen?",
+  "This will create a new VM": "Dadurch wird eine neue VM erstellt",
+  "This will deploy a Tailscale VPN gateway for secure remote access.": "Dadurch wird ein Tailscale VPN-Gateway für sicheren Fernzugriff bereitgestellt.",
+  "This will install and configure Fail2Ban with:": "Dadurch wird Fail2Ban installiert und konfiguriert mit:",
+  "This will install the Beta version from the develop branch and enable beta update checks.\n\nBeta builds may contain bugs or incomplete features.\n\nContinue?": "Dadurch wird die Beta-Version aus dem Entwicklungszweig installiert und Beta-Update-Prüfungen aktiviert.\n\nBeta-Builds können Fehler oder unvollständige Funktionen enthalten.\n\nWeitermachen?",
+  "This will launch the GPU assistant after VM creation and may require a host reboot.": "Dadurch wird der GPU-Assistent nach der VM-Erstellung gestartet und erfordert möglicherweise einen Neustart des Hosts.",
+  "This will reinstall and reconfigure Fail2Ban with the default ProxMenux settings. Continue?": "Dadurch wird Fail2Ban mit den Standard-ProxMenux-Einstellungen neu installiert und konfiguriert. Weitermachen?",
+  "This will reinstall core Proxmox packages and regenerate certificates": "Dadurch werden die Proxmox-Kernpakete neu installiert und Zertifikate neu generiert",
+  "This will reinstall the Stable version from the main branch and disable beta update checks.\n\nContinue?": "Dadurch wird die stabile Version aus dem Hauptzweig neu installiert und Beta-Update-Prüfungen deaktiviert.\n\nWeitermachen?",
+  "This will remove NVIDIA drivers and related configuration. Do you want to continue?": "Dadurch werden NVIDIA-Treiber und die zugehörige Konfiguration entfernt. Möchten Sie fortfahren?",
+  "This will remove and reinstall Lynis from the latest GitHub source. Continue?": "Dadurch wird Lynis von der neuesten GitHub-Quelle entfernt und neu installiert. Weitermachen?",
+  "This will remove the Coral TPU drivers (gasket DKMS + libedgetpu) and related configuration. Any LXC container with apex passthrough will lose access to /dev/apex_* after reboot. Continue?": "Dadurch werden die Coral TPU-Treiber (DKMS + libedgetpu) und die zugehörige Konfiguration entfernt. Jeder LXC-Container mit Apex-Passthrough verliert nach dem Neustart den Zugriff auf /dev/apex_*. Weitermachen?",
+  "This will remove the mount from /etc/fstab and delete credentials if present.": "Dadurch wird der Mount aus /etc/fstab entfernt und Anmeldeinformationen gelöscht, falls vorhanden.",
+  "This will remove the mount from /etc/fstab.": "Dadurch wird der Mount aus /etc/fstab entfernt.",
+  "This will restart the network service and may cause a brief disconnection. Continue?": "Dadurch wird der Netzwerkdienst neu gestartet und es kann zu einer kurzen Unterbrechung der Verbindung kommen. Weitermachen?",
+  "This will take time. Answer prompts carefully - see notes below.": "Das wird einige Zeit dauern. Beantworten Sie die Fragen sorgfältig – siehe Hinweise unten.",
+  "This will upgrade this node to Proxmox VE 9 on Debian Trixie.": "Dadurch wird dieser Knoten auf Proxmox VE 9 unter Debian Trixie aktualisiert.",
+  "Tick the paths to include in this backup. Press \"Add custom path\" to add a folder or file of your own to the list.": "Markieren Sie die Pfade, die in diese Sicherung einbezogen werden sollen. Klicken Sie auf „Benutzerdefinierten Pfad hinzufügen“, um der Liste einen eigenen Ordner oder eine eigene Datei hinzuzufügen.",
+  "Tick the paths to remove (they will not be deleted from disk — only from this list):": "Markieren Sie die zu entfernenden Pfade (sie werden nicht von der Festplatte gelöscht, sondern nur aus dieser Liste):",
+  "Time settings configured - Timezone:": "Konfigurierte Zeiteinstellungen – Zeitzone:",
+  "Time synchronization reset to UTC": "Zeitsynchronisation auf UTC zurückgesetzt",
+  "Tip: Also mount the VirtIO ISO for drivers and guest agent installer": "Tipp: Mounten Sie auch die VirtIO-ISO für Treiber und Gast-Agent-Installationsprogramm",
+  "Tip: You can install the QEMU Guest Agent inside the VM with:": "Tipp: Sie können den QEMU Guest Agent in der VM installieren mit:",
+  "Tip: zfs set acltype=posixacl xattr=sa <pool>/<dataset> enables full ACL support.": "Tipp: zfs set acltype=posixacl xattr=sa <pool>/<dataset> aktiviert die vollständige ACL-Unterstützung.",
+  "To allow LXC write access, change the NFS export on the server to include:": "Um LXC-Schreibzugriff zu ermöglichen, ändern Sie den NFS-Export auf dem Server so, dass er Folgendes enthält:",
+  "To assign VFs to VMs or LXCs, edit the configuration manually via the Proxmox web interface. The Physical Function will remain bound to the native driver.": "Um VFs VMs oder LXCs zuzuweisen, bearbeiten Sie die Konfiguration manuell über die Proxmox-Weboberfläche. Die physische Funktion bleibt an den nativen Treiber gebunden.",
+  "To continue with Add GPU to LXC, first switch the host to GPU -> LXC mode and reboot.": "Um mit „GPU zu LXC hinzufügen“ fortzufahren, schalten Sie zunächst den Host in den GPU->LXC-Modus und starten Sie ihn neu.",
+  "To copy any of these files verbatim, restore this backup on a host with the same kernel major.minor.": "Um eine dieser Dateien wörtlich zu kopieren, stellen Sie diese Sicherung auf einem Host mit demselben Kernel (major.minor) wieder her.",
+  "To exit iftop, press q": "Um iftop zu verlassen, drücken Sie q",
+  "To exit iptraf-ng, press x": "Um iptraf-ng zu beenden, drücken Sie x",
+  "To fix this, do ONE of the following:": "Um dies zu beheben, führen Sie EINEN der folgenden Schritte aus:",
+  "To install host drivers, first remove the GPU from VM passthrough configuration and reboot.": "Um Hosttreiber zu installieren, entfernen Sie zunächst die GPU aus der VM-Passthrough-Konfiguration und starten Sie neu.",
+  "To install the monitor, reinstall ProxMenux with the latest version": "Um den Monitor zu installieren, installieren Sie ProxMenux mit der neuesten Version neu",
+  "To pass SR-IOV Virtual Functions to a VM, edit the VM configuration manually via the Proxmox web interface.": "Um virtuelle SR-IOV-Funktionen an eine VM zu übergeben, bearbeiten Sie die VM-Konfiguration manuell über die Proxmox-Weboberfläche.",
+  "To pass SR-IOV Virtual Functions to a container, edit the LXC configuration manually via the Proxmox web interface. The Physical Function will remain bound to the native driver.": "Um virtuelle SR-IOV-Funktionen an einen Container zu übergeben, bearbeiten Sie die LXC-Konfiguration manuell über die Proxmox-Weboberfläche. Die physische Funktion bleibt an den nativen Treiber gebunden.",
+  "To remove partial VM:": "So entfernen Sie eine teilweise VM:",
+  "To restore": "Zum Wiederherstellen",
+  "To revert changes:": "So machen Sie Änderungen rückgängig:",
+  "To start the VM:": "So starten Sie die VM:",
+  "To stop:": "Zum Stoppen:",
+  "To use Coral from a regular app, install the libedgetpu runtime via the usual method for your distro (community package or build from source). The simplest path is to run an app container that bundles the runtime — e.g. the Frigate Docker image — passing the device through with": "Um Coral über eine reguläre App zu verwenden, installieren Sie die libedgetpu-Laufzeitumgebung über die für Ihre Distribution übliche Methode (Community-Paket oder Build aus dem Quellcode). Der einfachste Weg besteht darin, einen App-Container auszuführen, der die Laufzeit bündelt – z. B. das Frigate Docker-Image – Weiterleitung des Geräts mit",
+  "To use GPU passthrough, please create a new VM configured with:": "Um GPU-Passthrough zu verwenden, erstellen Sie bitte eine neue VM, konfiguriert mit:",
+  "To use a custom Fastfetch logo, place your ASCII logo file in:\n\n/usr/local/share/fastfetch/logos/\n\nThe file should not exceed 35 lines to fit properly in the terminal.\n\nPress OK to continue and select your logo.": "Um ein benutzerdefiniertes Fastfetch-Logo zu verwenden, platzieren Sie Ihre ASCII-Logodatei in:\n\n/usr/local/share/fastfetch/logos/\n\nDie Datei sollte 35 Zeilen nicht überschreiten, damit sie richtig in das Terminal passt.\n\nDrücken Sie OK, um fortzufahren und Ihr Logo auszuwählen.",
+  "To use the GPU again in LXC, run Add GPU to LXC from GPUs and Coral-TPU Menu": "Um die GPU wieder in LXC zu verwenden, führen Sie „GPU zu LXC hinzufügen“ über „GPUs“ und „Coral-TPU-Menü“ aus",
+  "To use the VM without issues, the host must be restarted before starting it.": "Um die VM problemlos nutzen zu können, muss der Host vor dem Start neu gestartet werden.",
+  "To use this share from an LXC, bind-mount it via:": "Um diese Freigabe von einem LXC aus zu verwenden, mounten Sie sie per Bind-Mount:",
+  "Tool exit code:": "Tool-Exit-Code:",
+  "Tool output:": "Werkzeugausgabe:",
+  "Top memory processes in CT": "Top-Gedächtnisprozesse in der CT",
+  "Total": "Gesamt",
+  "Total members:": "Gesamtzahl der Mitglieder:",
+  "Total routes": "Gesamtrouten",
+  "Total size:": "Gesamtgröße:",
+  "Translation files:": "Übersetzungsdateien:",
+  "Tried pvesm path and manual detection methods": "Versuchte den Pvesm-Pfad und manuelle Erkennungsmethoden",
+  "Try Again": "Versuchen Sie es erneut",
+  "Try a different search term.": "Versuchen Sie es mit einem anderen Suchbegriff.",
+  "Try accessing": "Versuchen Sie, darauf zuzugreifen",
+  "Try another archive": "Versuchen Sie es mit einem anderen Archiv",
+  "Try automatic repair of detected issues": "Versuchen Sie, erkannte Probleme automatisch zu reparieren",
+  "Two-factor authentication and backup codes will be removed.": "Zwei-Faktor-Authentifizierung und Backup-Codes werden entfernt.",
+  "Type": "Typ",
+  "Type the device path EXACTLY to confirm formatting:": "Geben Sie den Gerätepfad GENAU ein, um die Formatierung zu bestätigen:",
+  "Type the full disk path to confirm": "Geben Sie zur Bestätigung den vollständigen Festplattenpfad ein",
+  "Type:": "Typ:",
+  "Type: attached to PVE storage": "Typ: An PVE-Speicher angeschlossen",
+  "Typed value does not match selected disk. Operation cancelled.": "Der eingegebene Wert stimmt nicht mit der ausgewählten Festplatte überein. Vorgang abgebrochen.",
+  "UID in CT": "UID im CT",
+  "UPGRADE PROMPTS - RECOMMENDED ANSWERS:": "UPGRADE-AUFFORDERUNGEN – EMPFOHLENE ANTWORTEN:",
+  "USB Accelerators:": "USB-Beschleuniger:",
+  "USB disk target": "USB-Festplattenziel",
+  "USB drives mounted now:": "Jetzt gemountete USB-Laufwerke:",
+  "USB libedgetpu1": "USB libedgetpu1",
+  "UUP Dump script not found.": "UUP-Dump-Skript nicht gefunden.",
+  "UUp Dump ISO creator Custom": "UUp Dump ISO-Ersteller Benutzerdefiniert",
+  "Udev rules for Coral USB devices added and rules reloaded.": "Udev-Regeln für Coral USB-Geräte hinzugefügt und Regeln neu geladen.",
+  "Udev rules for Coral USB devices already exist.": "Udev-Regeln für Coral USB-Geräte existieren bereits.",
+  "Udev rules for Coral USB devices appended and rules reloaded.": "Udev-Regeln für Coral USB-Geräte angehängt und Regeln neu geladen.",
+  "Umbrel OS installer script by Helper Scripts\n\nVisit the GitHub repo to learn more, contribute, or support the project:\n\nhttps://community-scripts.github.io/ProxmoxVE/scripts?id=umbrel-os-vm": "Umbrel OS-Installationsskript von Helper Scripts\n\nBesuchen Sie das GitHub-Repo, um mehr zu erfahren, einen Beitrag zu leisten oder das Projekt zu unterstützen:\n\nhttps://community-scripts.github.io/ProxmoxVE/scripts?id=umbrel-os-vm",
+  "Unable to detect Proxmox version.": "Proxmox-Version kann nicht erkannt werden.",
+  "Understand the security implications of privileged containers": "Verstehen Sie die Sicherheitsauswirkungen privilegierter Container",
+  "Uninstall Coral drivers and configuration": "Deinstallieren Sie Coral-Treiber und -Konfiguration",
+  "Uninstall Fail2Ban": "Deinstallieren Sie Fail2Ban",
+  "Uninstall Lynis": "Deinstallieren Sie Lynis",
+  "Uninstall NFS Server": "Deinstallieren Sie den NFS-Server",
+  "Uninstall NVIDIA drivers and configuration": "Deinstallieren Sie NVIDIA-Treiber und -Konfiguration",
+  "Uninstall Optimizations": "Optimierungen deinstallieren",
+  "Uninstall ProxMenux": "Deinstallieren Sie ProxMenux",
+  "Uninstall Samba Server": "Deinstallieren Sie den Samba-Server",
+  "Uninstall optimizations": "Optimierungen deinstallieren",
+  "Uninstallation Summary:": "Zusammenfassung der Deinstallation:",
+  "Uninstallation completed. Press Enter to continue...": "Deinstallation abgeschlossen. Drücken Sie die Eingabetaste, um fortzufahren...",
+  "Uninstalling Ceph...": "Ceph deinstallieren...",
+  "Uninstalling Fastfetch...": "Fastfetch wird deinstalliert...",
+  "Uninstalling Figurine...": "Figur wird deinstalliert...",
+  "Uninstalling amdgpu_top...": "amdgpu_top wird deinstalliert...",
+  "Uninstalling current NVIDIA driver before installing new version": "Deinstallieren Sie den aktuellen NVIDIA-Treiber, bevor Sie eine neue Version installieren",
+  "Uninstalling intel-gpu-tools...": "Intel-GPU-Tools werden deinstalliert...",
+  "Uninstalling kexec-tools and removing custom service...": "Deinstallation von kexec-tools und Entfernen des benutzerdefinierten Dienstes ...",
+  "Uninstalling log2ram (all versions)...": "Log2ram wird deinstalliert (alle Versionen) ...",
+  "Universal Group Configuration:": "Universelle Gruppenkonfiguration:",
+  "Universal Group:": "Universalgruppe:",
+  "Universal NFS server has been completely uninstalled!": "Der universelle NFS-Server wurde vollständig deinstalliert!",
+  "Universal compatibility: ENABLED": "Universelle Kompatibilität: AKTIVIERT",
+  "Universal group: NOT CONFIGURED": "Universelle Gruppe: NICHT KONFIGURIERT",
+  "Universal sharedfiles group configured with": "Universelle SharedFiles-Gruppe, konfiguriert mit",
+  "Unknown": "Unbekannt",
+  "Unknown CPU type. IOMMU might not be properly enabled.": "Unbekannter CPU-Typ. IOMMU ist möglicherweise nicht ordnungsgemäß aktiviert.",
+  "Unknown CPU vendor. Cannot determine IOMMU parameter.": "Unbekannter CPU-Anbieter. IOMMU-Parameter kann nicht ermittelt werden.",
+  "Unknown GPU": "Unbekannte GPU",
+  "Unknown model": "Unbekanntes Modell",
+  "Unknown size": "Unbekannte Größe",
+  "Unknown storage controller": "Unbekannter Speichercontroller",
+  "Unmount NFS Share": "Hängen Sie die NFS-Freigabe aus",
+  "Unmount Samba Share": "Hängen Sie die Samba-Freigabe aus",
+  "Unmount USB drive": "USB-Laufwerk aushängen",
+  "Unmount a USB drive": "Hängen Sie ein USB-Laufwerk aus",
+  "Unmount and cleanup (LVM only):": "Unmounten und Bereinigen (nur LVM):",
+  "Unmount failed": "Das Aufheben der Bereitstellung ist fehlgeschlagen",
+  "Unmount it before proceeding. The script will verify this at execution.": "Demontieren Sie es, bevor Sie fortfahren. Das Skript wird dies bei der Ausführung überprüfen.",
+  "Unmounted": "Unmontiert",
+  "Unmounted successfully": "Erfolgreich ausgehängt",
+  "Unmounted:": "Unmontiert:",
+  "Unmounting": "Absteigen",
+  "Unmounting disk...": "Datenträger wird ausgehängt...",
+  "Unprivileged": "Unprivilegiert",
+  "Unprivileged Container Access": "Unprivilegierter Containerzugriff",
+  "Unprivileged container": "Unprivilegierter Container",
+  "Unprivileged container selected:": "Unprivilegierter Container ausgewählt:",
+  "Unprivileged container — UID offset:": "Nicht privilegierter Container – UID-Offset:",
+  "Unprivileged containers map their UIDs to high host UIDs (e.g. 100000+), which appear as 'others' on the host filesystem.": "Unprivilegierte Container ordnen ihre UIDs hohen Host-UIDs (z. B. 100000+) zu, die im Host-Dateisystem als „Andere“ angezeigt werden.",
+  "Unprivileged: Limited access (more secure)": "Unprivilegiert: Begrenzter Zugriff (sicherer)",
+  "Unreachable": "Unerreichbar",
+  "Unsupported Terminal": "Nicht unterstütztes Terminal",
+  "Unsupported format. Only .ova and .ovf files are supported.": "Nicht unterstütztes Format. Es werden nur .ova- und .ovf-Dateien unterstützt.",
+  "Unsupported output format:": "Nicht unterstütztes Ausgabeformat:",
+  "Update Available": "Update verfügbar",
+  "Update Ceph repository (Only if using Ceph):": "Ceph-Repository aktualisieren (nur bei Verwendung von Ceph):",
+  "Update Debian repositories to Trixie:": "Debian-Repositories auf Trixie aktualisieren:",
+  "Update Export": "Export aktualisieren",
+  "Update Lynis to latest version": "Aktualisieren Sie Lynis auf die neueste Version",
+  "Update NVIDIA in LXC Containers": "Aktualisieren Sie NVIDIA in LXC-Containern",
+  "Update PVE enterprise repository (Only if using enterprise):": "PVE-Enterprise-Repository aktualisieren (nur bei Verwendung von Enterprise):",
+  "Update Proxmox VE Appliance Manager": "Proxmox VE Appliance Manager aktualisieren",
+  "Update Proxmox package lists": "Proxmox-Paketlisten aktualisieren",
+  "Update Share": "Freigabe aktualisieren",
+  "Update Status": "Aktualisierungsstatus",
+  "Update and upgrade all system packages": "Aktualisieren und aktualisieren Sie alle Systempakete",
+  "Update and upgrade system": "System aktualisieren und aktualisieren",
+  "Update cancelled by user": "Update vom Benutzer abgebrochen",
+  "Update completed. Press Enter to continue...": "Aktualisierung abgeschlossen. Drücken Sie die Eingabetaste, um fortzufahren...",
+  "Update kernel to compatible version": "Aktualisieren Sie den Kernel auf eine kompatible Version",
+  "Update package index:": "Paketindex aktualisieren:",
+  "Update system to latest PVE 8.4+ (if not done already):": "Aktualisieren Sie das System auf die neueste PVE 8.4+ (falls noch nicht geschehen):",
+  "Updated": "Aktualisiert",
+  "Updated sharedfiles group to GID: 101000": "Sharedfiles-Gruppe auf GID aktualisiert: 101000",
+  "Updates all Proxmox and Debian packages": "Aktualisiert alle Proxmox- und Debian-Pakete",
+  "Updates and Packages Commands": "Befehle für Updates und Pakete",
+  "Updates file is empty or unreadable.": "Die Aktualisierungsdatei ist leer oder nicht lesbar.",
+  "Updating APT package lists...": "APT-Paketlisten werden aktualisiert...",
+  "Updating Debian Bookworm → Trixie in sources.list...": "Debian Bookworm wird aktualisiert → Trixie in resources.list...",
+  "Updating Figurine binary...": "Figur-Binärdatei wird aktualisiert...",
+  "Updating Lynis to the latest version...": "Lynis wird auf die neueste Version aktualisiert...",
+  "Updating PVE application manager...": "PVE-Anwendungsmanager wird aktualisiert...",
+  "Updating amdgpu_top...": "amdgpu_top wird aktualisiert...",
+  "Updating cluster certificates...": "Clusterzertifikate werden aktualisiert...",
+  "Updating initramfs (this may take a minute)...": "Initramfs wird aktualisiert (dies kann eine Minute dauern) ...",
+  "Updating initramfs for all kernels...": "Initramfs für alle Kernel wird aktualisiert ...",
+  "Updating initramfs, GRUB, and EFI boot, patience...": "Aktualisieren von initramfs, GRUB und EFI-Boot, Geduld ...",
+  "Updating journald to store info-level messages...": "Journald wird aktualisiert, um Nachrichten auf Informationsebene zu speichern ...",
+  "Updating kernel panic configuration...": "Kernel-Panic-Konfiguration wird aktualisiert...",
+  "Updating package lists...": "Paketlisten werden aktualisiert...",
+  "Updating pve-enterprise.list (if present) to Trixie...": "Aktualisierung von pve-enterprise.list (falls vorhanden) auf Trixie ...",
+  "Updating release channel configuration...": "Konfiguration des Release-Kanals wird aktualisiert...",
+  "Upgrade Ceph to compatible version": "Aktualisieren Sie Ceph auf eine kompatible Version",
+  "Upgrade PVE 8 to PVE 9": "Aktualisieren Sie PVE 8 auf PVE 9",
+  "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Upgrade-Assistent: Proxmox VE 8 → 9 (Trixie)",
+  "Upgrade canceled by user": "Upgrade vom Benutzer abgebrochen",
+  "Upgrade one node at a time": "Aktualisieren Sie jeweils einen Knoten",
+  "Upgrade to Proxmox VE 9": "Upgrade auf Proxmox VE 9",
+  "Upgrading NVIDIA utils (Arch)...": "NVIDIA-Dienstprogramme werden aktualisiert (Arch)...",
+  "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "Eine verschlüsselte Kopie des Schlüssels auf PBS hochladen, damit Sie ihn auf einem neu installierten Host mit nur einer Passphrase wiederherstellen können?",
+  "Upload key to PBS?": "Schlüssel auf PBS hochladen?",
+  "Upload to PBS disabled.": "Hochladen auf PBS deaktiviert.",
+  "Upload to PBS enabled. The envelope is uploaded on every encrypted backup.": "Hochladen auf PBS aktiviert.Der Umschlag wird bei jedem verschlüsselten Backup hochgeladen.",
+  "Upload to PBS is currently: no. Pick an action:": "Hochladen auf PBS ist derzeit: Nein.Wählen Sie eine Aktion:",
+  "Upload to PBS is currently: yes. Pick an action:": "Auf PBS hochladen ist derzeit: ja.Wählen Sie eine Aktion:",
+  "Upload to PBS: enable, disable or rotate the recovery passphrase": "Auf PBS hochladen: Wiederherstellungspassphrase aktivieren, deaktivieren oder drehen",
+  "Uptime and who is logged in": "Betriebszeit und wer angemeldet ist",
+  "Use \"Check test progress\" to see results.": "Verwenden Sie „Testfortschritt prüfen“, um die Ergebnisse anzuzeigen.",
+  "Use 'Export to file' to save it and inspect manually.": "Verwenden Sie „In Datei exportieren“, um es zu speichern und manuell zu überprüfen.",
+  "Use 'pct restore' / 'qmrestore' to recover their disks from your VM backups.": "Verwenden Sie „pct restart“ / „qmrestore“, um ihre Festplatten aus Ihren VM-Backups wiederherzustellen.",
+  "Use Custom backup and uncheck the conflicting path from the list": "Verwenden Sie die benutzerdefinierte Sicherung und deaktivieren Sie den in Konflikt stehenden Pfad aus der Liste",
+  "Use Default Settings?": "Standardeinstellungen verwenden?",
+  "Use Download first if you want to save a copy of the current key. Continue?": "Verwenden Sie zuerst „Herunterladen“, wenn Sie eine Kopie des aktuellen Schlüssels speichern möchten.Weitermachen?",
+  "Use SPACE to select, ENTER to confirm": "Benutzen Sie die Leertaste zur Auswahl und ENTER zur Bestätigung",
+  "Use SPACE to select/deselect, ENTER to confirm": "Benutzen Sie die LEERTASTE zum Auswählen/Abwählen, ENTER zum Bestätigen",
+  "Use SSH or terminal access (SSH recommended)": "Verwenden Sie SSH oder Terminalzugriff (SSH empfohlen)",
+  "Use a USB disk": "Verwenden Sie eine USB-Festplatte",
+  "Use a custom path": "Verwenden Sie einen benutzerdefinierten Pfad",
+  "Use a privileged LXC for NFS server/client workflows.": "Verwenden Sie einen privilegierten LXC für NFS-Server-/Client-Workflows.",
+  "Use a privileged LXC for Samba client/server workflows.": "Verwenden Sie einen privilegierten LXC für Samba-Client/Server-Workflows.",
+  "Use an existing SSH private key file on this host": "Verwenden Sie eine vorhandene private SSH-Schlüsseldatei auf diesem Host",
+  "Use an existing keyfile": "Verwenden Sie eine vorhandene Schlüsseldatei",
+  "Use as-is — keep data and filesystem": "So verwenden, wie es ist – Daten und Dateisystem beibehalten",
+  "Use content types according to your use case.": "Verwenden Sie Inhaltstypen entsprechend Ihrem Anwendungsfall.",
+  "Use default": "Standard verwenden",
+  "Use default (Yes)": "Standard verwenden (Ja)",
+  "Use default group:": "Standardgruppe verwenden:",
+  "Use enterprise URL if you have subscription.": "Verwenden Sie die Unternehmens-URL, wenn Sie ein Abonnement haben.",
+  "Use existing VirtIO ISO from storage": "Verwenden Sie vorhandene VirtIO-ISO aus dem Speicher",
+  "Use existing filesystem": "Vorhandenes Dateisystem verwenden",
+  "Use existing: mount without formatting": "Vorhandenes verwenden: mounten ohne Formatierung",
+  "Use images only if the directory is on suitable storage.": "Verwenden Sie Bilder nur, wenn sich das Verzeichnis auf einem geeigneten Speicher befindet.",
+  "Use mp1/mp2/... for extra mount points.": "Verwenden Sie mp1/mp2/... für zusätzliche Mount-Punkte.",
+  "Use only when unprivileged containers cannot meet your needs": "Verwenden Sie es nur, wenn nicht privilegierte Container Ihre Anforderungen nicht erfüllen können",
+  "Use option 1 to add a local disk (as Proxmox storage and/or as a host mount).": "Verwenden Sie Option 1, um eine lokale Festplatte hinzuzufügen (als Proxmox-Speicher und/oder als Host-Mount).",
+  "Use option 1 to add an iSCSI target as Proxmox storage.": "Verwenden Sie Option 1, um ein iSCSI-Ziel als Proxmox-Speicher hinzuzufügen.",
+  "Use pigz for faster gzip compression": "Verwenden Sie pigz für eine schnellere GZIP-Komprimierung",
+  "Use the Guided Cleanup option to fix issues safely": "Verwenden Sie die Option „Geführte Bereinigung“, um Probleme sicher zu beheben",
+  "Use the Guided Repair option to fix issues safely": "Verwenden Sie die Option „Geführte Reparatur“, um Probleme sicher zu beheben",
+  "Use these commands on your Proxmox host to access an LXC container's terminal:": "Verwenden Sie diese Befehle auf Ihrem Proxmox-Host, um auf das Terminal eines LXC-Containers zuzugreifen:",
+  "Use tmux or screen to avoid interruptions": "Verwenden Sie tmux oder screen, um Unterbrechungen zu vermeiden",
+  "Use:": "Verwenden:",
+  "Useful System Commands": "Nützliche Systembefehle",
+  "Useful to verify options/content after script execution.": "Nützlich, um Optionen/Inhalte nach der Skriptausführung zu überprüfen.",
+  "User": "Benutzer",
+  "User account exists on server": "Benutzerkonto ist auf dem Server vorhanden",
+  "User activity and uptime": "Benutzeraktivität und Betriebszeit",
+  "User chose not to remove NetworkManager": "Der Benutzer hat sich dafür entschieden, NetworkManager nicht zu entfernen",
+  "User chose to exit for manual backup creation.": "Der Benutzer hat sich für die manuelle Backup-Erstellung entschieden.",
+  "Username": "Benutzername",
+  "Username (e.g. root@pam or user@pbs!token):": "Benutzername (z. B. root@pam oder user@pbs!token):",
+  "Username and password": "Benutzername und Passwort",
+  "Username and password will be cleared.": "Benutzername und Passwort werden gelöscht.",
+  "Username cannot be empty.": "Der Benutzername darf nicht leer sein.",
+  "Username is correct": "Der Benutzername ist korrekt",
+  "Username on the Borg server that runs \"borg serve\" (typically \"borg\"). This is NOT the admin/root user of the server — that one is asked later only if you choose \"Generate a new key and authorize it\".": "Benutzername auf dem Borg-Server, auf dem „Borg Serve“ ausgeführt wird (normalerweise „Borg“).Dies ist NICHT der Admin-/Root-Benutzer des Servers – dieser wird später nur dann gefragt, wenn Sie „Neuen Schlüssel generieren und autorisieren“ wählen.",
+  "Username:": "Benutzername:",
+  "Users:": "Benutzer:",
+  "Using UUID is recommended over /dev/sdX.": "Die Verwendung von UUID wird gegenüber /dev/sdX empfohlen.",
+  "Using advanced configuration": "Verwenden der erweiterten Konfiguration",
+  "Using default Proxmox logo...": "Standardmäßiges Proxmox-Logo wird verwendet...",
+  "Using existing encryption key:": "Verwendung des vorhandenen Verschlüsselungsschlüssels:",
+  "Utilities Installation Menu": "Installationsmenü für Dienstprogramme",
+  "Utilities Menu": "Menü „Dienstprogramme“.",
+  "Utilities Verification": "Überprüfung der Dienstprogramme",
+  "Utilities and Tools": "Dienstprogramme und Tools",
+  "Utilities installation completed": "Die Installation der Dienstprogramme ist abgeschlossen",
+  "VFIO device IDs removed from /etc/modprobe.d/vfio.conf": "VFIO-Geräte-IDs wurden aus /etc/modprobe.d/vfio.conf entfernt",
+  "VFIO modules configured in /etc/modules": "In /etc/modules konfigurierte VFIO-Module",
+  "VFIO modules configured.": "VFIO-Module konfiguriert.",
+  "VFIO modules in /etc/modules": "VFIO-Module in /etc/modules",
+  "VFIO modules removed from /etc/modules": "VFIO-Module aus /etc/modules entfernt",
+  "VFIO orphans cleared and initramfs rebuilt — next boot will free the GPU.": "VFIO-Waisen gelöscht und initramfs neu erstellt – beim nächsten Start wird die GPU freigegeben.",
+  "VFIO orphans cleared but initramfs rebuild failed; check /var/log/proxmenux logs.": "VFIO-Waisen gelöscht, aber die Neuerstellung von initramfs ist fehlgeschlagen;Überprüfen Sie die /var/log/proxmenux-Protokolle.",
+  "VLAN": "VLAN",
+  "VM": "VM",
+  "VM Conflict Policy": "VM-Konfliktrichtlinie",
+  "VM ID": "VM-ID",
+  "VM ID:": "VM-ID:",
+  "VM Must Be Stopped": "VM muss gestoppt werden",
+  "VM Name": "VM-Name",
+  "VM Storage     (images, backup)": "VM-Speicher (Images, Backup)",
+  "VM and CT Management Commands": "VM- und CT-Verwaltungsbefehle",
+  "VM creation cancelled before disk planning.": "Die VM-Erstellung wurde vor der Festplattenplanung abgebrochen.",
+  "VM creation cancelled by user.": "VM-Erstellung vom Benutzer abgebrochen.",
+  "VM creation completed": "VM-Erstellung abgeschlossen",
+  "VM creation completed with GPU passthrough configured.": "VM-Erstellung mit konfiguriertem GPU-Passthrough abgeschlossen.",
+  "VM creation completed. GPU passthrough was not applied.": "VM-Erstellung abgeschlossen. GPU-Passthrough wurde nicht angewendet.",
+  "VM creation completed. GPU passthrough was skipped (no compatible GPU detected).": "VM-Erstellung abgeschlossen. GPU-Passthrough wurde übersprungen (keine kompatible GPU erkannt).",
+  "VM creation failed or was cancelled during storage setup.": "Die VM-Erstellung ist während der Speichereinrichtung fehlgeschlagen oder wurde abgebrochen.",
+  "VM description configured": "VM-Beschreibung konfiguriert",
+  "VM imported successfully": "VM erfolgreich importiert",
+  "VM is running": "VM läuft",
+  "VM is still running. Export cancelled.": "VM läuft noch. Export abgebrochen.",
+  "VM passthrough configuration failed. Review the log and VM config.": "Die VM-Passthrough-Konfiguration ist fehlgeschlagen. Überprüfen Sie das Protokoll und die VM-Konfiguration.",
+  "VM passthrough requires exclusive VFIO binding of the GPU.": "VM-Passthrough erfordert eine exklusive VFIO-Bindung der GPU.",
+  "VM removed:": "VM entfernt:",
+  "VM selected:": "Ausgewählte VM:",
+  "VM shell created:": "VM-Shell erstellt:",
+  "VM started": "VM gestartet",
+  "VM stopped": "VM gestoppt",
+  "VM:": "VM:",
+  "VMID in use": "VMID im Einsatz",
+  "VMID must be a number.": "VMID muss eine Zahl sein.",
+  "VMID of the Borg server LXC on": "VMID des Borg-Servers LXC auf",
+  "VMs to destroy:": "Zu zerstörende VMs:",
+  "VMs, LXCs, network, /etc/pve, users, cron, packages, drivers, ProxMenux state, etc.": "VMs, LXCs, Netzwerk, /etc/pve, Benutzer, Cron, Pakete, Treiber, ProxMenux-Status usw.",
+  "Valid backups for all VMs/CTs": "Gültige Backups für alle VMs/CTs",
+  "Validating Proxmox 9 repositories (checking 'proxmox-ve' candidate)...": "Validierung von Proxmox 9-Repositories (Prüfung des Kandidaten „proxmox-ve“) ...",
+  "Validating credentials with server": "Anmeldeinformationen werden mit dem Server validiert",
+  "Validating disk safety...": "Festplattensicherheit wird überprüft...",
+  "Verbose pool status": "Ausführlicher Poolstatus",
+  "Verification": "Überprüfung",
+  "Verify IOMMU group for PCI device": "Überprüfen Sie die IOMMU-Gruppe für das PCI-Gerät",
+  "Verify Options > OS Type — currently set to:": "Optionen überprüfen > Betriebssystemtyp – derzeit eingestellt auf:",
+  "Verify PVE version (must be 8.4.1 or newer):": "Überprüfen Sie die PVE-Version (muss 8.4.1 oder neuer sein):",
+  "Verify active exports:": "Aktive Exporte überprüfen:",
+  "Verify bridge assignment and NIC model — change to VirtIO if guest drivers are available": "Überprüfen Sie die Bridge-Zuweisung und das NIC-Modell – wechseln Sie zu VirtIO, wenn Gasttreiber verfügbar sind",
+  "Verify iSCSI sessions and storage status:": "Überprüfen Sie iSCSI-Sitzungen und Speicherstatus:",
+  "Verify inside container:": "Überprüfen Sie den Inhalt des Behälters:",
+  "Verify installations": "Überprüfen Sie die Installationen",
+  "Verify mount:": "Mount überprüfen:",
+  "Verify the conversion:": "Überprüfen Sie die Konvertierung:",
+  "Verify the credentials. Switching to manual paste mode so you can finish the setup without re-typing the password.": "Überprüfen Sie die Anmeldeinformationen.Wechseln Sie in den manuellen Einfügemodus, damit Sie die Einrichtung abschließen können, ohne das Passwort erneut eingeben zu müssen.",
+  "Verifying Ceph installation...": "Ceph-Installation wird überprüft...",
+  "Verifying Ceph packages availability...": "Verfügbarkeit von Ceph-Paketen überprüfen...",
+  "Verifying all utilities status": "Überprüfen des Status aller Dienstprogramme",
+  "Verifying disk accessibility in CT": "Überprüfung der Festplattenzugänglichkeit im CT",
+  "Version": "Version",
+  "Version Change Detected": "Versionsänderung erkannt",
+  "Version info not available": "Versionsinformationen nicht verfügbar",
+  "Version:": "Version:",
+  "Version: Auto-negotiation (NFSv3/NFSv4)": "Version: Auto-Negotiation (NFSv3/NFSv4)",
+  "Versions shown are compatible with your kernel. Latest available is recommended in most cases.": "Die angezeigten Versionen sind mit Ihrem Kernel kompatibel. In den meisten Fällen wird die neueste verfügbare Version empfohlen.",
+  "View CIFS Mounts (pvesm + fstab)": "CIFS-Mounts anzeigen (pvesm + fstab)",
+  "View Current Exports": "Aktuelle Exporte anzeigen",
+  "View Current Mounts": "Aktuelle Reittiere anzeigen",
+  "View Current Shares": "Aktuelle Freigaben anzeigen",
+  "View Disk Storages": "Festplattenspeicher anzeigen",
+  "View Mount Points": "Mount-Punkte anzeigen",
+  "View NFS Mounts (pvesm + fstab)": "NFS-Mounts anzeigen (pvesm + fstab)",
+  "View backup metadata": "Sicherungsmetadaten anzeigen",
+  "View current paths": "Aktuelle Pfade anzeigen",
+  "View existing folders in /mnt": "Vorhandene Ordner in /mnt anzeigen",
+  "View iSCSI Storages": "iSCSI-Speicher anzeigen",
+  "View raw CT configuration file": "Rohe CT-Konfigurationsdatei anzeigen",
+  "View raw VM configuration file": "Rohe VM-Konfigurationsdatei anzeigen",
+  "View restore plan": "Wiederherstellungsplan anzeigen",
+  "View self-test log": "Selbsttestprotokoll anzeigen",
+  "VirtIO (advanced - high performance)": "VirtIO (fortgeschritten – hohe Leistung)",
+  "VirtIO ISO not found after selection.": "VirtIO ISO wurde nach der Auswahl nicht gefunden.",
+  "VirtIO ISO selection cancelled.": "VirtIO-ISO-Auswahl abgebrochen.",
+  "VirtIO driver ISO downloaded successfully.": "VirtIO-Treiber-ISO erfolgreich heruntergeladen.",
+  "Virtual Disks Created:": "Erstellte virtuelle Festplatten:",
+  "Virtual Function": "Virtuelle Funktion",
+  "Virtual Function (parent PF:": "Virtuelle Funktion (übergeordnetes PF:",
+  "Virtual Machine ID": "ID der virtuellen Maschine",
+  "Virtual disk": "Virtuelle Festplatte",
+  "Virtual disks": "Virtuelle Festplatten",
+  "Virtual display already set to": "Virtuelle Anzeige bereits eingestellt",
+  "Virtual display changed from": "Virtuelle Anzeige geändert von",
+  "Virtual display normalized to vga: std (compatibility)": "Virtuelle Anzeige normalisiert auf VGA: std (Kompatibilität)",
+  "Virtual display set to": "Virtuelle Anzeige eingestellt auf",
+  "Virtual interface (normal)": "Virtuelle Schnittstelle (normal)",
+  "Virtualization": "Virtualisierung",
+  "Visit https://osx-proxmox.com for more information.": "Weitere Informationen finden Sie unter https://osx-proxmox.com.",
+  "Visit the website to discover more scripts, stay updated with the latest updates, and support the project:": "Besuchen Sie die Website, um weitere Skripte zu entdecken, über die neuesten Updates auf dem Laufenden zu bleiben und das Projekt zu unterstützen:",
+  "Visit the website to discover more scripts, stay updated with the latest updates, and support the project:\n\nhttps://community-scripts.github.io/ProxmoxVE": "Besuchen Sie die Website, um weitere Skripte zu entdecken, über die neuesten Updates auf dem Laufenden zu bleiben und das Projekt zu unterstützen:\n\nhttps://community-scripts.github.io/ProxmoxVE",
+  "Vulnerability detection": "Erkennung von Schwachstellen",
+  "WARNING": "WARNUNG",
+  "WARNING — This backup contains paths that are risky to restore on a running system:": "WARNUNG – Dieses Backup enthält Pfade, deren Wiederherstellung auf einem laufenden System riskant ist:",
+  "WARNING — You selected risky paths for live restore:": "WARNUNG – Sie haben riskante Pfade für die Live-Wiederherstellung ausgewählt:",
+  "WARNING: All data on selected disk will be ERASED if formatted.": "ACHTUNG: Alle Daten auf der ausgewählten Festplatte werden bei der Formatierung GELÖSCHT.",
+  "WARNING: The NFS server is not affected. The mount directory contents are NOT deleted (data stays on the server).": "WARNUNG: Der NFS-Server ist nicht betroffen. Der Inhalt des Mount-Verzeichnisses wird NICHT gelöscht (die Daten bleiben auf dem Server).",
+  "WARNING: The Samba server is not affected. The mount directory contents are NOT deleted.": "ACHTUNG: Der Samba-Server ist nicht betroffen. Der Inhalt des Mount-Verzeichnisses wird NICHT gelöscht.",
+  "WARNING: The selected directory is not empty!": "ACHTUNG: Das ausgewählte Verzeichnis ist nicht leer!",
+  "WARNING: This disk has a mounted partition.": "WARNUNG: Diese Festplatte verfügt über eine gemountete Partition.",
+  "WARNING: This disk is also assigned to:": "WARNUNG: Dieser Datenträger ist auch zugewiesen:",
+  "WARNING: This disk is referenced in a stopped VM/LXC config.": "WARNUNG: Auf diesen Datenträger wird in einer gestoppten VM/LXC-Konfiguration verwiesen.",
+  "WARNING: This is a single GPU system": "WARNUNG: Dies ist ein Einzel-GPU-System",
+  "WARNING: This may cause a brief disconnection.": "WARNUNG: Dies kann zu einer kurzen Unterbrechung der Verbindung führen.",
+  "WARNING: This removes the storage from Proxmox. The NFS server is not affected.": "ACHTUNG: Dadurch wird der Speicher von Proxmox entfernt. Der NFS-Server ist nicht betroffen.",
+  "WARNING: This removes the storage from Proxmox. The Samba server is not affected.": "ACHTUNG: Dadurch wird der Speicher von Proxmox entfernt. Der Samba-Server ist nicht betroffen.",
+  "WARNING: This will ERASE all data on this disk.": "ACHTUNG: Dadurch werden alle Daten auf dieser Festplatte gelöscht.",
+  "WARNING: This will FORMAT the disk": "ACHTUNG: Dadurch wird die Festplatte FORMATIERT",
+  "WARNING: This will completely remove NFS server from the CT.": "WARNUNG: Dadurch wird der NFS-Server vollständig vom CT entfernt.",
+  "WARNING: This will completely remove Samba server from the CT.": "WARNUNG: Dadurch wird der Samba-Server vollständig vom CT entfernt.",
+  "WARNING: You are about to remove this Proxmox storage:": "ACHTUNG: Sie sind dabei, diesen Proxmox-Speicher zu entfernen:",
+  "WARNING: You are about to remove this disk mount:": "WARNUNG: Sie sind dabei, diese Festplattenhalterung zu entfernen:",
+  "WARNING: this will ERASE EVERYTHING on the disk.": "ACHTUNG: Dadurch wird ALLES auf der Festplatte GELÖSCHT.",
+  "WILL BE PERMANENTLY ERASED.": "WIRD DAUERHAFT GELÖSCHT.",
+  "Wait for each node to complete before starting next": "Warten Sie, bis jeder Knoten abgeschlossen ist, bevor Sie mit dem nächsten beginnen",
+  "Warning": "Warnung",
+  "Warning: Auth key should start with 'tskey-'": "Warnung: Der Authentifizierungsschlüssel sollte mit „tskey-“ beginnen.",
+  "Warning: Disk Images on CIFS": "Warnung: Disk-Images auf CIFS",
+  "Warning: Limited PCI Reset Support": "Warnung: Eingeschränkte PCI-Reset-Unterstützung",
+  "Warning: both VMs have autostart enabled (onboot=1).": "Warnung: Auf beiden VMs ist der Autostart aktiviert (onboot=1).",
+  "Warnings": "Warnungen",
+  "Website": "Webseite",
+  "What do you want to do?": "Was möchten Sie tun?",
+  "What would you like to do?": "Was möchten Sie tun?",
+  "When asked to select a disk, click Load Driver and load the VirtIO drivers.": "Wenn Sie aufgefordert werden, einen Datenträger auszuwählen, klicken Sie auf „Treiber laden“ und laden Sie die VirtIO-Treiber.",
+  "When this GPU is passed through to a VM, the Proxmox host will lose all video output on the physical monitor.": "Wenn diese GPU an eine VM weitergeleitet wird, verliert der Proxmox-Host die gesamte Videoausgabe auf dem physischen Monitor.",
+  "Where are the backup archives stored?": "Wo werden die Backup-Archive gespeichert?",
+  "Where do you want the host folder?": "Wo möchten Sie den Host-Ordner haben?",
+  "Where do you want to mount inside container?": "Wo möchten Sie im Container montieren?",
+  "Where do you want to mount the NFS export?": "Wo möchten Sie den NFS-Export bereitstellen?",
+  "Where do you want to mount the Samba share?": "Wo möchten Sie die Samba-Freigabe mounten?",
+  "Where is the OVA/OVF file located?": "Wo befindet sich die OVA/OVF-Datei?",
+  "Where to mount inside container?": "Wo im Container montieren?",
+  "While the server allows guest listing, no shares are actually accessible without authentication.": "Während der Server die Auflistung von Gästen zulässt, sind ohne Authentifizierung tatsächlich keine Freigaben zugänglich.",
+  "Will be configured now": "Wird jetzt konfiguriert",
+  "Windows Installation Options": "Windows-Installationsoptionen",
+  "Windows path:": "Windows-Pfad:",
+  "Wipe all          — erase partitions + metadata": "Alles löschen – Partitionen und Metadaten löschen",
+  "Wipe all — remove partitions + metadata": "Alles löschen – Partitionen und Metadaten entfernen",
+  "Wipe old signatures and partition table (DESTRUCTIVE):": "Alte Signaturen und Partitionstabelle löschen (DESTRUKTIV):",
+  "Wiping existing partition table...": "Vorhandene Partitionstabelle wird gelöscht...",
+  "Wiping partitions and metadata...": "Partitionen und Metadaten löschen...",
+  "Wired NICs in backup missing on target:": "Kabelgebundene Netzwerkkarten im Backup fehlen auf dem Ziel:",
+  "With warnings": "Mit Warnungen",
+  "Without Function Level Reset (FLR), passthrough is not considered reliable": "Ohne Function Level Reset (FLR) gilt Passthrough nicht als zuverlässig",
+  "Without a usable reset path, passthrough reliability is poor and VM": "Ohne einen nutzbaren Reset-Pfad ist die Passthrough-Zuverlässigkeit schlecht und VM",
+  "Working directory:": "Arbeitsverzeichnis:",
+  "Works with LVM, ZFS, and BTRFS storage types": "Funktioniert mit LVM-, ZFS- und BTRFS-Speichertypen",
+  "Would you like to continue in passthrough-only mode? The libedgetpu APT install will be skipped, the Coral device will still be visible inside the container (e.g. /dev/apex_0), and you can install the runtime yourself or use an app container that bundles it (e.g. the Frigate Docker image).": "Möchten Sie im Nur-Passthrough-Modus fortfahren? Die Installation von libedgetpu APT wird übersprungen, das Coral-Gerät ist weiterhin im Container sichtbar (z. B. /dev/apex_0) und Sie können die Laufzeit selbst installieren oder einen App-Container verwenden, der sie bündelt (z. B. das Frigate Docker-Image).",
+  "Would you like to see the current": "Möchten Sie den aktuellen Stand sehen?",
+  "Write access confirmed for user:": "Schreibzugriff für Benutzer bestätigt:",
+  "Write access confirmed.": "Schreibzugriff bestätigt.",
+  "Write access test FAILED for user:": "Schreibzugriffstest für Benutzer fehlgeschlagen:",
+  "Write access verified for user:": "Schreibzugriff für Benutzer bestätigt:",
+  "Wrong passphrase": "Falsche Passphrase",
+  "Yes": "Ja",
+  "Yes, upload": "Ja, hochladen",
+  "Yes: set a recovery passphrase now; the encrypted key envelope is uploaded with every backup.": "Ja: Legen Sie jetzt eine Wiederherstellungspassphrase fest.Der verschlüsselte Schlüsselumschlag wird bei jedem Backup hochgeladen.",
+  "You are connected via SSH and selected network-related restore paths.": "Die Verbindung erfolgt über SSH und ausgewählte netzwerkbezogene Wiederherstellungspfade.",
+  "You can add it manually through:": "Sie können es manuell hinzufügen über:",
+  "You can add servers manually.": "Sie können Server manuell hinzufügen.",
+  "You can enter the export path manually.": "Sie können den Exportpfad manuell eingeben.",
+  "You can enter the share name manually.": "Sie können den Freigabenamen manuell eingeben.",
+  "You can now monitor your AMD GPU using:": "Sie können Ihre AMD-GPU jetzt überwachen mit:",
+  "You can now monitor your Intel GPU using:": "Sie können Ihre Intel-GPU jetzt überwachen mit:",
+  "You can now select Controller/NVMe devices in Storage Plan.": "Sie können jetzt Controller/NVMe-Geräte im Speicherplan auswählen.",
+  "You can reboot later manually with: reboot": "Sie können später manuell neu starten mit: reboot",
+  "You can reboot later manually.": "Sie können später manuell neu starten.",
+  "You can restore it anytime with": "Sie können es jederzeit mit wiederherstellen",
+  "You can restore the backup with": "Sie können das Backup mit wiederherstellen",
+  "You can run a security audit with:": "Sie können eine Sicherheitsüberprüfung durchführen mit:",
+  "You can still install amdgpu_top if needed.": "Sie können bei Bedarf weiterhin amdgpu_top installieren.",
+  "You can still install intel-gpu-tools if needed.": "Sie können bei Bedarf weiterhin Intel-GPU-Tools installieren.",
+  "You can still mount this share for READ-ONLY access.": "Sie können diese Freigabe weiterhin für den schreibgeschützten Zugriff bereitstellen.",
+  "You can use the following credentials to login to the Nextcloud vm:": "Sie können die folgenden Anmeldeinformationen verwenden, um sich bei der Nextcloud-VM anzumelden:",
+  "You haven't added any custom paths yet.": "Sie haben noch keine benutzerdefinierten Pfade hinzugefügt.",
+  "You may need to run 'pveceph install' manually": "Möglicherweise müssen Sie „pveceph install“ manuell ausführen",
+  "You must select a logo to continue.": "Sie müssen ein Logo auswählen, um fortzufahren.",
+  "You must select at least one mount method to continue.": "Sie müssen mindestens eine Mount-Methode auswählen, um fortzufahren.",
+  "You need to use username and password authentication.": "Sie müssen die Authentifizierung mit Benutzername und Passwort verwenden.",
+  "You selected 'Disk image' content on a CIFS/SMB storage.": "Sie haben „Disk-Image“-Inhalt auf einem CIFS/SMB-Speicher ausgewählt.",
+  "You should now be able to access the Proxmox web interface.": "Sie sollten nun auf die Proxmox-Weboberfläche zugreifen können.",
+  "You will need a Tailscale auth key from: https://login.tailscale.com/admin/settings/keys": "Sie benötigen einen Tailscale-Authentifizierungsschlüssel von: https://login.tailscale.com/admin/settings/keys",
+  "ZFS ARC config removed (kernel defaults will apply on reboot)": "ZFS ARC-Konfiguration entfernt (Kernel-Standardeinstellungen gelten beim Neustart)",
+  "ZFS ARC configuration file created/updated successfully": "ZFS ARC-Konfigurationsdatei erfolgreich erstellt/aktualisiert",
+  "ZFS ARC configuration is up to date": "Die ZFS ARC-Konfiguration ist auf dem neuesten Stand",
+  "ZFS ARC optimization completed": "ZFS ARC-Optimierung abgeschlossen",
+  "ZFS Management Commands": "ZFS-Verwaltungsbefehle",
+  "ZFS Pool Name": "ZFS-Poolname",
+  "ZFS auto-snapshot installation and configuration completed": "Die Installation und Konfiguration des automatischen ZFS-Snapshots ist abgeschlossen",
+  "ZFS autotrim already enabled for pool:": "ZFS-Autotrim ist für den Pool bereits aktiviert:",
+  "ZFS autotrim disabled for pool:": "ZFS-Autotrim für Pool deaktiviert:",
+  "ZFS autotrim enabled for pool:": "ZFS-Autotrim für Pool aktiviert:",
+  "ZFS autotrim is not supported for pool:": "ZFS-Autotrim wird für Pool nicht unterstützt:",
+  "ZFS autotrim setup completed": "ZFS-Autotrim-Setup abgeschlossen",
+  "ZFS command history": "ZFS-Befehlsverlauf",
+  "ZFS configuration": "ZFS-Konfiguration",
+  "ZFS member detected": "ZFS-Mitglied erkannt",
+  "ZFS not detected. Nothing to disable.": "ZFS nicht erkannt. Nichts zu deaktivieren.",
+  "ZFS not detected. Skipping ZFS ARC optimization.": "ZFS nicht erkannt. Überspringen der ZFS ARC-Optimierung.",
+  "ZFS not detected. Skipping ZFS autotrim.": "ZFS nicht erkannt. ZFS-Autotrim wird übersprungen.",
+  "ZFS pool": "ZFS-Pool",
+  "ZFS pool created": "ZFS-Pool erstellt",
+  "ZFS pool created and mounted at": "ZFS-Pool erstellt und gemountet unter",
+  "ZFS pool exported:": "Exportierter ZFS-Pool:",
+  "ZFS pool is not available after creation:": "Der ZFS-Pool ist nach der Erstellung nicht verfügbar:",
+  "ZFS pool not found:": "ZFS-Pool nicht gefunden:",
+  "ZFS pool:": "ZFS-Pool:",
+  "ZFS storage added successfully to Proxmox!": "ZFS-Speicher erfolgreich zu Proxmox hinzugefügt!",
+  "ZFS tools not found. Install zfsutils-linux and retry.": "ZFS-Tools nicht gefunden. Installieren Sie zfsutils-linux und versuchen Sie es erneut.",
+  "ZFS:": "ZFS:",
+  "Zero all data     — partition table preserved, data wiped": "Alle Daten auf Null setzen – Partitionstabelle bleibt erhalten, Daten werden gelöscht",
+  "Zero all data — partition table preserved": "Alle Daten auf Null setzen – Partitionstabelle bleibt erhalten",
+  "Zeroing partition": "Partition auf Null setzen",
+  "active VF(s)": "aktive VF(s)",
+  "active VFs": "aktive VFs",
+  "active Virtual Functions. Changing its driver binding would destroy every VF.": "aktive virtuelle Funktionen. Eine Änderung der Treiberbindung würde jedes VF zerstören.",
+  "after copy; source tree is incomplete.": "nach Kopie; Der Quellbaum ist unvollständig.",
+  "after update.": "nach dem Update.",
+  "all_squash,anonuid=65534,anongid=65534": "all_squash,anonuid=65534,anongid=65534",
+  "amdgpu_top installed successfully": "amdgpu_top erfolgreich installiert",
+  "amdgpu_top is already installed:": "amdgpu_top ist bereits installiert:",
+  "amdgpu_top is not installed": "amdgpu_top ist nicht installiert",
+  "amdgpu_top is up to date": "amdgpu_top ist auf dem neuesten Stand",
+  "amdgpu_top uninstalled successfully": "amdgpu_top wurde erfolgreich deinstalliert",
+  "amdgpu_top updated to": "amdgpu_top aktualisiert auf",
+  "and": "Und",
+  "and could not be unmounted — disk may be busy.": "und konnte nicht ausgehängt werden – die Festplatte ist möglicherweise ausgelastet.",
+  "and upgrade the system (disables the enterprise repo)": "und aktualisieren Sie das System (deaktiviert das Enterprise-Repository)",
+  "apex device node not found yet; a reboot may be required.": "Apex-Geräteknoten noch nicht gefunden; Möglicherweise ist ein Neustart erforderlich.",
+  "apex group and udev rules are in place.": "Apex-Gruppen- und udev-Regeln sind vorhanden.",
+  "apex group removed.": "Apex-Gruppe entfernt.",
+  "apex group still has members; left in place:": "Die Apex-Gruppe hat noch Mitglieder. an Ort und Stelle belassen:",
+  "apex kernel module not loaded on host. Run \"Install Coral on Host\" first or the container will not see /dev/apex_0.": "Das Apex-Kernelmodul ist nicht auf dem Host geladen. Führen Sie zuerst „Install Coral on Host“ aus, sonst wird der Container /dev/apex_0 nicht sehen.",
+  "appears to be part of a": "scheint Teil von a zu sein",
+  "applying minimal banner patch": "Anwenden eines minimalen Banner-Patches",
+  "apt cache refreshed.": "Apt-Cache aktualisiert.",
+  "apt-get exited": "apt-get exited",
+  "apt-get update returned warnings. Continuing anyway; check": "apt-get update hat Warnungen zurückgegeben. Trotzdem weitermachen; überprüfen",
+  "as": "als",
+  "automatically. Install it manually inside the container.": "automatisch. Installieren Sie es manuell im Container.",
+  "automatically. Reboot LXC to fully release.": "automatisch. Starten Sie LXC neu, um es vollständig freizugeben.",
+  "available for LXC bind-mounts via 'LXC Mount Manager'": "verfügbar für LXC-Bind-Mounts über „LXC Mount Manager“",
+  "available in this same GPU and TPU menu.": "verfügbar im selben GPU- und TPU-Menü.",
+  "backup at /etc/fstab.proxmenux.bak": "Backup unter /etc/fstab.proxmenux.bak",
+  "ban": "Verbot",
+  "blocking issue(s).": "Blockierungsproblem(e).",
+  "btrfs — Proxmox dir storage (snapshots, compression)": "btrfs – Proxmox-Verzeichnisspeicher (Snapshots, Komprimierung)",
+  "btrfs — snapshots and compression": "btrfs – Snapshots und Komprimierung",
+  "but it does not match the one used to create the backup. Replace it with the correct keyfile from the source host and retry.": "aber es stimmt nicht mit dem überein, das zum Erstellen der Sicherung verwendet wurde.Ersetzen Sie es durch die richtige Schlüsseldatei vom Quellhost und versuchen Sie es erneut.",
+  "bytes": "Bytes",
+  "can write to": "kann schreiben",
+  "chmod 1777 + setfacl o::rwx (applied on the NFS share from this host)": "chmod 1777 + setfacl o::rwx (auf die NFS-Freigabe von diesem Host angewendet)",
+  "chmod failed — NFS server may be restricting changes from root": "chmod fehlgeschlagen – Der NFS-Server schränkt möglicherweise Änderungen vom Root aus ein",
+  "chown/chmod failed — likely unprivileged CT against host bind mount. Falling back to ACL.": "chown/chmod fehlgeschlagen – wahrscheinlich unprivilegierter CT gegen Host-Bind-Mount. Zurückgreifen auf ACL.",
+  "content:": "Inhalt:",
+  "custom path(s) saved.": "Benutzerdefinierte(r) Pfad(e) gespeichert.",
+  "default": "Standard",
+  "delete the credentials file (if any)": "Löschen Sie die Anmeldeinformationsdatei (falls vorhanden).",
+  "delete the matching line from /etc/fstab": "Löschen Sie die entsprechende Zeile aus /etc/fstab",
+  "descriptor + VMDK files": "Deskriptor + VMDK-Dateien",
+  "device(s) added to VM": "Gerät(e) zur VM hinzugefügt",
+  "devices": "Geräte",
+  "did not become ready. Skipping.": "nicht fertig geworden. Überspringen.",
+  "disk(s) added to CT": "Festplatte(n) zu CT hinzugefügt",
+  "disk(s) added to VM": "Festplatte(n) zur VM hinzugefügt",
+  "dkms.conf generated.": "dkms.conf generiert.",
+  "does not exist on this host. Path not added.": "existiert auf diesem Host nicht. Pfad nicht hinzugefügt.",
+  "does not exist. Exiting.": "existiert nicht. Verlassen.",
+  "driver:": "Treiber:",
+  "exFAT (portable: Windows/Linux/macOS)": "exFAT (tragbar: Windows/Linux/macOS)",
+  "exFAT tools installed successfully.": "exFAT-Tools erfolgreich installiert.",
+  "ext4  — Proxmox dir storage (recommended)": "ext4 – Proxmox-Verzeichnisspeicher (empfohlen)",
+  "ext4  — recommended, most compatible": "ext4 – empfohlen, am kompatibelsten",
+  "fail2ban-client could not communicate with the server": "fail2ban-client konnte nicht mit dem Server kommunizieren",
+  "fail2ban-client successfully communicated with the server": "fail2ban-client hat erfolgreich mit dem Server kommuniziert",
+  "failed:": "fehlgeschlagen:",
+  "feranick fork unreachable. Falling back to google/gasket-driver...": "Feranick-Gabel nicht erreichbar. Zurückgreifen auf google/gasket-driver...",
+  "feranick/gasket-driver cloned (actively maintained, kernel 6.12+ ready).": "Feranick/Gasket-Treiber geklont (aktiv gewartet, Kernel 6.12+ bereit).",
+  "file?": "Datei?",
+  "files": "Dateien",
+  "files/folders": "Dateien/Ordner",
+  "filesystem. Skipping format.": "Dateisystem. Format überspringen.",
+  "filesystem...": "Dateisystem...",
+  "for better performance and stability": "für bessere Leistung und Stabilität",
+  "for next boot (needs reboot to take effect)": "für den nächsten Start (Neustart erforderlich, um wirksam zu werden)",
+  "for this policy and may fail after first use or on subsequent VM starts.": "für diese Richtlinie und kann nach der ersten Verwendung oder bei nachfolgenden VM-Starts fehlschlagen.",
+  "formatted as": "formatiert als",
+  "found": "gefunden",
+  "from Proxmox web interface (you will be asked)": "über die Proxmox-Weboberfläche (Sie werden gefragt)",
+  "from container": "aus Container",
+  "from the GPUs and Coral-TPU menu first, then run this option again.": "Wählen Sie zunächst das Menü „GPUs und Coral-TPU“ aus und führen Sie dann diese Option erneut aus.",
+  "fstab entry exists": "fstab-Eintrag vorhanden",
+  "fstab line:": "fstab-Zeile:",
+  "fstab references UUIDs/devices not present on this host:": "fstab verweist auf UUIDs/Geräte, die auf diesem Host nicht vorhanden sind:",
+  "gasket DKMS entries removed.": "Dichtung DKMS-Einträge entfernt.",
+  "gawk installed": "gawk installiert",
+  "google/gasket-driver cloned (fallback — will apply local patches).": "google/gasket-driver geklont (Fallback – wendet lokale Patches an).",
+  "gpg not found; trying apt-key fallback": "gpg nicht gefunden; Ich versuche einen Apt-Key-Fallback",
+  "gzip replaced with pigz wrapper successfully": "gzip wurde erfolgreich durch den Pigz-Wrapper ersetzt",
+  "has": "hat",
+  "has a different MAC than the backup — update any DHCP static reservation": "Hat einen anderen MAC als das Backup – aktualisieren Sie alle statischen DHCP-Reservierungen",
+  "has a new MAC": "hat einen neuen MAC",
+  "has only": "hat nur",
+  "host fstab only (not registered as Proxmox storage)": "Nur Host-fstab (nicht als Proxmox-Speicher registriert)",
+  "hostpci entries for all IOMMU group devices": "hostpci-Einträge für alle IOMMU-Gruppengeräte",
+  "hostpci entries for selected GPU functions (full IOMMU group will be enforced after reboot)": "hostpci-Einträge für ausgewählte GPU-Funktionen (die vollständige IOMMU-Gruppe wird nach dem Neustart erzwungen)",
+  "hour(s)": "Std)",
+  "iSCSI Content Type": "iSCSI-Inhaltstyp",
+  "iSCSI Daemon (iscsid): RUNNING": "iSCSI-Daemon (iscsid): LÄUFT",
+  "iSCSI Daemon (iscsid): STOPPED": "iSCSI-Daemon (iscsid): GESTOPPT",
+  "iSCSI Host Manager - Proxmox Host": "iSCSI-Host-Manager – Proxmox-Host",
+  "iSCSI Initiator: AVAILABLE": "iSCSI-Initiator: VERFÜGBAR",
+  "iSCSI Initiator: NOT INSTALLED": "iSCSI-Initiator: NICHT INSTALLIERT",
+  "iSCSI Portal": "iSCSI-Portal",
+  "iSCSI Storages in Proxmox": "iSCSI-Speicher in Proxmox",
+  "iSCSI Storages:": "iSCSI-Speicher:",
+  "iSCSI discovery failed": "Die iSCSI-Erkennung ist fehlgeschlagen",
+  "iSCSI port": "iSCSI-Port",
+  "iSCSI service is running on the target": "Der iSCSI-Dienst wird auf dem Ziel ausgeführt",
+  "iSCSI storage added successfully to Proxmox!": "iSCSI-Speicher erfolgreich zu Proxmox hinzugefügt!",
+  "iSCSI storage provides raw block devices for VM disk images.": "iSCSI-Speicher stellt Rohblockgeräte für VM-Festplatten-Images bereit.",
+  "iSCSI tools installed": "iSCSI-Tools installiert",
+  "iftop usage": "iftop-Nutzung",
+  "imported:": "importiert:",
+  "in CT": "im CT",
+  "initramfs updated": "initramfs aktualisiert",
+  "initramfs updated.": "initramfs aktualisiert.",
+  "installed but command not immediately available": "installiert, aber der Befehl ist nicht sofort verfügbar",
+  "installed correctly and available": "korrekt installiert und verfügbar",
+  "installed in CT": "im CT installiert",
+  "installed inside CT": "im CT installiert",
+  "installed successfully.": "erfolgreich installiert.",
+  "intel-gpu-tools installed successfully": "Intel-GPU-Tools erfolgreich installiert",
+  "intel-gpu-tools is already installed:": "Intel-GPU-Tools ist bereits installiert:",
+  "intel-gpu-tools is up to date": "Intel-GPU-Tools ist auf dem neuesten Stand",
+  "intel-gpu-tools uninstalled successfully": "Intel-GPU-Tools erfolgreich deinstalliert",
+  "intel-gpu-tools updated to": "Intel-GPU-Tools aktualisiert auf",
+  "intel_iommu/amd_iommu is set in cmdline but no IOMMU groups exist — IOMMU appears disabled in BIOS. Enable VT-d / AMD-Vi in firmware before continuing.": "intel_iommu/amd_iommu ist in cmdline festgelegt, aber es sind keine IOMMU-Gruppen vorhanden – IOMMU scheint im BIOS deaktiviert zu sein. Aktivieren Sie VT-d / AMD-Vi in der Firmware, bevor Sie fortfahren.",
+  "interfaces": "Schnittstellen",
+  "into an LXC.": "in einen LXC.",
+  "iperf3 - Bandwidth test": "iperf3 – Bandbreitentest",
+  "iperf3 - Bandwidth test (Client mode)": "iperf3 – Bandbreitentest (Client-Modus)",
+  "iperf3 - Bandwidth test (Server mode)": "iperf3 – Bandbreitentest (Servermodus)",
+  "iperf3 client": "iperf3-Client",
+  "iperf3 client output": "Ausgabe des iperf3-Clients",
+  "iperf3 server": "iperf3-Server",
+  "iperf3 server is running on": "Der iperf3-Server läuft",
+  "iperf3 server output": "Ausgabe des iperf3-Servers",
+  "iperf3 test failed": "Der iperf3-Test ist fehlgeschlagen",
+  "iptraf-ng usage": "iptraf-ng-Nutzung",
+  "is UNPRIVILEGED.": "ist UNprivilegiert.",
+  "is a Physical Function with": "ist eine physikalische Funktion mit",
+  "is already assigned to the following VM(s) or CT(s):": "ist bereits den folgenden VM(s) oder CT(s) zugeordnet:",
+  "is already installed. Do you want to reinstall it? This will perform a clean uninstall first.": "ist bereits installiert. Möchten Sie es neu installieren? Dadurch wird zunächst eine saubere Deinstallation durchgeführt.",
+  "is already unprivileged.": "ist bereits unprivilegiert.",
+  "is an SR-IOV Virtual Function (VF). Its parent Physical Function is": "ist eine SR-IOV Virtual Function (VF). Seine übergeordnete physikalische Funktion ist",
+  "is in use by running VM": "wird von der laufenden VM verwendet",
+  "is in use by the following running VM(s) or CT(s):": "wird von den folgenden laufenden VM(s) oder CT(s) verwendet:",
+  "is mounted at": "ist montiert bei",
+  "is not configured as machine type q35.": "ist nicht als Maschinentyp q35 konfiguriert.",
+  "is not in the patch.sh supported list. The patch may no-op or fail; review keylase/nvidia-patch README before continuing.": "ist nicht in der von patch.sh unterstützten Liste enthalten. Der Patch funktioniert möglicherweise nicht oder schlägt fehl. Lesen Sie die README-Datei zu keylase/nvidia-patch, bevor Sie fortfahren.",
+  "is not supported by the official Google libedgetpu APT repository.": "wird vom offiziellen Google libedgetpu APT-Repository nicht unterstützt.",
+  "is referenced in the following stopped VM(s)/CT(s):": "wird in den folgenden gestoppten VM(s)/CT(s) referenziert:",
+  "journald MaxLevelStore is adequate for auth logging": "„journald MaxLevelStore“ ist für die Authentifizierungsprotokollierung ausreichend",
+  "journald drop-in created: /etc/systemd/journald.conf.d/proxmenux-loglevel.conf": "Journald-Drop-In erstellt: /etc/systemd/journald.conf.d/proxmenux-loglevel.conf",
+  "journald log level restored": "Journald-Protokollebene wiederhergestellt",
+  "journald restarted - auth messages will now be stored": "Journald neu gestartet – Authentifizierungsnachrichten werden jetzt gespeichert",
+  "jq is required for this operation but is not installed.": "jq ist für diesen Vorgang erforderlich, aber nicht installiert.",
+  "jq is required to apply updates from this menu.": "jq ist erforderlich, um Updates aus diesem Menü anzuwenden.",
+  "jq not available — skipping rollback execution": "jq nicht verfügbar – Rollback-Ausführung wird übersprungen",
+  "keep-daily (0 disables)": "keep-day (0 deaktiviert)",
+  "keep-hourly (0 disables)": "Stündlich halten (0 Deaktivierungen)",
+  "keep-last (0 disables)": "keep-last (0 deaktiviert)",
+  "keep-monthly (0 disables)": "keep-monthly (0 Deaktivierungen)",
+  "keep-weekly (0 disables)": "Keep-weekly (0 Deaktivierungen)",
+  "keep-yearly (0 disables)": "keep-yearly (0 Deaktivierungen)",
+  "keeping current settings": "Beibehaltung der aktuellen Einstellungen",
+  "kexec configured successfully. Use the command: reboot-quick": "kexec erfolgreich konfiguriert. Verwenden Sie den Befehl: reboot-quick",
+  "kexec-pve service enabled": "kexec-pve-Dienst aktiviert",
+  "kexec-pve service file created": "kexec-pve-Dienstdatei erstellt",
+  "kexec-tools and related settings removed": "kexec-tools und zugehörige Einstellungen entfernt",
+  "kexec-tools installed successfully": "kexec-tools erfolgreich installiert",
+  "kexec-tools is not installed or already removed.": "kexec-tools ist nicht installiert oder bereits entfernt.",
+  "log2ram completely removed from system": "log2ram vollständig aus dem System entfernt",
+  "manually inside the container before starting it.": "manuell in den Behälter hinein, bevor Sie ihn starten.",
+  "manually inside the container.": "manuell in den Behälter einfüllen.",
+  "maximum performance": "maximale Leistung",
+  "may be closed — trying discovery anyway...": "möglicherweise geschlossen – versuchen Sie es trotzdem ...",
+  "missing": "fehlt",
+  "mkfs.btrfs not found. Install btrfs-progs and retry.": "mkfs.btrfs nicht gefunden. Installieren Sie btrfs-progs und versuchen Sie es erneut.",
+  "more": "mehr",
+  "mount.cifs command not found after installation.": "Der Befehl mount.cifs wurde nach der Installation nicht gefunden.",
+  "mount.nfs command not found after installation.": "Der Befehl mount.nfs wurde nach der Installation nicht gefunden.",
+  "never": "nie",
+  "nftables not available - using iptables ban action": "nftables nicht verfügbar – iptables-Verbotsaktion wird verwendet",
+  "no": "nein",
+  "no (kdf=none, not needed)": "nein (kdf=none, nicht erforderlich)",
+  "no (no escrow blob — set a recovery passphrase to enable recovery)": "nein (kein Escrow-Blob – legen Sie eine Wiederherstellungspassphrase fest, um die Wiederherstellung zu aktivieren)",
+  "no passphrase": "keine Passphrase",
+  "no password": "kein Passwort",
+  "no_root_squash": "no_root_squash",
+  "non-ProxMenux .tar archive(s) in this path": "Nicht-ProxMenux-.tar-Archive in diesem Pfad",
+  "not found.": "nicht gefunden.",
+  "not installed": "nicht installiert",
+  "not reliable on this hardware due to the following limitations": "Aufgrund der folgenden Einschränkungen ist die Funktion auf dieser Hardware nicht zuverlässig",
+  "nouveau driver has been blacklisted.": "Nouveau-Fahrer wurde auf die schwarze Liste gesetzt.",
+  "nouveau module unloaded after initramfs rebuild.": "Das Nouveau-Modul wurde nach der Neuerstellung von initramfs entladen.",
+  "nouveau module unloaded successfully.": "Das Nouveau-Modul wurde erfolgreich entladen.",
+  "nouveau still active. Proceeding with installation. A reboot will be required for the driver to work.": "Jugendstil immer noch aktiv. Fortsetzung der Installation. Damit der Treiber funktioniert, ist ein Neustart erforderlich.",
+  "now": "jetzt",
+  "now?": "Jetzt?",
+  "nvidia-smi not found after install. Check log:": "nvidia-smi wurde nach der Installation nicht gefunden. Protokoll prüfen:",
+  "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi nicht im PATH gefunden. Bitte überprüfen Sie die Treiberinstallation.",
+  "nvidia-smi not found in container": "nvidia-smi nicht im Container gefunden",
+  "of": "von",
+  "of free disk space.": "freien Speicherplatz.",
+  "older firmware may increase passthrough instability": "Ältere Firmware kann die Passthrough-Instabilität erhöhen",
+  "on SSD/NVMe pools that support discard": "auf SSD/NVMe-Pools, die das Verwerfen unterstützen",
+  "openssl encryption failed.": "Die OpenSSL-Verschlüsselung ist fehlgeschlagen.",
+  "openssl is not installed — cannot create recovery copy. Install openssl and retry.": "OpenSSL ist nicht installiert – Wiederherstellungskopie kann nicht erstellt werden. Installieren Sie OpenSSL und versuchen Sie es erneut.",
+  "or format it manually using external tools.": "oder formatieren Sie es manuell mit externen Tools.",
+  "or use the ProxMenux LXC Mount Manager.": "oder verwenden Sie den ProxMenux LXC Mount Manager.",
+  "orphan iface lines, no impact on restore": "Verwaiste Iface-Zeilen, keine Auswirkung auf die Wiederherstellung",
+  "other .tar archive(s) — not ProxMenux host backups (e.g. PVE vzdump or unrelated tarballs).": "andere .tar-Archive – keine ProxMenux-Host-Backups (z. B. PVE vzdump oder nicht verwandte Tarballs).",
+  "packages (this may take a few minutes)...": "Pakete (dies kann einige Minuten dauern)...",
+  "packages.": "Pakete.",
+  "parent PF:": "Eltern-PF:",
+  "partition(s). Partition table preserved.": "Partition(en). Partitionstabelle bleibt erhalten.",
+  "paths for next boot (/etc/pve, guests, drivers, ...)": "Pfade für den nächsten Start (/etc/pve, Gäste, Treiber, ...)",
+  "pci_passthrough_helpers.sh missing — SR-IOV / orphan-audio guards will be skipped": "pci_passthrough_helpers.sh fehlt – SR-IOV / Orphan-Audio Guards werden übersprungen",
+  "pct exec authorization failed": "PCT-Exec-Autorisierung fehlgeschlagen",
+  "pct push failed. Check log:": "PCT-Push fehlgeschlagen. Protokoll prüfen:",
+  "pending (reboot required to enumerate full group)": "ausstehend (Neustart erforderlich, um die vollständige Gruppe aufzulisten)",
+  "pigz configuration completed": "Pigz-Konfiguration abgeschlossen",
+  "pigz enabled in vzdump configuration": "pigz in der vzdump-Konfiguration aktiviert",
+  "pigz installed successfully": "pigz erfolgreich installiert",
+  "pigz removed": "Schweinchen entfernt",
+  "pigz wrapper script created": "Pigz-Wrapper-Skript erstellt",
+  "port": "Hafen",
+  "portmapper/rpcbind has been disabled and removed": "portmapper/rpcbind wurde deaktiviert und entfernt",
+  "proxmox-backup-client reported:": "proxmox-backup-client berichtete:",
+  "proxmox-boot-tool refreshed": "proxmox-boot-tool aktualisiert",
+  "pve-enterprise.list update skipped (no change)": "pve-enterprise.list-Update übersprungen (keine Änderung)",
+  "pve-enterprise.list updated to Trixie": "pve-enterprise.list auf Trixie aktualisiert",
+  "pvecm command not found (might not be in a cluster)": "pvecm-Befehl nicht gefunden (möglicherweise nicht in einem Cluster)",
+  "pvesm command found": "pvesm-Befehl gefunden",
+  "pvesm command not found. This should not happen on Proxmox.": "pvesm-Befehl nicht gefunden. Dies sollte auf Proxmox nicht passieren.",
+  "pvesm not available.": "pvesm nicht verfügbar.",
+  "pvesm not found.": "pvesm nicht gefunden.",
+  "pvesm path failed, trying manual detection...": "pvesm-Pfad fehlgeschlagen, manuelle Erkennung versucht ...",
+  "pvesm status failed": "pvesm-Status fehlgeschlagen",
+  "raw USB disk — no filesystem (will be FORMATTED)": "Raw-USB-Festplatte – kein Dateisystem (wird FORMATTIERT)",
+  "reboot-quick alias added": "reboot-quick-Alias ​​hinzugefügt",
+  "recommended": "empfohlen",
+  "remapped users": "Benutzer neu zugeordnet",
+  "remove the (now-empty) directory if possible": "Entfernen Sie nach Möglichkeit das (jetzt leere) Verzeichnis",
+  "removed from Proxmox": "aus Proxmox entfernt",
+  "removed successfully from Proxmox.": "erfolgreich aus Proxmox entfernt.",
+  "requires the package": "erfordert das Paket",
+  "restarted successfully": "erfolgreich neu gestartet",
+  "restoring /etc/network would lose connectivity": "Das Wiederherstellen von /etc/network würde zum Verlust der Konnektivität führen",
+  "restoring on:": "Wiederherstellung am:",
+  "retries": "wiederholt",
+  "reverse proxy": "Reverse-Proxy",
+  "root and real users only": "Nur Root- und echte Benutzer",
+  "rpcbind service has been disabled and stopped": "Der Rpcbind-Dienst wurde deaktiviert und gestoppt",
+  "running": "läuft",
+  "safe paths now (configs, packages, /etc, /root, ...)": "Jetzt sichere Pfade (Konfigurationen, Pakete, /etc, /root, ...)",
+  "same MAC": "gleicher MAC",
+  "seconds (default)": "Sekunden (Standard)",
+  "see log:": "siehe Protokoll:",
+  "selected path(s):": "ausgewählte(r) Pfad(e):",
+  "server": "Server",
+  "server IP or hostname:": "Server-IP oder Hostname:",
+  "server?": "Server?",
+  "servers found on the network.": "im Netzwerk gefundene Server.",
+  "servers found.": "Server gefunden.",
+  "sha256sum not found. Cannot verify Borg binary.": "sha256sum nicht gefunden. Borg-Binärdatei kann nicht überprüft werden.",
+  "showmount command is not working properly.": "Der Befehl showmount funktioniert nicht ordnungsgemäß.",
+  "showmount command not found after installation.": "Der Befehl „showmount“ wurde nach der Installation nicht gefunden.",
+  "single portable archive": "einzelnes tragbares Archiv",
+  "skipped (already exist)": "übersprungen (existiert bereits)",
+  "smbclient command is not working properly.": "Der smbclient-Befehl funktioniert nicht ordnungsgemäß.",
+  "smbclient command not found after installation.": "Der Befehl smbclient wurde nach der Installation nicht gefunden.",
+  "sources.list update skipped (no change)": "Aktualisierung der Quellenliste übersprungen (keine Änderung)",
+  "sources.list updated to Trixie": "Quellen.Liste auf Trixie aktualisiert",
+  "ssh-keygen failed. Cannot create a new SSH key.": "ssh-keygen ist fehlgeschlagen. Es kann kein neuer SSH-Schlüssel erstellt werden.",
+  "standard performance": "Standardleistung",
+  "start/restart failures and reset instability.": "Start-/Neustartfehler und Reset-Instabilität.",
+  "started successfully.": "erfolgreich gestartet.",
+  "started.": "begonnen.",
+  "startup/restart errors are likely.": "Start-/Neustartfehler sind wahrscheinlich.",
+  "stop source VM first": "Stoppen Sie zuerst die Quell-VM",
+  "stopped": "gestoppt",
+  "storage yet.": "Speicher noch.",
+  "storage(s) from backup exist on target": "Speicher aus der Sicherung sind auf dem Ziel vorhanden",
+  "storage.": "Lagerung.",
+  "successfully formatted with": "erfolgreich formatiert mit",
+  "suggested:": "empfohlen:",
+  "switch_gpu_mode.sh was not found.": "switch_gpu_mode.sh wurde nicht gefunden.",
+  "sysfs ROM dump failed — trying ACPI VFCT table...": "sysfs-ROM-Dump fehlgeschlagen – Versuch der ACPI-VFCT-Tabelle ...",
+  "systemctl restart networking failed:": "systemctl-Neustart des Netzwerks fehlgeschlagen:",
+  "systemd OnCalendar expression": "systemd OnCalendar-Ausdruck",
+  "this distribution": "diese Verteilung",
+  "to": "Zu",
+  "to CT": "zu CT",
+  "to VM": "zu VM",
+  "to move the GPU safely.": "um die GPU sicher zu bewegen.",
+  "to run without being killed by the OOM killer.": "zu rennen, ohne vom OOM-Killer getötet zu werden.",
+  "to sharedfiles group": "zur Sharedfiles-Gruppe",
+  "total": "gesamt",
+  "umount the path if currently mounted": "umount den Pfad, falls aktuell gemountet",
+  "updating NVIDIA userspace libs": "Aktualisieren der NVIDIA-Userspace-Bibliotheken",
+  "user packages missing — will be installed automatically:": "Benutzerpakete fehlen – werden automatisch installiert:",
+  "users": "Benutzer",
+  "users (for unprivileged compatibility)": "Benutzer (für unprivilegierte Kompatibilität)",
+  "using": "verwenden",
+  "using direct path (not guaranteed to survive reboots).": "Verwenden des direkten Pfads (keine Garantie, dass Neustarts überlebt werden).",
+  "vCPUs:": "vCPUs:",
+  "vfio-pci IDs configured": "vfio-pci-IDs konfiguriert",
+  "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "vfio-pci-IDs in /etc/modprobe.d/vfio.conf",
+  "vzdump backup speed optimization completed": "vzdump-Backup-Geschwindigkeitsoptimierung abgeschlossen",
+  "was": "war",
+  "wipefs failed on": "Wipefs sind fehlgeschlagen",
+  "with": "mit",
+  "with the password you provided.": "mit dem von Ihnen angegebenen Passwort.",
+  "xfs   — Proxmox dir storage (large files and VMs)": "xfs – Proxmox-Verzeichnisspeicher (große Dateien und VMs)",
+  "xfs   — better for large files": "xfs – besser für große Dateien",
+  "years old": "Jahre alt",
+  "yes": "ja",
+  "yes (scrypt-unlock passphrase stored)": "Ja (Verschlüsselungs-Entsperr-Passphrase gespeichert)",
+  "yes (survives reboot)": "ja (überlebt Neustart)",
+  "yes (via PBS escrow + recovery passphrase)": "Ja (über PBS-Treuhandkonto + Wiederherstellungspassphrase)",
+  "zeroed.": "auf Null gesetzt.",
+  "zfs   — Proxmox ZFS pool storage": "zfs – Proxmox ZFS-Poolspeicher",
+  "zfs-auto-snapshot installed successfully": "zfs-auto-snapshot erfolgreich installiert",
+  "zfs-auto-snapshot is already installed": "zfs-auto-snapshot ist bereits installiert",
+  "zfs-auto-snapshot removed (existing snapshots preserved on the pool)": "zfs-auto-snapshot entfernt (vorhandene Snapshots bleiben im Pool erhalten)",
+  "zpool command not found. Install zfsutils-linux and retry.": "zpool-Befehl nicht gefunden. Installieren Sie zfsutils-linux und versuchen Sie es erneut.",
+  "zpool not found. Install zfsutils-linux and retry.": "zpool nicht gefunden. Installieren Sie zfsutils-linux und versuchen Sie es erneut.",
+  "— Full/Custom restore will skip kernel-tied paths": "– Bei der vollständigen/benutzerdefinierten Wiederherstellung werden an den Kernel gebundene Pfade übersprungen",
+  "— disk may be busy. Skipping fstab removal.": "— Die Festplatte ist möglicherweise ausgelastet. Überspringen der fstab-Entfernung.",
+  "— restore proceeds as same-version (verified safe)": "– Die Wiederherstellung erfolgt wie bei derselben Version (als sicher verifiziert)",
+  "— safe restore mode will skip boot/kernel/apt config": "– Der sichere Wiederherstellungsmodus überspringt die Boot-/Kernel-/APT-Konfiguration",
+  "— that part works on any distro and is harmless.": "– Dieser Teil funktioniert in jeder Distribution und ist harmlos.",
+  "• Both: mounts twice (pvesm + an independent fstab entry)": "• Beide: Mountet zweimal (pvesm + ein unabhängiger fstab-Eintrag)",
+  "• Both: registers as Proxmox storage AND keeps the mount available for LXC bind-mounts": "• Beides: Registriert sich als Proxmox-Speicher UND hält den Mount für LXC-Bind-Mounts verfügbar",
+  "• Both: two independent CIFS mounts (one for Proxmox UI, one for LXC bind-mounts with open perms)": "• Beide: zwei unabhängige CIFS-Mounts (einer für die Proxmox-Benutzeroberfläche, einer für LXC-Bind-Mounts mit offenen Perms)",
+  "• Clean up remapped users": "• Bereinigen Sie neu zugeordnete Benutzer",
+  "• Host fstab: mounted at a path you choose, NOT visible as Proxmox storage": "• Host-fstab: unter einem von Ihnen gewählten Pfad gemountet, NICHT sichtbar als Proxmox-Speicher",
+  "• Host fstab: mounted at host path only, for LXC bind-mounts (NOT visible as Proxmox storage)": "• Host-fstab: nur im Host-Pfad gemountet, für LXC-Bind-Mounts (NICHT als Proxmox-Speicher sichtbar)",
+  "• Host fstab: mounted with open uid/gid/file_mode at a path you choose, ideal for LXC bind-mounts": "• Host-fstab: gemountet mit open uid/gid/file_mode in einem von Ihnen gewählten Pfad, ideal für LXC-Bind-Mounts",
+  "• Proxmox storage (pvesm): visible in Datacenter > Storage, mount at /mnt/pve/<id>": "• Proxmox-Speicher (pvesm): sichtbar in Datacenter > Speicher, mounten unter /mnt/pve/<id>",
+  "• Proxmox storage (pvesm): visible in Datacenter > Storage, usable for VMs/backups/ISOs": "• Proxmox-Speicher (pvesm): sichtbar in Datacenter > Speicher, verwendbar für VMs/Backups/ISOs",
+  "• Remove Samba groups": "• Samba-Gruppen entfernen",
+  "• Remove all Samba users": "• Entfernen Sie alle Samba-Benutzer",
+  "• Remove all exports": "• Entfernen Sie alle Exporte",
+  "• Remove all shares": "• Entfernen Sie alle Freigaben",
+  "• Remove universal sharedfiles group": "• Entfernen Sie die universelle Sharedfiles-Gruppe",
+  "• Stop all NFS services": "• Stoppen Sie alle NFS-Dienste",
+  "• Stop all Samba services": "• Stoppen Sie alle Samba-Dienste",
+  "• Uninstall NFS packages": "• Deinstallieren Sie NFS-Pakete",
+  "• Uninstall Samba packages": "• Samba-Pakete deinstallieren",
+  "← Return": "← Zurück",
+  "− Remove a path": "− Einen Pfad entfernen",
+  "──── [ Finish and continue ] ────": "──── [ Fertig stellen und fortfahren ] ────",
+  "─────── Custom profile (choose paths manually) ───────": "─────── Benutzerdefiniertes Profil (Pfade manuell auswählen) ───────",
+  "────────────────── Default profile ───────────────────": "────────────────── Standardprofil───────────────────",
+  "⚠ Disk data will NOT be erased.": "⚠ Festplattendaten werden NICHT gelöscht.",
+  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ Die Festplatte wird ausgehängt und aus /etc/fstab entfernt.",
+  "⚠ The /etc/fstab entry will be removed.": "⚠ Der /etc/fstab-Eintrag wird entfernt.",
+  "⚠ The disk will be unmounted.": "⚠ Die Festplatte wird ausgehängt."
+}
diff --git a/lang/en.lang b/lang/en.lang
deleted file mode 100644
index e4c938a3..00000000
--- a/lang/en.lang
+++ /dev/null
@@ -1,113 +0,0 @@
-# General system messages
-MAIN_MENU_TITLE="ProxMenux - Main Menu"
-CONFIG_TITLE="ProxMenux - Configuration"
-SELECT_OPTION="Select an option:"
-LANG_OPTION="Change language"
-UNINSTALL_OPTION="Uninstall ProxMenu"
-EXIT_MENU="Exit"
-EXIT_MESSAGE="Exiting menu. Goodbye!"
-
-# Main menu options
-OPTION_1="Configure iGPU + TPU"
-OPTION_2="Repair network"
-OPTION_3="Settings"
-
-# Version messages
-VERSION_OPTION="Show version information"
-VERSION_TITLE="Version Information"
-VERSION_INFO="Current version: %s\n\nFor more information, visit:\nhttps://github.com/MacRimi/ProxMenux"
-
-# Update messages
-UPDATE_CHECKING="Checking for updates..."
-UPDATE_ERROR_REMOTE="Error checking remote version."
-UPDATE_NEW_AVAILABLE="New version available: %s (current: %s)"
-UPDATE_TITLE="Update available"
-UPDATE_PROMPT="Do you want to update to the latest version %s?"
-UPDATE_POSTPONED="Update postponed."
-UPDATE_CURRENT="The menu is already up to date (%s)."
-UPDATE_PROCESS="Updating to version %s..."
-UPDATE_COMPLETE="Update completed to version %s."
-UPDATE_ERROR_DOWNLOAD="Error downloading the update."
-
-# Uninstall messages
-UNINSTALL_TITLE="Uninstall ProxMenu"
-UNINSTALL_CONFIRM="Are you sure you want to uninstall ProxMenu?"
-UNINSTALL_COMPLETE="ProxMenu has been uninstalled successfully."
-UNINSTALL_PROCESS="Uninstalling ProxMenu..."
-
-# Script messages
-SCRIPT_RUNNING="Running igpu_tpu.sh script..."
-SCRIPT_SUCCESS="Script executed successfully."
-SCRIPT_ERROR="Error executing the script."
-
-# Language messages
-LANG_SELECT="Select Language"
-LANG_PROMPT="Choose your language:"
-LANG_ERROR="No language selected. Exiting..."
-LANG_SUCCESS="Selected language:"
-LANG_LOADED="Language loaded:"
-LANG_DOWNLOAD="Downloading language file..."
-LANG_DOWNLOAD_ERROR="Error downloading language file. Check your internet connection."
-LANG_EXISTS="Language file exists locally."
-
-# Dependency messages
-DEPS_INSTALLING="Installing necessary dependencies..."
-DEPS_SUCCESS="Dependencies installed."
-DEPS_ERROR="Error installing dependencies. Please install whiptail manually."
-
-# Bilingual messages (first run)
-INITIAL_LANG_SELECT="Select Language / Seleccionar Idioma"
-INITIAL_LANG_PROMPT="Choose your language / Elige tu idioma:"
-INITIAL_LANG_ERROR="No language selected. Exiting... / No se seleccionó ningún idioma. Saliendo..."
-
-# --- Messages for the network repair script (repair_network.sh) ---
-REPAIR_MENU_TITLE="Network Repair Menu"
-MENU_PROMPT="Please select an option:"
-MENU_REPAIR="Repair network"
-MENU_VERIFY="Verify network configuration"
-MENU_SHOW_IP="Show IP information"
-MENU_EXIT="Exit"
-MENU_CANCELED="Operation canceled by user."
-MENU_EXIT_MSG="Exiting network repair script. Goodbye!"
-INVALID_OPTION="Invalid option. Please try again."
-PRESS_ENTER="Press Enter to continue..."
-RESULT_TITLE="Operation Result"
-REPAIR_COMPLETED="Network repair completed."
-VERIFY_COMPLETED="Network verification completed."
-IP_INFO_COMPLETED="IP information displayed."
-NETWORK_ERROR="ERROR"
-NETWORK_SUCCESS="SUCCESS"
-NETWORK_WARNING="WARNING"
-NETWORK_PHYSICAL_INTERFACES="Detected physical interfaces"
-NETWORK_CONFIGURED_INTERFACES="Configured interfaces"
-NETWORK_CHECKING_BRIDGES="Checking bridge configuration"
-NETWORK_BRIDGE_PORT_MISSING="Bridge port non-existent or not active"
-NETWORK_BRIDGE_PORT_UPDATED="Bridge port updated"
-NETWORK_NO_PHYSICAL_INTERFACE="No suitable physical interface found"
-NETWORK_BRIDGE_PORT_OK="Bridge port correct"
-NETWORK_CLEANING_INTERFACES="Cleaning configurations of non-existent interfaces"
-NETWORK_INTERFACE_REMOVED="Interface removed"
-NETWORK_CONFIGURING_INTERFACES="Configuring interfaces"
-NETWORK_INTERFACE_ADDED="Interface added"
-NETWORK_RESTARTING="Restarting network service"
-NETWORK_RESTART_SUCCESS="Network service restarted successfully"
-NETWORK_RESTART_FAILED="Failed to restart network service"
-NETWORK_CONNECTIVITY_OK="Network connectivity OK"
-NETWORK_CONNECTIVITY_FAILED="Network connectivity failed"
-NETWORK_IP_INFO="IP Information"
-NETWORK_NO_IP="No IP"
-NETWORK_REPAIR_STARTED="Starting network repair"
-NETWORK_REPAIR_COMPLETED="Network repair completed"
-NETWORK_REPAIR_FAILED="Network repair failed"
-NETWORK_REPAIR_PROCESS_FINISHED="Network repair process finished"
-NETWORK_VERIFY_STARTED="Starting network verification"
-NETWORK_VERIFY_FINISHED="Network verification finished"
-NETWORK_REPAIR_RUNNING="Running network repair..."
-NETWORK_REPAIR_SUCCESS="Network repair executed successfully."
-NETWORK_REPAIR_ERROR="Error executing network repair."
-NETWORK_VERIFY_RUNNING="Running network verification..."
-NETWORK_VERIFY_SUCCESS="Network verification completed successfully."
-NETWORK_VERIFY_ERROR="Error executing network verification."
-NETWORK_IP_INFO_RUNNING="Obtaining IP information..."
-NETWORK_IP_INFO_SUCCESS="IP information obtained successfully."
-NETWORK_IP_INFO_ERROR="Error obtaining IP information."
diff --git a/lang/es.json b/lang/es.json
new file mode 100644
index 00000000..11baaa9a
--- /dev/null
+++ b/lang/es.json
@@ -0,0 +1,5231 @@
+{
+  "# Alternative if you prefer screen": "# Alternativa si prefieres la pantalla",
+  "# Recommended: avoids disconnection during upgrade": "# Recomendado: evita la desconexión durante la actualización",
+  "(Checked entries will be removed. Uncheck to keep in VM.)": "(Las entradas marcadas se eliminarán. Desmarque para mantener en VM).",
+  "(Import is selected by default — required for disk image imports)": "(Importar está seleccionado de forma predeterminada; es necesario para importar imágenes de disco)",
+  "(Only the host directory is modified. Nothing inside the container is changed.": "(Solo se modifica el directorio del host. No se cambia nada dentro del contenedor.",
+  "(common default on Debian/LXC: PermitRootLogin prohibit-password).": "(valor predeterminado común en Debian/LXC: contraseña prohibida PermitRootLogin).",
+  "(disabled)": "(deshabilitado)",
+  "(e.g.": "(por ej.",
+  "(for unprivileged LXCs)": "(para LXC sin privilegios)",
+  "(if only privileged LXCs need write access)": "(si solo los LXC privilegiados necesitan acceso de escritura)",
+  "(make.log not found — DKMS may have failed before invoking make)": "(make.log no encontrado; es posible que DKMS haya fallado antes de invocar make)",
+  "(need ≥ 1024MB)": "(necesita ≥ 1024 MB)",
+  "(no credentials file — guest mode)": "(sin archivo de credenciales - modo invitado)",
+  "(none)": "(ninguno)",
+  "(not mounted — will be mounted)": "(no montado - se montará)",
+  "(only on SSD/NVMe) to protect your disk": "(solo en SSD/NVMe) para proteger su disco",
+  "(parent PF:": "(padre PF:",
+  "(recommended)": "(recomendado)",
+  "(same MAC — restored config adjusted automatically)": "(misma MAC: configuración restaurada ajustada automáticamente)",
+  ")": ")",
+  "+ Add a path": "+ Agregar una ruta",
+  "+ Add new Borg target": "+ Agregar nuevo objetivo Borg",
+  "+ Add new PBS manually": "+ Agregar nuevo PBS manualmente",
+  "- Delete a saved target": "- Eliminar un objetivo guardado",
+  "/backup": "/backup",
+  "/etc/exports file does not exist.": "El archivo /etc/exports no existe.",
+  "/etc/fstab updated — permissions will persist after reboot": "/etc/fstab actualizado: los permisos persistirán después del reinicio",
+  "/etc/network controls active interfaces. Applying may immediately change or drop network connectivity, including active SSH sessions.": "/etc/network controla las interfaces activas. La solicitud puede cambiar o cancelar inmediatamente la conectividad de la red, incluidas las sesiones SSH activas.",
+  "/etc/network/interfaces uses allow-hotplug. Renaming interfaces via systemd .link can break that flow — review the file after reboot.": "/etc/network/interfaces utiliza enable-hotplug. Cambiar el nombre de las interfaces a través de systemd .link puede interrumpir ese flujo; revise el archivo después de reiniciar.",
+  "/etc/pve is managed by pmxcfs (cluster filesystem). Applying this on a running node can corrupt cluster state. Use 'Export to file' and apply it manually during a maintenance window.": "/etc/pve es administrado por pmxcfs (sistema de archivos de clúster). Aplicar esto en un nodo en ejecución puede dañar el estado del clúster. Utilice 'Exportar a archivo' y aplíquelo manualmente durante una ventana de mantenimiento.",
+  "/etc/samba/smb.conf file does not exist.": "El archivo /etc/samba/smb.conf no existe.",
+  "/var/lib/pve-cluster is live cluster data. Never restore this while the node is running. Use 'Export to file' for manual recovery only.": "/var/lib/pve-cluster son datos del clúster en vivo. Nunca restaure esto mientras el nodo esté en ejecución. Utilice 'Exportar a archivo' solo para recuperación manual.",
+  "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump (ruta de vzdump predeterminada de Proxmox)",
+  "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump (predeterminado de Proxmox)",
+  "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = bit adhesivo + rwx para todos. No se necesita un grupo compartido.",
+  "====== PVE UPDATE COMPLETED ======": "====== ACTUALIZACIÓN PVE COMPLETADA ======",
+  "A VirtIO ISO already exists. Do you want to overwrite it?": "Ya existe una ISO VirtIO. ¿Quieres sobrescribirla?",
+  "A ZFS pool with this name already exists.": "Ya existe un grupo ZFS con este nombre.",
+  "A ZFS pool with this name already exists:": "Ya existe un grupo ZFS con este nombre:",
+  "A complete restore will:": "Una restauración completa:",
+  "A host reboot is required after this change.": "Es necesario reiniciar el host después de este cambio.",
+  "A host reboot is required before starting the VM. Reboot now?": "Es necesario reiniciar el host antes de iniciar la VM. ¿Reiniciar ahora?",
+  "A job with this ID already exists.": "Ya existe un trabajo con este ID.",
+  "A keyfile is installed at:": "un archivo de claves está instalado en:",
+  "A newer version is available:": "Hay una versión más nueva disponible:",
+  "A reboot is required after installation to load the new kernel modules.": "Es necesario reiniciar después de la instalación para cargar los nuevos módulos del kernel.",
+  "A reboot is required for VFIO binding to take effect. Do you want to restart now?": "Es necesario reiniciar para que la vinculación de VFIO surta efecto. ¿Quieres reiniciar ahora?",
+  "A reboot is required to apply the new GPU mode. Do you want to restart now?": "Es necesario reiniciar para aplicar el nuevo modo GPU. ¿Quieres reiniciar ahora?",
+  "A reboot is required to finish the restore.": "es necesario reiniciar para finalizar la restauración.",
+  "A reboot will be required to complete the restore.": "será necesario reiniciar para completar la restauración.",
+  "A server reboot is recommended for all changes to take full effect.": "Se recomienda reiniciar el servidor para que todos los cambios surtan efecto.",
+  "A system reboot is recommended to ensure all changes take effect.": "Se recomienda reiniciar el sistema para garantizar que todos los cambios surtan efecto.",
+  "ACL Status:": "Estado de ACL:",
+  "ACL permissions applied for local access for user:": "Permisos ACL aplicados para el acceso local del usuario:",
+  "ADVANCED SETTINGS COMPLETE": "CONFIGURACIÓN AVANZADA COMPLETA",
+  "ALL DATA ON": "TODOS LOS DATOS SOBRE",
+  "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "¡TODOS LOS DATOS DE ESTE DISCO SE PERDERÁN PERMANENTEMENTE!",
+  "ALL Utilities": "TODOS los servicios públicos",
+  "AMD CPU detected": "CPU AMD detectada",
+  "AMD CPU fixes applied successfully": "Las correcciones de CPU AMD se aplicaron con éxito",
+  "AMD GPU Tools installation completed!": "¡Se completó la instalación de las herramientas AMD GPU!",
+  "AMD GPU passthrough configured.": "Paso a través de GPU AMD configurado.",
+  "AMD GPU(s) detected:": "GPU AMD detectadas:",
+  "AMD fixes have been successfully reverted": "Las correcciones de AMD se han revertido con éxito",
+  "AMD mesa drivers installed.": "Controladores de mesa AMD instalados.",
+  "AMD softdep configured": "AMD softdep configurado",
+  "AMD softdep configured in /etc/modprobe.d/vfio.conf": "Softdep de AMD configurado en /etc/modprobe.d/vfio.conf",
+  "ANALYSIS SUMMARY": "RESUMEN DEL ANÁLISIS",
+  "API returned an invalid timezone": "API devolvió una zona horaria no válida",
+  "API tokens (Home Assistant, scripts) will keep working.": "Los tokens API (Home Assistant, scripts) seguirán funcionando.",
+  "APT IPv4 configuration completed": "Configuración APT IPv4 completada",
+  "APT IPv4 configuration removed": "Se eliminó la configuración de APT IPv4",
+  "APT and repositories": "APT y repositorios",
+  "APT configured to skip additional languages": "APT configurado para omitir idiomas adicionales",
+  "APT configured to skip downloading additional languages": "APT configurado para omitir la descarga de idiomas adicionales",
+  "APT configured to use IPv4": "APT configurado para usar IPv4",
+  "APT index update failed after switching to no-subscription. See log:": "La actualización del índice APT falló después de cambiar a sin suscripción. Ver registro:",
+  "APT index update failed. See log:": "Error al actualizar el índice APT. Ver registro:",
+  "APT indexes updated for Trixie": "Índices APT actualizados para Trixie",
+  "APT indexes updated for Trixie (no-subscription)": "Índices APT actualizados para Trixie (sin suscripción)",
+  "APT language configuration already set": "La configuración del idioma APT ya está configurada",
+  "APT language configuration updated": "Configuración del idioma APT actualizada",
+  "APT language downloads restored": "Descargas del idioma APT restauradas",
+  "APT package lists updated": "Listas de paquetes APT actualizadas",
+  "Aborted": "Abortado",
+  "About to restore": "A punto de restaurar",
+  "Absolute directory path to use as backup target:": "Ruta absoluta del directorio para usar como destino de la copia de seguridad:",
+  "Absolute path to a file or directory you want backed up:": "ruta absoluta a un archivo o directorio del que desea realizar una copia de seguridad:",
+  "Accept routes from other nodes?": "¿Aceptar rutas de otros nodos?",
+  "Access Scope:": "Ámbito de acceso:",
+  "Access profile:": "Perfil de acceso:",
+  "Account is not locked": "La cuenta no está bloqueada",
+  "Action cancelled due to previous xshok-proxmox modifications.": "Acción cancelada debido a modificaciones anteriores de xshok-proxmox.",
+  "Action:": "Acción:",
+  "Activate Monitor": "Activar monitor",
+  "Activate ProxMenux Monitor": "Activar monitor ProxMenux",
+  "Active": "Activo",
+  "Active Connections": "Conexiones activas",
+  "Active exports:": "Exportaciones activas:",
+  "Active session:": "Sesión activa:",
+  "Add Audio Passthrough": "Agregar transferencia de audio",
+  "Add CIFS storage:": "Agregue almacenamiento CIFS:",
+  "Add Controller or NVMe (PCI passthrough)": "Agregar controlador o NVMe (paso PCI)",
+  "Add Controller or NVMe PCIe to VM": "Agregar controlador o NVMe PCIe a VM",
+  "Add Coral TPU to LXC": "Agregar Coral TPU a LXC",
+  "Add GPU to LXC": "Agregar GPU a un LXC",
+  "Add GPU to LXC   (Intel | AMD | NVIDIA)": "Agregar GPU a un LXC (Intel | AMD | NVIDIA)",
+  "Add GPU to VM    (Intel | AMD | NVIDIA)": "Agregar GPU a una VM (Intel | AMD | NVIDIA)",
+  "Add Local Disk   as Proxmox Storage": "Agregar disco local                 como almacenamiento",
+  "Add Local Disk (Proxmox storage + host mount)": "Agregar disco local (almacenamiento Proxmox + montaje de host)",
+  "Add Local Disk as Host Mount (for LXC bind-mounts)": "Agregar disco local como montaje de host (para montajes vinculados LXC)",
+  "Add Local Disk as Proxmox Storage": "Agregar disco local como almacenamiento",
+  "Add NFS Share as Proxmox Storage": "Agregue NFS Share como almacenamiento",
+  "Add NFS share    as Proxmox Storage": "Agregar un recurso compartido NFS   como almacenamiento",
+  "Add NFS storage:": "Agregar almacenamiento NFS:",
+  "Add PBS": "Agregar PBS",
+  "Add Samba Share as Proxmox Storage": "Agregar Samba Share como almacenamiento",
+  "Add Samba share  as Proxmox Storage": "Agregue el recurso compartido Samba como almacenamiento",
+  "Add as IDE": "Agregar como IDE",
+  "Add as SATA": "Agregar como SATA",
+  "Add as SCSI": "Agregar como SCSI",
+  "Add as VirtIO": "Agregar como VirtIO",
+  "Add as disk (standard)": "Agregar como disco (estándar)",
+  "Add bind mount to container:": "Agregue montaje de enlace al contenedor:",
+  "Add color prompts and useful aliases to the terminal environment": "Agregue indicaciones de color y alias útiles al entorno del terminal",
+  "Add custom path": "agregar ruta personalizada",
+  "Add disk to LXC container": "Agregar disco al contenedor LXC",
+  "Add explicit privileged flag (optional but recommended):": "Agregue una bandera privilegiada explícita (opcional pero recomendada):",
+  "Add export rule:": "Agregar regla de exportación:",
+  "Add iSCSI Target as Proxmox Storage": "Agregar un destino iSCSI            como almacenamiento",
+  "Add iSCSI storage in Proxmox Storage": "Agregar almacenamiento iSCSI en Proxmox Storage",
+  "Add iSCSI storage in Proxmox:": "Agregar almacenamiento iSCSI en Proxmox:",
+  "Add import disk": "Agregar disco de importación",
+  "Add latest Ceph support": "Añadir soporte para la última versión de Ceph",
+  "Add new PVE 9 enterprise repository (deb822 format) (Only if using enterprise):": "Agregue un nuevo repositorio empresarial PVE 9 (formato deb822) (solo si usa Enterprise):",
+  "Add physical disk to VM via": "Agregue el disco físico a la VM mediante",
+  "Add share block in /etc/samba/smb.conf:": "Agregue el bloque para compartir en /etc/samba/smb.conf:",
+  "Add unprivileged flag to container configuration:": "Agregue una bandera sin privilegios a la configuración del contenedor:",
+  "Add virtual disk": "Agregar disco virtual",
+  "Add: Mount Host Directory into LXC": "Agregar: montar el directorio de host en LXC",
+  "Added to /etc/fstab": "Agregado a /etc/fstab",
+  "Added to /etc/fstab for permanent mounting.": "Agregado a /etc/fstab para montaje permanente.",
+  "Added to /etc/fstab using UUID": "Agregado a /etc/fstab usando UUID",
+  "Added to /etc/fstab using device path": "Agregado a /etc/fstab usando la ruta del dispositivo",
+  "Added to /etc/fstab.": "Agregado a /etc/fstab.",
+  "Added user": "Usuario agregado",
+  "Adding": "Añadiendo",
+  "Adding CIFS storage to Proxmox...": "Agregando almacenamiento CIFS a Proxmox...",
+  "Adding QEMU Guest Agent support...": "Agregando soporte para el agente invitado QEMU...",
+  "Adding disk using the generated command to the selected VM": "Agregar disco usando el comando generado a la VM seleccionada",
+  "Adding existing users to sharedfiles group...": "Agregando usuarios existentes al grupo de archivos compartidos...",
+  "Adding iSCSI storage to Proxmox...": "Agregando almacenamiento iSCSI a Proxmox...",
+  "Adding new share to smb.conf...": "Agregando un nuevo recurso compartido a smb.conf...",
+  "Adding this NVMe as a PCIe device (via 'Add Controller or NVMe PCIe to VM') gives better performance.": "Agregar este NVMe como dispositivo PCIe (a través de \"Agregar controlador o NVMe PCIe a VM\") proporciona un mejor rendimiento.",
+  "Adding to /etc/fstab for permanent mounting...": "Agregando a /etc/fstab para montaje permanente...",
+  "Additional audio function(s) to be added": "Funciones de audio adicionales que se agregarán",
+  "Adjust network/CIDR to your environment.": "Ajuste la red/CIDR a su entorno.",
+  "Adjust options if needed (vers=4,hard,timeo,...).": "Ajuste las opciones si es necesario (vers=4,hard,timeo,...).",
+  "Adjusting systemd-journald limits to match Log2RAM size...": "Ajustando los límites de systemd-journald para que coincidan con el tamaño de Log2RAM...",
+  "Adjusts journald log level if needed (Proxmox defaults may block auth logs)": "Ajusta el nivel de registro diario si es necesario (los valores predeterminados de Proxmox pueden bloquear los registros de autenticación)",
+  "Advanced": "Avanzado",
+  "Advanced Diagnostics": "Diagnóstico de red",
+  "Advanced Network Diagnostics": "Diagnóstico de red avanzado",
+  "Affected LXC containers": "Contenedores LXC afectados",
+  "After completing GPU setup, start the VM manually when the host is ready.": "Después de completar la configuración de la GPU, inicie la VM manualmente cuando el host esté listo.",
+  "After confirming, you will be asked to choose the NVIDIA driver version to install.": "Después de confirmar, se le pedirá que elija la versión del controlador NVIDIA para instalar.",
+  "After detailed analysis, no changes are needed.": "Después de un análisis detallado, no se necesitan cambios.",
+  "After detailed analysis, no cleanup is needed.": "Después de un análisis detallado, no es necesaria ninguna limpieza.",
+  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Después de iniciar sesión, ejecute: ip a para obtener la dirección IP.\nLuego, ingrese esa dirección IP en su navegador web de esta manera:\n  http://DIRECCIÓN_IP\n\nEsto abrirá el panel de Umbral OS.",
+  "After pasting on the server, ensure the file is chmod 600 and owned by": "después de pegarlo en el servidor, asegúrese de que el archivo sea chmod 600 y sea propiedad de",
+  "After reboot the system will be fully accessible (SSH, web UI, login), but the following components will be reinstalled in BACKGROUND — until they finish, commands like nvidia-smi may not yet be available:": "después de reiniciar, el sistema será completamente accesible (SSH, interfaz de usuario web, inicio de sesión), pero los siguientes componentes se reinstalarán en ANTECEDENTES; hasta que finalicen, es posible que comandos como nvidia-smi aún no estén disponibles:",
+  "After reboot, these components will reinstall in background:": "después de reiniciar, estos componentes se reinstalarán en segundo plano:",
+  "After reboot, verify PVE version:": "Después de reiniciar, verifique la versión PVE:",
+  "After switching mode, reboot the host if requested.": "Después de cambiar de modo, reinicie el host si se le solicita.",
+  "After that, run this script again to add it.": "Después de eso, ejecute este script nuevamente para agregarlo.",
+  "After the reboot you can follow the post-restore work live from ProxMenux Monitor → Backups tab (estimated time, per-component status, log tail, rollback delta).": "después del reinicio, puede seguir el trabajo posterior a la restauración en vivo desde ProxMenux Monitor → pestaña Copias de seguridad (tiempo estimado, estado por componente, cola de registro, delta de reversión).",
+  "After the reboot, you will only be able to access the Proxmox host via:": "Después del reinicio, solo podrá acceder al host Proxmox a través de:",
+  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Después de este cambio LXC → VM, reinicie el host para que el nuevo estado de enlace se aplique limpiamente.",
+  "Aliases added to .bashrc": "Alias ​​agregados a .bashrc",
+  "All": "Todos",
+  "All Available Scripts": "Todos los scripts disponibles",
+  "All GPUs Already Assigned": "Todas las GPU ya asignadas",
+  "All ProxMenux optimizations are up to date.": "Todas las optimizaciones de ProxMenux están actualizadas.",
+  "All block devices:": "Todos los dispositivos de bloque:",
+  "All changes applied. No reboot required.": "Todos los cambios aplicados. No es necesario reiniciar.",
+  "All changes are reversible using the ProxMenux uninstaller.": "Todos los cambios son reversibles utilizando el desinstalador ProxMenux.",
+  "All dependencies installed and verified.": "Todas las dependencias instaladas y verificadas.",
+  "All detected GPUs are already assigned to this VM.": "Todas las GPU detectadas ya están asignadas a esta VM.",
+  "All detected controllers/NVMe are already present in the selected VM.": "Todos los controladores/NVMe detectados ya están presentes en la VM seleccionada.",
+  "All disks may already be in use or mounted.": "Es posible que todos los discos ya estén en uso o montados.",
+  "All images imported and configured successfully": "Todas las imágenes importadas y configuradas correctamente.",
+  "All imports failed": "Todas las importaciones fallaron",
+  "All partitions and metadata removed.": "Se eliminaron todas las particiones y metadatos.",
+  "All physical interfaces from backup are present on target": "Todas las interfaces físicas de la copia de seguridad están presentes en el objetivo",
+  "All types      (images, backup, iso, vztmpl, snippets)": "Todo tipo (imágenes, copias de seguridad, iso, vztmpl, fragmentos)",
+  "All user-installed packages from the backup are present on this host": "todos los paquetes instalados por el usuario desde la copia de seguridad están presentes en este host",
+  "All users with UID and GID": "Todos los usuarios con UID y GID",
+  "Allocate CPU Cores": "Asignar núcleos de CPU",
+  "Allocate RAM in MiB": "Asignar RAM en MiB",
+  "Already Mounted": "Ya Montado",
+  "Already configured": "Ya configurado",
+  "Already installed — skipping": "Ya instalado - omitiendo",
+  "Also comment any remaining 'bookworm' entries in *.list if present.": "También comente cualquier entrada restante de 'ratón de biblioteca' en *.list si está presente.",
+  "Also install the VirtIO network driver during setup to enable network access.": "Instale también el controlador de red VirtIO durante la configuración para permitir el acceso a la red.",
+  "Although VFIO can bind to this device, full passthrough to a VM is": "Aunque VFIO puede vincularse a este dispositivo, se requiere transferencia completa a una VM.",
+  "Amount of RAM in MiB (default: 4096)": "Cantidad de RAM en MiB (predeterminado: 4096)",
+  "An AMD dedicated GPU has been detected without FLR support": "Se ha detectado una GPU dedicada de AMD sin soporte FLR",
+  "An AMD integrated GPU (APU) has been detected": "Se ha detectado una GPU (APU) integrada de AMD",
+  "An Intel dedicated GPU has been detected without FLR support": "Se ha detectado una GPU dedicada de Intel sin soporte FLR",
+  "An fstab entry already exists for:": "Ya existe una entrada fstab para:",
+  "Analysis Tools": "Herramientas de análisis",
+  "Analyze Bridge Configuration": "Analizar la configuración del puente",
+  "Analyze Network Configuration": "Analizar la configuración de la red",
+  "Analyzing Bridge Configuration - READ ONLY MODE": "Análisis de la configuración del puente: MODO DE SÓLO LECTURA",
+  "Analyzing Network Configuration - READ ONLY MODE": "Análisis de la configuración de la red: MODO DE SÓLO LECTURA",
+  "Analyzing selected disks...": "Analizando discos seleccionados...",
+  "Analyzing system for available PCIe storage devices...": "Analizando el sistema para dispositivos de almacenamiento PCIe disponibles...",
+  "Apply": "Aplicar",
+  "Apply AMD CPU fixes": "Aplicar correcciones para CPU AMD",
+  "Apply Available Updates": "Aplicar actualizaciones disponibles",
+  "Apply and restart services:": "Aplicar y reiniciar servicios:",
+  "Apply available updates": "Aplicar actualizaciones disponibles",
+  "Apply boot/initramfs changes": "Aplicar cambios de arranque/initramfs",
+  "Apply fix now?": "¿Aplicar corrección ahora?",
+  "Apply fix now? (The share will be briefly remounted)": "¿Aplicar corrección ahora? (La acción será remontada brevemente)",
+  "Apply network optimizations": "Aplicar optimizaciones de red",
+  "Apply read+write access for 'others' on the host directory?": "¿Aplicar acceso de lectura+escritura para 'otros' en el directorio de host?",
+  "Applying AMD-specific fixes...": "Aplicando correcciones específicas de AMD...",
+  "Applying Changes": "Aplicar cambios",
+  "Applying Controller/NVMe passthrough to VM": "Aplicación del paso directo del controlador/NVMe a la VM",
+  "Applying balanced memory optimization settings...": "Aplicando configuraciones equilibradas de optimización de memoria...",
+  "Applying changes safely...": "Aplicando cambios de forma segura...",
+  "Applying custom restore": "Aplicar restauración personalizada",
+  "Applying default VM configuration": "Aplicar la configuración predeterminada de VM",
+  "Applying host permissions for unprivileged LXC bind-mounts...": "Aplicando permisos de host para montajes de enlace LXC sin privilegios...",
+  "Applying optimized logrotate configuration...": "Aplicando la configuración optimizada de logrotate...",
+  "Applying passthrough to CT": "Aplicar paso a CT",
+  "Applying safe paths and preparing pending restore": "Aplicar rutas seguras y preparar la restauración pendiente",
+  "Applying selected LXC switch action": "Aplicar la acción del interruptor LXC seleccionada",
+  "Archive deleted.": "Archivo eliminado.",
+  "Archive extracted.": "Archivo extraído.",
+  "Archive format": "Formato de archivo",
+  "Archive ready": "Archivo listo",
+  "Archive size:": "Tamaño del archivo:",
+  "Archive:": "Archivo:",
+  "Are you absolutely sure?": "¿Estás absolutamente seguro?",
+  "Are you sure you want to continue?": "¿Estás seguro de que quieres continuar?",
+  "Are you sure you want to delete this export?": "¿Está seguro de que desea eliminar esta exportación?",
+  "Are you sure you want to delete this share?": "¿Estás seguro de que deseas eliminar este recurso compartido?",
+  "Are you sure you want to remove these configurations?": "¿Está seguro de que desea eliminar estas configuraciones?",
+  "Are you sure you want to restore this backup?\nCurrent configuration will be overwritten.": "¿Está seguro de que desea restaurar esta copia de seguridad?\nSe sobrescribirá la configuración actual.",
+  "Are you sure you want to uninstall ProxMenux?": "¿Estás seguro de que deseas desinstalar ProxMenux?",
+  "Are you sure you want to uninstall the selected optimizations.": "¿Está seguro de que desea desinstalar las optimizaciones seleccionadas?",
+  "Are you sure you want to unmount this NFS share?": "¿Está seguro de que desea desmontar este recurso compartido NFS?",
+  "Are you sure you want to unmount this Samba share?": "¿Estás seguro de que quieres desmontar este recurso compartido de Samba?",
+  "Are you sure?": "¿Está seguro?",
+  "As Proxmox storage": "Como almacenamiento Proxmox",
+  "As host fstab mount only": "Solo como montaje de host fstab",
+  "Assign GPU PCI function to VM": "Asignar función PCI de GPU a VM",
+  "Assign controller/NVMe passthrough": "Asignar controlador/paso NVMe",
+  "Assigned to VM": "Asignado a la máquina virtual",
+  "Assigned to VM(s)": "Asignado a máquinas virtuales",
+  "Assigning imported disk to VM using the generated command": "Asignar disco importado a VM usando el comando generado",
+  "Associated Audio Devices": "Dispositivos de audio asociados",
+  "Associated audio removed from VM": "Audio asociado eliminado de la VM",
+  "At least 5GB free space on root filesystem": "Al menos 5 GB de espacio libre en el sistema de archivos raíz",
+  "At least one selected GPU is blocked by policy for GPU -> VM mode due to passthrough instability risk.": "Al menos una GPU seleccionada está bloqueada por la política para GPU -> modo VM debido al riesgo de inestabilidad de transferencia.",
+  "Attach imported disk to VM": "Adjunte el disco importado a la VM",
+  "Attach to an existing PVE vzdump job (inherit schedule + retention)": "Adjuntar a un trabajo PVE vzdump existente (heredar programación + retención)",
+  "Attached to PVE job:": "Adjunto al trabajo PVE:",
+  "Attempting automatic repair...": "Intentando reparación automática...",
+  "Attempting passthrough with this GPU typically results in": "Intentar la transferencia con esta GPU generalmente resulta en",
+  "Attention: Removing the subscription banner may cause issues in the web interface after a future update.": "Atención: Eliminar el banner de suscripción puede causar problemas en la interfaz web después de una actualización futura.",
+  "Audit completed. Press Enter to continue...": "Auditoría completada. Presione Entrar para continuar...",
+  "Auth key is required.": "Se requiere clave de autenticación.",
+  "Auth:": "Autenticación:",
+  "Authentication": "Autenticación",
+  "Authentication Error": "Error de autenticación",
+  "Authentication failed.": "La autenticación falló.",
+  "Authentication required:": "Se requiere autenticación:",
+  "Authentication:": "Autenticación:",
+  "Authorization failed": "Autorización fallida",
+  "Authorization successful": "Autorización exitosa",
+  "Authorize this key on the server": "Autorizar esta clave en el servidor",
+  "Authorize via 'pct exec' (Borg server is an LXC on a PVE host I can SSH into)": "Autorizar a través de 'pct exec' (el servidor Borg es un LXC en un host PVE en el que puedo acceder mediante SSH)",
+  "Authorized": "Autorizado",
+  "Auto-detected firewall backend (nftables/iptables)": "Backend de firewall detectado automáticamente (nftables/iptables)",
+  "Auto-discover servers on network": "Servidores de descubrimiento automático en la red",
+  "Auto-negotiate:": "Negociar automáticamente:",
+  "Auto-start was skipped because GPU passthrough setup was requested.": "Se omitió el inicio automático porque se solicitó la configuración de transferencia de GPU.",
+  "Auto-sync enabled when /var/log exceeds 80% of": "Sincronización automática habilitada cuando /var/log excede el 80% de",
+  "Auto-sync was not enabled": "La sincronización automática no estaba habilitada",
+  "Automated Post-Install Script": "Script automático Post-Install",
+  "Automated post-installation script": "Script automático          Post-Install",
+  "Automatic/Unattended": "Automático/desatendido",
+  "Available": "Disponible",
+  "Available Borg archives (newest first):": "Archivos Borg disponibles (los más nuevos primero):",
+  "Available Borg targets:": "Objetivos Borg disponibles:",
+  "Available Disks on Host": "Discos disponibles en el host",
+  "Available ISO Images": "Imágenes ISO disponibles",
+  "Available PBS repositories:": "Repositorios de PBS disponibles:",
+  "Available PVE Version": "Versión PVE disponible",
+  "Available Shares:": "Acciones disponibles:",
+  "Available action": "Acción disponible",
+  "Available archives:": "Archivos disponibles:",
+  "Available disks detected.": "Discos disponibles detectados.",
+  "Available host backups:": "Copias de seguridad de host disponibles:",
+  "Available images in /var/lib/vz/images/:": "Imágenes disponibles en /var/lib/vz/images/:",
+  "Available network interfaces:": "Interfaces de red disponibles:",
+  "Available output formats include:": "Los formatos de salida disponibles incluyen:",
+  "Available physical disks for passthrough:": "Discos físicos disponibles para transferencia:",
+  "Available shares for guest access:": "Acciones disponibles para acceso de invitados:",
+  "Available space in /mnt:": "Espacio disponible en /mnt:",
+  "Available storage information:": "Información de almacenamiento disponible:",
+  "Available storage volumes:": "Volúmenes de almacenamiento disponibles:",
+  "BIOS TYPE": "TIPO DE BIOS",
+  "BIOS Type": "Tipo de BIOS",
+  "BIOS from": "BIOS de",
+  "BIOS: OVMF (UEFI)": "BIOS: OVMF (UEFI)",
+  "BRIDGE CONFIGURATION ANALYSIS": "ANÁLISIS DE CONFIGURACIÓN DEL PUENTE",
+  "BTRFS:": "BTRFS:",
+  "Back to previous menu or Esc + Enter": "Volver al menú anterior o Esc + Enter",
+  "Backed up and cleared": "Copia de seguridad y limpieza",
+  "Backend": "backend",
+  "Backend:": "Parte trasera:",
+  "Backup            — VM and CT backups": "Copia de seguridad: copias de seguridad de VM y CT",
+  "Backup Created": "Copia de seguridad creada",
+  "Backup ID (group name in PBS):": "ID del backup (nombre del grupo en PBS):",
+  "Backup ID for this job:": "ID del backup para este trabajo:",
+  "Backup ID:": "ID del backup:",
+  "Backup Preview": "Vista previa de la copia de seguridad",
+  "Backup Recommendation": "Recomendación de copia de seguridad",
+  "Backup Restored": "Copia de seguridad restaurada",
+  "Backup all VMs and CTs": "Copia de seguridad de todas las máquinas virtuales y CT",
+  "Backup and Restore Commands": "Comandos de copia de seguridad y restauración",
+  "Backup available at": "Copia de seguridad disponible en",
+  "Backup completed successfully.": "La copia de seguridad se completó correctamente.",
+  "Backup completed:": "Copia de seguridad completada:",
+  "Backup created:": "Copia de seguridad creada:",
+  "Backup declares unused NICs that are not on this host:": "La copia de seguridad declara las NIC no utilizadas que no están en este host:",
+  "Backup destination is inside the backup": "el destino de la copia de seguridad está dentro de la copia de seguridad",
+  "Backup failed. See log:": "Error en la copia de seguridad.Ver registro:",
+  "Backup file appears corrupted, will reinstall packages": "El archivo de copia de seguridad parece dañado, reinstalará los paquetes",
+  "Backup host configuration": "Copia de seguridad de la configuración del host",
+  "Backup includes /etc/zfs/zpool.cache. Restore it (same host detected)?": "La copia de seguridad incluye /etc/zfs/zpool.cache.¿Restaurarlo (se detectó el mismo host)?",
+  "Backup information": "Información de respaldo",
+  "Backup location": "Ubicación de la copia de seguridad",
+  "Backup metadata": "Metadatos de copia de seguridad",
+  "Backup of original MOTD created": "Copia de seguridad del MOTD original creado",
+  "Backup on newer kernel:": "Copia de seguridad en un kernel más nuevo:",
+  "Backup on older kernel:": "Copia de seguridad en un kernel anterior:",
+  "Backup origin metadata:": "Metadatos de origen de la copia de seguridad:",
+  "Backup path:": "Ruta de respaldo:",
+  "Backup pools not present on this host:": "grupos de respaldo no presentes en este host:",
+  "Backup saved to:": "Copia de seguridad guardada en:",
+  "Backup scheduler and retention": "Programador de copias de seguridad y retención",
+  "Backup to Borg repository": "Copia de seguridad en Borg",
+  "Backup to Proxmox Backup Server (PBS)": "Copia de seguridad en PBS",
+  "Backup to a specific directory": "Copia de seguridad en un directorio específico",
+  "Backup to local archive  (.tar.zst)": "Copia de seguridad en archivo local (.tar.zst)",
+  "Backup:": "Copia de seguridad:",
+  "Backups already on PBS were encrypted with the current key — downloading them will fail unless you first Download the current keyfile to keep a copy.": "Las copias de seguridad que ya están en PBS se cifraron con la clave actual; la descarga fallará a menos que primero descargue el archivo de clave actual para conservar una copia.",
+  "Backups already stored on PBS were encrypted with the current keyfile. After this action:": "las copias de seguridad ya almacenadas en PBS se cifraron con el archivo de claves actual.Después de esta acción:",
+  "Bandwidth limit configured": "Límite de ancho de banda configurado",
+  "Bandwidth test (iperf3)": "Prueba de ancho de banda (iperf3)",
+  "Bandwidth test completed successfully": "La prueba de ancho de banda se completó con éxito",
+  "Base VM created with ID": "VM base creada con ID",
+  "Bashrc customization completed": "Personalización de Bashrc completada",
+  "Basic Settings": "Ajustes básicos",
+  "Basic Utilities": "Utilidades básicas",
+  "Before making any changes, we'll create a safety backup.": "Antes de realizar cualquier cambio, crearemos una copia de seguridad de seguridad.",
+  "Beta (develop branch)": "Beta (rama de desarrollo)",
+  "Beta version:": "Versión beta:",
+  "Binary not found in extracted content.": "Binario no encontrado en el contenido extraído.",
+  "Bind mount added:": "Montaje de enlace agregado:",
+  "Blacklist nouveau driver": "Nuevo conductor de la lista negra",
+  "Blacklisting GPU host drivers...": "Incluir en la lista negra los controladores del host de la GPU...",
+  "Blacklisting nouveau driver...": "Poner en la lista negra al nuevo conductor...",
+  "Blocked GPU ID": "ID de GPU bloqueada",
+  "Blocked GPU ID for VM Mode": "ID de GPU bloqueada para el modo VM",
+  "Blocked device(s)": "Dispositivo(s) bloqueado(s)",
+  "Blocked device(s):": "Dispositivo(s) bloqueado(s):",
+  "Boot Disk": "Disco de arranque",
+  "Boot artifacts regenerated — reboot the host to activate the merged config.": "artefactos de arranque regenerados: reinicie el host para activar la configuración fusionada.",
+  "Boot disk:": "Disco de arranque:",
+  "Boot order set to": "Orden de arranque establecido en",
+  "Boot partition UUIDs from backup not found on this host:": "Los UUID de partición de arranque desde la copia de seguridad no se encuentran en este host:",
+  "Boot type (grub/zfs):": "Tipo de arranque (grub/zfs):",
+  "Borg backup error log": "Registro de errores de copia de seguridad de Borg",
+  "Borg backup failed.": "La copia de seguridad de Borg falló.",
+  "Borg binary checksum verification failed.": "Error en la verificación de la suma de comprobación binaria de Borg.",
+  "Borg encryption": "Cifrado borg",
+  "Borg extraction failed.": "La extracción de Borg falló.",
+  "Borg not found. Downloading borg": "Borg no encontrado. Descargando borg",
+  "Borg passphrase:": "Frase de contraseña de Borg:",
+  "Borg ready.": "Borg listo.",
+  "Borg repositories": "repositorios Borg",
+  "Borg repository location": "Ubicación del repositorio Borg",
+  "Borg repository passphrase": "frase de contraseña del repositorio Borg",
+  "Borg repository path:": "Ruta del repositorio Borg:",
+  "Borg restore error log": "Registro de errores de restauración de Borg",
+  "Borg server SSH user": "usuario SSH del servidor Borg",
+  "Bridge": "Puente",
+  "Bridge Analysis": "Análisis de puentes",
+  "Bridge Configuration Analysis": "Análisis de configuración de puente",
+  "Bridge:": "Puente:",
+  "Bridges analyzed": "Puentes analizados",
+  "Broken gasket-dkms package state recovered.": "Se recuperó el estado del paquete de junta rota-dkms.",
+  "Browse manually (advanced)...": "Navegar manualmente (avanzado)...",
+  "Build and install the gasket and apex kernel modules (DKMS)": "Construya e instale los módulos de junta y núcleo apex (DKMS)",
+  "Build dependencies installed.": "Construya dependencias instaladas.",
+  "CHANGES APPLIED SUCCESSFULLY": "CAMBIOS APLICADOS EXITOSAMENTE",
+  "CIFS Client Tools: AVAILABLE": "Herramientas de cliente CIFS: DISPONIBLES",
+  "CIFS Client Tools: NOT AVAILABLE - installing...": "Herramientas de cliente CIFS: NO DISPONIBLES - instalando...",
+  "CIFS Client: INSTALLED": "Cliente CIFS: INSTALADO",
+  "CIFS Client: NOT INSTALLED": "Cliente CIFS: NO INSTALADO",
+  "CIFS Mount Not Found": "Montaje CIFS no encontrado",
+  "CIFS Mounts on Host": "CIFS se monta en el host",
+  "CIFS Proxmox storages (pvesm):": "Almacenamientos CIFS Proxmox (pvesm):",
+  "CIFS can cause file locking issues with VM disk operations.": "CIFS puede causar problemas de bloqueo de archivos con las operaciones de disco de VM.",
+  "CIFS client tools installed.": "Herramientas de cliente CIFS instaladas.",
+  "CIFS share mounted at:": "El recurso compartido CIFS se montó en:",
+  "CIFS share remounted — LXC containers can now read and write": "Se volvió a montar el recurso compartido CIFS: los contenedores LXC ahora pueden leer y escribir",
+  "CIFS storage added successfully to Proxmox!": "¡Almacenamiento CIFS agregado exitosamente a Proxmox!",
+  "CLEANUP COMPLETED SUCCESSFULLY": "LIMPIEZA COMPLETADA CON ÉXITO",
+  "CLUSTER UPGRADE NOTES:": "NOTAS DE ACTUALIZACIÓN DEL CLÚSTER:",
+  "CONFIGURED INTERFACES": "INTERFACES CONFIGURADAS",
+  "CONFIRM FORMAT": "CONFIRMAR FORMATO",
+  "CPU Cores": "Núcleos de CPU",
+  "CPU MODEL": "MODELO DE CPU",
+  "CPU Model": "Modelo de CPU",
+  "CPU set to host,hidden=1,flags=+pcid": "CPU configurada como host, oculta = 1, banderas = + pcid",
+  "CPU vendor (intel/amd):": "Proveedor de CPU (Intel/AMD):",
+  "CRITICAL: The selected disk is referenced by a RUNNING VM or CT.": "CRÍTICO: El disco seleccionado tiene referencia a una VM o CT EN EJECUCIÓN.",
+  "CT": "Connecticut",
+  "CT started successfully.": "La TC se inició con éxito.",
+  "Cancel": "Cancelar",
+  "Cancel restore": "Cancelar restauración",
+  "Cancel this setup": "cancelar esta configuración",
+  "Cancelled by user or empty URL.": "Cancelado por usuario o URL vacía.",
+  "Cancelled by user.": "Cancelado por el usuario.",
+  "Cannot connect to server": "No se puede conectar al servidor",
+  "Cannot continue": "no puedo continuar",
+  "Cannot create:": "No se puede crear:",
+  "Cannot detect filesystem on": "No se puede detectar el sistema de archivos en",
+  "Cannot find": "no puedo encontrar",
+  "Cannot load backup library: lib_host_backup_common.sh": "No se puede cargar la biblioteca de respaldo: lib_host_backup_common.sh",
+  "Cannot proceed with invalid export path.": "No se puede continuar con una ruta de exportación no válida.",
+  "Cannot proceed with invalid share name.": "No se puede continuar con un nombre compartido no válido.",
+  "Cannot reach Proxmox repositories": "No se puede acceder a los repositorios de Proxmox",
+  "Cannot reach portal:": "No se puede acceder al portal:",
+  "Cannot reach server": "No puede alcanzar el servidor",
+  "Cannot validate credentials - no shares available for testing.": "No se pueden validar las credenciales: no hay recursos compartidos disponibles para realizar pruebas.",
+  "Category": "Categoría",
+  "Caution: Maximum mode generates more heat.": "Precaución: el modo máximo genera más calor.",
+  "Ceph check skipped by user flag (--ignore-ceph-check)": "Comprobación de Ceph omitida por el indicador del usuario (--ignore-ceph-check)",
+  "Ceph components": "Componentes ceph",
+  "Ceph detected as hyper-converged on this node. Checking version (require 19.x Squid)...": "Ceph detectó hiperconvergencia en este nodo. Comprobando la versión (requiere 19.x Squid)...",
+  "Ceph enterprise repository present": "Repositorio empresarial de Ceph presente",
+  "Ceph installation check completed": "Verificación de instalación de Ceph completada",
+  "Ceph installation completed successfully": "La instalación de Ceph se completó con éxito",
+  "Ceph installation could not be verified": "No se pudo verificar la instalación de Ceph",
+  "Ceph installation process completed": "Proceso de instalación de Ceph completado",
+  "Ceph installation process finished with warnings": "El proceso de instalación de Ceph finalizó con advertencias",
+  "Ceph installed but integration may need configuration": "Ceph instalado pero la integración puede necesitar configuración",
+  "Ceph integration with PVE 9 verified": "Integración de Ceph con PVE 9 verificada",
+  "Ceph is already installed": "Ceph ya está instalado",
+  "Ceph is not 19.x (Squid). Proceeding due to --warn-ceph-check. Detected:": "Ceph no es 19.x (Squid). Procedimiento debido a --warn-ceph-check. Detectado:",
+  "Ceph is not 19.x (Squid). Upgrade Ceph first. Detected:": "Ceph no es 19.x (Squid). Actualice Ceph primero. Detectado:",
+  "Ceph no-subscription repository present": "Repositorio Ceph sin suscripción presente",
+  "Ceph packages and repository removed": "Paquetes y repositorio de Ceph eliminados",
+  "Ceph packages are available": "Los paquetes Ceph están disponibles",
+  "Ceph packages installed and verified successfully": "Paquetes Ceph instalados y verificados exitosamente",
+  "Ceph packages installed but service verification failed": "Paquetes Ceph instalados pero falla la verificación del servicio",
+  "Ceph packages may not be available, but continuing installation...": "Es posible que los paquetes de Ceph no estén disponibles, pero continúa la instalación...",
+  "Ceph repository configured for PVE 8": "Repositorio Ceph configurado para PVE 8",
+  "Ceph repository configured for PVE 9": "Repositorio Ceph configurado para PVE 9",
+  "Ceph version OK:": "Versión Ceph correcta:",
+  "Change Language": "Cambiar idioma",
+  "Change Release Channel": "Cambiar canal de lanzamiento",
+  "Changes applied. A system reboot is recommended for them to take full effect.": "Se aplicaron cambios. Se recomienda reiniciar el sistema para que surtan efecto completo.",
+  "Changes detected. Updating ZFS ARC configuration...": "Cambios detectados. Actualizando la configuración de ZFS ARC...",
+  "Changes have been applied to the configuration file.": "Se han aplicado cambios al archivo de configuración.",
+  "Changes will apply after reboot.": "Los cambios se aplicarán después del reinicio.",
+  "Changing Release Channel": "Cambiar el canal de lanzamiento",
+  "Changing the machine type on an existing installed VM is not safe: it changes the chipset and PCI slot layout, which typically prevents the guest OS from booting.": "Cambiar el tipo de máquina en una VM instalada existente no es seguro: cambia el diseño del chipset y de la ranura PCI, lo que normalmente impide que el sistema operativo invitado se inicie.",
+  "Check": "Controlar",
+  "Check BIOS/UEFI in Hardware > BIOS — must match what the original VM used": "Verifique BIOS/UEFI en Hardware > BIOS: debe coincidir con lo que usó la VM original",
+  "Check Coral USB/M.2 detection": "Comprobar la detección de Coral USB/M.2",
+  "Check LXC GPU/TPU mapping": "Verifique el mapeo LXC GPU/TPU",
+  "Check NFS Status": "Verificar el estado de NFS",
+  "Check NVIDIA driver and devices": "Verifique el controlador y los dispositivos NVIDIA",
+  "Check Proxmox Web UI status": "Verifique el estado de la interfaz de usuario web de Proxmox",
+  "Check Proxmox firewall status": "Verifique el estado del firewall de Proxmox",
+  "Check Samba Status": "Verificar el estado de Samba",
+  "Check VM disk/PCI slots": "Verifique el disco VM/ranuras PCI",
+  "Check VM passthrough settings": "Verifique la configuración de paso a través de VM",
+  "Check connectivity with another host": "Verificar la conectividad con otro host",
+  "Check container mount points": "Verifique los puntos de montaje del contenedor",
+  "Check if container is unprivileged:": "Compruebe si el contenedor no tiene privilegios:",
+  "Check kernel params (IOMMU flags)": "Verifique los parámetros del kernel (indicadores IOMMU)",
+  "Check loaded GPU/TPU modules": "Verifique los módulos GPU/TPU cargados",
+  "Check log:": "Registro de verificación:",
+  "Check resulting config:": "Verifique la configuración resultante:",
+  "Check script not found": "Comprobar script no encontrado",
+  "Check test progress   — show active or last test result": "Verifique el progreso de la prueba: muestre el resultado de la prueba activa o la última",
+  "Check that:": "Comprueba que:",
+  "Check the error messages above for details.": "Consulte los mensajes de error anteriores para obtener más detalles.",
+  "Check the service status manually if needed.": "Verifique el estado del servicio manualmente si es necesario.",
+  "Checking MOTD configuration...": "Comprobando la configuración del MOTD...",
+  "Checking NVIDIA driver status with nvidia-smi": "Comprobar el estado del controlador NVIDIA con nvidia-smi",
+  "Checking VFIO modules...": "Comprobando módulos VFIO...",
+  "Checking VM virtual display model...": "Comprobando el modelo de pantalla virtual de VM...",
+  "Checking ZFS autotrim configuration...": "Comprobando la configuración de recorte automático de ZFS...",
+  "Checking and repairing old LVM PV headers (if needed)...": "Comprobación y reparación de cabezales fotovoltaicos LVM antiguos (si es necesario)...",
+  "Checking conflicting drivers blacklist...": "Comprobando la lista negra de controladores en conflicto...",
+  "Checking existing ZFS ARC configuration...": "Comprobando la configuración ZFS ARC existente...",
+  "Checking for updates...": "Buscando actualizaciones...",
+  "Checking free space in /var/cache/apt/archives...": "Comprobando espacio libre en /var/cache/apt/archives...",
+  "Checking if system disk is SSD or M.2...": "Comprobando si el disco del sistema es SSD o M.2...",
+  "Checking if the server belongs to OVH...": "Comprobando si el servidor pertenece a OVH...",
+  "Checking kernel headers and build tools...": "Comprobando los encabezados del kernel y las herramientas de compilación...",
+  "Checking remaining interfaces": "Comprobando las interfaces restantes",
+  "Checklist post-upgrade finished. Warnings:": "Lista de verificación posterior a la actualización finalizada. Advertencias:",
+  "Checklist pre-check finished. Warnings:": "Verificación previa de la lista de verificación finalizada. Advertencias:",
+  "Checks for LVM and storage issues": "Comprueba si hay problemas de almacenamiento y LVM",
+  "Choose BIOS type": "Elige el tipo de BIOS",
+  "Choose No to abort and roll back to the legacy refuse behaviour.": "elija No para cancelar y volver al comportamiento de rechazo heredado.",
+  "Choose ZimaOS image option:": "Elige la opción de imagen de ZimaOS:",
+  "Choose a Samba server:": "Elige un servidor Samba:",
+  "Choose a Windows ISO to use:": "Elige una ISO de Windows para usar:",
+  "Choose a ZimaOS image:": "Elige una imagen de ZimaOS:",
+  "Choose a custom image:": "Elige una imagen personalizada:",
+  "Choose a custom logo:": "Elige un logotipo personalizado:",
+  "Choose a destination directory OUTSIDE of": "Elige un directorio de destino FUERA de",
+  "Choose a different path or unmount it first.": "Elige una ruta diferente o desmóntela primero.",
+  "Choose a folder to export:": "Elige una carpeta para exportar:",
+  "Choose a folder to mount the export:": "Elige una carpeta para montar la exportación:",
+  "Choose a folder to mount the share:": "Elige una carpeta para montar el recurso compartido:",
+  "Choose a folder to mount:": "Elige una carpeta para montar:",
+  "Choose a folder to share:": "Elige una carpeta para compartir:",
+  "Choose a group policy for this shared directory:": "Elige una política de grupo para este directorio compartido:",
+  "Choose a loader for Synology DSM:": "Elige un cargador para Synology DSM:",
+  "Choose a logo for Fastfetch:": "Elige un logotipo para Fastfetch:",
+  "Choose a recent server:": "Elige un servidor reciente:",
+  "Choose a recovery passphrase (write it down somewhere safe):": "elija una frase de contraseña de recuperación (escríbala en un lugar seguro):",
+  "Choose a script to execute:": "Elige un script para ejecutar:",
+  "Choose a server:": "Elige un servidor:",
+  "Choose a share to mount:": "Elige un recurso compartido para montar:",
+  "Choose action for this controller/NVMe:": "Elige la acción para este controlador/NVMe:",
+  "Choose action:": "Elige acción:",
+  "Choose an NFS server:": "Elige un servidor NFS:",
+  "Choose an action:": "Elige una acción:",
+  "Choose an export to mount:": "Elige una exportación para montar:",
+  "Choose an option:": "Elige una opción:",
+  "Choose any host path you want to share with CTs.": "Elige cualquier ruta de host que desee compartir con los CT.",
+  "Choose conflict policy": "Elige una política de conflictos",
+  "Choose conflict policy for the source VM:": "Elige la política de conflictos para la máquina virtual de origen:",
+  "Choose conflict policy:": "Elige política de conflictos:",
+  "Choose filesystem for the disk:": "Elige el sistema de archivos para el disco:",
+  "Choose how this host backup will be triggered:": "elija cómo se activará esta copia de seguridad del host:",
+  "Choose how to continue:": "Elige cómo continuar:",
+  "Choose how to handle affected LXC containers before switching to VM mode.": "Elige cómo manejar los contenedores LXC afectados antes de cambiar al modo VM.",
+  "Choose how to make the disk available on this host. Mark one or both options:": "Elige cómo hacer que el disco esté disponible en este host. Marque una o ambas opciones:",
+  "Choose how to mount the NFS share on this host. Mark one or both options:": "Elige cómo montar el recurso compartido NFS en este host. Marque una o ambas opciones:",
+  "Choose how to mount the Samba share on this host. Mark one or both options:": "Elige cómo montar el recurso compartido Samba en este host. Marque una o ambas opciones:",
+  "Choose how to perform the upgrade:": "Elige cómo realizar la actualización:",
+  "Choose how to run the script:": "Elige cómo ejecutar el script:",
+  "Choose iperf3 mode:": "Elige el modo iperf3:",
+  "Choose options to configure:": "Elige opciones para configurar:",
+  "Choose the driver version for Coral M.2:": "Elige la versión del controlador para Coral M.2:",
+  "Choose the filesystem for the new partition:": "Elige el sistema de archivos para la nueva partición:",
+  "Choose the release channel to use:": "Elige el canal de lanzamiento a utilizar:",
+  "Choose the storage volume for the EFI disk (4MB):\n\nUse Spacebar to select.": "Elige el volumen de almacenamiento para el disco EFI (4 MB):\n\nUtilice la barra espaciadora para seleccionar.",
+  "Choose the storage volume for the virtual disk:": "Elige el volumen de almacenamiento para el disco virtual:",
+  "Choose the type of virtual system to install:": "Elige el tipo de sistema virtual a instalar:",
+  "Choose what to do with the selected disk:": "Elige qué hacer con el disco seleccionado:",
+  "Choose where to save the backup:": "Elige dónde guardar la copia de seguridad:",
+  "Clean disk metadata": "Limpiar metadatos del disco",
+  "Cleaned up": "limpiado",
+  "Cleaning cached files...": "Limpiando archivos en caché...",
+  "Cleaning disk metadata...": "Limpiando metadatos del disco...",
+  "Cleaning previous Log2RAM installation...": "Limpiando la instalación anterior de Log2RAM...",
+  "Cleaning temporary files...": "Limpiando archivos temporales...",
+  "Cleaning up Samba directories...": "Limpiando directorios de Samba...",
+  "Cleaning up duplicate parameters...": "Limpiando parámetros duplicados...",
+  "Cleaning up duplicate repositories...": "Limpiando repositorios duplicados...",
+  "Cleaning up remaining processes...": "Limpiando los procesos restantes...",
+  "Cleaning up unused time synchronization services...": "Limpiando servicios de sincronización horaria no utilizados...",
+  "Cleans duplicate or conflicting sources": "Limpia fuentes duplicadas o conflictivas",
+  "Cleanup Complete": "Limpieza completa",
+  "Cleanup finished": "Limpieza terminada",
+  "Cleanup partial VM?": "¿Limpiar VM parcial?",
+  "Clear configured target": "Borrar destino configurado",
+  "Clear pool error state": "Borrar estado de error del grupo",
+  "Cleared": "Borrado",
+  "Clearing login credentials...": "Borrando credenciales de inicio de sesión...",
+  "Client (run a bandwidth test to a server)": "Cliente (ejecute una prueba de ancho de banda en un servidor)",
+  "Client determines best version to use": "El cliente determina la mejor versión para usar",
+  "Cloning Coral driver repository (feranick fork)...": "Clonación del repositorio de controladores de Coral (fork feranick)...",
+  "Cloning Lynis from GitHub...": "Clonando Lynis desde GitHub...",
+  "Cloning and applying NVIDIA patch (keylase/nvidia-patch)...": "Clonación y aplicación del parche NVIDIA (keylase/nvidia-patch)...",
+  "Closed": "Cerrado",
+  "Cloud-Init Automated Installers": "Instaladores automatizados de Cloud-Init",
+  "Cluster certificates updated": "Certificados de clúster actualizados",
+  "Cluster configuration (advanced)": "Configuración de clúster (avanzada)",
+  "Cluster data will be applied automatically at next boot.": "los datos del clúster se aplicarán automáticamente en el próximo inicio.",
+  "Cluster upgrade mode": "Modo de actualización del clúster",
+  "Command": "Dominio",
+  "Commenting any residual Bookworm lines in *.list...": "Comentando cualquier línea residual de Bookworm en *.list...",
+  "Commenting legacy PVE 8 repository .list files (if any)...": "Comentando archivos .list del repositorio PVE 8 heredado (si los hay)...",
+  "Commenting legacy ceph.list (if present)...": "Comentando ceph.list heredado (si está presente)...",
+  "Common Issues Check": "Verificación de problemas comunes",
+  "Community Scripts": "Scripts comunitarios",
+  "Compatibility check": "verificación de compatibilidad",
+  "Compatibility check — OK": "Verificación de compatibilidad - OK",
+  "Compatibility check — issues detected": "verificación de compatibilidad: problemas detectados",
+  "Compatibility check — review warnings": "verificación de compatibilidad: revisar las advertencias",
+  "Compatible with privileged and unprivileged LXC containers": "Compatible con contenedores LXC privilegiados y no privilegiados",
+  "Compatible with:": "Compatible con:",
+  "Compile firewall rules for all nodes": "Compile reglas de firewall para todos los nodos",
+  "Compiling Coral TPU drivers for current kernel...": "Compilando los controladores Coral TPU para el kernel actual...",
+  "Complete": "Completo",
+  "Complete NVIDIA uninstallation finished.": "Completa la desinstalación de NVIDIA finalizada.",
+  "Complete post-installation optimization finished!": "¡Optimización completa posterior a la instalación finalizada!",
+  "Complete restore": "restauración completa",
+  "Complete the DSM installation wizard": "Complete el asistente de instalación de DSM",
+  "Complete the ZimaOS installation wizard": "Complete el asistente de instalación de ZimaOS",
+  "Completed Successfully with GPU passthrough configured!": "¡Completado exitosamente con el paso a través de GPU configurado!",
+  "Completed Successfully!": "¡Completado con éxito!",
+  "Completed with errors —": "Completado con errores.",
+  "Completed.": "Terminado.",
+  "Completed. Press Enter to return to menu...": "Terminado. Presione Enter para regresar al menú...",
+  "Compliance checking (PCI-DSS, HIPAA, etc.)": "Comprobación de cumplimiento (PCI-DSS, HIPAA, etc.)",
+  "Component to uninstall manually (no --auto-uninstall yet):": "Componente para desinstalar manualmente (aún no hay desinstalación automática):",
+  "Component was installed on the backup source but no matching hardware was found on this host.": "El componente se instaló en la fuente de respaldo, pero no se encontró hardware coincidente en este host.",
+  "Component:": "Componente:",
+  "Components to uninstall (manual for now):": "Componentes para desinstalar (manual por ahora):",
+  "Compressed size:": "Tamaño comprimido:",
+  "Compressing": "comprimir",
+  "Compression Tools": "Herramientas de compresión",
+  "Concise output of logical volumes": "Salida concisa de volúmenes lógicos",
+  "Concise output of physical volumes": "Salida concisa de volúmenes físicos.",
+  "Concise output of volume groups": "Salida concisa de grupos de volúmenes.",
+  "Configuration Analysis": "Análisis de configuración",
+  "Configuration Menu": "Menú de configuración",
+  "Configuration Summary:": "Resumen de configuración:",
+  "Configuration analysis": "Análisis de configuración",
+  "Configuration backup created:": "Copia de seguridad de configuración creada:",
+  "Configuration can continue now and will be effective after reboot.": "La configuración puede continuar ahora y será efectiva después del reinicio.",
+  "Configuration completed successfully!": "¡La configuración se completó con éxito!",
+  "Configuration file for container": "Archivo de configuración para contenedor",
+  "Configuration has been stopped due to high reset risk.": "La configuración se ha detenido debido al alto riesgo de reinicio.",
+  "Configuration has been stopped to prevent an unusable VM state.": "La configuración se ha detenido para evitar un estado de VM inutilizable.",
+  "Configuration has been stopped to prevent leaving the VM in an unusable state.": "La configuración se ha detenido para evitar dejar la máquina virtual en un estado inutilizable.",
+  "Configuration name:": "Nombre de configuración:",
+  "Configuration sections that will be REMOVED": "Secciones de configuración que serán ELIMINADAS",
+  "Configuration to be Removed": "Configuración que se eliminará",
+  "Configuration will continue now and be effective after reboot.": "La configuración continuará ahora y será efectiva después del reinicio.",
+  "Configuration:": "Configuración:",
+  "Configure": "Configurar",
+  "Configure GPU passthrough with VFIO": "Configurar el paso a través de GPU con VFIO",
+  "Configure LXC Mount Points    (Host ↔ Container)": "Configurar puntos de montaje LXC    (Host ↔ Contenedor)",
+  "Configure LXC mount points": "Configurar puntos de montaje LXC",
+  "Configure Mount Point inside LXC": "Configurar el punto de montaje dentro de LXC",
+  "Configure NFS   Client in LXC (only privileged)": "Configurar el Cliente  NFS   en LXC (solo privilegiado)",
+  "Configure NFS   Server in LXC (only privileged)": "Configurar el servidor NFS   en LXC (solo privilegiado)",
+  "Configure Proxmox APT repositories": "Configurar repositorios APT de Proxmox",
+  "Configure Samba Client in LXC (only privileged)": "Configurar el Cliente  Samba en LXC (solo privilegiado)",
+  "Configure Samba Server in LXC (only privileged)": "Configurar el servidor Samba en LXC (solo privilegiado)",
+  "Configure as guest (no authentication)": "Configurar como invitado (sin autenticación)",
+  "Configure backup destinations": "configurar destinos de copia de seguridad",
+  "Configure backup destinations (PBS, Borg, local)": "configurar destinos de copia de seguridad (PBS, Borg, local)",
+  "Configure the Google Coral APT repository": "Configurar el repositorio de Google Coral APT",
+  "Configure with username and password": "Configurar con nombre de usuario y contraseña",
+  "Configured Ports": "Puertos configurados",
+  "Configured but doesn't exist": "Configurado pero no existe",
+  "Configuring AMD GPU passthrough...": "Configurando el paso a través de GPU AMD...",
+  "Configuring AMD softdep...": "Configurando el software AMD...",
+  "Configuring APT to skip downloading additional languages": "Configurar APT para omitir la descarga de idiomas adicionales",
+  "Configuring APT to skip downloading additional languages...": "Configurando APT para omitir la descarga de idiomas adicionales...",
+  "Configuring APT to use IPv4...": "Configurando APT para usar IPv4...",
+  "Configuring Ceph repository for PVE": "Configurando el repositorio de Ceph para PVE",
+  "Configuring Coral USB support...": "Configurando la compatibilidad con Coral USB...",
+  "Configuring EFI disk": "Configurar el disco EFI",
+  "Configuring I/O priority for vzdump...": "Configurando la prioridad de E/S para vzdump...",
+  "Configuring Intel iGPU passthrough...": "Configurando el paso a través de Intel iGPU...",
+  "Configuring MOTD (Message of the Day) banner...": "Configurando el banner MOTD (Mensaje del día)...",
+  "Configuring NVIDIA GPU passthrough...": "Configurando el paso a través de GPU NVIDIA...",
+  "Configuring NVIDIA KVM hiding...": "Configurando la ocultación de NVIDIA KVM...",
+  "Configuring NVIDIA and VFIO modules...": "Configurando módulos NVIDIA y VFIO...",
+  "Configuring PAM limits...": "Configurando límites de PAM...",
+  "Configuring ProxMenux Monitor filter...": "Configurando el filtro Monitor ProxMenux...",
+  "Configuring ProxMenux Monitor jail...": "Configurando la cárcel de ProxMenux Monitor...",
+  "Configuring Proxmox APT repositories...": "Configurando repositorios Proxmox APT...",
+  "Configuring Proxmox filter...": "Configurando el filtro Proxmox...",
+  "Configuring Proxmox jail...": "Configurando la cárcel de Proxmox...",
+  "Configuring TCP optimizations...": "Configurando optimizaciones de TCP...",
+  "Configuring TPM device": "Configurar el dispositivo TPM",
+  "Configuring VFIO modules...": "Configurando módulos VFIO...",
+  "Configuring VM": "Configurando la máquina virtual",
+  "Configuring bandwidth limit for vzdump...": "Configurando el límite de ancho de banda para vzdump...",
+  "Configuring boot order...": "Configurando el orden de arranque...",
+  "Configuring disk as": "Configurar el disco como",
+  "Configuring global Fail2Ban settings and SSH jail...": "Configurando los ajustes globales de Fail2Ban y la cárcel SSH...",
+  "Configuring host for GPU -> VM mode...": "Configurando host para GPU -> modo VM...",
+  "Configuring journald...": "Configurando diario...",
+  "Configuring kernel max Key limit...": "Configurando el límite máximo de claves del kernel...",
+  "Configuring kernel panic behavior": "Configurar el comportamiento de pánico del kernel",
+  "Configuring kernel swappiness...": "Configurando el intercambio de kernel...",
+  "Configuring kexec for quick reboots...": "Configurando kexec para reinicios rápidos...",
+  "Configuring max FD limit / ulimit...": "Configurando límite máximo de FD/ulimit...",
+  "Configuring max user watches...": "Configurando el número máximo de visualizaciones de usuarios...",
+  "Configuring pigz as a faster replacement for gzip...": "Configurando pigz como un reemplazo más rápido para gzip...",
+  "Configuring snapshot schedules...": "Configurando programas de instantáneas...",
+  "Configuring system time settings...": "Configurando los ajustes de hora del sistema...",
+  "Configuring vfio-pci binding...": "Configurando el enlace vfio-pci...",
+  "Confirm Borg passphrase": "Confirmar la frase de contraseña de Borg",
+  "Confirm Borg passphrase:": "Confirmar la contraseña de Borg:",
+  "Confirm Controller + NVMe Assignment": "Confirmar asignación de controlador + NVMe",
+  "Confirm Deletion": "Confirmar eliminación",
+  "Confirm Format": "Confirmar formato",
+  "Confirm GPU Switch Mode": "Confirmar el modo de cambio de GPU",
+  "Confirm Import": "Confirmar importación",
+  "Confirm Mount": "Confirmar montaje",
+  "Confirm Mount Point Removal": "Confirmar la eliminación del punto de montaje",
+  "Confirm Password": "confirmar Contraseña",
+  "Confirm Remove": "Confirmar eliminar",
+  "Confirm Restore": "Confirmar restauración",
+  "Confirm Uninstallation": "Confirmar la desinstalación",
+  "Confirm Unmount": "Confirmar desmontar",
+  "Confirm complete restore": "Confirmar restauración completa",
+  "Confirm custom restore": "confirmar restauración personalizada",
+  "Confirm delete": "Confirmar eliminación",
+  "Confirm export": "Confirmar exportación",
+  "Confirm password for": "Confirmar contraseña para",
+  "Confirm recovery passphrase:": "Confirmar la contraseña de recuperación:",
+  "Confirm the keyfile passphrase:": "confirme la frase de contraseña del archivo clave:",
+  "Confirm the mount path is visible.": "Confirme que la ruta de montaje sea visible.",
+  "Confirm the password:": "Confirme la contraseña:",
+  "Confirmation": "Confirmación",
+  "Confirmation Failed": "Error de confirmación",
+  "Conflicting drivers blacklisted successfully.": "Los conductores en conflicto se incluyeron exitosamente en la lista negra.",
+  "Conflicting path included in backup:": "Ruta conflictiva incluida en la copia de seguridad:",
+  "Conflicting utilities removed": "Se eliminaron las utilidades conflictivas",
+  "Connect a Coral Accelerator and try again.": "Conecte un Coral Accelerator y vuelva a intentarlo.",
+  "Connected": "Conectado",
+  "Connecting to PBS and starting backup...": "Conectándose a PBS e iniciando la copia de seguridad...",
+  "Connection Details:": "Detalles de conexión:",
+  "Connection Error": "Error de conexión",
+  "Connection details:": "Detalles de conexión:",
+  "Connectivity Test": "Prueba de conectividad",
+  "Connectivity Test Results": "Resultados de la prueba de conectividad",
+  "Consider adding physical interface": "Considere agregar una interfaz física",
+  "Consider removing its configuration": "Considere eliminar su configuración",
+  "Consider security implications for production environments": "Considere las implicaciones de seguridad para los entornos de producción.",
+  "Consider visiting the repository and supporting the project.": "considere visitar el repositorio y apoyar el proyecto.",
+  "Container": "Recipiente",
+  "Container         — LXC root directories": "Contenedor: directorios raíz de LXC",
+  "Container ID": "ID del contenedor",
+  "Container ID not defined. Make sure to select a container first.": "ID de contenedor no definido. Asegúrese de seleccionar un contenedor primero.",
+  "Container Mount Point": "Punto de montaje del contenedor",
+  "Container OS:": "SO de contenedor:",
+  "Container Path": "Ruta del contenedor",
+  "Container Path:": "Ruta del contenedor:",
+  "Container Status": "Estado del contenedor",
+  "Container configuration not found": "Configuración del contenedor no encontrada",
+  "Container did not become ready in time. Skipping driver installation.": "El contenedor no estuvo listo a tiempo. Saltarse la instalación del controlador.",
+  "Container did not start in time.": "El contenedor no arrancó a tiempo.",
+  "Container distro": "distribución de contenedores",
+  "Container does not have apt-get available. Coral driver installation only supports Debian/Ubuntu containers.": "El contenedor no tiene apt-get disponible. La instalación del controlador Coral solo admite contenedores Debian/Ubuntu.",
+  "Container is already stopped.": "El contenedor ya está detenido.",
+  "Container is running. Restart to apply changes?": "El contenedor está funcionando. ¿Reiniciar para aplicar cambios?",
+  "Container is stopped. Start it now to verify the mount works?": "El contenedor está detenido. ¿Iniciarlo ahora para verificar que el soporte funciona?",
+  "Container mount point:": "Punto de montaje del contenedor:",
+  "Container must be stopped before conversion": "El contenedor debe detenerse antes de la conversión.",
+  "Container restarted successfully": "El contenedor se reinició correctamente",
+  "Container started successfully": "El contenedor se inició correctamente",
+  "Container started successfully.": "El contenedor se inició correctamente.",
+  "Container started.": "Contenedor iniciado.",
+  "Container stopped.": "El contenedor se detuvo.",
+  "Container successfully converted to privileged.": "Contenedor convertido exitosamente a privilegiado.",
+  "Container template— LXC templates": "Plantilla de contenedor: plantillas LXC",
+  "Container will pick up the mount on next start": "El contenedor recogerá la montura en el próximo inicio.",
+  "Container with ID": "Contenedor con identificación",
+  "Container:": "Recipiente:",
+  "Contains files": "Contiene archivos",
+  "Contains:": "Contiene:",
+  "Content Types": "Tipos de contenido",
+  "Content Types:": "Tipos de contenido:",
+  "Content is usually images for VM block devices.": "El contenido suele ser imágenes para dispositivos de bloque VM.",
+  "Content type is fixed to:": "El tipo de contenido se fija en:",
+  "Content:": "Contenido:",
+  "Continue": "Continuar",
+  "Continue anyway?": "¿Continuar de todos modos?",
+  "Continue despite failures?": "¿Continuar a pesar de los fracasos?",
+  "Continue the VM wizard and reboot the host at the end.": "Continúe con el asistente de VM y reinicie el host al final.",
+  "Continue the Windows installation as usual.": "Continúe la instalación de Windows como de costumbre.",
+  "Continue with Coral TPU configuration only?": "¿Continuar solo con la configuración Coral TPU?",
+  "Continue with live apply now? SSH may disconnect immediately.": "¿Continuar con la solicitud en vivo ahora? SSH puede desconectarse inmediatamente.",
+  "Continue with the import?": "¿Continuar con la importación?",
+  "Continue: Proceed with conversion": "Continuar: continuar con la conversión",
+  "Continue?": "¿Continuar?",
+  "Continuing with your selection.": "Continuando con su selección.",
+  "Controller": "Controlador",
+  "Controller + NVMe": "Controlador + NVMe",
+  "Controller + NVMe assignment will be written now and become active after host reboot.": "La asignación de controlador + NVMe se escribirá ahora y se activará después de reiniciar el host.",
+  "Controller + NVMe passthrough requires machine type q35. Skipping controller assignment.": "El paso de controlador + NVMe requiere el tipo de máquina q35. Saltarse la asignación del controlador.",
+  "Controller/NVMe Conflict Policy": "Política de conflictos entre controlador y NVMe",
+  "Controller/NVMe already present in VM config": "Controlador/NVMe ya presente en la configuración de VM",
+  "Controller/NVMe assigned": "Controlador/NVMe asignado",
+  "Controller/NVMe is in use by running VM": "El controlador/NVMe está en uso al ejecutar VM",
+  "Controller/NVMe passthrough requires IOMMU enabled in BIOS/UEFI and kernel.": "La transferencia de controlador/NVMe requiere IOMMU habilitado en BIOS/UEFI y kernel.",
+  "Controller/NVMe passthrough requires machine type q35.": "La transferencia de controlador/NVMe requiere el tipo de máquina q35.",
+  "Controller/NVMe passthrough to VMs requires IOMMU enabled in BIOS/UEFI and kernel.": "La transferencia de controlador/NVMe a máquinas virtuales requiere IOMMU habilitado en BIOS/UEFI y kernel.",
+  "Controller/NVMe passthrough to VMs requires IOMMU to be enabled in the kernel.": "La transferencia del controlador/NVMe a las máquinas virtuales requiere que IOMMU esté habilitado en el kernel.",
+  "Controller/NVMe passthrough — compatibility notice": "Transferencia de controlador/NVMe: aviso de compatibilidad",
+  "Controller/NVMe removed from source VM": "Controlador/NVMe eliminado de la VM de origen",
+  "Controllers + NVMe": "Controladores + NVMe",
+  "Controllers + NVMe Selected:": "Controladores + NVMe seleccionados:",
+  "Convert Privileged to Unprivileged": "Convertir privilegiados en no privilegiados",
+  "Convert Unprivileged to Privileged": "Convertir personas no privilegiadas en privilegiadas",
+  "Convert directory ownership:": "Convertir la propiedad del directorio:",
+  "Convert disk image format": "Convertir formato de imagen de disco",
+  "Convert disk image format using QEMU-IMG": "Convertir formato de imagen de disco usando QEMU-IMG",
+  "Convert file ownership (this takes time):": "Convertir la propiedad del archivo (esto lleva tiempo):",
+  "Converted + verified:": "Convertido + verificado:",
+  "Converted container ID:": "ID de contenedor convertido:",
+  "Converting container to privileged...": "Convirtiendo contenedor a privilegiado...",
+  "Converting disk": "Convirtiendo disco",
+  "Converting file ownership (this may take several minutes)...": "Convirtiendo la propiedad del archivo (esto puede tardar varios minutos)...",
+  "Converting image using command:": "Convertir imagen usando el comando:",
+  "Converts to deb822; keeps .list backups as .bak": "Se convierte a deb822; mantiene las copias de seguridad .list como .bak",
+  "Copy failed": "Copia fallida",
+  "Copy that file offsite yourself, or download it from the Monitor.": "copie ese archivo fuera del sitio usted mismo o descárguelo del Monitor.",
+  "Copy the correct keyfile to this host and rerun Restore — or pick an unencrypted backup.": "copie el archivo de claves correcto en este host y vuelva a ejecutar Restaurar, o elija una copia de seguridad sin cifrar.",
+  "Copy the keyfile to a path for offsite backup": "copie el archivo de claves a una ruta para realizar una copia de seguridad externa",
+  "Copy your PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to": "primero copie su archivo de clave PBS en este host (a través de scp, USB, sftp, etc.) e ingrese su ruta absoluta a continuación.El archivo se copiará a",
+  "Copy your existing PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to": "primero copie su archivo de claves PBS existente en este host (a través de scp, USB, sftp, etc.) e ingrese su ruta absoluta a continuación.El archivo se copiará a",
+  "Copying installer to container": "Copiando el instalador al contenedor",
+  "Copying sources to": "Copiar fuentes a",
+  "Coral APT repository ready.": "Repositorio Coral APT listo.",
+  "Coral Actions": "Acciones coralinas",
+  "Coral M.2 / PCIe detected — installing gasket and apex kernel modules...": "Se detectó Coral M.2/PCIe: instalación de módulos de junta y kernel apex...",
+  "Coral M.2 Apex configuration added - device ready": "Configuración de Coral M.2 Apex agregada: dispositivo listo",
+  "Coral M.2 Apex configuration added - device will be available after reboot": "Se agregó la configuración de Coral M.2 Apex: el dispositivo estará disponible después del reinicio",
+  "Coral M.2 Apex detected, configuring...": "Coral M.2 Apex detectado, configurando...",
+  "Coral TPU Installation": "Instalación de TPU Coral",
+  "Coral TPU Uninstall": "Desinstalación de Coral TPU",
+  "Coral TPU device nodes detected with correct group (apex).": "Nodos del dispositivo Coral TPU detectados con el grupo correcto (ápice).",
+  "Coral TPU driver installed successfully inside the container.": "El controlador Coral TPU se instaló correctamente dentro del contenedor.",
+  "Coral TPU drivers installed and loaded successfully.": "Los controladores Coral TPU se instalaron y cargaron correctamente.",
+  "Coral TPU is already installed on this host:": "Coral TPU ya está instalado en este host:",
+  "Coral TPU is already installed:": "Coral TPU ya está instalado:",
+  "Coral USB Accelerator detected — installing Edge TPU runtime...": "Se detectó Coral USB Accelerator: instalando el tiempo de ejecución de Edge TPU...",
+  "Coral USB configuration added - device detected": "Configuración de Coral USB agregada: dispositivo detectado",
+  "Coral USB configured but device not currently connected": "Coral USB configurado pero el dispositivo no está conectado actualmente",
+  "Coral USB runtime installed. No reboot required.": "Tiempo de ejecución Coral USB instalado. No es necesario reiniciar.",
+  "Coral hardware configuration completed for container": "Configuración de hardware Coral completada para contenedor",
+  "Coral kernel modules unloaded.": "Módulos del kernel de Coral descargados.",
+  "Coral packages purged.": "Paquetes de coral purgados.",
+  "Coral uninstallation completed.": "Se completó la desinstalación de Coral.",
+  "Core Proxmox packages reinstalled successfully": "Paquetes Core Proxmox reinstalados exitosamente",
+  "Core packages": "Paquetes principales",
+  "Could not add": "No se pudo agregar",
+  "Could not add disk": "No se pudo agregar el disco",
+  "Could not assign disk": "No se pudo asignar el disco",
+  "Could not authorize the key via 'pct exec' on": "No se pudo autorizar la clave a través de 'pct exec' en",
+  "Could not back up the existing auth.json": "No se pudo realizar una copia de seguridad del auth.json existente",
+  "Could not change VM virtual display to vga: std": "No se pudo cambiar la pantalla virtual de VM a vga: estándar",
+  "Could not clone any gasket-driver repository. Check your internet connection and": "No se pudo clonar ningún repositorio de controladores de juntas. Comprueba tu conexión a Internet y",
+  "Could not configure IOMMU kernel parameters automatically. Configure manually and reboot.": "No se pudieron configurar los parámetros del kernel IOMMU automáticamente. Configure manualmente y reinicie.",
+  "Could not copy the PVE keyfile into place. Check permissions on:": "No se pudo copiar el archivo de claves PVE en su lugar.Verifique los permisos en:",
+  "Could not copy the keyfile into place.": "no se pudo copiar el archivo de claves en su lugar.",
+  "Could not copy the keyfile into place. Check permissions on:": "no se pudo copiar el archivo de claves en su lugar.Verifique los permisos en:",
+  "Could not create converter directory:": "No se pudo crear el directorio del convertidor:",
+  "Could not create destination directory:": "No se pudo crear el directorio de destino:",
+  "Could not create or access directory:": "No se pudo crear o acceder al directorio:",
+  "Could not create temporary directory:": "No se pudo crear el directorio temporal:",
+  "Could not create temporary working directory.": "No se pudo crear un directorio de trabajo temporal.",
+  "Could not detect apex major number from /proc/devices. Load the apex module first: modprobe apex": "No se pudo detectar el número principal del ápice desde /proc/devices. Cargue el módulo apex primero: modprobe apex",
+  "Could not detect the CIFS mount for this directory. Try accessing it manually.": "No se pudo detectar el montaje CIFS para este directorio. Intente acceder manualmente.",
+  "Could not determine a valid ISO storage directory.": "No se pudo determinar un directorio de almacenamiento ISO válido.",
+  "Could not determine disk path for:": "No se pudo determinar la ruta del disco para:",
+  "Could not determine the IOMMU group for the selected GPU.": "No se pudo determinar el grupo IOMMU para la GPU seleccionada.",
+  "Could not download recovery blob from PBS.": "No se pudo descargar el blob de recuperación de PBS.",
+  "Could not download the installer.": "No se pudo descargar el instalador.",
+  "Could not enable on-boot restore service.": "No se pudo habilitar el servicio de restauración al arrancar.",
+  "Could not export ZFS pool": "No se pudo exportar el grupo ZFS",
+  "Could not extract from PBS.": "No se pudo extraer de PBS.",
+  "Could not fetch keylase/nvidia-patch supported list — patch reapply compatibility is not verified.": "No se pudo recuperar la lista compatible con keylase/nvidia-patch: no se ha verificado la compatibilidad con la reaplicación del parche.",
+  "Could not find a valid 'proxmox-ve' 9.x candidate after switching to no-subscription. Please verify your repository configuration and network, then retry.": "No se pudo encontrar un candidato válido para 'proxmox-ve' 9.x después de cambiar a sin suscripción. Verifique la configuración y la red de su repositorio y luego vuelva a intentarlo.",
+  "Could not find rootfs configuration for container.": "No se pudo encontrar la configuración de rootfs para el contenedor.",
+  "Could not format the disk.": "No se pudo formatear el disco.",
+  "Could not fully zero": "No se pudo poner completamente a cero",
+  "Could not identify the imported disk in VM config": "No se pudo identificar el disco importado en la configuración de VM",
+  "Could not install": "No se pudo instalar",
+  "Could not install Git — Lynis cannot be cloned. Run 'apt-get install git' manually.": "No se pudo instalar Git: Lynis no se puede clonar. Ejecute 'apt-get install git' manualmente.",
+  "Could not install exFAT tools automatically.": "No se pudieron instalar las herramientas exFAT automáticamente.",
+  "Could not install sshpass automatically (no internet?). Falling back to manual paste mode — you'll see the line to copy onto the server next.": "No se pudo instalar sshpass automáticamente (¿no hay Internet?).Volviendo al modo de pegado manual, verá la línea para copiar en el servidor a continuación.",
+  "Could not install vzdump hook in /etc/vzdump.conf": "No se pudo instalar el gancho vzdump en /etc/vzdump.conf",
+  "Could not load shared functions. Script cannot continue.": "No se pudieron cargar funciones compartidas. El guión no puede continuar.",
+  "Could not locate imported disk in VM config.": "No se pudo ubicar el disco importado en la configuración de VM.",
+  "Could not mount": "No se pudo montar",
+  "Could not mount ISO on device": "No se pudo montar ISO en el dispositivo",
+  "Could not parse OVF file, or no disk image references found.": "No se pudo analizar el archivo OVF o no se encontraron referencias de imágenes de disco.",
+  "Could not push the key. Check the password and that": "No se pudo presionar la tecla.Verifique la contraseña y eso",
+  "Could not read SMART data from": "No se pudieron leer los datos SMART de",
+  "Could not read VM configuration.": "No se pudo leer la configuración de la VM.",
+  "Could not remount automatically. Try manually or check credentials.": "No se pudo volver a montar automáticamente. Pruebe manualmente o verifique las credenciales.",
+  "Could not remove VM automatically. Run manually:": "No se pudo eliminar la VM automáticamente. Ejecutar manualmente:",
+  "Could not remove previous DKMS tree at": "No se pudo eliminar el árbol DKMS anterior en",
+  "Could not restart ProxMenux Monitor service.": "No se pudo reiniciar el servicio ProxMenux Monitor.",
+  "Could not restart the service — start it manually with systemctl start": "No se pudo reiniciar el servicio; inícielo manualmente con systemctl start",
+  "Could not retrieve versions list from NVIDIA. Please check your internet connection.": "No se pudo recuperar la lista de versiones de NVIDIA. Por favor verifique su conexión a Internet.",
+  "Could not run NVIDIA patch script. Please verify repository and driver version.": "No se pudo ejecutar el script de parche de NVIDIA. Verifique el repositorio y la versión del controlador.",
+  "Could not set VM virtual display to vga: std": "No se pudo configurar la pantalla virtual de VM en vga: estándar",
+  "Could not set boot order for": "No se pudo establecer el orden de inicio para",
+  "Could not stop LXC": "No se pudo detener LXC",
+  "Could not unload nouveau module (may be in use). The blacklist will take effect after reboot. Installation will continue but a reboot will be required.": "No se pudo descargar el módulo nouveau (puede estar en uso). La lista negra entrará en vigor después del reinicio. La instalación continuará pero será necesario reiniciar.",
+  "Could not unmount": "No se pudo desmontar",
+  "Could not unmount — disk may be busy. Removing fstab entry anyway.": "No se pudo desmontar: es posible que el disco esté ocupado. Eliminando la entrada fstab de todos modos.",
+  "Could not update config file.": "No se pudo actualizar el archivo de configuración.",
+  "Could not write to:": "No se pudo escribir a:",
+  "Create": "Crear",
+  "Create Directory": "Crear directorio",
+  "Create GPT and one partition:": "Crea GPT y una partición:",
+  "Create GPT partition": "Crear partición GPT",
+  "Create LXC server NFS": "Crear servidor LXC NFS",
+  "Create Network Backup": "Crear copia de seguridad de red",
+  "Create Samba server service": "Crear servicio de servidor Samba",
+  "Create Samba user:": "Crear usuario de Samba:",
+  "Create Shared Directory": "Crear directorio compartido",
+  "Create Shared Directory on Host": "Crear directorio compartido en el host",
+  "Create Universal NFS Export": "Crear exportación NFS universal",
+  "Create VM from template or script": "Crear VM a partir de una plantilla o script",
+  "Create a VM first (machine type q35 + UEFI BIOS), then run this option again.": "Primero cree una máquina virtual (tipo de máquina q35 + UEFI BIOS), luego ejecute esta opción nuevamente.",
+  "Create a backup of the container configuration:": "Cree una copia de seguridad de la configuración del contenedor:",
+  "Create a backup of your container before proceeding": "Cree una copia de seguridad de su contenedor antes de continuar",
+  "Create a fresh GPT + ext4 partition and mount it?": "¿Crear una nueva partición GPT + ext4 y montarla?",
+  "Create a new dataset in a ZFS pool": "Crear un nuevo conjunto de datos en un grupo ZFS",
+  "Create a new group for isolation": "Crear un nuevo grupo para aislamiento",
+  "Create credentials file (recommended):": "Crear archivo de credenciales (recomendado):",
+  "Create directory": "Crear directorio",
+  "Create export directory:": "Crear directorio de exportación:",
+  "Create mount point:": "Crear punto de montaje:",
+  "Create new directory in /mnt": "Crear nuevo directorio en /mnt",
+  "Create new folder in /mnt": "Crear nueva carpeta en /mnt",
+  "Create one first in Datacenter → Backup, then return here to attach.": "cree uno primero en Centro de datos → Copia de seguridad, luego regrese aquí para adjuntarlo.",
+  "Create persistent network interface names?": "¿Crear nombres de interfaz de red persistentes?",
+  "Create scheduled backup job": "Crear trabajo de copia de seguridad programado",
+  "Create share directory:": "Crear directorio compartido:",
+  "Create shared directory:": "Crear directorio compartido:",
+  "Created common remapped user": "Usuario común reasignado creado",
+  "Created directory on host:": "Directorio creado en el host:",
+  "Created persistent names for": "Creó nombres persistentes para",
+  "Created remapped user": "Usuario reasignado creado",
+  "Created sharedfiles group (GID: 101000)": "Grupo de archivos compartidos creado (GID: 101000)",
+  "Creating APT configuration to force IPv4...": "Creando configuración APT para forzar IPv4...",
+  "Creating Ceph repository for PVE 8 (legacy format)...": "Creando repositorio Ceph para PVE 8 (formato heredado)...",
+  "Creating Ceph repository for PVE 9 (deb822 format)...": "Creando repositorio Ceph para PVE 9 (formato deb822)...",
+  "Creating Proxmox VE 9.x no-subscription repository...": "Creando repositorio sin suscripción Proxmox VE 9.x...",
+  "Creating Proxmox auth logger service...": "Creando el servicio de registro de autenticación Proxmox...",
+  "Creating SSH auth logger service...": "Creando servicio de registro de autenticación SSH...",
+  "Creating UID remapping for unprivileged container compatibility...": "Creando reasignación de UID para compatibilidad con contenedores sin privilegios...",
+  "Creating VM with the above configuration": "Creando VM con la configuración anterior",
+  "Creating VM...": "Creando máquina virtual...",
+  "Creating backup of configuration file...": "Creando copia de seguridad del archivo de configuración...",
+  "Creating backup of network interfaces configuration...": "Creando copia de seguridad de la configuración de las interfaces de red...",
+  "Creating compressed archive...": "Creando archivo comprimido...",
+  "Creating export archive...": "Creando archivo de exportación...",
+  "Creating local archive...": "Creando archivo local...",
+  "Creating mount point...": "Creando punto de montaje...",
+  "Creating new ZFS ARC configuration...": "Creando nueva configuración ZFS ARC...",
+  "Creating partition table and partition...": "Creando tabla de particiones y partición...",
+  "Creating partition...": "Creando partición...",
+  "Creating pigz wrapper script...": "Creando script contenedor pigz...",
+  "Credentials are correct": "Las credenciales son correctas",
+  "Credentials cleared. jwt_secret and API tokens preserved.": "Credenciales borradas. Se conservan los tokens jwt_secret y API.",
+  "Credentials file created securely.": "Archivo de credenciales creado de forma segura.",
+  "Credentials file removed.": "Archivo de credenciales eliminado.",
+  "Credentials file:": "Archivo de credenciales:",
+  "Credentials validated successfully": "Credenciales validadas exitosamente",
+  "Cross-host restore: guest IDs in backup overlap live IDs on target:": "Restauración entre hosts: los ID de invitados en la copia de seguridad se superponen a los ID activos en el destino:",
+  "Cross-kernel restore — kernel-tied paths merged, not copied": "restauración entre núcleos: rutas vinculadas al núcleo fusionadas, no copiadas",
+  "Cross-kernel — paths hidden from picker": "Cross-kernel: rutas ocultas al selector",
+  "Cross-version detected — safe restore mode": "Se detectó una versión cruzada: modo de restauración segura",
+  "Current": "Actual",
+  "Current CIFS mounts:": "Montajes CIFS actuales:",
+  "Current Configuration": "Configuración actual",
+  "Current LXC Mount Points": "Puntos de montaje LXC actuales",
+  "Current NFS Mounts": "Montajes NFS actuales",
+  "Current NFS client script supports privileged LXC only.": "La secuencia de comandos del cliente NFS actual solo admite LXC privilegiado.",
+  "Current NFS exports in CT": "Exportaciones actuales de NFS en CT",
+  "Current NFS mounts:": "Montajes NFS actuales:",
+  "Current Network Configuration": "Configuración de red actual",
+  "Current PVE Version": "Versión PVE actual",
+  "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Los scripts de host ProxMenux actuales registran recursos compartidos remotos como almacenamientos en Proxmox utilizando pvesm.",
+  "Current ProxMenux version:": "Versión actual de ProxMenux:",
+  "Current Samba Mounts": "Monturas de Samba actuales",
+  "Current Samba client script supports privileged LXC only.": "El script del cliente Samba actual solo admite LXC privilegiado.",
+  "Current Samba shares in CT": "Acciones actuales de Samba en CT",
+  "Current channel:": "Canal actual:",
+  "Current driver": "Conductor actual",
+  "Current free space:": "Espacio libre actual:",
+  "Current language:": "Idioma actual:",
+  "Current mode": "Modo actual",
+  "Current mount options:": "Opciones de montaje actuales:",
+  "Current permissions:": "Permisos actuales:",
+  "Current power state: D3cold (device currently inaccessible)": "Estado de energía actual: D3cold (dispositivo actualmente inaccesible)",
+  "Current script uses native bind mounts with pct set -mpX.": "El script actual utiliza montajes de enlace nativos con pct set -mpX.",
+  "Current selection:": "Selección actual:",
+  "Current status:": "Estado actual:",
+  "Current user": "Usuario actual",
+  "Current user UID, GID and groups": "UID, GID y grupos del usuario actual",
+  "Current version:": "Versión actual:",
+  "Currently": "actualmente",
+  "Currently Mounted:": "Actualmente montado:",
+  "Currently configured target:": "Destino actualmente configurado:",
+  "Currently mounted:": "Actualmente montado:",
+  "Custom": "Costumbre",
+  "Custom Configuration": "Configuración personalizada",
+  "Custom Content": "Contenido personalizado",
+  "Custom Directory": "Directorio personalizado",
+  "Custom Logo Instructions": "Instrucciones de logotipo personalizado",
+  "Custom Options": "Opciones personalizadas",
+  "Custom Path": "Ruta personalizada",
+  "Custom backup paths": "rutas de copia de seguridad personalizadas",
+  "Custom backup profile": "Perfil de copia de seguridad personalizado",
+  "Custom backup to Borg": "Copia de seguridad personalizada en Borg",
+  "Custom backup to PBS": "Copia de seguridad personalizada en PBS",
+  "Custom backup to local archive": "Copia de seguridad personalizada en archivo local",
+  "Custom local directory": "Directorio local personalizado",
+  "Custom message added to MOTD": "Mensaje personalizado agregado a MOTD",
+  "Custom options": "Opciones personalizadas",
+  "Custom path": "Ruta personalizada",
+  "Custom path...": "Ruta personalizada...",
+  "Custom paths are included in BOTH default and custom backup profiles.": "Las rutas personalizadas se incluyen tanto en los perfiles de copia de seguridad predeterminados como en los personalizados.",
+  "Custom restore by components": "Restauración personalizada por componentes",
+  "Custom restore by paths": "restauración personalizada por rutas",
+  "Custom scripts and ProxMenux files": "Scripts personalizados y archivos ProxMenux",
+  "Custom selection": "Selección personalizada",
+  "Custom systemd units": "Unidades de sistema personalizadas",
+  "Customizable post-installation script": "Script personalizable      Post-Install",
+  "Customization": "Personalización",
+  "Customize bashrc": "Personalizar bashrc",
+  "Customizing bashrc for root user...": "Personalizando bashrc para usuario root...",
+  "DISABLED unless you enable it": "DESHABILITADO a menos que lo habilites",
+  "DKMS add failed. Check": "Error al agregar DKMS. Controlar",
+  "DKMS build failed.": "Error en la compilación de DKMS.",
+  "DKMS build failed. Last lines of make.log:": "Error en la compilación de DKMS. Últimas líneas de make.log:",
+  "DKMS install failed.": "La instalación de DKMS falló.",
+  "DKMS module registered.": "Módulo DKMS registrado.",
+  "DNS Resolution": "Resolución DNS",
+  "DNS lookup for a domain": "Búsqueda de DNS para un dominio",
+  "Data size:": "Tamaño de datos:",
+  "Data wipe complete.": "Borrado de datos completo.",
+  "Data wiped from": "Datos borrados de",
+  "Datastore name:": "Nombre del almacén de datos:",
+  "Deactivate Monitor": "Desactivar monitor",
+  "Deactivate ProxMenux Monitor": "Desactivar Monitor ProxMenux",
+  "Debian repositories missing; creating default source file": "Faltan repositorios de Debian; creando un archivo fuente predeterminado",
+  "Decompress backup manually": "Descomprimir la copia de seguridad manualmente",
+  "Decryption failed. The passphrase may be wrong, or the blob is corrupt. Try again?": "Falló el descifrado.La frase de contraseña puede ser incorrecta o el blob está dañado.¿Intentar otra vez?",
+  "Default ACLs applied for group inheritance.": "ACL predeterminadas aplicadas para la herencia de grupo.",
+  "Default Credentials": "Credenciales predeterminadas",
+  "Default Gateway": "Puerta de enlace predeterminada",
+  "Default ISO directory": "Directorio ISO predeterminado",
+  "Default Login Credentials:": "Credenciales de inicio de sesión predeterminadas:",
+  "Default Port": "Puerto predeterminado",
+  "Default Proxmox logo applied": "Logotipo predeterminado de Proxmox aplicado",
+  "Default is none (video-only passthrough). Use SPACE to toggle selections.": "El valor predeterminado es ninguno (transmisión de solo video). Utilice la ESPACIO para alternar selecciones.",
+  "Default journald configuration restored": "Configuración de diario predeterminada restaurada",
+  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "La ubicación predeterminada es /mnt/<nombre>. El recurso compartido se montará aquí en el host con permisos abiertos para que un LXC sin privilegios pueda vincularlo, montarlo y escribir en él. Para acceder a LXC, vincule esta ruta con LXC Mount Manager.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "La ubicación predeterminada es /mnt/<nombre>. El recurso compartido se montará aquí en el host. Utilice esta ruta en /etc/fstab. Para acceder a LXC, vincule esta ruta con LXC Mount Manager.",
+  "Default options": "Opciones predeterminadas",
+  "Default options read/write": "Opciones predeterminadas lectura/escritura",
+  "Default will be used:": "Se utilizará el valor predeterminado:",
+  "Default:": "Predeterminado:",
+  "Delete Borg target": "Eliminar objetivo Borg",
+  "Delete Export": "Eliminar Exportar",
+  "Delete Share": "Eliminar Compartir",
+  "Delete a CT (irreversible). Use the correct <ctid>": "Eliminar un CT (irreversible). Utilice el <ctid> correcto",
+  "Delete a VM (irreversible). Use the correct <vmid>": "Eliminar una VM (irreversible). Utilice el <vmid> correcto",
+  "Delete archive": "Eliminar archivo",
+  "Delete job": "Eliminar tarea de copia de seguridad",
+  "Delete scheduled backup job?": "¿Eliminar la tarea de copia de seguridad programada?",
+  "Delete this corrupt archive and pick another": "elimine este archivo corrupto y elija otro",
+  "Dependencies installed successfully": "Dependencias instaladas exitosamente",
+  "Deploy with this configuration?": "¿Implementar con esta configuración?",
+  "Deploying Secure Gateway...": "Implementando puerta de enlace segura...",
+  "Deployment cancelled.": "Despliegue cancelado.",
+  "Deployment failed": "Error en la implementación",
+  "Description": "Descripción",
+  "Desktop UI backup created": "Se creó la copia de seguridad de la interfaz de usuario del escritorio",
+  "Desktop and Mobile UI patched": "UI de escritorio y móvil parcheada",
+  "Destination Directory": "Directorio de destino",
+  "Destination directory does not exist:": "El directorio de destino no existe:",
+  "Destination directory is not writable:": "El directorio de destino no se puede escribir:",
+  "Destination path for the copy (typically outside ProxMenux state):": "ruta de destino de la copia (normalmente fuera del estado ProxMenux):",
+  "Destination:": "Destino:",
+  "Destroy a ZFS dataset (irreversible)": "Destruir un conjunto de datos ZFS (irreversible)",
+  "Destructive rollback": "retroceso destructivo",
+  "Detailed Proxmox version info": "Información detallada de la versión de Proxmox",
+  "Detailed partition layout with GPT info": "Diseño de partición detallado con información GPT",
+  "Detailed service information": "Información detallada del servicio",
+  "Details": "Detalles",
+  "Detect GPUs in host": "Detectar GPU en el host",
+  "Detect controller/NVMe BDF": "Detectar controlador/NVMe BDF",
+  "Detected": "Detectado",
+  "Detected AMD CPU": "CPU AMD detectada",
+  "Detected Coral hardware:": "Hardware de coral detectado:",
+  "Detected GPU(s):": "GPU detectadas:",
+  "Detected Intel CPU": "CPU Intel detectada",
+  "Detected Proxmox VE": "Proxmox VE detectado",
+  "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Proxmox VE 8.x detectado: instalación de Ceph Squid para Debian",
+  "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Detectado Proxmox VE 9.x - Instalación de Ceph Squid para Debian Trixie",
+  "Detected RAM:": "RAM detectada:",
+  "Detected a mounted directory from host. Setting up shared group...": "Se detectó un directorio montado desde el host. Configurando grupo compartido...",
+  "Detected backups — newest first:": "Copias de seguridad detectadas: las más nuevas primero:",
+  "Detected broken gasket-dkms package state:": "Estado del paquete de junta rota detectada-dkms:",
+  "Detected existing Samba user:": "Usuario de Samba existente detectado:",
+  "Detected filesystem:": "Sistema de archivos detectado:",
+  "Detected nftables - using nftables ban action": "Nftables detectados: uso de la acción de prohibición de nftables",
+  "Detected paths in this backup:": "Rutas detectadas en esta copia de seguridad:",
+  "Detected power state": "Estado de energía detectado",
+  "Detected reset method": "Método de reinicio detectado",
+  "Detected risk factor": "Factor de riesgo detectado",
+  "Detected subtype": "Subtipo detectado",
+  "Detected:": "Detectado:",
+  "Detecting AMD CPU and applying fixes if necessary...": "Detectando CPU AMD y aplicando correcciones si es necesario...",
+  "Detecting PCI storage controllers and NVMe devices...": "Detectando controladores de almacenamiento PCI y dispositivos NVMe...",
+  "Detecting available disks...": "Detectando discos disponibles...",
+  "Detecting container OS...": "Detectando SO de contenedor...",
+  "Detecting if this is an OVH server and installing OVH RTM if necessary...": "Detectando si se trata de un servidor OVH e instalando OVH RTM si es necesario...",
+  "Detecting previous optimizations...": "Detectando optimizaciones anteriores...",
+  "Detecting virtualization and installing  guest agent...": "Detectando virtualización e instalando agente invitado...",
+  "Development Tools": "Herramientas de desarrollo",
+  "Device In Use": "Dispositivo en uso",
+  "Device added": "Dispositivo agregado",
+  "Device already present in target VM — existing hostpci entry reused": "Dispositivo ya presente en la máquina virtual de destino: se reutiliza la entrada hostpci existente",
+  "Device assignments will be written now and become active after reboot.": "Las asignaciones de dispositivos se escribirán ahora y se activarán después del reinicio.",
+  "Device hostname": "Nombre de host del dispositivo",
+  "Device path mismatch. Format cancelled.": "la ruta del dispositivo no coincide.Formato cancelado.",
+  "Device:": "Dispositivo:",
+  "Devices to add to VM": "Dispositivos para agregar a VM",
+  "Diff: current system vs backup (--- system  +++ backup)": "Diferencia: sistema actual vs copia de seguridad (--- sistema +++ copia de seguridad)",
+  "Different host. Backup from:": "anfitrión diferente.Copia de seguridad desde:",
+  "Direct conversion completed for container": "Conversión directa completada para contenedor.",
+  "Directory Exists": "El directorio existe",
+  "Directory Not Empty": "Directorio no vacío",
+  "Directory Not Found": "Directorio no encontrado",
+  "Directory already exists. Continue with permission setup?": "El directorio ya existe. ¿Continuar con la configuración de permisos?",
+  "Directory configured for sharedfiles group access on:": "Directorio configurado para acceso al grupo de archivos compartidos en:",
+  "Directory configured with sharedfiles group ownership": "Directorio configurado con propiedad del grupo de archivos compartidos",
+  "Directory created successfully.": "Directorio creado exitosamente.",
+  "Directory created successfully:": "Directorio creado exitosamente:",
+  "Directory created:": "Directorio creado:",
+  "Directory does not exist and was not created.": "El directorio no existe y no fue creado.",
+  "Directory does not exist:": "El directorio no existe:",
+  "Directory error": "error de directorio",
+  "Directory not found": "Directorio no encontrado",
+  "Directory storage added successfully to Proxmox!": "¡Almacenamiento de directorio agregado exitosamente a Proxmox!",
+  "Directory successfully.": "Directorio con éxito.",
+  "Directory:": "Directorio:",
+  "Disable NIC Offloading (Intel e1000e)": "Desactivar descarga NIC (Intel e1000e)",
+  "Disable autostart on conflicting VM": "Deshabilitar el inicio automático en VM en conflicto",
+  "Disable autostart on one VM to avoid startup conflicts.": "Deshabilite el inicio automático en una VM para evitar conflictos de inicio.",
+  "Disable kernel audit messages (optional but recommended):": "Deshabilite los mensajes de auditoría del kernel (opcional pero recomendado):",
+  "Disable onboot on affected VM(s)/CT(s)": "Deshabilitar el arranque en las VM/CT afectadas",
+  "Disable portmapper/rpcbind": "Desactivar portmapper/rpcbind",
+  "Disabled": "Desactivado",
+  "Disabling High Availability services...": "Deshabilitando los servicios de alta disponibilidad...",
+  "Disabling ZFS autotrim applied by ProxMenux...": "Deshabilitando el recorte automático ZFS aplicado por ProxMenux...",
+  "Disabling and removing NetworkManager...": "Deshabilitando y eliminando NetworkManager...",
+  "Disabling and stopping rpcbind service...": "Deshabilitando y deteniendo el servicio rpcbind...",
+  "Disabling non-free firmware warnings...": "Deshabilitando las advertencias de firmware no libre...",
+  "Disabling portmapper/rpcbind for security...": "Deshabilitando portmapper/rpcbind por seguridad...",
+  "Discover targets on portal:": "Descubra objetivos en el portal:",
+  "Discovering iSCSI targets...": "Descubriendo objetivos iSCSI...",
+  "Discovery successful": "Descubrimiento exitoso",
+  "Disk": "Disco",
+  "Disk Already Assigned": "Disco ya asignado",
+  "Disk In Use": "Disco en uso",
+  "Disk In Use by Running VM": "Disco en uso ejecutando VM",
+  "Disk Manager": "Administrador de discos",
+  "Disk Reference Conflict": "Conflicto de referencia de disco",
+  "Disk Setup": "Configuración del disco",
+  "Disk added as": "Disco agregado como",
+  "Disk already has": "El disco ya tiene",
+  "Disk and Storage Manager - Manual CLI Guide": "Administrador de discos y almacenamiento: guía CLI manual",
+  "Disk appears empty. It will be formatted.": "El disco parece vacío. Se formateará.",
+  "Disk assigned at": "Disco asignado en",
+  "Disk attached as:": "Disco adjunto como:",
+  "Disk configured as": "Disco configurado como",
+  "Disk conversion failed for": "La conversión del disco falló para",
+  "Disk file not found:": "Archivo de disco no encontrado:",
+  "Disk formatted as": "Disco formateado como",
+  "Disk formatted successfully.": "Disco formateado exitosamente.",
+  "Disk image        — VM disk images": "Imagen de disco: imágenes de disco de VM",
+  "Disk interface is required to continue VM creation.": "Se requiere una interfaz de disco para continuar con la creación de VM.",
+  "Disk interface selected:": "Interfaz de disco seleccionada:",
+  "Disk interface selection cancelled.": "Selección de interfaz de disco cancelada.",
+  "Disk is part of a host ZFS pool": "El disco es parte de un grupo ZFS de host",
+  "Disk is part of host LVM": "El disco es parte del host LVM",
+  "Disk is ready for VM passthrough.": "El disco está listo para el paso de VM.",
+  "Disk is ready to be added to Proxmox storage.": "El disco está listo para agregarse al almacenamiento de Proxmox.",
+  "Disk metadata cleaned.": "Metadatos del disco limpios.",
+  "Disk mounted at": "Disco montado en",
+  "Disk path resolved via pvesm:": "Ruta del disco resuelta mediante pvesm:",
+  "Disk path:": "Ruta del disco:",
+  "Disk safety revalidation failed.": "Error en la revalidación de seguridad del disco.",
+  "Disk safety validation passed.": "Se pasó la validación de seguridad del disco.",
+  "Disk unmounted from": "Disco desmontado de",
+  "Disk verified and accessible inside CT at": "Disco verificado y accesible dentro de CT en",
+  "Disk:": "Disco:",
+  "Disks exported:": "Discos exportados:",
+  "Disks to export:": "Discos para exportar:",
+  "Disks to import:": "Discos para importar:",
+  "Disks to process:": "Discos para procesar:",
+  "Disks:": "Discos:",
+  "Display  :": "Mostrar  :",
+  "Display logical volumes (LVM)": "Mostrar volúmenes lógicos (LVM)",
+  "Display physical volumes (LVM)": "Mostrar volúmenes físicos (LVM)",
+  "Display system summary in ASCII format": "Mostrar resumen del sistema en formato ASCII",
+  "Display volume groups (LVM)": "Mostrar grupos de volúmenes (LVM)",
+  "Do not run the upgrade from the Web UI virtual console (it will disconnect)": "No ejecute la actualización desde la consola virtual de la interfaz de usuario web (se desconectará)",
+  "Do not start the VM until the system has been rebooted.": "No inicie la VM hasta que se haya reiniciado el sistema.",
+  "Do you want ProxMenux to stop it now?": "¿Quieres que ProxMenux lo detenga ahora?",
+  "Do you want to activate ProxMenux Monitor?": "¿Quieres activar ProxMenux Monitor?",
+  "Do you want to apply the optional NVIDIA patch to remove some GPU limitations?": "¿Quieres aplicar el parche opcional de NVIDIA para eliminar algunas limitaciones de la GPU?",
+  "Do you want to apply these optimizations now?": "¿Quieres aplicar estas optimizaciones ahora?",
+  "Do you want to configure GPU passthrough for this VM now?": "¿Quiere configurar el paso de GPU para esta máquina virtual ahora?",
+  "Do you want to continue anyway?": "¿Quieres continuar de todos modos?",
+  "Do you want to continue with the conversion now, or exit to create a backup first?": "¿Quiere continuar con la conversión ahora o salir para crear una copia de seguridad primero?",
+  "Do you want to continue?": "¿Quieres continuar?",
+  "Do you want to convert it to a privileged container now?": "¿Quieres convertirlo en un contenedor privilegiado ahora?",
+  "Do you want to create it now?": "¿Quieres crearlo ahora?",
+  "Do you want to create it?": "¿Quieres crearlo?",
+  "Do you want to deactivate ProxMenux Monitor?": "¿Quieres desactivar ProxMenux Monitor?",
+  "Do you want to disable and remove it now?": "¿Quieres desactivarlo y eliminarlo ahora?",
+  "Do you want to enable IOMMU now?": "¿Quieres habilitar IOMMU ahora?",
+  "Do you want to enable the serial port": "¿Quieres habilitar el puerto serie?",
+  "Do you want to encrypt this backup?": "¿Quieres cifrar esta copia de seguridad?",
+  "Do you want to install Log2RAM anyway to reduce log write load?": "¿Quiere instalar Log2RAM de todos modos para reducir la carga de escritura de registros?",
+  "Do you want to make this mount permanent?": "¿Quieres que este soporte sea permanente?",
+  "Do you want to open Switch GPU Mode now?": "¿Quieres abrir el modo Cambiar GPU ahora?",
+  "Do you want to proceed and run the Proxmox System Update?": "¿Quiere continuar y ejecutar la actualización del sistema Proxmox?",
+  "Do you want to proceed with the system update?": "¿Quieres continuar con la actualización del sistema?",
+  "Do you want to proceed?": "¿Quieres continuar?",
+  "Do you want to reboot now?": "¿Quieres reiniciar ahora?",
+  "Do you want to restart the network service now to apply changes?": "¿Quieres reiniciar el servicio de red ahora para aplicar los cambios?",
+  "Do you want to restart the network service to apply changes?": "¿Quieres reiniciar el servicio de red para aplicar los cambios?",
+  "Do you want to run the network script from": "¿Quiere ejecutar el script de red desde",
+  "Do you want to run the post-installation script from": "¿Desea ejecutar el script posterior a la instalación desde",
+  "Do you want to run the script now?": "¿Quieres ejecutar el script ahora?",
+  "Do you want to schedule selected paths for next boot now?": "¿Quiere programar rutas seleccionadas para el próximo inicio ahora?",
+  "Do you want to start the converted unprivileged container": "¿Quiere iniciar el contenedor sin privilegios convertido?",
+  "Do you want to start the privileged container": "¿Quieres iniciar el contenedor privilegiado?",
+  "Do you want to try different credentials or authentication method?": "¿Quieres probar diferentes credenciales o métodos de autenticación?",
+  "Do you want to unmount it first?": "¿Quieres desmontarlo primero?",
+  "Do you want to update now?": "¿Quieres actualizar ahora?",
+  "Do you want to update the NVIDIA userspace libraries inside these containers to match the host?": "¿Quiere actualizar las bibliotecas del espacio de usuario de NVIDIA dentro de estos contenedores para que coincidan con el host?",
+  "Do you want to update the existing export?": "¿Quiere actualizar la exportación existente?",
+  "Do you want to update the existing share?": "¿Quieres actualizar el recurso compartido existente?",
+  "Do you want to view the selected backup before restoring?": "¿Quieres ver la copia de seguridad seleccionada antes de restaurar?",
+  "Download failed for all attempted URLs": "La descarga falló en todos los intentos de URL",
+  "Download keyfile": "Descargar archivo clave",
+  "Download latest VirtIO ISO automatically": "Descargue la última ISO de VirtIO automáticamente",
+  "Downloaded amdgpu_top": "Descargado amdgpu_top",
+  "Downloading": "Descargando",
+  "Downloading Helper-Scripts logo...": "Descargando el logotipo de Helper-Scripts...",
+  "Downloading Home-Labs-Club logo...": "Descargando el logo de Home-Labs-Club...",
+  "Downloading JC Channel logo...": "Descargando logo de JC Channel...",
+  "Downloading ProxMenux logo...": "Descargando el logo de ProxMenux...",
+  "Downloading Proxmology logo...": "Descargando logo de Proxmología...",
+  "Downloading UUP converter...": "Descargando el convertidor UUP...",
+  "Downloading amdgpu_top": "Descargando amdgpu_top",
+  "Downloading official installer...": "Descargando el instalador oficial...",
+  "Downloading pre-existing encrypted backups from this host will fail unless you kept a copy of the current key.": "la descarga de copias de seguridad cifradas preexistentes desde este host fallará a menos que conserve una copia de la clave actual.",
+  "Downloading the latest Fastfetch release...": "Descargando la última versión de Fastfetch...",
+  "Driver blacklist entries removed": "Se eliminaron las entradas de la lista negra de controladores",
+  "Driver blacklist removed for": "Lista negra de controladores eliminada para",
+  "Driver installed successfully. Press Enter to continue...": "Controlador instalado correctamente. Presione Entrar para continuar...",
+  "Drivers  :": "Conductores:",
+  "Drivers compiled and installed via DKMS.": "Controladores compilados e instalados mediante DKMS.",
+  "Dumping AMD GPU ROM BIOS via sysfs...": "Volviendo la BIOS de la ROM de la GPU AMD a través de sysfs...",
+  "Duplicate IP addresses found": "Se encontraron direcciones IP duplicadas",
+  "Duplicate parameters cleaned": "Parámetros duplicados limpiados",
+  "Duration": "Duración",
+  "Duration:": "Duración:",
+  "EFI disk created and configured on": "Disco EFI creado y configurado en",
+  "EFI storage selection cancelled.": "Se canceló la selección de almacenamiento EFI.",
+  "EFI storage selection failed or was cancelled. VM creation aborted.": "La selección de almacenamiento EFI falló o se canceló. Se canceló la creación de la máquina virtual.",
+  "EMERGENCY PROXMOX SYSTEM REPAIR": "REPARACIÓN DE EMERGENCIA SISTEMA PROXMOX",
+  "ENABLED for restore": "HABILITADO para restaurar",
+  "EXISTS": "EXISTE",
+  "Each LUN will appear as a block device assignable to VMs.": "Cada LUN aparecerá como un dispositivo de bloque asignable a las VM.",
+  "Edge TPU runtime installed.": "Tiempo de ejecución de Edge TPU instalado.",
+  "Edit raw CT configuration file": "Editar archivo de configuración CT sin formato",
+  "Edit raw VM configuration file": "Editar archivo de configuración de VM sin formato",
+  "Edit the VM machine type to q35 and try again.": "Edite el tipo de máquina VM a q35 y vuelva a intentarlo.",
+  "Emergency Proxmox System Repair": "Reparación de emergencia del sistema Proxmox",
+  "Emergency recovery:": "Recuperación de emergencia:",
+  "Empty": "Vacío",
+  "Enable": "Permitir",
+  "Enable / disable job timer": "Activar/desactivar el temporizador de copias",
+  "Enable High Availability services": "Activar servicios de alta disponibilidad",
+  "Enable IOMMU in GRUB or ZFS boot": "Habilite IOMMU en el arranque GRUB o ZFS",
+  "Enable IOMMU support if not enabled": "Habilite la compatibilidad con IOMMU si no está habilitado",
+  "Enable IOMMU, reboot the host, and try again.": "Habilite IOMMU, reinicie el host y vuelva a intentarlo.",
+  "Enable Remote Desktop (RDP) before disabling the virtual display.": "Habilite el Escritorio remoto (RDP) antes de deshabilitar la pantalla virtual.",
+  "Enable SSD emulation for this disk?": "¿Habilitar la emulación SSD para este disco?",
+  "Enable TCP BBR/Fast Open control": "Activar control TCP BBR/Fast Open",
+  "Enable VFIO IOMMU support": "Activar soporte VFIO IOMMU",
+  "Enable ZFS autotrim (SSD/NVMe pools)": "Activar ZFS autotrim (pools SSD/NVMe)",
+  "Enable auto-sync if /var/log exceeds 90% of its size?": "¿Habilitar la sincronización automática si /var/log excede el 90% de su tamaño?",
+  "Enable fast reboots": "Activar reinicios rápidos",
+  "Enable restart on kernel panic": "Activar reinicio ante kernel panic",
+  "Enable/Disable job": "Activar/Desactivar trabajo",
+  "Enabled": "Activado",
+  "Enabled (device pending — load apex module or reboot)": "Habilitado (dispositivo pendiente: cargar el módulo Apex o reiniciar)",
+  "Enabled (repokey)": "Habilitado (repokey)",
+  "Enabled and detected": "Habilitado y detectado",
+  "Enabled and ready": "Habilitado y listo",
+  "Enabled but not connected": "Habilitado pero no conectado",
+  "Enabled memory compaction proactiveness": "Proactividad de compactación de memoria habilitada",
+  "Enabling Google TCP BBR congestion control...": "Habilitando el control de congestión TCP BBR de Google...",
+  "Enabling High Availability (HA) services...": "Habilitando servicios de alta disponibilidad (HA)...",
+  "Enabling IOMMU": "Habilitando IOMMU",
+  "Enabling IOMMU and configuring VFIO for PCI passthrough...": "Habilitando IOMMU y configurando VFIO para paso a través de PCI...",
+  "Enabling TCP Fast Open...": "Habilitando la apertura rápida de TCP...",
+  "Enabling pigz in vzdump configuration...": "Habilitando pigz en la configuración de vzdump...",
+  "Encrypt this Borg repository?": "¿Cifrar este repositorio Borg?",
+  "Encryption": "Cifrado",
+  "Encryption key": "clave de cifrado",
+  "Encryption key creation failed": "Falló la creación de la clave de cifrado",
+  "Encryption:": "Cifrado:",
+  "English": "Inglés",
+  "Ensure there are no errors and that proxmox-ve candidate shows 9.x": "Asegúrese de que no haya errores y que el candidato proxmox-ve muestre 9.x",
+  "Ensuring apex group and udev rules...": "Garantizando las reglas del grupo Apex y de la udev...",
+  "Ensuring ceph.sources (enterprise, Trixie) is present...": "Garantizar que ceph.sources (empresa, Trixie) esté presente...",
+  "Ensuring ceph.sources (no-subscription, Trixie) is present...": "Garantizar que ceph.sources (sin suscripción, Trixie) esté presente...",
+  "Ensuring proxmox.sources (PVE 9, no-subscription, deb822) is present...": "Garantizar que proxmox.sources (PVE 9, sin suscripción, deb822) esté presente...",
+  "Ensuring pve-enterprise.sources (PVE 9, deb822) is present...": "Garantizar que pve-enterprise.sources (PVE 9, deb822) esté presente...",
+  "Enter": "Ingresar",
+  "Enter CT ID:": "Ingrese el ID de CT:",
+  "Enter MSR register (e.g. 0x10):": "Ingrese el registro MSR (por ejemplo, 0x10):",
+  "Enter NFS export path (e.g., /mnt/shared):": "Ingrese la ruta de exportación NFS (por ejemplo, /mnt/shared):",
+  "Enter NFS server IP or hostname:": "Ingrese la IP o el nombre de host del servidor NFS:",
+  "Enter NVMe device (e.g., nvme0):": "Ingrese el dispositivo NVMe (por ejemplo, nvme0):",
+  "Enter PCI BDF (e.g. 0000:01:00.0):": "Ingrese PCI BDF (por ejemplo, 0000:01:00.0):",
+  "Enter PCI BDF (e.g. 0000:04:00.0):": "Ingrese PCI BDF (por ejemplo, 0000:04:00.0):",
+  "Enter Path": "Ingresar ruta",
+  "Enter Samba server IP:": "Ingrese la IP del servidor Samba:",
+  "Enter Samba share name:": "Ingrese el nombre del recurso compartido de Samba:",
+  "Enter Tailscale Auth Key": "Ingrese la clave de autenticación de Tailscale",
+  "Enter VM ID:": "Introduzca el ID de la máquina virtual:",
+  "Enter VM/CT ID:": "Introduzca el ID de VM/CT:",
+  "Enter ZFS pool name for the selected disk:": "Ingrese el nombre del grupo ZFS para el disco seleccionado:",
+  "Enter a name for the mount point (used as /mnt/<name>):": "Ingrese un nombre para el punto de montaje (usado como /mnt/<nombre>):",
+  "Enter a name for the new virtual machine:": "Ingrese un nombre para la nueva máquina virtual:",
+  "Enter a number, or write or paste a command:": "Ingrese un número, o escriba o pegue un comando:",
+  "Enter backup file (.zst):": "Ingrese el archivo de respaldo (.zst):",
+  "Enter backup path (.tar.zst):": "Ingrese la ruta de respaldo (.tar.zst):",
+  "Enter backup path (.vma.zst):": "Ingrese la ruta de respaldo (.vma.zst):",
+  "Enter base folder for temporary files and converter (default:": "Ingrese la carpeta base para archivos temporales y convertidor (predeterminado:",
+  "Enter boot target (e.g. scsi0, sata0, ide0):": "Ingrese el destino de inicio (por ejemplo, scsi0, sata0, ide0):",
+  "Enter content types (comma-separated):": "Introduzca los tipos de contenido (separados por comas):",
+  "Enter custom CIFS mount options (open uid/gid/file_mode strongly recommended for LXC bind-mounts):": "Ingrese las opciones de montaje CIFS personalizadas (se recomienda abrir uid/gid/file_mode para montajes enlazados de LXC):",
+  "Enter custom NFS mount options:": "Ingrese las opciones de montaje NFS personalizadas:",
+  "Enter custom NFS options:": "Ingrese opciones NFS personalizadas:",
+  "Enter custom Samba configuration for this share:": "Ingrese la configuración Samba personalizada para este recurso compartido:",
+  "Enter custom mount options:": "Ingrese opciones de montaje personalizadas:",
+  "Enter custom path": "Ingrese la ruta personalizada",
+  "Enter custom pathr": "Ingrese una ruta personalizada",
+  "Enter destination directory for exported file(s):": "Ingrese el directorio de destino para los archivos exportados:",
+  "Enter destination path for ISO file": "Ingrese la ruta de destino para el archivo ISO",
+  "Enter destination path:": "Introduzca la ruta de destino:",
+  "Enter device (e.g., sda or nvme0):": "Ingrese el dispositivo (por ejemplo, sda o nvme0):",
+  "Enter directory containing OVA/OVF files:": "Ingrese al directorio que contiene los archivos OVA/OVF:",
+  "Enter directory path:": "Introduzca la ruta del directorio:",
+  "Enter disk image path:": "Ingrese la ruta de la imagen del disco:",
+  "Enter disk or partition path (prefer /dev/disk/by-id/...):": "Ingrese la ruta del disco o la partición (prefiera /dev/disk/by-id/...):",
+  "Enter domain name:": "Introduzca el nombre de dominio:",
+  "Enter domain:": "Introduzca el dominio:",
+  "Enter filesystem (ext4/xfs/btrfs):": "Ingrese al sistema de archivos (ext4/xfs/btrfs):",
+  "Enter folder name for /mnt:": "Ingrese el nombre de la carpeta para /mnt:",
+  "Enter full disk path as shown above (starting with /dev/disk/by-id/xxx...):": "Ingrese la ruta completa del disco como se muestra arriba (comenzando con /dev/disk/by-id/xxx...):",
+  "Enter full path for mount point:": "Ingrese la ruta completa para el punto de montaje:",
+  "Enter full path to the disk image (e.g., /var/lib/vz/images/xyz.img):": "Ingrese la ruta completa a la imagen del disco (por ejemplo, /var/lib/vz/images/xyz.img):",
+  "Enter full path to the input image (e.g., /var/lib/vz/images/disk.vmdk):": "Ingrese la ruta completa a la imagen de entrada (por ejemplo, /var/lib/vz/images/disk.vmdk):",
+  "Enter full path:": "Ingrese la ruta completa:",
+  "Enter host IP (e.g., 192.168.0.100):": "Ingrese la IP del host (por ejemplo, 192.168.0.100):",
+  "Enter host or IP:": "Ingrese el host o IP:",
+  "Enter hostpci slot (e.g. 0):": "Ingrese la ranura hostpci (por ejemplo, 0):",
+  "Enter hostpci slot number (e.g. 0):": "Ingrese el número de ranura hostpci (por ejemplo, 0):",
+  "Enter iSCSI target portal IP or hostname:": "Ingrese la IP o el nombre de host del portal de destino iSCSI:",
+  "Enter image full path:": "Ingrese la ruta completa de la imagen:",
+  "Enter imported disk reference (e.g. local-lvm:vm-100-disk-0):": "Ingrese la referencia del disco importado (por ejemplo, local-lvm:vm-100-disk-0):",
+  "Enter interface (sata/scsi/virtio/ide):": "Ingrese a la interfaz (sata/scsi/virtio/ide):",
+  "Enter interface name (e.g. eth0):": "Ingrese el nombre de la interfaz (por ejemplo, eth0):",
+  "Enter mount path on host:": "Ingrese la ruta de montaje en el host:",
+  "Enter mount point in CT (e.g. /mnt/data):": "Ingrese el punto de montaje en CT (por ejemplo, /mnt/data):",
+  "Enter mp slot number (e.g. 0):": "Ingrese el número de ranura mp (por ejemplo, 0):",
+  "Enter name for the imported VM:": "Ingrese el nombre de la VM importada:",
+  "Enter networks to advertise (comma-separated CIDR):": "Ingrese las redes para anunciar (CIDR separados por comas):",
+  "Enter new folder name:": "Ingrese el nuevo nombre de la carpeta:",
+  "Enter new group name:": "Ingrese el nuevo nombre del grupo:",
+  "Enter partition path (e.g. /dev/sdX1):": "Ingrese la ruta de la partición (por ejemplo, /dev/sdX1):",
+  "Enter password for": "Introduzca la contraseña para",
+  "Enter password:": "Introduzca la contraseña:",
+  "Enter path manually": "Ingrese la ruta manualmente",
+  "Enter path to analyze:": "Ingrese la ruta a analizar:",
+  "Enter path:": "Introduzca la ruta:",
+  "Enter pool name to clear errors:": "Ingrese el nombre del grupo para borrar errores:",
+  "Enter pool name to export:": "Ingrese el nombre del grupo para exportar:",
+  "Enter pool name to import:": "Ingrese el nombre del grupo para importar:",
+  "Enter pool name:": "Introduzca el nombre del grupo:",
+  "Enter pool/dataset name:": "Ingrese el nombre del grupo/conjunto de datos:",
+  "Enter pool/dataset to destroy:": "Ingrese el grupo/conjunto de datos para destruir:",
+  "Enter pool/dataset to mount:": "Ingrese el grupo/conjunto de datos para montar:",
+  "Enter search term (leave empty to show all scripts):": "Ingrese el término de búsqueda (déjelo vacío para mostrar todos los scripts):",
+  "Enter server IP": "Ingrese la IP del servidor",
+  "Enter server IP/hostname manually": "Ingrese la IP/nombre de host del servidor manualmente",
+  "Enter server IP:": "Ingrese la IP del servidor:",
+  "Enter slot number (e.g. 0):": "Ingrese el número de ranura (por ejemplo, 0):",
+  "Enter storage ID for Proxmox:": "Ingrese el ID de almacenamiento para Proxmox:",
+  "Enter storage ID:": "Ingrese el ID de almacenamiento:",
+  "Enter storage name:": "Introduzca el nombre del almacenamiento:",
+  "Enter subnet (e.g., 192.168.0.0/24):": "Ingrese la subred (por ejemplo, 192.168.0.0/24):",
+  "Enter target disk (e.g. /dev/sdX):": "Ingrese el disco de destino (por ejemplo, /dev/sdX):",
+  "Enter target storage name (e.g., local-lvm):": "Ingrese el nombre del almacenamiento de destino (por ejemplo, local-lvm):",
+  "Enter target storage:": "Ingrese el almacenamiento de destino:",
+  "Enter the BORG REPOKEY passphrase for target:": "Ingrese la frase de contraseña de BORG REPOKEY para el objetivo:",
+  "Enter the Samba username:": "Ingrese el nombre de usuario de Samba:",
+  "Enter the VMID for the new VM:": "Ingrese el VMID para la nueva VM:",
+  "Enter the container terminal:": "Ingrese a la terminal de contenedores:",
+  "Enter the full path to the directory containing disk images:": "Ingrese la ruta completa al directorio que contiene las imágenes del disco:",
+  "Enter the full path to the host directory:": "Ingrese la ruta completa al directorio del host:",
+  "Enter the full path to the host folder:": "Ingrese la ruta completa a la carpeta del host:",
+  "Enter the full path to the output image (e.g., /var/lib/vz/images/output.qcow2):": "Ingrese la ruta completa a la imagen de salida (por ejemplo, /var/lib/vz/images/output.qcow2):",
+  "Enter the host mount path:": "Ingrese la ruta de montaje del host:",
+  "Enter the iperf3 server IP or hostname:": "Ingrese la IP o el nombre de host del servidor iperf3:",
+  "Enter the maximum size (in MB) to allocate for /var/log in RAM (e.g. 128, 256, 512):": "Ingrese el tamaño máximo (en MB) para asignar para /var/log en la RAM (por ejemplo, 128, 256, 512):",
+  "Enter the mount point for the NFS export (e.g., /mnt/mynfs):": "Ingrese el punto de montaje para la exportación NFS (por ejemplo, /mnt/mynfs):",
+  "Enter the mount point for the shared folder (e.g., /mnt/myshare):": "Ingrese el punto de montaje para la carpeta compartida (por ejemplo, /mnt/myshare):",
+  "Enter the mount point inside the CT for": "Introduzca el punto de montaje dentro del CT para",
+  "Enter the number or type the interface name:": "Ingrese el número o escriba el nombre de la interfaz:",
+  "Enter the password for Samba user:": "Ingrese la contraseña para el usuario de Samba:",
+  "Enter the recovery passphrase set when the keyfile was created:": "ingrese la frase de contraseña de recuperación establecida cuando se creó el archivo de claves:",
+  "Enter username for Samba server:": "Ingrese el nombre de usuario para el servidor Samba:",
+  "Enter username:": "Introduzca nombre de usuario:",
+  "Enterprise Proxmox Ceph repository disabled": "Repositorio Enterprise Proxmox Ceph deshabilitado",
+  "Enterprise Proxmox repository disabled": "Repositorio Enterprise Proxmox deshabilitado",
+  "Enterprise repositories restored": "Repositorios empresariales restaurados",
+  "Enterprise repository present": "Repositorio empresarial presente",
+  "Enterprise repository returned 401 Unauthorized (no valid subscription). Switch to the no-subscription repository and retry?": "El repositorio empresarial devolvió 401 No autorizado (sin suscripción válida). ¿Cambiar al repositorio sin suscripción y volver a intentarlo?",
+  "Enterprise repository unauthorized and fallback declined by user": "Repositorio empresarial no autorizado y respaldo rechazado por el usuario",
+  "Entropy generation optimization removed": "Se eliminó la optimización de la generación de entropía.",
+  "Equivalent manual flow of disk_host.sh: partition, format, mount, persist, register in Proxmox.": "Flujo manual equivalente de disk_host.sh: particionar, formatear, montar, persistir, registrar en Proxmox.",
+  "Equivalent manual flow of iscsi_host.sh.": "Flujo manual equivalente de iscsi_host.sh.",
+  "Equivalent manual flow used by Local Shared Manager.": "Flujo manual equivalente utilizado por Local Shared Manager.",
+  "Error": "Error",
+  "Error applying patch. Backups preserved at": "Error al aplicar el parche. Copias de seguridad conservadas en",
+  "Error details:": "Detalles del error:",
+  "Error installing": "Error al instalar",
+  "Error installing build dependencies. Check": "Error al instalar las dependencias de compilación. Controlar",
+  "Error:": "Error:",
+  "Error: Cannot create directory": "Error: no se puede crear el directorio",
+  "Error: Failed to download the script.": "Error: no se pudo descargar el script.",
+  "Error: No script data found for slug:": "Error: no se encontraron datos de script para slug:",
+  "Error: No write permissions in directory": "Error: no hay permisos de escritura en el directorio",
+  "Essential Proxmox packages installed": "Paquetes esenciales de Proxmox instalados",
+  "Estimated required free space:": "Espacio libre requerido estimado:",
+  "Every 12 hours": "Cada 12 horas",
+  "Every 3 hours": "Cada 3 horas",
+  "Every 6 hours": "Cada 6 horas",
+  "Every hour": "Cada hora",
+  "Every path in this backup is kernel-tied: the restore applies these paths automatically via the safe-subset filter and re-merges the operator's tuning.": "Cada ruta en esta copia de seguridad está vinculada al kernel: la restauración aplica estas rutas automáticamente a través del filtro de subconjunto seguro y vuelve a fusionar el ajuste del operador.",
+  "Everything restorable in this backup will be restored": "Todo lo que se pueda restaurar en esta copia de seguridad será restaurado",
+  "Example output: rootfs: local-lvm:vm-114-disk-0,size=8G": "Salida de ejemplo: rootfs: local-lvm:vm-114-disk-0,size=8G",
+  "Example target: /dev/sdb": "Destino de ejemplo: /dev/sdb",
+  "Example: /dev/pve/vm-114-disk-0": "Ejemplo: /dev/pve/vm-114-disk-0",
+  "Example: /rpool/data/subvol-114-disk-0": "Ejemplo: /rpool/data/subvol-114-disk-0",
+  "Example: MOUNT_PATH=\"/rpool/data/subvol-114-disk-0\"": "Ejemplo: MOUNT_PATH=\"/rpool/data/subvol-114-disk-0\"",
+  "Example: cp /etc/pve/lxc/110.conf /etc/pve/lxc/110.conf.bak": "Ejemplo: cp /etc/pve/lxc/110.conf /etc/pve/lxc/110.conf.bak",
+  "Example: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak": "Ejemplo: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak",
+  "Example: daily or Mon..Fri 03:00": "Ejemplo: diario o lunes a viernes 03:00",
+  "Example: mkdir -p /tmp/lxc_convert_114": "Ejemplo: mkdir -p /tmp/lxc_convert_114",
+  "Example: pct config 110 | grep unprivileged": "Ejemplo: configuración pct 110 | grep sin privilegios",
+  "Example: pct stop 110": "Ejemplo: parada pct 110",
+  "Example: pct stop 114": "Ejemplo: parada pct 114",
+  "Example: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup": "Ejemplo: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup",
+  "Example: pvesm path local-lvm:vm-114-disk-0": "Ejemplo: ruta pvesm local-lvm:vm-114-disk-0",
+  "Example: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf": "Ejemplo: sed -i '/^sin privilegios: 1/d' /etc/pve/lxc/110.conf",
+  "Examples:": "Ejemplos:",
+  "Execute destructive rollback?": "¿Ejecutar reversión destructiva?",
+  "Executing destructive rollback (operator confirmed) ...": "Ejecutando reversión destructiva (confirmado por el operador)...",
+  "Executing:": "Ejecutando:",
+  "Existing Groups": "Grupos existentes",
+  "Existing file, re-downloading...": "Archivo existente, volviendo a descargar...",
+  "Existing filesystem:": "Sistema de archivos existente:",
+  "Existing hostpci entries detected — they will be reused": "Se detectaron entradas de hostpci existentes: se reutilizarán",
+  "Existing key is at:": "La clave existente está en:",
+  "Existing recovery envelopes already on PBS stay intact — they still recover the old key with its original passphrase.": "Los sobres de recuperación existentes que ya están en PBS permanecen intactos; aún recuperan la clave anterior con su frase de contraseña original.",
+  "Exit": "Volver",
+  "Exit and repair manually": "Salir y reparar manualmente",
+  "Exit the container terminal:": "Salir de la terminal de contenedores:",
+  "Exit: Stop to create backup manually": "Salir: Detener para crear una copia de seguridad manualmente",
+  "Exiting for manual repair...": "Saliendo para reparación manual...",
+  "Expected /tmp/gasket-driver/src not found. The clone seems incomplete or uses an unknown layout.": "Se esperaba /tmp/gasket-driver/src no encontrado. El clon parece incompleto o utiliza un diseño desconocido.",
+  "Expected Makefile not found in /tmp/gasket-driver/src. Source tree is incomplete.": "Makefile esperado no encontrado en /tmp/gasket-driver/src. El árbol de fuentes está incompleto.",
+  "Expected path:": "Camino esperado:",
+  "Expected: rootfs/ directory, or /etc /var /root at archive root.": "Se esperaba: directorio rootfs/ o /etc /var /root en la raíz del archivo.",
+  "Export Format": "Formato de exportación",
+  "Export Options": "Opciones de exportación",
+  "Export Path": "Ruta de exportación",
+  "Export Summary": "Resumen de exportación",
+  "Export VM to OVA or OVF": "Exportar VM a OVA u OVF",
+  "Export a ZFS pool": "Exportar un grupo ZFS",
+  "Export added successfully.": "Exportación agregada exitosamente.",
+  "Export backup data to file": "Exportar datos de respaldo a un archivo",
+  "Export completed. The running system has not been modified.": "Exportación completada. El sistema en ejecución no ha sido modificado.",
+  "Export completed:": "Exportación completada:",
+  "Export deleted and NFS service restarted.": "Exportación eliminada y servicio NFS reiniciado.",
+  "Export error log": "Exportar registro de errores",
+  "Export exists:": "Existe exportación:",
+  "Export failed.": "La exportación falló.",
+  "Export list test": "Prueba de lista de exportación",
+  "Export list:": "Lista de exportación:",
+  "Export mode:": "Modo de exportación:",
+  "Export not found on server:": "Exportación no encontrada en el servidor:",
+  "Export path:": "Ruta de exportación:",
+  "Export permissions allow access": "Los permisos de exportación permiten el acceso.",
+  "Export to file (no system changes)": "Exportar a archivo (sin cambios en el sistema)",
+  "Export updated successfully.": "Exportación actualizada correctamente.",
+  "Export:": "Exportar:",
+  "Exporting ZFS pool...": "Exportando grupo ZFS...",
+  "Exports cleared.": "Exportaciones liquidadas.",
+  "Exports:": "Exportaciones:",
+  "Extended Filesystem 4 (recommended)": "Sistema de archivos extendido 4 (recomendado)",
+  "External disk for backup": "Disco externo para copia de seguridad",
+  "Extracting NVIDIA installer on host...": "Extrayendo el instalador de NVIDIA en el host...",
+  "Extracting OVA archive...": "Extrayendo archivo OVA...",
+  "Extracting archive...": "Extrayendo archivo...",
+  "Extracting data from Borg...": "Extrayendo datos de Borg...",
+  "Extracting data from PBS...": "Extrayendo datos de PBS...",
+  "Extraction completed.": "Extracción completada.",
+  "Extraction failed.": "La extracción falló.",
+  "Extraction failed. Check log:": "La extracción falló. Registro de verificación:",
+  "Extraction successful": "Extracción exitosa",
+  "FAILED": "FALLIDO",
+  "FINAL CONFIRMATION — DATA WILL BE ERASED": "CONFIRMACIÓN FINAL — LOS DATOS SERÁN BORRADOS",
+  "Fail2Ban - Intrusion Prevention": "Fail2Ban - Prevención de intrusiones",
+  "Fail2Ban Management": "Gestión de Fail2Ban",
+  "Fail2Ban has been removed": "Fail2Ban ha sido eliminado",
+  "Fail2Ban installation and configuration completed successfully!": "¡La instalación y configuración de Fail2Ban se completaron con éxito!",
+  "Fail2Ban installed successfully": "Fail2Ban se instaló exitosamente",
+  "Fail2Ban is NOT running!": "¡Fail2Ban NO se está ejecutando!",
+  "Fail2Ban is currently installed.": "Fail2Ban está actualmente instalado.",
+  "Fail2Ban is not installed on this system.": "Fail2Ban no está instalado en este sistema.",
+  "Fail2Ban is running correctly": "Fail2Ban se está ejecutando correctamente",
+  "Failed": "Fallido",
+  "Failed to access log2ram directory": "No se pudo acceder al directorio log2ram",
+  "Failed to access share with provided credentials.": "No se pudo acceder al recurso compartido con las credenciales proporcionadas.",
+  "Failed to access:": "No se pudo acceder:",
+  "Failed to add CIFS storage to Proxmox.": "No se pudo agregar almacenamiento CIFS a Proxmox.",
+  "Failed to add GPU audio function": "No se pudo agregar la función de audio de GPU",
+  "Failed to add GPU to target VM": "No se pudo agregar GPU a la máquina virtual de destino",
+  "Failed to add IOMMU group device": "No se pudo agregar el dispositivo del grupo IOMMU",
+  "Failed to add NFS storage to Proxmox.": "No se pudo agregar almacenamiento NFS a Proxmox.",
+  "Failed to add bind mount:": "No se pudo agregar el montaje de enlace:",
+  "Failed to add iSCSI storage to Proxmox.": "No se pudo agregar almacenamiento iSCSI a Proxmox.",
+  "Failed to add storage to Proxmox.": "No se pudo agregar almacenamiento a Proxmox.",
+  "Failed to assign Controller/NVMe": "No se pudo asignar el controlador/NVMe",
+  "Failed to assign virtual disk": "No se pudo asignar el disco virtual",
+  "Failed to clone Lynis from GitHub": "No se pudo clonar Lynis desde GitHub",
+  "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "No se pudo clonar el repositorio log2ram. Compruebe /tmp/log2ram_install.log",
+  "Failed to configure EFI disk": "No se pudo configurar el disco EFI",
+  "Failed to configure IOMMU automatically.": "No se pudo configurar IOMMU automáticamente.",
+  "Failed to configure Proxmox repositories": "No se pudieron configurar los repositorios de Proxmox",
+  "Failed to configure TPM device in VM": "No se pudo configurar el dispositivo TPM en VM",
+  "Failed to configure repositories.": "No se pudieron configurar los repositorios.",
+  "Failed to configure repositories. Installation aborted.": "No se pudieron configurar los repositorios. Instalación cancelada.",
+  "Failed to connect to": "No se pudo conectar a",
+  "Failed to connect to server.": "No se pudo conectar al servidor.",
+  "Failed to copy sources into": "No se pudieron copiar las fuentes en",
+  "Failed to create EFI disk": "No se pudo crear el disco EFI",
+  "Failed to create OVA archive.": "No se pudo crear el archivo OVA.",
+  "Failed to create TPM state disk": "No se pudo crear el disco de estado TPM",
+  "Failed to create VM": "No se pudo crear la máquina virtual",
+  "Failed to create base VM. Check VM ID and host configuration.": "No se pudo crear la máquina virtual base. Verifique la ID de VM y la configuración del host.",
+  "Failed to create directory on host:": "No se pudo crear el directorio en el host:",
+  "Failed to create directory:": "No se pudo crear el directorio:",
+  "Failed to create disk": "No se pudo crear el disco",
+  "Failed to create encryption key. Backup cancelled — fix the underlying issue and retry.": "no se pudo crear la clave de cifrado.Copia de seguridad cancelada: solucione el problema subyacente y vuelva a intentarlo.",
+  "Failed to create group:": "No se pudo crear el grupo:",
+  "Failed to create mount point.": "No se pudo crear el punto de montaje.",
+  "Failed to create mount point:": "No se pudo crear el punto de montaje:",
+  "Failed to create partition table": "No se pudo crear la tabla de particiones",
+  "Failed to create partition table on disk": "No se pudo crear la tabla de particiones en el disco",
+  "Failed to create partition.": "No se pudo crear la partición.",
+  "Failed to create temporary directory:": "No se pudo crear el directorio temporal:",
+  "Failed to create/update ZFS ARC configuration file": "No se pudo crear/actualizar el archivo de configuración ZFS ARC",
+  "Failed to destroy LXC:": "No se pudo destruir LXC:",
+  "Failed to destroy VM:": "No se pudo destruir la VM:",
+  "Failed to detect RAM size. Using default value of 16GB for ZFS ARC optimization.": "No se pudo detectar el tamaño de la RAM. Utilizando el valor predeterminado de 16 GB para la optimización ZFS ARC.",
+  "Failed to detect installed NVIDIA driver version.": "No se pudo detectar la versión del controlador NVIDIA instalada.",
+  "Failed to detect partition on disk": "No se pudo detectar la partición en el disco",
+  "Failed to determine timezone from IP address - keeping current timezone settings": "No se pudo determinar la zona horaria a partir de la dirección IP: se mantiene la configuración de zona horaria actual",
+  "Failed to disable Start on boot for LXC": "No se pudo deshabilitar el inicio al arrancar para LXC",
+  "Failed to disable Start on boot for VM": "No se pudo deshabilitar el inicio al arrancar para VM",
+  "Failed to disable ZFS autotrim for pool:": "No se pudo deshabilitar el recorte automático de ZFS para el grupo:",
+  "Failed to download Borg.": "No se pudo descargar Borg.",
+  "Failed to download Figurine": "No se pudo descargar Figurine",
+  "Failed to download Helper-Scripts logo": "No se pudo descargar el logotipo de Helper-Scripts",
+  "Failed to download Home-Lab-Club logo": "No se pudo descargar el logotipo de Home-Lab-Club",
+  "Failed to download ISO image": "No se pudo descargar la imagen ISO",
+  "Failed to download JC Channel logo": "No se pudo descargar el logotipo del canal JC",
+  "Failed to download NVIDIA installer": "No se pudo descargar el instalador de NVIDIA",
+  "Failed to download ProxMenux logo": "No se pudo descargar el logotipo de ProxMenux",
+  "Failed to download Proxmology logo": "No se pudo descargar el logotipo de Proxmology",
+  "Failed to download VirtIO driver ISO.": "No se pudo descargar la ISO del controlador VirtIO.",
+  "Failed to download amdgpu_top": "No se pudo descargar amdgpu_top",
+  "Failed to edit /etc/fstab — remove the line manually.": "No se pudo editar /etc/fstab: elimine la línea manualmente.",
+  "Failed to enable ZFS autotrim for pool:": "No se pudo habilitar el recorte automático de ZFS para el grupo:",
+  "Failed to enable automatic time synchronization": "No se pudo habilitar la sincronización automática de la hora",
+  "Failed to extract OVA file:": "No se pudo extraer el archivo OVA:",
+  "Failed to extract package": "No se pudo extraer el paquete",
+  "Failed to fetch the Google Coral GPG key. Check": "No se pudo recuperar la clave GPG de Google Coral. Controlar",
+  "Failed to format disk as": "No se pudo formatear el disco como",
+  "Failed to format partition": "No se pudo formatear la partición",
+  "Failed to format the partition.": "No se pudo formatear la partición.",
+  "Failed to get .deb download URL": "No se pudo obtener la URL de descarga de .deb",
+  "Failed to get latest version from GitHub": "No se pudo obtener la última versión de GitHub",
+  "Failed to get release information from GitHub": "No se pudo obtener información de lanzamiento de GitHub",
+  "Failed to get shares": "No se pudieron obtener acciones",
+  "Failed to get shares from": "No se pudieron obtener acciones de",
+  "Failed to import": "No se pudo importar",
+  "Failed to initialize Borg repository at:": "No se pudo inicializar el repositorio Borg en:",
+  "Failed to install Coral TPU driver inside the container.": "No se pudo instalar el controlador Coral TPU dentro del contenedor.",
+  "Failed to install Fail2Ban": "No se pudo instalar Fail2Ban",
+  "Failed to install Fastfetch.": "No se pudo instalar Fastfetch.",
+  "Failed to install NFS client packages.": "No se pudieron instalar los paquetes del cliente NFS.",
+  "Failed to install OVH RTM": "No se pudo instalar OVH RTM",
+  "Failed to install OpenVSwitch": "No se pudo instalar OpenVSwitch",
+  "Failed to install Samba client packages.": "No se pudieron instalar los paquetes del cliente Samba.",
+  "Failed to install amdgpu_top": "No se pudo instalar amdgpu_top",
+  "Failed to install dependencies": "No se pudieron instalar las dependencias",
+  "Failed to install gawk": "No se pudo instalar gawk",
+  "Failed to install intel-gpu-tools": "No se pudo instalar Intel-gpu-tools",
+  "Failed to install libedgetpu1-std. Check": "No se pudo instalar libedgetpu1-std. Controlar",
+  "Failed to install pigz": "No se pudo instalar pigz",
+  "Failed to install zfs-auto-snapshot": "No se pudo instalar zfs-auto-snapshot",
+  "Failed to mount CIFS share on host.": "No se pudo montar el recurso compartido CIFS en el host.",
+  "Failed to mount NFS share on host.": "No se pudo montar el recurso compartido NFS en el host.",
+  "Failed to mount NFS share.": "No se pudo montar el recurso compartido NFS.",
+  "Failed to mount Samba share.": "No se pudo montar el recurso compartido de Samba.",
+  "Failed to mount container filesystem.": "No se pudo montar el sistema de archivos del contenedor.",
+  "Failed to mount disk": "No se pudo montar el disco",
+  "Failed to obtain public IP address - keeping current timezone settings": "No se pudo obtener la dirección IP pública: se mantiene la configuración de zona horaria actual",
+  "Failed to refresh boot configuration": "No se pudo actualizar la configuración de inicio",
+  "Failed to refresh proxmox-boot-tool": "No se pudo actualizar la herramienta de arranque proxmox",
+  "Failed to reinstall Proxmox packages": "No se pudieron reinstalar los paquetes de Proxmox",
+  "Failed to reinstall packages": "No se pudieron reinstalar los paquetes",
+  "Failed to remove gateway.": "No se pudo eliminar la puerta de enlace.",
+  "Failed to remove mount point": "No se pudo eliminar el punto de montaje",
+  "Failed to remove storage from Proxmox.": "No se pudo eliminar el almacenamiento de Proxmox.",
+  "Failed to remove storage.": "No se pudo eliminar el almacenamiento.",
+  "Failed to resolve group GID for": "No se pudo resolver el GID del grupo para",
+  "Failed to restart": "No se pudo reiniciar",
+  "Failed to restart container — restart manually": "No se pudo reiniciar el contenedor: reinicie manualmente",
+  "Failed to restart gateway.": "No se pudo reiniciar la puerta de enlace.",
+  "Failed to restart network service": "No se pudo reiniciar el servicio de red",
+  "Failed to restart — restart manually to activate mount": "No se pudo reiniciar: reinicie manualmente para activar el montaje",
+  "Failed to restore subscription banner completely": "No se pudo restaurar completamente el banner de suscripción",
+  "Failed to retrieve Fastfetch download URL.": "No se pudo recuperar la URL de descarga de Fastfetch.",
+  "Failed to run log2ram installer. Check /tmp/log2ram_install.log": "No se pudo ejecutar el instalador de log2ram. Compruebe /tmp/log2ram_install.log",
+  "Failed to set VM description": "No se pudo establecer la descripción de la máquina virtual",
+  "Failed to set timezone - keeping current settings": "No se pudo establecer la zona horaria: se mantienen las configuraciones actuales",
+  "Failed to start CT": "No se pudo iniciar CT",
+  "Failed to start container — start manually and check the mount": "No se pudo iniciar el contenedor: comience manualmente y verifique el montaje",
+  "Failed to start gateway.": "No se pudo iniciar la puerta de enlace.",
+  "Failed to start long self-test on": "No se pudo iniciar la autoprueba larga en",
+  "Failed to start self-test on": "No se pudo iniciar la autoprueba en",
+  "Failed to start the CT.": "No se pudo iniciar el CT.",
+  "Failed to start the container.": "No se pudo iniciar el contenedor.",
+  "Failed to stop gateway.": "No se pudo detener la puerta de enlace.",
+  "Failed to stop the container.": "No se pudo detener el contenedor.",
+  "Failed to uninstall amdgpu_top": "No se pudo desinstalar amdgpu_top",
+  "Failed to uninstall intel-gpu-tools": "No se pudo desinstalar Intel-gpu-tools",
+  "Failed to update GRUB": "No se pudo actualizar GRUB",
+  "Failed to update GRUB configuration": "No se pudo actualizar la configuración de GRUB",
+  "Failed to update Lynis": "No se pudo actualizar Lynis",
+  "Failed to update amdgpu_top": "No se pudo actualizar amdgpu_top",
+  "Failed to update auth.json — restoring backup.": "No se pudo actualizar auth.json: restaurar la copia de seguridad.",
+  "Failed to update cluster certificates (might not be in a cluster)": "No se pudieron actualizar los certificados del clúster (puede que no estén en un clúster)",
+  "Failed to update intel-gpu-tools": "No se pudo actualizar Intel-gpu-tools",
+  "Failed to update package list.": "No se pudo actualizar la lista de paquetes.",
+  "Failed to update package lists": "No se pudieron actualizar las listas de paquetes",
+  "Failed to write": "No se pudo escribir",
+  "Failed transitions from D3cold to D0": "Transiciones fallidas de D3cold a D0",
+  "Failed. See log:": "Fallido. Ver registro:",
+  "Falling back to manual paste mode.": "volver al modo de pegado manual.",
+  "Fastfetch Logo Selection": "Selección de logotipo de búsqueda rápida",
+  "Fastfetch configuration updated": "Configuración Fastfetch actualizada",
+  "Fastfetch download URL retrieved successfully.": "La URL de descarga de Fastfetch se recuperó correctamente.",
+  "Fastfetch installation and configuration completed": "Instalación y configuración de Fastfetch completadas",
+  "Fastfetch installed successfully": "Fastfetch se instaló exitosamente",
+  "Fastfetch is not installed correctly.": "Fastfetch no está instalado correctamente.",
+  "Fastfetch is not installed.": "Fastfetch no está instalado.",
+  "Fastfetch is not installed. Run: apt install fastfetch": "Fastfetch no está instalado. Ejecutar: apto instalar fastfetch",
+  "Fastfetch now displays: System optimised by: ProxMenux": "Fastfetch ahora muestra: Sistema optimizado por: ProxMenux",
+  "Fastfetch removed from system": "Fastfetch eliminado del sistema",
+  "Fastfetch will start automatically in the console": "Fastfetch se iniciará automáticamente en la consola",
+  "Figurine installation and configuration completed successfully.": "La instalación y configuración deFigurine se completó con éxito.",
+  "Figurine is not installed.": "Figurine no está instalado.",
+  "Figurine removed from system": "Figurine desinstalado del sistema",
+  "File:": "Archivo:",
+  "Filesystem": "Sistema de archivos",
+  "Filesystem Tools Required": "Herramientas del sistema de archivos necesarias",
+  "Filesystem:": "Sistema de archivos:",
+  "Final Confirmation": "Confirmación final",
+  "Final confirmation": "Confirmación final",
+  "Final storage health/status check": "Comprobación final del estado/salud del almacenamiento",
+  "Find your device using https://finds.synology.com": "Encuentre su dispositivo usando https://finds.synology.com",
+  "Fingerprint:": "Huella digital:",
+  "Firewall allows port": "El firewall permite el puerto",
+  "Firewall settings": "Configuración del cortafuegos",
+  "Firmware :": "Firmware:",
+  "First complete DSM setup and verify Web UI/SSH access.": "Primero complete la configuración de DSM y verifique el acceso a la interfaz de usuario web/SSH.",
+  "First complete ZimaOS setup and verify remote access (web/SSH).": "Primero complete la configuración de ZimaOS y verifique el acceso remoto (web/SSH).",
+  "First install the GPU drivers inside the guest and verify remote access (RDP/SSH).": "Primero instale los controladores de GPU dentro del invitado y verifique el acceso remoto (RDP/SSH).",
+  "Fix CIFS Permissions": "Reparar permisos CIFS",
+  "Fix Ceph version:": "Reparar la versión de Ceph:",
+  "Fix NFS Access for Unprivileged LXC": "Reparar el acceso NFS para LXC sin privilegios",
+  "Fix disk space:": "Reparar espacio en disco:",
+  "Fix kernel version:": "Corregir la versión del kernel:",
+  "Fix network connectivity": "Reparar la conectividad de red",
+  "Fix network:": "Reparar red:",
+  "Fix package conflicts:": "Solucionar conflictos de paquetes:",
+  "Fix repositories:": "Reparar repositorios:",
+  "Fix repository configuration": "Arreglar la configuración del repositorio",
+  "Fix systemd-boot meta-package conflict": "Solucionar el conflicto del metapaquete systemd-boot",
+  "Fix systemd-boot:": "Arreglar systemd-boot:",
+  "Fix: on the host, run": "Solución: en el host, ejecute",
+  "Fixing GPG key issues...": "Solucionando problemas clave de GPG...",
+  "Folder Name": "Nombre de la carpeta",
+  "Folders in /mnt": "Carpetas en /mnt",
+  "Follow post-restore progress live from ProxMenux Monitor → Backups tab after the reboot.": "siga el progreso posterior a la restauración en vivo desde la pestaña ProxMenux Monitor → Copias de seguridad después del reinicio.",
+  "For LVM - Create mount directory and mount:": "Para LVM: cree el directorio de montaje y monte:",
+  "For ZFS, storage ID must start with a letter and use only letters, numbers, dot, dash, underscore or colon.": "Para ZFS, el ID de almacenamiento debe comenzar con una letra y usar solo letras, números, punto, guión, guión bajo o dos puntos.",
+  "For ZFS/BTRFS - Set the mount path:": "Para ZFS/BTRFS: establezca la ruta de montaje:",
+  "For a consistent export, the VM should be stopped.": "Para una exportación consistente, se debe detener la VM.",
+  "For any question, issue or bug report, please use the official repository": "para cualquier pregunta, problema o informe de error, utilice el repositorio oficial",
+  "For dedicated GPUs, FLR is required by this policy to reduce VM": "Para GPU dedicadas, esta política requiere FLR para reducir la VM",
+  "For example: pct enter 101": "Por ejemplo: pct introduzca 101",
+  "For guest shares add: --options guest": "Para acciones de invitados agregue: --options guest",
+  "For security reasons, the system cannot format it.": "Por razones de seguridad, el sistema no puede formatearlo.",
+  "For unprivileged containers, use instead:": "Para contenedores sin privilegios, utilice en su lugar:",
+  "For your safety, a backup of the current configuration will be created automatically before restoring.": "Para su seguridad, se creará automáticamente una copia de seguridad de la configuración actual antes de restaurarla.",
+  "Force APT to use IPv4": "Forzar APT a usar IPv4",
+  "Force NFSv3:": "Forzar NFSv3:",
+  "Force NFSv4:": "Forzar NFSv4:",
+  "Force stop VM now?": "¿Forzar la detención de VM ahora?",
+  "Force stop a container. Use the correct <ctid>": "Forzar la parada de un contenedor. Utilice el <ctid> correcto",
+  "Force stop a virtual machine. Use the correct <vmid>": "Forzar la detención de una máquina virtual. Utilice el <vmid> correcto",
+  "Forcing removal...": "Forzando la eliminación...",
+  "Format / Wipe Physical Disk (Safe)": "Formatear/borrar disco físico (seguro)",
+  "Format Mode": "Modo de formato",
+  "Format USB disk?": "¿Formatear disco USB?",
+  "Format disk (ERASE all data)": "Formatear disco (BORRAR todos los datos)",
+  "Format failed": "Error de formato",
+  "Format filesystem": "Formatear sistema de archivos",
+  "Format partition:": "Formatear partición:",
+  "Format — erase and create new filesystem": "Formatear: borrar y crear un nuevo sistema de archivos",
+  "Format:": "Formato:",
+  "Format: ERASE all data and create new filesystem": "Formato: BORRAR todos los datos y crear un nuevo sistema de archivos",
+  "Formatted and mounted": "formateado y montado",
+  "Formatting": "Formato",
+  "Formatting as": "Formatear como",
+  "Formatting partition": "Formatear partición",
+  "Found": "Encontrado",
+  "Found guest-accessible shares:": "Acciones encontradas accesibles para invitados:",
+  "Free public Proxmox repository enabled": "Repositorio público gratuito de Proxmox habilitado",
+  "Free space OK:": "Espacio libre Aceptar:",
+  "Free up disk space": "Liberar espacio en disco",
+  "Free:": "Gratis:",
+  "French": "Francés",
+  "Full SMART Report": "Informe SMART completo",
+  "Full SMART info and attributes": "Información y atributos SMART completos",
+  "Full format       — new GPT partition + filesystem": "Formato completo: nueva partición GPT + sistema de archivos",
+  "Full format — new GPT partition + filesystem": "Formato completo: nueva partición GPT + sistema de archivos",
+  "Full format: clean + new GPT partition + filesystem": "Formato completo: limpio + nueva partición GPT + sistema de archivos",
+  "Full log:": "Registro completo:",
+  "Full report           — complete SMART data (scrollable)": "Informe completo: datos SMART completos (desplazables)",
+  "Full system upgrade, including dependencies": "Actualización completa del sistema, incluidas las dependencias.",
+  "Function Level Reset (FLR) not available": "Restablecimiento del nivel de función (FLR) no disponible",
+  "GID already in use:": "GID ya en uso:",
+  "GID in CT": "GID en TC",
+  "GPU": "GPU",
+  "GPU -> VM Mode Detected": "GPU -> Modo VM detectado",
+  "GPU Already Added": "GPU ya agregada",
+  "GPU Already Assigned to Another VM": "GPU ya asignada a otra VM",
+  "GPU Already Assigned to This VM": "GPU ya asignada a esta VM",
+  "GPU Busy in Running VM": "GPU ocupada en VM en ejecución",
+  "GPU Not Available for Reliable VM Passthrough": "GPU no disponible para transferencia de VM confiable",
+  "GPU Not Compatible with VM Passthrough": "GPU no compatible con paso a través de VM",
+  "GPU Passthrough Commands": "Comandos de paso a través de GPU",
+  "GPU Passthrough Not Configured": "Paso de GPU no configurado",
+  "GPU Passthrough to VM": "Paso de GPU a VM",
+  "GPU Passthrough to VM (from LXC)": "Paso de GPU a VM (desde LXC)",
+  "GPU Passthrough to VM (reassign from LXC and another VM)": "Transferencia de GPU a VM (reasignar desde LXC y otra VM)",
+  "GPU Passthrough to VM (reassign from another VM)": "Transferencia de GPU a VM (reasignar desde otra VM)",
+  "GPU ROM dump to /usr/share/kvm/": "Volcado de ROM de GPU a /usr/share/kvm/",
+  "GPU ROM dumped to": "ROM de GPU volcada a",
+  "GPU ROM extracted from ACPI VFCT table to": "ROM de GPU extraída de la tabla ACPI VFCT para",
+  "GPU Switch Mode": "Modo de conmutación de GPU",
+  "GPU Switch Mode Blocked": "Modo de cambio de GPU bloqueado",
+  "GPU Used in LXC Containers": "GPU utilizada en contenedores LXC",
+  "GPU access removed from LXC": "Acceso a GPU eliminado de LXC",
+  "GPU added": "GPU agregada",
+  "GPU already present in target VM — existing hostpci entry reused": "GPU ya presente en la máquina virtual de destino: se reutiliza la entrada hostpci existente",
+  "GPU audio added": "Audio GPU agregado",
+  "GPU audio already present in target VM — existing hostpci entry reused": "El audio de la GPU ya está presente en la máquina virtual de destino: se reutiliza la entrada hostpci existente",
+  "GPU driver blacklisted": "Controlador de GPU en lista negra",
+  "GPU guard hook will block concurrent start when another VM is already using this GPU": "El gancho de protección de GPU bloqueará el inicio simultáneo cuando otra VM ya esté usando esta GPU",
+  "GPU host driver blacklisted in /etc/modprobe.d/blacklist.conf": "Controlador de host de GPU incluido en la lista negra en /etc/modprobe.d/blacklist.conf",
+  "GPU in VM Passthrough Mode": "GPU en modo de paso a través de VM",
+  "GPU kept in source VM config": "GPU mantenida en la configuración de la VM de origen",
+  "GPU not found with slot": "GPU no encontrada con ranura",
+  "GPU passthrough assistant not found. You can run it later from Hardware Graphics.": "No se encontró el asistente de transferencia de GPU. Puede ejecutarlo más tarde desde Hardware Graphics.",
+  "GPU passthrough changes require a host reboot.": "Los cambios de transferencia de GPU requieren reiniciar el host.",
+  "GPU passthrough configuration will continue now and will become effective after host reboot.": "La configuración de transferencia de GPU continuará ahora y entrará en vigor después de reiniciar el host.",
+  "GPU passthrough configured for LXC": "Paso a través de GPU configurado para LXC",
+  "GPU passthrough configured for VM": "Transferencia de GPU configurada para VM",
+  "GPU passthrough to VMs requires IOMMU to be enabled in the kernel.": "El paso de GPU a las máquinas virtuales requiere que IOMMU esté habilitado en el kernel.",
+  "GPU passthrough was not applied.": "No se aplicó la transferencia de GPU.",
+  "GPU passthrough was skipped (no compatible GPU detected).": "Se omitió el paso de GPU (no se detectó ninguna GPU compatible).",
+  "GPU removed from VM": "GPU eliminada de la VM",
+  "GPU removed from VM config": "GPU eliminada de la configuración de VM",
+  "GPU switch complete: LXC mode prepared.": "Cambio de GPU completo: modo LXC preparado.",
+  "GPU switch complete: VM mode prepared.": "Cambio de GPU completo: modo VM preparado.",
+  "GPU switch mode completed. No reboot required.": "Modo de cambio de GPU completado. No es necesario reiniciar.",
+  "GPU will be removed from source VM config": "La GPU se eliminará de la configuración de la VM de origen",
+  "GPU will remain configured in source VM": "La GPU permanecerá configurada en la VM de origen",
+  "GPU/TPU - Manual CLI Guide": "GPU/TPU - Guía CLI manual",
+  "GPU/TPU Passthrough Commands": "Comandos de transferencia de GPU/TPU",
+  "GPUs and Coral-TPU Menu": "Menú GPU y Coral-TPU",
+  "GRUB config file not found; skipping GRUB changes": "Archivo de configuración de GRUB no encontrado; omitiendo cambios de GRUB",
+  "GRUB configuration updated": "Configuración de GRUB actualizada",
+  "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT no se encuentra en la configuración de GRUB",
+  "GUI mode (if available)": "Modo GUI (si está disponible)",
+  "Gateway is not installed.": "La puerta de enlace no está instalada.",
+  "Gateway removed.": "Puerta de enlace eliminada.",
+  "Gateway restarted.": "La puerta de enlace se reinició.",
+  "Gateway started.": "Se inició la puerta de enlace.",
+  "Gateway stopped.": "La puerta de enlace se detuvo.",
+  "Gathering container privilege information...": "Recopilando información sobre privilegios del contenedor...",
+  "Generate a new key and authorize it on the server automatically (recommended)": "genere una nueva clave y autorícela en el servidor automáticamente (recomendado)",
+  "Generate a new key, show me the line to paste manually": "Genera una nueva clave, muéstrame la línea para pegar manualmente",
+  "Generate a new keyfile": "generar un nuevo archivo de claves",
+  "Generating OVF descriptor...": "Generando descriptor OVF...",
+  "Generating dkms.conf...": "Generando dkms.conf...",
+  "Generating manifest...": "Generando manifiesto...",
+  "Generating missing locale:": "Generando configuración regional faltante:",
+  "German": "Alemán",
+  "Get a list of all your containers:": "Obtenga una lista de todos sus contenedores:",
+  "Get the actual disk path:": "Obtenga la ruta real del disco:",
+  "Get the container's storage information:": "Obtenga la información de almacenamiento del contenedor:",
+  "Git installed": "git instalado",
+  "Global settings and SSH jail configured": "Configuración global y cárcel SSH configurada",
+  "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "vaya a \"Administrar rutas personalizadas\" y elimine la entrada personalizada que incluye el destino.",
+  "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "Google solo envía un repositorio APT oficial de libedgetpu para Debian/Ubuntu.La transferencia de hardware ya está escrita en",
+  "Graceful shutdown timed out.": "Se agotó el tiempo de cierre elegante.",
+  "Group": "Grupo",
+  "Group 'sharedfiles' already exists inside the CT": "El grupo 'archivos compartidos' ya existe dentro del CT",
+  "Group GID:": "GID de grupo:",
+  "Group created:": "Grupo creado:",
+  "Group name cannot be empty.": "El nombre del grupo no puede estar vacío.",
+  "Group:": "Grupo:",
+  "Groups": "Grupos",
+  "Groups:": "Grupos:",
+  "Guest Access Denied": "Acceso de invitado denegado",
+  "Guest Access Error": "Error de acceso de invitados",
+  "Guest Access Failed": "Error de acceso de invitados",
+  "Guest Access Validation Results:": "Resultados de la validación del acceso de invitados:",
+  "Guest Agent configuration applied": "Configuración del agente invitado aplicada",
+  "Guest access (no authentication)": "Acceso de invitado (sin autenticación)",
+  "Guest access confirmed for share:": "Acceso de invitado confirmado para compartir:",
+  "Guest access denied for share:": "Acceso de invitado denegado para compartir:",
+  "Guest access failed.": "El acceso de invitados falló.",
+  "Guest access is not allowed on this server.": "El acceso de invitados no está permitido en este servidor.",
+  "Guest access test:": "Prueba de acceso de invitados:",
+  "Guest access validated successfully!": "¡Acceso de invitado validado exitosamente!",
+  "Guest access works for listing, but no shares are available.": "El acceso de invitado funciona para la cotización, pero no hay acciones disponibles.",
+  "Guest accessible share": "Compartir accesible para invitados",
+  "Guest accessible:": "Accesible para invitados:",
+  "Guest agent detection completed": "Detección del agente invitado completada",
+  "Guest agent installation process completed": "Proceso de instalación del agente invitado completado",
+  "Guest agent packages removed": "Paquetes de agente invitado eliminados",
+  "Guest configs restored:": "Configuraciones de invitados restauradas:",
+  "Guest share listing successful": "Listado de acciones de invitados exitoso",
+  "Guided Cleanup Available": "Limpieza guiada disponible",
+  "Guided Repair Available": "Reparación guiada disponible",
+  "HA groups will be migrated to HA rules automatically": "Los grupos de HA se migrarán a reglas de HA automáticamente",
+  "HA services disabled (configs preserved)": "Servicios HA deshabilitados (configuraciones preservadas)",
+  "Hardening SSH: setting MaxAuthTries to 3...": "Endurecimiento de SSH: configuración de MaxAuthTries en 3...",
+  "Hardware": "Hardware",
+  "Hardware compatibility — these items will be skipped to keep the boot safe:": "Compatibilidad de hardware: estos elementos se omitirán para mantener el arranque seguro:",
+  "Hardware passthrough is already configured — the Coral device is visible inside the container as /dev/apex_0 (M.2) and/or /dev/bus/usb (USB).": "La transferencia de hardware ya está configurada: el dispositivo Coral es visible dentro del contenedor como /dev/apex_0 (M.2) y/o /dev/bus/usb (USB).",
+  "Hardware: GPUs and Coral-TPU": "Hardware: GPU y Coral-TPU",
+  "Have valid backups of all VMs and containers": "Tener copias de seguridad válidas de todas las máquinas virtuales y contenedores",
+  "Help & Info (commands)": "Ayuda e información (comandos)",
+  "Help & Information": "Ayuda e información",
+  "Help and Info": "Ayuda e información",
+  "Help and Info Commands": "Comandos de ayuda e información",
+  "Helper-Scripts logo applied": "Logotipo de Helper-Scripts aplicado",
+  "Hidden for safety": "Escondido por seguridad",
+  "Hidden:": "Oculto:",
+  "High Availability services have been enabled successfully": "Los servicios de alta disponibilidad se han habilitado correctamente",
+  "High Availability setup completed": "Configuración de alta disponibilidad completada",
+  "High risk confirmation": "Confirmación de alto riesgo",
+  "High-Risk GPU Power State": "Estado de energía de la GPU de alto riesgo",
+  "Home-Lab-Club logo applied": "Logotipo de Home-Lab-Club aplicado",
+  "Host": "Anfitrión",
+  "Host Backup  →  Borg": "Copia de seguridad del host → Borg",
+  "Host Backup  →  Local archive": "Copia de seguridad del host → Archivo local",
+  "Host Backup  →  PBS": "Copia de seguridad del host → PBS",
+  "Host Backup & Restore": "Copia de seguridad y restauración del host",
+  "Host Config Backup": "Copia de seguridad de la configuración del host",
+  "Host Config Backup / Restore": "Copia de seguridad/restauración de la configuración del host",
+  "Host Config Restore": "Restauración de configuración del host",
+  "Host Directory": "Directorio de host",
+  "Host Directory to LXC Mount Point": "Directorio de host para el punto de montaje LXC",
+  "Host Directory:": "Directorio de host:",
+  "Host GPU binding changed — reboot required.": "Se cambió el enlace de la GPU del host: es necesario reiniciar.",
+  "Host GPU detected": "GPU del host detectada",
+  "Host GPU is already bound to vfio-pci. Host reconfiguration/reboot should not be required for this VM-to-VM reassignment.": "La GPU del host ya está vinculada a vfio-pci. No debería ser necesario reconfigurar/reiniciar el host para esta reasignación de VM a VM.",
+  "Host IP": "IP del host",
+  "Host Mount Path": "Ruta de montaje del host",
+  "Host NFS/Samba as Proxmox Storage (pvesm)": "Aloje NFS/Samba como almacenamiento en Proxmox (pvesm)",
+  "Host Path": "Ruta del host",
+  "Host Path:": "Ruta del anfitrión:",
+  "Host Storage (NFS / Samba via Proxmox)": "Almacenamiento de host (NFS/Samba vía Proxmox)",
+  "Host VFIO config was already up to date — no reboot needed.": "La configuración del host VFIO ya estaba actualizada; no es necesario reiniciar.",
+  "Host VFIO configuration already up to date": "Configuración del host VFIO ya actualizada",
+  "Host VFIO configuration changed (initramfs updated). Reboot required before starting the VM.": "La configuración de VFIO del host cambió (initramfs actualizado). Es necesario reiniciar antes de iniciar la máquina virtual.",
+  "Host VFIO configuration changed — reboot required before starting the VM.": "La configuración de VFIO del host cambió: es necesario reiniciar antes de iniciar la máquina virtual.",
+  "Host already in VFIO mode — skipping host reconfiguration for VM reassignment": "El host ya está en modo VFIO: omitir la reconfiguración del host para la reasignación de VM",
+  "Host backup attached to PVE job": "Copia de seguridad del host adjunta al trabajo PVE",
+  "Host directory access for unprivileged containers has been prepared above": "El acceso al directorio de host para contenedores sin privilegios se preparó anteriormente",
+  "Host directory permissions updated — unprivileged containers can now access it": "Permisos del directorio de host actualizados: los contenedores sin privilegios ahora pueden acceder a él",
+  "Host directory:": "Directorio de host:",
+  "Host fstab CIFS Mounts:": "Montajes CIFS del host fstab:",
+  "Host fstab CIFS mounts (not registered with pvesm):": "Montajes CIFS del host fstab (no registrados con pvesm):",
+  "Host fstab CIFS mounts:": "Montajes CIFS del host fstab:",
+  "Host fstab Mount:": "Montaje fstab del host:",
+  "Host fstab NFS Mounts:": "Montajes NFS del host fstab:",
+  "Host fstab NFS mounts (not registered with pvesm):": "Montajes host fstab NFS (no registrados con pvesm):",
+  "Host fstab NFS mounts:": "Montajes NFS del host fstab:",
+  "Host fstab mounts (not registered as Proxmox storage):": "Montajes de host fstab (no registrados como almacenamiento Proxmox):",
+  "Host identity (hostname, hosts)": "Identidad del host (nombre de host, hosts)",
+  "Host permissions applied (o+rwx + default ACL) — unprivileged LXCs can read/write through bind-mounts": "Permisos de host aplicados (o+rwx + ACL predeterminada): los LXC sin privilegios pueden leer/escribir a través de montajes vinculados",
+  "Host write access confirmed.": "Acceso de escritura del host confirmado.",
+  "Hostname": "Nombre de host",
+  "Hot changes applied. No reboot needed for these paths.": "Se aplicaron cambios importantes. No es necesario reiniciar para estas rutas.",
+  "How do you want to add it?": "¿Cómo quieres agregarlo?",
+  "How do you want to authenticate this backup target?": "¿Cómo desea autenticar este destino de copia de seguridad?",
+  "How do you want to select the": "¿Cómo desea seleccionar el",
+  "How do you want to select the HOST folder to mount?": "¿Cómo desea seleccionar la carpeta HOST para montar?",
+  "How do you want to select the NFS server?": "¿Cómo desea seleccionar el servidor NFS?",
+  "How do you want to select the Samba server?": "¿Cómo desea seleccionar el servidor Samba?",
+  "How do you want to select the folder to export?": "¿Cómo desea seleccionar la carpeta para exportar?",
+  "How do you want to select the folder to share?": "¿Cómo desea seleccionar la carpeta para compartir?",
+  "How to Access an LXC Terminal": "Cómo acceder a una terminal LXC",
+  "How to Access an LXC Terminal from Proxmox Host": "Cómo acceder a una terminal LXC desde Proxmox Host",
+  "How to schedule": "Cómo programar",
+  "I have read this": "He leído esto",
+  "I/O priority configured": "Prioridad de E/S configurada",
+  "ID already in use. Please choose another.": "ID ya en uso. Por favor elige otro.",
+  "IMPORTANT": "IMPORTANTE",
+  "IMPORTANT NOTES:": "NOTAS IMPORTANTES:",
+  "IMPORTANT PREREQUISITES:": "PRERREQUISITOS IMPORTANTES:",
+  "IMPORTANT — Save this passphrase": "IMPORTANTE: guarde esta frase de contraseña",
+  "IOMMU Group": "Grupo IOMMU",
+  "IOMMU Group Error": "Error del grupo IOMMU",
+  "IOMMU Group Pending": "Grupo IOMMU Pendiente",
+  "IOMMU Pending Reboot": "Reinicio pendiente de IOMMU",
+  "IOMMU Required": "Se requiere IOMMU",
+  "IOMMU already configured in /etc/kernel/cmdline": "IOMMU ya configurado en /etc/kernel/cmdline",
+  "IOMMU already configured in GRUB": "IOMMU ya configurado en GRUB",
+  "IOMMU already configured in kernel parameters": "IOMMU ya configurado en los parámetros del kernel",
+  "IOMMU already enabled in GRUB configuration": "IOMMU ya habilitado en la configuración de GRUB",
+  "IOMMU and VFIO setup completed": "Configuración de IOMMU y VFIO completada",
+  "IOMMU configured successfully.": "IOMMU configurado correctamente.",
+  "IOMMU configured. GPU passthrough setup will continue now and will be effective after reboot.": "IOMMU configurado. La configuración de transferencia de GPU continuará ahora y será efectiva después del reinicio.",
+  "IOMMU enabled in GRUB configuration": "IOMMU habilitado en la configuración de GRUB",
+  "IOMMU groups are not available yet because reboot is pending.": "Los grupos IOMMU aún no están disponibles porque el reinicio está pendiente.",
+  "IOMMU has been enabled on this system.": "IOMMU se ha habilitado en este sistema.",
+  "IOMMU has been enabled on this system. A reboot is required to apply the changes. Reboot now?": "IOMMU se ha habilitado en este sistema. Es necesario reiniciar para aplicar los cambios. ¿Reiniciar ahora?",
+  "IOMMU has been enabled — a system reboot is required": "Se ha habilitado IOMMU: es necesario reiniciar el sistema",
+  "IOMMU interrupt remapping configured": "Reasignación de interrupciones de IOMMU configurada",
+  "IOMMU is already active on this system": "IOMMU ya está activo en este sistema.",
+  "IOMMU is already configured for next boot, but it is not active yet.": "IOMMU ya está configurado para el próximo inicio, pero aún no está activo.",
+  "IOMMU is enabled on the system": "IOMMU está habilitado en el sistema.",
+  "IOMMU is not active on this host.": "IOMMU no está activo en este host.",
+  "IOMMU is not active on this system.": "IOMMU no está activo en este sistema.",
+  "IOMMU is not active. Skipping Controller + NVMe assignment.": "IOMMU no está activo. Saltarse la asignación de Controlador + NVMe.",
+  "IOMMU kernel parameters configured": "Parámetros del kernel IOMMU configurados",
+  "IOMMU parameters added to /etc/kernel/cmdline": "Parámetros IOMMU agregados a /etc/kernel/cmdline",
+  "IOMMU parameters added to GRUB": "Parámetros IOMMU agregados a GRUB",
+  "IOMMU parameters removed from /etc/kernel/cmdline": "Parámetros de IOMMU eliminados de /etc/kernel/cmdline",
+  "IOMMU parameters removed from GRUB": "Parámetros IOMMU eliminados de GRUB",
+  "IOMMU was configured during this wizard and a reboot is pending.": "IOMMU se configuró durante este asistente y hay un reinicio pendiente.",
+  "IOMMU/VFIO configuration reverted": "Configuración de IOMMU/VFIO revertida",
+  "IP": "IP",
+  "IP or hostname of the PVE node hosting the Borg server LXC:": "IP o nombre de host del nodo PVE que aloja el servidor Borg LXC:",
+  "ISO": "ISO",
+  "ISO created successfully:": "ISO creada con éxito:",
+  "ISO image         — installation images": "Imagen ISO: imágenes de instalación",
+  "ISO image downloaded": "imagen ISO descargada",
+  "ISO not found to mount on device": "ISO no encontrado para montar en el dispositivo",
+  "Identical:": "Idéntico:",
+  "Identify candidate disk (never use system disk):": "Identifique el disco candidato (nunca use el disco del sistema):",
+  "Identify persistent disk paths": "Identificar rutas de disco persistentes",
+  "If 'proxmox-ve' removal warning:": "Si hay advertencia de eliminación de 'proxmox-ve':",
+  "If Code 43 error appears, KVM hiding is already configured.": "Si aparece el error Código 43, la ocultación de KVM ya está configurada.",
+  "If GUI does not load:": "Si la GUI no se carga:",
+  "If ZFS errors occur:": "Si se producen errores de ZFS:",
+  "If booting in EFI mode with root on LVM: install GRUB for EFI": "Si arranca en modo EFI con root en LVM: instale GRUB para EFI",
+  "If config issues occur:": "Si ocurren problemas de configuración:",
+  "If container won't start:": "Si el contenedor no se inicia:",
+  "If imported from ESXi: install qemu-guest-agent inside the guest OS": "Si se importa desde ESXi: instale qemu-guest-agent dentro del sistema operativo invitado",
+  "If it still fails, the NFS server export options must be changed on the server.": "Si aún falla, se deben cambiar las opciones de exportación del servidor NFS en el servidor.",
+  "If it warns about 'systemd-boot' meta-package, remove it:": "Si advierte sobre el metapaquete 'systemd-boot', elimínelo:",
+  "If mount fails (LVM):": "Si el montaje falla (LVM):",
+  "If needed again, re-add GPU to LXC from GPUs and Coral-TPU Menu → Add GPU to LXC.": "Si es necesario nuevamente, vuelva a agregar GPU a un LXC desde el menú GPU y Coral-TPU → Agregar GPU a un LXC.",
+  "If network does not work:": "Si la red no funciona:",
+  "If not 19.x, upgrade Ceph (Reef→Squid) first per the official guide:": "Si no es 19.x, actualice Ceph (Reef→Squid) primero según la guía oficial:",
+  "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.": "si las notificaciones están habilitadas (Telegram/Discord/ntfy/...), recibirá un mensaje de \"Restauración del host finalizada\" cuando se completen todas las tareas en segundo plano.",
+  "If passthrough fails on Windows: install RadeonResetBugFix.": "Si el paso a través falla en Windows: instale RadeonResetBugFix.",
+  "If path not accessible (ZFS/BTRFS):": "Si la ruta no es accesible (ZFS/BTRFS):",
+  "If pvesm path returned a DEVICE (LVM):": "Si la ruta pvesm devolvió un DISPOSITIVO (LVM):",
+  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Si la ruta pvesm devolvió un DIRECTORIO (ZFS/BTRFS):",
+  "If repositories error:": "Si hay error en los repositorios:",
+  "If the host freezes, remove hostpci entries from": "Si el host se congela, elimine las entradas hostpci de",
+  "If this happens, you can restore the backup from the 'Subscription Banner Removal' option in 'Uninstall optimizations'.": "Si esto sucede, puede restaurar la copia de seguridad desde la opción 'Eliminación del banner de suscripción' en 'Optimizaciones de desinstalación'.",
+  "If this node runs hyper-converged Ceph: ensure Ceph is 19.x (Squid) BEFORE upgrading PVE.": "Si este nodo ejecuta Ceph hiperconvergente: asegúrese de que Ceph sea 19.x (Squid) ANTES de actualizar PVE.",
+  "If upgrade fails:": "Si la actualización falla:",
+  "If you are sure you want to use it, please remove the": "Si está seguro de que desea utilizarlo, elimine el",
+  "If you choose No, install": "Si elige No, instale",
+  "If you continue, some adjustments may be duplicated or conflict with those already made by xshok.": "Si continúa, es posible que algunos ajustes se dupliquen o entren en conflicto con los que ya realizó xshok.",
+  "If you lose connectivity, you can restore from backup using the console.": "Si pierde la conectividad, puede restaurar desde la copia de seguridad usando la consola.",
+  "If you lose or reinstall this host without a copy of the passphrase somewhere else (password manager, offline note, another host, USB stick...), every encrypted archive in this Borg repository becomes UNRECOVERABLE.": "si pierde o reinstala este host sin una copia de la frase de contraseña en otro lugar (administrador de contraseñas, nota sin conexión, otro host, memoria USB...), todos los archivos cifrados en este repositorio Borg se vuelven IRRECUPERABLES.",
+  "If you want HDMI/analog audio inside the VM, select the audio controller(s) to pass through along with the GPU.": "Si desea audio HDMI/analógico dentro de la VM, seleccione los controladores de audio para pasar junto con la GPU.",
+  "If you want to use a physical monitor on the passthrough GPU:": "Si desea utilizar un monitor físico en la GPU de paso:",
+  "If your DHCP has a static reservation for the old MAC, update it.": "si su DHCP tiene una reserva estática para la MAC anterior, actualícela.",
+  "Image Source Directory": "Directorio de origen de imágenes",
+  "Image directory:": "Directorio de imágenes:",
+  "Image file not found:": "Archivo de imagen no encontrado:",
+  "Image imported:": "Imagen importada:",
+  "Images to import:": "Imágenes para importar:",
+  "Import            — disk image imports": "Importar: importaciones de imágenes de disco",
+  "Import Disk Image to VM": "Importar imagen de disco a VM",
+  "Import Disk to LXC": "Importar disco a LXC",
+  "Import Disk to VM": "Importar disco a VM",
+  "Import Disks Selected:": "Importar discos seleccionados:",
+  "Import PBS keyfile": "Importar archivo de claves PBS",
+  "Import Summary": "Resumen de importación",
+  "Import VM from OVA or OVF": "Importar VM desde OVA u OVF",
+  "Import a ZFS pool": "Importar un grupo ZFS",
+  "Import a keyfile from an absolute path (replaces the current one)": "importe un archivo de claves desde una ruta absoluta (reemplaza la actual)",
+  "Import disk assigned": "Importar disco asignado",
+  "Import disk image to VM": "Importar imagen de disco a VM",
+  "Import disks": "Importar discos",
+  "Import encryption keyfile": "importar archivo de claves de cifrado",
+  "Import failed": "Importación fallida",
+  "Import failed for:": "La importación falló para:",
+  "Important: both VMs cannot be running at the same time with the same GPU.": "Importante: ambas VM no pueden ejecutarse al mismo tiempo con la misma GPU.",
+  "Important: some GPUs may still fail in passthrough and can affect host stability or overall performance depending on hardware/firmware quality.": "Importante: algunas GPU aún pueden fallar en la transferencia y pueden afectar la estabilidad del host o el rendimiento general según la calidad del hardware/firmware.",
+  "Importing": "Importador",
+  "Importing disk": "Importando disco",
+  "Importing:": "Importador:",
+  "Improve log rotation and limit log size to save space and extend disk life": "Mejore la rotación de registros y limite el tamaño de los registros para ahorrar espacio y extender la vida útil del disco.",
+  "In the loader interface, follow the instructions to select your Synology model": "En la interfaz del cargador, siga las instrucciones para seleccionar su modelo de Synology",
+  "In use": "En uso",
+  "In use by VM/LXC config": "En uso por la configuración de VM/LXC",
+  "In use by running VM/LXC — stop it first": "En uso ejecutando VM/LXC: deténgalo primero",
+  "Inaccessible device during VM startup": "Dispositivo inaccesible durante el inicio de la VM",
+  "Inactive": "Inactivo",
+  "Inactive (entry in fstab, not currently mounted)": "Inactivo (entrada en fstab, no montado actualmente)",
+  "Includes /etc/network (may drop SSH immediately)": "Incluye /etc/network (puede eliminar SSH inmediatamente)",
+  "Includes /etc/zfs": "Incluye /etc/zfs",
+  "Includes cluster data (/etc/pve, /var/lib/pve-cluster)": "Incluye datos del clúster (/etc/pve, /var/lib/pve-cluster)",
+  "Incompatible GPU for VM Passthrough": "GPU incompatible para paso de VM",
+  "Incompatible Machine Type": "Tipo de máquina incompatible",
+  "Incompatible Reset Capability for AMD dGPU": "Capacidad de reinicio incompatible para AMD dGPU",
+  "Incompatible Reset Capability for Intel GPU": "Capacidad de reinicio incompatible para GPU Intel",
+  "Incompatible Reset Capability for Intel dGPU": "Capacidad de reinicio incompatible para Intel dGPU",
+  "Incompatible archive": "Archivo incompatible",
+  "Increase container RAM temporarily to": "Aumente temporalmente la RAM del contenedor para",
+  "Increase file and process limits for advanced workloads": "Aumente los límites de archivos y procesos para cargas de trabajo avanzadas",
+  "Increase various system limits": "Aumentar varios límites del sistema",
+  "Increase vzdump backup speed": "Aumentar velocidad de copias vzdump",
+  "Increasing maximum file system open files...": "Aumentando el número máximo de archivos abiertos en el sistema de archivos...",
+  "Increasing various system limits...": "Aumentando varios límites del sistema...",
+  "Inherited retention:": "Retención heredada:",
+  "Inherited schedule:": "Horario heredado:",
+  "Initializing Borg repository if needed...": "Inicializando el repositorio de Borg si es necesario...",
+  "Initiator IQN is authorised on the target": "El iniciador IQN está autorizado en el objetivo.",
+  "Initiator IQN:": "IQN del iniciador:",
+  "Inspect disks before any action": "Inspeccionar los discos antes de cualquier acción.",
+  "Inspect host device nodes": "Inspeccionar los nodos del dispositivo host",
+  "Inspect passthrough/kernel events": "Inspeccionar eventos de transferencia/kernel",
+  "Inspect storage config block:": "Inspeccionar el bloque de configuración de almacenamiento:",
+  "Inspection commands run directly. Template commands [T] require parameter substitution.": "Los comandos de inspección se ejecutan directamente. Los comandos de plantilla [T] requieren la sustitución de parámetros.",
+  "Install": "Instalar",
+  "Install ALL utilities": "Instalar TODAS las utilidades",
+  "Install AMD GPU drivers inside the guest.": "Instale los controladores de GPU AMD dentro del invitado.",
+  "Install CIFS client packages inside CT:": "Instale paquetes de cliente CIFS dentro de CT:",
+  "Install Coral TPU in LXC": "Instalar Coral TPU en LXC",
+  "Install Fail2Ban": "Instalar Fail2Ban",
+  "Install Figurine": "Instalar Figurine",
+  "Install Intel Graphics Driver inside the guest.": "Instale el controlador de gráficos Intel dentro del invitado.",
+  "Install Lynis": "Instalar Lynis",
+  "Install NFS client packages inside CT:": "Instale paquetes de cliente NFS dentro de CT:",
+  "Install NVIDIA Drivers on Host": "Instalar controladores NVIDIA en el host",
+  "Install NVIDIA drivers from nvidia.com inside the guest.": "Instale los controladores NVIDIA de nvidia.com dentro del invitado.",
+  "Install NVIDIA proprietary drivers": "Instalar controladores propietarios de NVIDIA",
+  "Install OVH Real Time Monitoring": "Instalar monitorización en tiempo real de OVH",
+  "Install Open vSwitch": "Instalar Open vSwitch",
+  "Install Samba inside CT:": "Instale Samba dentro de CT:",
+  "Install ZFS auto-snapshot": "Instalar ZFS auto-snapshot",
+  "Install analysis tools": "Instalar herramientas de análisis",
+  "Install and configure": "Instalar y configurar",
+  "Install and configure Fastfetch": "Instalar y configurar Fastfetch",
+  "Install and configure Log2RAM": "Instalar y configurar Log2RAM",
+  "Install and start iSCSI initiator:": "Instale e inicie el iniciador iSCSI:",
+  "Install basic utilities": "Instalar utilidades básicas",
+  "Install common system utilities": "Instalar utilidades comunes del sistema",
+  "Install compression tools": "Instalar herramientas de compresión",
+  "Install development tools": "Instalar herramientas de desarrollo",
+  "Install maintainer's version (Y)": "Instalar la versión del mantenedor (Y)",
+  "Install manually and retry: apt-get install -y exfatprogs": "Instale manualmente y vuelva a intentarlo: apt-get install -y exfatprogs",
+  "Install manually with:": "Instalar manualmente con:",
+  "Install network tools": "Instalar herramientas de red",
+  "Install podman or docker to continue.": "Instale podman o docker para continuar.",
+  "Install relevant guest agent": "Instalar el agente invitado correspondiente",
+  "Install server packages inside CT:": "Instale paquetes de servidor dentro de CT:",
+  "Install terminal multiplexers": "Instalar multiplexores de terminales",
+  "Install the Edge TPU runtime (libedgetpu1-std)": "Instale el tiempo de ejecución de Edge TPU (libedgetpu1-std)",
+  "Install with Cloud-Init script": "Instalar con el script Cloud-Init",
+  "Install with ISO from UUP Dump": "Instalar con ISO desde UUP Dump",
+  "Install with personal ISO": "Instalar con ISO personal",
+  "Install with traditional method": "Instalar con método tradicional.",
+  "Install with: apt-get install open-iscsi": "Instalar con: apt-get install open-iscsi",
+  "Install/Update Coral TPU on Host": "Instalar/actualizar Coral TPU en el host",
+  "Install/Update NVIDIA Drivers (Host + LXC)": "Instalar/actualizar controladores NVIDIA (Host + LXC)",
+  "Installation Complete": "Instalación completa",
+  "Installation completed.": "Instalación completada.",
+  "Installation completed. Please reboot the server manually as soon as possible.": "Instalación completada. Reinicie el servidor manualmente lo antes posible.",
+  "Installation completed. Press Enter to continue...": "Instalación completada. Presione Entrar para continuar...",
+  "Installation failed": "La instalación falló",
+  "Installation finished but drivers are not loaded. A reboot may be required.": "La instalación finalizó pero los controladores no están cargados. Es posible que sea necesario reiniciar.",
+  "Installation log:": "Registro de instalación:",
+  "Installation summary": "Resumen de instalación",
+  "Installed": "Instalado",
+  "Installed at:": "Instalado en:",
+  "Installed components:": "Componentes instalados:",
+  "Installed:": "Instalado:",
+  "Installer already downloaded and verified.": "Instalador ya descargado y verificado.",
+  "Installer copied to container.": "Instalador copiado al contenedor.",
+  "Installer downloaded.": "Instalador descargado.",
+  "Installer finished with errors.": "El instalador terminó con errores.",
+  "Installer not found:": "Instalador no encontrado:",
+  "Installing": "Instalación",
+  "Installing AMD mesa drivers in container...": "Instalando controladores AMD mesa en contenedor...",
+  "Installing Ceph packages...": "Instalando paquetes Ceph...",
+  "Installing Ceph support...": "Instalando soporte Ceph...",
+  "Installing Coral TPU driver inside the container...": "Instalando el controlador Coral TPU dentro del contenedor...",
+  "Installing Edge TPU runtime (libedgetpu1-std)...": "Instalando el tiempo de ejecución de Edge TPU (libedgetpu1-std)...",
+  "Installing Fail2Ban...": "Instalando Fail2Ban...",
+  "Installing Git as a prerequisite...": "Instalar Git como requisito previo...",
+  "Installing Intel VA-API drivers in container...": "Instalación de controladores Intel VA-API en contenedor...",
+  "Installing Log2RAM from GitHub...": "Instalando Log2RAM desde GitHub...",
+  "Installing Log2RAM from source...": "Instalando Log2RAM desde la fuente...",
+  "Installing NFS Client in LXC": "Instalación del cliente NFS en LXC",
+  "Installing NFS client packages...": "Instalando paquetes de cliente NFS...",
+  "Installing NFS client tools...": "Instalando herramientas de cliente NFS...",
+  "Installing NFS server packages inside the CT...": "Instalando paquetes de servidor NFS dentro del CT...",
+  "Installing NVIDIA drivers in container. This may take several minutes...": "Instalación de controladores NVIDIA en contenedor. Esto puede tardar varios minutos...",
+  "Installing NVIDIA udev rules and persistence service...": "Instalando reglas de NVIDIA udev y servicio de persistencia...",
+  "Installing NVIDIA utils (Alpine)...": "Instalando utilidades NVIDIA (Alpine)...",
+  "Installing NVIDIA utils (Arch)...": "Instalando utilidades NVIDIA (Arch)...",
+  "Installing OVH RTM (Real Time Monitoring)...": "Instalando OVH RTM (Monitorización en tiempo real)...",
+  "Installing OpenVSwitch for virtual internal network...": "Instalando OpenVSwitch para red interna virtual...",
+  "Installing OpenVSwitch packages...": "Instalando paquetes OpenVSwitch...",
+  "Installing Samba Client": "Instalación del cliente Samba",
+  "Installing Samba Client in LXC": "Instalación del cliente Samba en LXC",
+  "Installing Samba client tools...": "Instalando herramientas de cliente Samba...",
+  "Installing Samba server packages inside the CT...": "Instalando paquetes del servidor Samba dentro del CT...",
+  "Installing Samba/CIFS client packages...": "Instalando paquetes de cliente Samba/CIFS...",
+  "Installing amdgpu_top...": "Instalando amdgpu_top...",
+  "Installing and configuring Fail2Ban to protect Proxmox web interface and SSH...": "Instalando y configurando Fail2Ban para proteger la interfaz web de Proxmox y SSH...",
+  "Installing and configuring Fastfetch...": "Instalando y configurando Fastfetch...",
+  "Installing and configuring Figurine...": "Instalando y configurando Figurine...",
+  "Installing and configuring ZFS auto-snapshot...": "Instalando y configurando la instantánea automática de ZFS...",
+  "Installing build dependencies...": "Instalando dependencias de compilación...",
+  "Installing dependency:": "Instalación de dependencia:",
+  "Installing essential Proxmox packages...": "Instalando paquetes esenciales de Proxmox...",
+  "Installing gawk (required for OVF parsing)...": "Instalando gawk (requerido para el análisis de OVF)...",
+  "Installing group": "Grupo de instalación",
+  "Installing host drivers while the GPU is assigned to a VM could break passthrough and destabilize the system.": "La instalación de controladores de host mientras la GPU está asignada a una máquina virtual podría interrumpir el paso y desestabilizar el sistema.",
+  "Installing iSCSI initiator tools...": "Instalando herramientas de iniciador iSCSI...",
+  "Installing intel-gpu-tools...": "Instalando herramientas Intel-Gpu...",
+  "Installing kexec-tools...": "Instalando herramientas kexec...",
+  "Installing latest Lynis security scan tool...": "Instalando la última herramienta de análisis de seguridad de Lynis...",
+  "Installing packages...": "Instalando paquetes...",
+  "Installing pigz...": "Instalando pigz...",
+  "Installing required dependencies...": "Instalando las dependencias requeridas...",
+  "Installing required package: git": "Instalación del paquete requerido: git",
+  "Installing required tools...": "Instalando las herramientas necesarias...",
+  "Installing selected utilities": "Instalación de utilidades seleccionadas",
+  "Installing system utilities...": "Instalando utilidades del sistema...",
+  "Installing zfs-auto-snapshot package...": "Instalando el paquete zfs-auto-snapshot...",
+  "Installs essential packages if missing": "Instala paquetes esenciales si faltan",
+  "Insufficient Disk Space": "Espacio en disco insuficiente",
+  "Insufficient disk space. Skipping LXC": "Espacio en disco insuficiente. Saltarse LXC",
+  "Insufficient memory. NVIDIA install aborted.": "Memoria insuficiente. Instalación de NVIDIA cancelada.",
+  "Insufficient memory. Skipping LXC": "Memoria insuficiente. Saltarse LXC",
+  "Insufficient space:": "Espacio insuficiente:",
+  "Integrity check failed on": "La verificación de integridad falló",
+  "Intel CPU detected": "CPU Intel detectada",
+  "Intel GPU Tools installation completed!": "¡Se completó la instalación de las herramientas Intel GPU!",
+  "Intel GPU(s) detected:": "GPU Intel detectadas:",
+  "Intel VA-API drivers installed.": "Controladores Intel VA-API instalados.",
+  "Intel iGPU passthrough configured.": "Paso a través de Intel iGPU configurado.",
+  "Interactive (guided, prompts visible)": "Interactivo (guiado, indicaciones visibles)",
+  "Interactive process viewer (press q to exit)": "Visor de procesos interactivo (presione q para salir)",
+  "Interface": "Interfaz",
+  "Interface MTU": "MTU de interfaz",
+  "Interface Names (persistent)": "Nombres de interfaces persistentes",
+  "Interface Type": "Tipo de interfaz",
+  "Interface names will return to default systemd behavior.": "Los nombres de las interfaces volverán al comportamiento predeterminado de systemd.",
+  "Interface type:": "Tipo de interfaz:",
+  "Interfaces configured": "Interfaces configuradas",
+  "Interfaces defined with 'auto' but no 'iface' block": "Interfaces definidas con el bloque 'auto' pero sin 'iface'",
+  "Interfaces to Remove": "Interfaces para eliminar",
+  "Internal error: NVIDIA installer path is empty or file not found.": "Error interno: la ruta del instalador de NVIDIA está vacía o no se encuentra el archivo.",
+  "Internal error: missing arguments in pmx_prepare_host_shared_dir": "Error interno: faltan argumentos en pmx_prepare_host_shared_dir",
+  "Invalid 'proxmox-ve' candidate (not 9.x or none). Please verify your repository configuration and network, then retry.": "Candidato 'proxmox-ve' no válido (ni 9.x ni ninguno). Verifique la configuración y la red de su repositorio y luego vuelva a intentarlo.",
+  "Invalid ID": "ID no válida",
+  "Invalid Option": "Opción no válida",
+  "Invalid Path": "Ruta no válida",
+  "Invalid VMID": "VMID no válido",
+  "Invalid ZFS pool name.": "Nombre de grupo ZFS no válido.",
+  "Invalid group name. Use letters, digits, underscore or hyphen, and start with a letter or underscore.": "Nombre de grupo no válido. Utilice letras, dígitos, guiones bajos o guiones y comience con una letra o un guión bajo.",
+  "Invalid input": "Entrada no válida",
+  "Invalid name": "Nombre no válido",
+  "Invalid name. Use only letters, numbers, hyphens and underscores.": "Nombre no válido. Utilice únicamente letras, números, guiones y guiones bajos.",
+  "Invalid option": "Opción no válida",
+  "Invalid option, please try again.": "Opción no válida, inténtalo de nuevo.",
+  "Invalid option. Skipping.": "Opción no válida. Salto a la comba.",
+  "Invalid parameters for bind mount": "Parámetros no válidos para montaje de enlace",
+  "Invalid selection": "Selección no válida",
+  "Invalid size. Please enter a number in MB (e.g., 128, 256, 512).": "Tamaño no válido. Ingrese un número en MB (por ejemplo, 128, 256, 512).",
+  "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "ID de almacenamiento no válido. Utilice únicamente letras, números, guiones y guiones bajos.",
+  "Invalid username or password.": "Nombre de usuario o contraseña no válidos.",
+  "Issue": "Asunto",
+  "Issues found": "Problemas encontrados",
+  "Issues were found. Would you like to use the Guided Cleanup Assistant?": "Se encontraron problemas. ¿Le gustaría utilizar el Asistente de limpieza guiada?",
+  "Issues were found. Would you like to use the Guided Repair Assistant?": "Se encontraron problemas. ¿Le gustaría utilizar el Asistente de reparación guiada?",
+  "It appears that you have already executed the xshok-proxmox post-install script on this system.": "Parece que ya ejecutó el script posterior a la instalación xshok-proxmox en este sistema.",
+  "It is recommended to create a backup before continuing.": "Se recomienda crear una copia de seguridad antes de continuar.",
+  "It is strongly recommended to create a backup of your container before proceeding with the conversion.": "Se recomienda encarecidamente crear una copia de seguridad de su contenedor antes de continuar con la conversión.",
+  "It will be installed from the official GitHub repository.": "Se instalará desde el repositorio oficial de GitHub.",
+  "Italian": "italiano",
+  "JC Channel logo applied": "Logotipo de JC Channel aplicado",
+  "JSON output for scripts": "Salida JSON para scripts",
+  "Job ID (letters, numbers, - _)": "ID de trabajo (letras, números, - _)",
+  "Job ID:": "Identificación del trabajo:",
+  "Job deleted:": "Trabajo eliminado:",
+  "Job disabled:": "Trabajo deshabilitado:",
+  "Job enabled:": "Trabajo habilitado:",
+  "Job selection returned empty id — aborting.": "La selección de trabajo devolvió una identificación vacía: abortando.",
+  "Journald configuration adjusted to": "Configuración de diario ajustada a",
+  "Journald configuration is already optimized": "La configuración de Journald ya está optimizada",
+  "Journald configuration updated and service restarted": "Configuración de diario actualizada y servicio reiniciado",
+  "Journald optimization completed": "Optimización del diario completada",
+  "Journald optimized - Max size: 64M": "Diario optimizado - Tamaño máximo: 64M",
+  "KDF:": "KDF:",
+  "KVM MSR options added to /etc/modprobe.d/kvm.conf": "Opciones de KVM MSR agregadas a /etc/modprobe.d/kvm.conf",
+  "KVM MSR options ensured in /etc/modprobe.d/kvm.conf": "Opciones de KVM MSR aseguradas en /etc/modprobe.d/kvm.conf",
+  "KVM MSR options not present, nothing to revert": "Las opciones de KVM MSR no están presentes, no hay nada que revertir",
+  "Keep GPU in LXC config (disable Start on boot)": "Mantenga la GPU en la configuración LXC (deshabilite Inicio al arrancar)",
+  "Keep GPU in LXC config + disable Start on boot": "Mantenga la GPU en la configuración LXC + deshabilite el inicio al arrancar",
+  "Keep GPU in VM config (disable Start on boot)": "Mantenga la GPU en la configuración de VM (deshabilite Inicio al arrancar)",
+  "Keep GPU in source VM config (disable Start on boot if enabled)": "Mantenga la GPU en la configuración de la máquina virtual de origen (deshabilite Iniciar al arrancar si está habilitado)",
+  "Keep GPU in source VM config + disable Start on boot if enabled": "Mantenga la GPU en la configuración de la VM de origen + deshabilite Iniciar al arrancar si está habilitado",
+  "Keep current version (N)": "Mantener la versión actual (N)",
+  "Keep current version (N) if modified": "Mantener la versión actual (N) si se modifica",
+  "Keep in source VM(s) + disable onboot + add to target VM": "Mantener en las VM de origen + desactivar el inicio + agregar a la VM de destino",
+  "Keeping GPU in source VM config": "Mantener la GPU en la configuración de la VM de origen",
+  "Kept sharedfiles group (has regular users assigned).": "Se mantiene el grupo de archivos compartidos (tiene usuarios habituales asignados).",
+  "Kernel and architecture info": "Información sobre el kernel y la arquitectura",
+  "Kernel headers and build tools verified.": "Encabezados del kernel y herramientas de compilación verificados.",
+  "Kernel max Key limit configured": "Límite máximo de claves del kernel configurado",
+  "Kernel panic behavior configuration completed": "Configuración del comportamiento de pánico del kernel completada",
+  "Kernel panic configuration removed": "Se eliminó la configuración de pánico del kernel",
+  "Kernel panic configuration updated and applied": "Configuración de pánico del kernel actualizada y aplicada",
+  "Kernel, modules and boot config": "Kernel, módulos y configuración de arranque",
+  "Kernel/boot-tied files (boot config, /etc/systemd/system, initramfs config, apt sources, ZFS state, ...) are NOT copied verbatim to keep the target's boot safe. The operator's own tuning inside them (IOMMU cmdline, VFIO IDs, custom quirks, GRUB timeout, ...) is merged into the target's fresh copies automatically via kernel-agnostic merge.": "Los archivos vinculados al kernel/arranque (configuración de arranque, /etc/systemd/system, configuración initramfs, fuentes apt, estado de ZFS, ...) NO se copian palabra por palabra para mantener seguro el arranque del destino.El propio ajuste del operador dentro de ellos (línea cmd de IOMMU, ID de VFIO, peculiaridades personalizadas, tiempo de espera de GRUB, ...) se fusiona automáticamente con las copias nuevas del objetivo mediante una fusión independiente del kernel.",
+  "Keyfile copied": "archivo clave copiado",
+  "Keyfile copied to:": "archivo clave copiado a:",
+  "Keyfile passphrase": "frase de contraseña del archivo clave",
+  "Keyfile passphrase stored:": "Frase de contraseña del archivo clave almacenada:",
+  "Keyfile recovered": "Archivo de claves recuperado",
+  "Keyfile recovered successfully.": "Keyfile recuperado exitosamente.",
+  "Keyfile recovery available": "Recuperación de archivos clave disponible",
+  "Keyfile recovery — pick source host": "Recuperación de archivos clave: elija el host de origen",
+  "Keyfile removed.": "Archivo de claves eliminado.",
+  "Keyrings method failed; trying apt-key fallback": "El método de llaveros falló; probando el respaldo de clave apta",
+  "LUNs appear as block devices assignable to VMs": "Los LUN aparecen como dispositivos de bloque asignables a VM",
+  "LVM PV headers check completed": "Se completó la verificación de los encabezados fotovoltaicos de LVM",
+  "LVM physical volume detected": "Volumen físico LVM detectado",
+  "LVM tools not available, skipping LVM check": "Herramientas LVM no disponibles, omitiendo la verificación de LVM",
+  "LVM:": "LVM:",
+  "LXC Conflict Policy": "Política de conflictos de LXC",
+  "LXC Container Privilege Status": "Estado de privilegio del contenedor LXC",
+  "LXC Conversion Manual Guides": "Guías manuales de conversión LXC",
+  "LXC Management": "Gestión LXC",
+  "LXC Mount Manager": "Administrador de montaje LXC",
+  "LXC Privileged to Unprivileged conversion": "Conversión de LXC privilegiado a no privilegiado",
+  "LXC Unprivileged to Privileged conversion": "Conversión de LXC no privilegiado a privilegiado",
+  "LXC already stopped": "LXC ya se detuvo",
+  "LXC containers with NVIDIA passthrough:": "Contenedores LXC con transferencia NVIDIA:",
+  "LXC conversion from privileged to unprivileged completed successfully!": "¡La conversión de LXC de privilegiado a no privilegiado se completó con éxito!",
+  "LXC conversion from unprivileged to privileged completed successfully!": "¡La conversión de LXC de no privilegiado a privilegiado se completó con éxito!",
+  "LXC removed:": "LXC eliminado:",
+  "LXC stopped": "LXC se detuvo",
+  "LXC update skipped by user.": "Actualización de LXC omitida por el usuario.",
+  "LXCs to destroy:": "LXC para destruir:",
+  "Label:": "Etiqueta:",
+  "Language Change": "Cambio de idioma",
+  "Language changed to": "Idioma cambiado a",
+  "Last 50 kernel log lines": "Últimas 50 líneas de registro del kernel",
+  "Last run:": "Última ejecución:",
+  "Last system boot time": "Hora del último arranque del sistema",
+  "Latest available": "Último disponible",
+  "Latest version:": "Última versión:",
+  "Launching GPU passthrough assistant for VM": "Lanzamiento del asistente de transferencia de GPU para VM",
+  "Legacy PVE 8 .list files commented or not present": "Archivos .list de PVE 8 heredados comentados o no presentes",
+  "Legacy ceph.list commented or not present": "Legacy ceph.list comentado o no presente",
+  "Legacy network tools (e.g., ifconfig)": "Herramientas de red heredadas (por ejemplo, ifconfig)",
+  "Legend:": "Leyenda:",
+  "Let's review your current network configuration.": "Revisemos su configuración de red actual.",
+  "Likely cause: host directory permissions deny the container's mapped UID.": "Causa probable: los permisos del directorio del host niegan el UID asignado del contenedor.",
+  "Limiting size and optimizing journald": "Limitar el tamaño y optimizar el diario",
+  "Limiting size and optimizing journald...": "Limitar el tamaño y optimizar el diario...",
+  "Line to paste (single line, including \"command=...\" prefix):": "Línea para pegar (una sola línea, incluido el prefijo \"comando=...\"):",
+  "Linux Installation Options": "Opciones de instalación de Linux",
+  "Linux/Mac path:": "Ruta Linux/Mac:",
+  "List Available Disks": "Listar discos disponibles",
+  "List IOMMU group mapping": "Listar el mapeo del grupo IOMMU",
+  "List NVMe devices": "Listar dispositivos NVMe",
+  "List SMART-capable devices": "Listar dispositivos compatibles con SMART",
+  "List VM/CT IDs to operate on": "Enumere los ID de VM/CT para operar",
+  "List ZFS datasets and snapshots": "Enumerar conjuntos de datos e instantáneas de ZFS",
+  "List all LXC containers": "Listar todos los contenedores LXC",
+  "List all ZFS pools": "Listar todos los grupos ZFS",
+  "List all containers to identify the privileged one:": "Enumere todos los contenedores para identificar el privilegiado:",
+  "List all containers to identify the unprivileged one:": "Enumere todos los contenedores para identificar el que no tiene privilegios:",
+  "List all virtual machines": "Listar todas las máquinas virtuales",
+  "List backups in a specific storage": "Listar copias de seguridad en un almacenamiento específico",
+  "List block devices and partitions": "Listar dispositivos de bloque y particiones",
+  "List configured storages:": "Lista de almacenamientos configurados:",
+  "List containers:": "Lista de contenedores:",
+  "List content of specific storage": "Listar el contenido de un almacenamiento específico",
+  "List disk persistent identifiers": "Listar identificadores persistentes de disco",
+  "List disks with detailed info": "Listar discos con información detallada.",
+  "List importable ZFS pools": "Listar grupos ZFS importables",
+  "List local backups": "Listar copias de seguridad locales",
+  "List storages valid for image import": "Listar almacenamientos válidos para importar imágenes",
+  "Listening Ports": "Puertos de escucha",
+  "Listening on:": "Escuchando en:",
+  "Listening ports:": "Puertos de escucha:",
+  "Listing relevant CT users and their mapped UID/GID on host...": "Listado de usuarios CT relevantes y su UID/GID asignado en el host...",
+  "Loading modules...": "Cargando módulos...",
+  "Local Disk Manager - Proxmox Host": "Administrador de discos locales - Proxmox Host",
+  "Local Disk Storages": "Almacenamientos en disco local",
+  "Local Shared Directory on Host": "Directorio compartido local en el host",
+  "Local archive targets (paths + USB mount/unmount)": "destinos de archivos locales (rutas + montaje/desmontaje de USB)",
+  "Local backup error log": "Registro de errores de copia de seguridad local",
+  "Local backup failed.": "Error en la copia de seguridad local.",
+  "Local directory  (single-machine — only use if it is a SEPARATE disk)": "directorio local (una sola máquina; utilícelo solo si es un disco SEPARADO)",
+  "Local keyfile is missing but a recovery copy was found in PBS.": "falta el archivo de claves local, pero se encontró una copia de recuperación en PBS.",
+  "Local network only (192.168.0.0/16)": "Sólo red local (192.168.0.0/16)",
+  "Local restore error log": "Registro de errores de restauración local",
+  "Locale generated": "Configuración regional generada",
+  "Location:": "Ubicación:",
+  "Log": "Registro",
+  "Log file": "Archivo de registro",
+  "Log2RAM already registered — updating to latest configuration": "Log2RAM ya registrado: actualizando a la última configuración",
+  "Log2RAM installation and configuration completed successfully.": "La instalación y configuración de Log2RAM se completó con éxito.",
+  "Log2RAM installation cancelled by user": "Instalación de Log2RAM cancelada por el usuario",
+  "Log2RAM installation verification failed. Check /tmp/log2ram_install.log": "Error en la verificación de la instalación de Log2RAM. Compruebe /tmp/log2ram_install.log",
+  "Log2RAM installed successfully": "Log2RAM se instaló correctamente",
+  "Log2RAM size set to:": "Tamaño de Log2RAM establecido en:",
+  "Log2RAM write scheduled every": "Escritura de Log2RAM programada cada",
+  "Log:": "Registro:",
+  "Logged-in users": "Usuarios registrados",
+  "Logrotate optimization completed": "Optimización de logrotate completada",
+  "Logrotate service restarted successfully": "El servicio Logrotate se reinició exitosamente",
+  "Long Test — Background": "Prueba larga: antecedentes",
+  "Long self-test started on": "La autoprueba larga comenzó el",
+  "Long test             — full scan, runs in background if closed": "Prueba larga: análisis completo, se ejecuta en segundo plano si está cerrado",
+  "Look for containers with 'unprivileged: 1' in their config": "Busque contenedores con 'sin privilegios: 1' en su configuración",
+  "Look for containers without 'unprivileged: 1' in their config": "Busque contenedores sin 'sin privilegios: 1' en su configuración",
+  "Lookup domain registration info": "Buscar información de registro de dominio",
+  "Low Container Memory": "Memoria de contenedor baja",
+  "Low free space warning": "Advertencia de poco espacio libre",
+  "Low-power CPU platform": "Plataforma de CPU de bajo consumo",
+  "Lynis - Security Audit": "Lynis - Auditoría de seguridad",
+  "Lynis Management": "Gestión Lynis",
+  "Lynis command not found": "Comando Lynis no encontrado",
+  "Lynis has been removed": "Lynis ha sido eliminada",
+  "Lynis installation could not be verified": "No se pudo verificar la instalación de Lynis",
+  "Lynis installed successfully from GitHub": "Lynis se instaló exitosamente desde GitHub",
+  "Lynis is a security auditing tool that performs comprehensive system scans including:": "Lynis es una herramienta de auditoría de seguridad que realiza análisis completos del sistema que incluyen:",
+  "Lynis is currently installed.": "Lynis está instalado actualmente.",
+  "Lynis is not installed on this system.": "Lynis no está instalado en este sistema.",
+  "Lynis is not installed. Run: apt install lynis": "Lynis no está instalado. Ejecutar: apto instalar lynis",
+  "Lynis is ready to use": "Lynis está listo para usar.",
+  "Lynis updated to version:": "Lynis actualizado a la versión:",
+  "Lynis version:": "Versión Lynis:",
+  "Lynis was not installed from Git. Reinstalling...": "Lynis no se instaló desde Git. Reinstalando...",
+  "M.2 / PCIe devices:": "Dispositivos M.2/PCIe:",
+  "MAC Address": "Dirección MAC",
+  "MACHINE TYPE": "TIPO DE MÁQUINA",
+  "MOTD configuration updated successfully": "Configuración de MOTD actualizada con éxito",
+  "Machine Type": "Tipo de máquina",
+  "Machine type: q35": "Tipo de máquina: q35",
+  "Machine: q35": "Máquina: q35",
+  "Major version differs:": "La versión principal difiere:",
+  "Make sure IOMMU is properly enabled and the system has been rebooted after activation.": "Asegúrese de que IOMMU esté habilitado correctamente y que el sistema se haya reiniciado después de la activación.",
+  "Make sure there are no critical services running as they will be interrupted. Ensure your server can be safely rebooted.": "Asegúrese de que no haya servicios críticos en ejecución, ya que se interrumpirán. Asegúrese de que su servidor pueda reiniciarse de forma segura.",
+  "Make sure you have SSH or Web UI access before rebooting.": "Asegúrese de tener acceso SSH o UI web antes de reiniciar.",
+  "Makefile missing in": "Falta el archivo Makefile",
+  "Malformed repository entries cleaned": "Se limpiaron las entradas del repositorio con formato incorrecto",
+  "Manage PBS encryption keyfile": "administrar el archivo de claves de cifrado PBS",
+  "Manage Secure Gateway": "Configurar puerta de enlace segura",
+  "Manage and inspect VM disk images": "Administrar e inspeccionar imágenes de disco de VM",
+  "Manage custom backup paths": "Configurar rutas de respaldo personalizadas",
+  "Manage custom paths (add / remove your folders)": "Configurar rutas personalizadas (agreguar/eliminar carpetas)",
+  "Manage local backup target": "Configurar el destino de la copia de seguridad local",
+  "Manual CLI Guide (Disk and Storage Manager)": "Comandos CLI manuales (Administrador de discos y almacenamiento)",
+  "Manual CLI Guide (GPU/TPU)": "Comandos CLI manuales (GPU/TPU)",
+  "Manual Guide: Convert LXC Privileged to Unprivileged": "Guía manual: convertir LXC privilegiado a no privilegiado",
+  "Manual Guide: Convert LXC Unprivileged to Privileged": "Guía manual: convertir LXC sin privilegios en privilegiado",
+  "Manual Path Entry": "Entrada manual de ruta",
+  "Manual backup of a VM or CT": "Copia de seguridad manual de una VM o CT",
+  "Manual command template (copy/paste):": "Plantilla de comando manual (copiar/pegar):",
+  "Manual destination path": "Ruta de destino manual",
+  "Manual guide script not found": "Script de guía manual no encontrado",
+  "Manual install required inside CT": "Se requiere instalación manual dentro del CT",
+  "Manual path entry": "Entrada de ruta manual",
+  "Manual steps recommended after import": "Pasos manuales recomendados después de la importación",
+  "Manual upgrade guide step by step": "Guía de actualización manual paso a paso",
+  "Mapped GID on host": "GID asignado en el host",
+  "Mapped UID on host": "UID asignado en el host",
+  "Max FD limit / ulimit configured": "Límite máximo de FD/ulimit configurado",
+  "Max FS open files configuration created successfully": "Configuración de archivos abiertos de Max FS creada con éxito",
+  "Max user watches configured": "Número máximo de relojes de usuario configurados",
+  "Maximum auto-repair attempts reached (3). Please review the log and run any remaining commands manually.": "Se alcanzó el número máximo de intentos de reparación automática (3). Revise el registro y ejecute los comandos restantes manualmente.",
+  "May need to restart terminal": "Puede que sea necesario reiniciar el terminal",
+  "Memory optimization completed.": "Optimización de la memoria completada.",
+  "Memory optimizations removed": "Se eliminaron las optimizaciones de memoria.",
+  "Memory restored.": "Memoria restaurada.",
+  "Memory settings optimized successfully": "Configuración de memoria optimizada con éxito",
+  "Memory:": "Memoria:",
+  "Method:": "Método:",
+  "Migrate VMs away from node being upgraded": "Migrar las máquinas virtuales fuera del nodo que se está actualizando",
+  "Migrate away any guests that must keep running": "Migrar cualquier invitado que deba seguir ejecutándose",
+  "Migrated legacy ProxMenux NVIDIA blacklist state — module will reload after reboot": "Estado de lista negra de NVIDIA ProxMenux heredado migrado: el módulo se recargará después del reinicio",
+  "Mirror URL not available for this script.": "La URL reflejada no está disponible para este script.",
+  "Missing": "Desaparecido",
+  "Missing commands after installation:": "Comandos que faltan después de la instalación:",
+  "Missing dependency": "Dependencia faltante",
+  "Missing on target:": "Falta en el objetivo:",
+  "Missing or invalid parameter": "Parámetro faltante o no válido",
+  "Missing required parameter": "Falta el parámetro requerido",
+  "Mixed GPU Modes": "Modos de GPU mixtos",
+  "Mixed current mode detected in selected GPU(s).": "Modo de corriente mixta detectado en GPU seleccionadas.",
+  "Mobile UI backup created": "Se creó la copia de seguridad de la interfaz de usuario móvil",
+  "Mode": "Modo",
+  "Model": "Modelo",
+  "Modern resource monitor (press q to exit)": "Monitor de recursos moderno (presione q para salir)",
+  "Modifying Fastfetch configuration...": "Modificando la configuración de Fastfetch...",
+  "Modules configuration updated.": "Configuración de módulos actualizada.",
+  "Modules loaded.": "Módulos cargados.",
+  "Monitor Activated": "Monitor activado",
+  "Monitor Deactivated": "Monitor desactivado",
+  "Monitor URL": "URL del monitor",
+  "Monitor disk I/O usage (press q to exit)": "Monitorear el uso de E/S del disco (presione q para salir)",
+  "Monitor progress:": "Supervisar el progreso:",
+  "Monitoring": "Monitorización",
+  "Most common cause: the archive is corrupted (interrupted write, partial copy, or storage issue).": "causa más común: el archivo está dañado (escritura interrumpida, copia parcial o problema de almacenamiento).",
+  "Mount Added Successfully:": "Montaje agregado con éxito:",
+  "Mount CIFS share:": "Monte el recurso compartido CIFS:",
+  "Mount Configuration Summary:": "Resumen de configuración de montaje:",
+  "Mount Details:": "Detalles de montaje:",
+  "Mount Examples:": "Ejemplos de montaje:",
+  "Mount Host Directory to LXC": "Montar el directorio de host en LXC",
+  "Mount Host Directory to LXC Container": "Montar el directorio de host en el contenedor LXC",
+  "Mount Information:": "Información de montaje:",
+  "Mount Method": "Método de montaje",
+  "Mount NFS Client in LXC": "Montar cliente NFS en LXC",
+  "Mount NFS Share": "Montar recurso compartido NFS",
+  "Mount NFS Share on Host": "Montar NFS Share en el host",
+  "Mount NFS share:": "Montar el recurso compartido NFS:",
+  "Mount Name": "Nombre de montaje",
+  "Mount Name:": "Nombre de montaje:",
+  "Mount Options": "Opciones de montaje",
+  "Mount Path": "Camino del monte",
+  "Mount Path:": "Camino de montaje:",
+  "Mount Point": "Punto de montaje",
+  "Mount Point ID": "ID del punto de montaje",
+  "Mount Point Removal Summary:": "Resumen de eliminación del punto de montaje:",
+  "Mount Point:": "Punto de montaje:",
+  "Mount Samba Share": "Monte Samba Compartir",
+  "Mount Samba Share on Host": "Monte Samba Compartir en el anfitrión",
+  "Mount USB disk?": "¿Montar disco USB?",
+  "Mount a USB drive now": "Monte una unidad USB ahora",
+  "Mount all datasets": "Montar todos los conjuntos de datos",
+  "Mount already exists for this path in container": "El montaje ya existe para esta ruta en el contenedor",
+  "Mount and persist with UUID:": "Montar y persistir con UUID:",
+  "Mount failed": "Montaje fallido",
+  "Mount options:": "Opciones de montaje:",
+  "Mount path must be an absolute path starting with /": "La ruta de montaje debe ser una ruta absoluta que comience con /",
+  "Mount path:": "Ruta de montaje:",
+  "Mount point created": "Punto de montaje creado",
+  "Mount point created.": "Punto de montaje creado.",
+  "Mount point is visible but NOT writable from inside the container": "El punto de montaje es visible pero NO se puede escribir desde el interior del contenedor.",
+  "Mount point is writable from inside the container": "El punto de montaje se puede escribir desde el interior del contenedor.",
+  "Mount point not visible inside the container yet": "El punto de montaje aún no es visible dentro del contenedor.",
+  "Mount point ready:": "Punto de montaje listo:",
+  "Mount point removed successfully": "Punto de montaje eliminado correctamente",
+  "Mount point:": "Punto de montaje:",
+  "Mount shares on HOST first": "Montar acciones en HOST primero",
+  "Mount specific dataset": "Montar conjunto de datos específico",
+  "Mount status:": "Estado de montaje:",
+  "Mount this device and use it as the backup destination?": "¿Montar este dispositivo y usarlo como destino de respaldo?",
+  "Mount was busy — performed lazy unmount": "El montaje estaba ocupado: se realizó un desmontaje diferido",
+  "Mounted": "Montado",
+  "Mounted ISO on device": "ISO montado en el dispositivo",
+  "Mounted at": "Montado en",
+  "Mounted external disk": "Disco externo montado",
+  "Mounted external disk  (offline-safe, single-machine dedup)": "disco externo montado (desduplicación de una sola máquina, segura sin conexión)",
+  "Mounted filesystem detected": "Sistema de archivos montado detectado",
+  "Mounting CIFS share...": "Montando recurso compartido CIFS...",
+  "Mounting NFS share...": "Montando recurso compartido NFS...",
+  "Mounting container filesystem": "Montaje del sistema de archivos del contenedor",
+  "Mounting disk...": "Disco de montaje...",
+  "Mounting existing": "Montaje existente",
+  "Mounting here will hide existing files until unmounted.": "Montar aquí ocultará los archivos existentes hasta que se desmonten.",
+  "Move that copy offsite (USB, password manager, another host). Delete it from this path when done.": "mueva esa copia fuera del sitio (USB, administrador de contraseñas, otro host).Elimínelo de esta ruta cuando haya terminado.",
+  "Move to target VM (remove from source VM config)": "Mover a la VM de destino (eliminar de la configuración de la VM de origen)",
+  "Multiple recovery groups found in PBS. Pick the one that originally created the keyfile:": "Múltiples grupos de recuperación encontrados en PBS. Elige el que creó originalmente el archivo de claves:",
+  "Multiple rootfs directories were found in this archive. Restore cannot continue automatically.": "Se encontraron varios directorios rootfs en este archivo. La restauración no puede continuar automáticamente.",
+  "NAS Systems": "Sistemas NAS",
+  "NETWORK CONFIGURATION ANALYSIS": "ANÁLISIS DE CONFIGURACIÓN DE RED",
+  "NFS Access Restricted": "Acceso NFS restringido",
+  "NFS Client Error": "Error del cliente NFS",
+  "NFS Client Manager - CT": "Administrador de clientes NFS - CT",
+  "NFS Client Status in CT": "Estado del cliente NFS en CT",
+  "NFS Client Tools: AVAILABLE": "Herramientas de cliente NFS: DISPONIBLES",
+  "NFS Client Tools: NOT AVAILABLE": "Herramientas de cliente NFS: NO DISPONIBLES",
+  "NFS Client in LXC (Privileged)": "Cliente NFS en LXC (privilegiado)",
+  "NFS Client in LXC (privileged)": "Cliente NFS en LXC    (privilegiado)",
+  "NFS Client: INSTALLED": "Cliente NFS: INSTALADO",
+  "NFS Client: NOT INSTALLED": "Cliente NFS: NO INSTALADO",
+  "NFS Error": "Error de NFS",
+  "NFS Host Manager - Proxmox Host": "Administrador de host NFS - Host Proxmox",
+  "NFS LXC Manager - CT": "Administrador de NFS LXC - CT",
+  "NFS Mounts on Host": "NFS se monta en el host",
+  "NFS Not Installed": "NFS no instalado",
+  "NFS Port Error": "Error de puerto NFS",
+  "NFS Proxmox storages (pvesm):": "Almacenamientos NFS Proxmox (pvesm):",
+  "NFS Server": "Servidor NFS",
+  "NFS Server Selection": "Selección del servidor NFS",
+  "NFS Server in LXC (Privileged)": "Servidor NFS en LXC (privilegiado)",
+  "NFS Server in LXC (privileged)": "Servidor NFS en LXC   (privilegiado)",
+  "NFS Server: INSTALLED": "Servidor NFS: INSTALADO",
+  "NFS Server: NOT INSTALLED": "Servidor NFS: NO INSTALADO",
+  "NFS Service Status in CT": "Estado del servicio NFS en CT",
+  "NFS Service: RUNNING": "Servicio NFS: EN EJECUCIÓN",
+  "NFS Service: STOPPED": "Servicio NFS: DETENIDO",
+  "NFS Version Configuration:": "Configuración de la versión NFS:",
+  "NFS Version:": "Versión NFS:",
+  "NFS Version: Auto-negotiation (NFSv3/NFSv4)": "Versión NFS: negociación automática (NFSv3/NFSv4)",
+  "NFS client installed successfully.": "El cliente NFS se instaló correctamente.",
+  "NFS client tools installed": "Herramientas de cliente NFS instaladas",
+  "NFS directory permissions set — containers should now be able to write": "Permisos de directorio NFS establecidos: los contenedores ahora deberían poder escribir",
+  "NFS export": "Exportación NFS",
+  "NFS export Selected": "Exportación NFS seleccionada",
+  "NFS export created successfully!": "¡La exportación NFS se creó correctamente!",
+  "NFS export:": "Exportación NFS:",
+  "NFS is recommended for VM disk image storage.": "Se recomienda NFS para el almacenamiento de imágenes de disco de VM.",
+  "NFS mounts in CT": "Montajes NFS en CT",
+  "NFS packages removed.": "Paquetes NFS eliminados.",
+  "NFS port (2049) is not accessible on": "No se puede acceder al puerto NFS (2049) en",
+  "NFS port 2049": "Puerto NFS 2049",
+  "NFS server Selected": "Servidor NFS seleccionado",
+  "NFS server installed successfully.": "El servidor NFS se instaló correctamente.",
+  "NFS server is already installed.": "El servidor NFS ya está instalado.",
+  "NFS server is not installed in this CT.": "El servidor NFS no está instalado en este CT.",
+  "NFS server is running": "El servidor NFS se está ejecutando",
+  "NFS server:": "Servidor NFS:",
+  "NFS servers detected": "Servidores NFS detectados",
+  "NFS service is enabled": "El servicio NFS está habilitado",
+  "NFS services stopped and disabled.": "Los servicios NFS se detuvieron y deshabilitaron.",
+  "NFS share mounted at:": "Compartir NFS montado en:",
+  "NFS share mounted successfully!": "¡El recurso compartido NFS se montó correctamente!",
+  "NFS share unmount completed.": "Se completó el desmontaje del recurso compartido NFS.",
+  "NFS storage added successfully!": "¡El almacenamiento NFS se agregó correctamente!",
+  "NFS storage adding in progress...": "Almacenamiento NFS agregando en progreso...",
+  "NIC": "tarjeta de red",
+  "NIC changes detected — adjusted automatically": "cambios de NIC detectados: ajustados automáticamente",
+  "NICs:": "NIC:",
+  "NOT FOUND": "EXTRAVIADO",
+  "NOTE: The host directory and its contents will remain unchanged.": "NOTA: El directorio del host y su contenido permanecerán sin cambios.",
+  "NVENC patch detected — list narrowed to versions supported by keylase/nvidia-patch.": "Parche NVENC detectado: lista reducida a versiones compatibles con keylase/nvidia-patch.",
+  "NVIDIA Actions": "Acciones de NVIDIA",
+  "NVIDIA CPU hiding already configured": "Ocultación de CPU NVIDIA ya configurada",
+  "NVIDIA DKMS entries removed.": "Se eliminaron las entradas de NVIDIA DKMS.",
+  "NVIDIA Driver Uninstall": "Desinstalación del controlador NVIDIA",
+  "NVIDIA Driver Version": "Versión del controlador NVIDIA",
+  "NVIDIA Drivers": "Controladores NVIDIA",
+  "NVIDIA Drivers Not Found": "Controladores NVIDIA no encontrados",
+  "NVIDIA GPU Driver Installation": "Instalación del controlador de GPU NVIDIA",
+  "NVIDIA GPU passthrough configured.": "Paso a través de GPU NVIDIA configurado.",
+  "NVIDIA KVM args configured (kvm=off, vendor_id spoof)": "Argumentos de NVIDIA KVM configurados (kvm=off, spoof de seller_id)",
+  "NVIDIA KVM hiding (cpu hidden=1)": "Ocultación de NVIDIA KVM (cpu oculta = 1)",
+  "NVIDIA KVM hiding already configured": "Ocultación de NVIDIA KVM ya configurada",
+  "NVIDIA Patch": "Parche NVIDIA",
+  "NVIDIA driver": "controlador nvidia",
+  "NVIDIA driver installed successfully.": "El controlador NVIDIA se instaló correctamente.",
+  "NVIDIA driver installed:": "Controlador NVIDIA instalado:",
+  "NVIDIA driver verification in container:": "Verificación del controlador NVIDIA en contenedor:",
+  "NVIDIA drivers are not installed or not loaded on this host.": "Los controladores NVIDIA no están instalados o no están cargados en este host.",
+  "NVIDIA host services already aligned for VFIO mode": "Los servicios de host de NVIDIA ya están alineados para el modo VFIO",
+  "NVIDIA host services disabled for VFIO mode": "Servicios de host NVIDIA deshabilitados para el modo VFIO",
+  "NVIDIA host services/autoload already aligned for VFIO mode": "Servicios de host de NVIDIA/carga automática ya alineados para el modo VFIO",
+  "NVIDIA host services/autoload already aligned for native mode": "Servicios de host de NVIDIA/carga automática ya alineados para el modo nativo",
+  "NVIDIA host services/autoload disabled for VFIO mode": "Servicios de host NVIDIA/carga automática deshabilitados para el modo VFIO",
+  "NVIDIA host services/autoload restored for native mode": "Servicios de host NVIDIA/carga automática restaurados para el modo nativo",
+  "NVIDIA install incomplete. Check log:": "Instalación de NVIDIA incompleta. Registro de verificación:",
+  "NVIDIA installer downloaded successfully": "El instalador de NVIDIA se descargó correctamente",
+  "NVIDIA installer extracted.": "Instalador de NVIDIA extraído.",
+  "NVIDIA installer not found at": "Instalador de NVIDIA no encontrado en",
+  "NVIDIA installer reported an error. Check /tmp/nvidia_install.log": "El instalador de NVIDIA informó un error. Verifique /tmp/nvidia_install.log",
+  "NVIDIA installer returned error": "El instalador de NVIDIA devolvió un error",
+  "NVIDIA kernel modules unloaded successfully.": "Los módulos del kernel de NVIDIA se descargaron correctamente.",
+  "NVIDIA libs require approximately 1.5GB of free space.": "Las bibliotecas de NVIDIA requieren aproximadamente 1,5 GB de espacio libre.",
+  "NVIDIA patch applied - check README for supported versions.": "Parche de NVIDIA aplicado: consulte README para conocer las versiones compatibles.",
+  "NVIDIA patch not applied.": "Parche de NVIDIA no aplicado.",
+  "NVIDIA per-BDF VFIO binding configured": "Enlace NVIDIA por BDF VFIO configurado",
+  "NVIDIA services stopped and disabled.": "Los servicios de NVIDIA se detuvieron y deshabilitaron.",
+  "NVIDIA udev rules and persistence service installed.": "Reglas de NVIDIA udev y servicio de persistencia instalados.",
+  "NVIDIA uninstallation steps completed.": "Pasos de desinstalación de NVIDIA completados.",
+  "NVIDIA uninstaller completed.": "Desinstalador de NVIDIA completado.",
+  "NVIDIA update failed for LXC": "La actualización de NVIDIA falló para LXC",
+  "NVIDIA userspace libraries installed.": "Bibliotecas de espacio de usuario de NVIDIA instaladas.",
+  "NVMe Disk Detected": "Disco NVMe detectado",
+  "NVMe health status: PASSED": "Estado de salud de NVMe: PASADO",
+  "NVMe health status: WARNING (critical_warning =": "Estado de salud de NVMe: ADVERTENCIA (advertencia_crítica =",
+  "NVMe skipped (to add as PCIe use 'Add Controller or NVMe PCIe to VM'):": "NVMe omitido (para agregar como PCIe use 'Agregar controlador o NVMe PCIe a VM'):",
+  "NVMe-specific SMART log": "Registro SMART específico de NVMe",
+  "Name for this target:": "Nombre para este objetivo:",
+  "Name:": "Nombre:",
+  "Neither /etc/kernel/cmdline nor /etc/default/grub found.": "No se encontraron /etc/kernel/cmdline ni /etc/default/grub.",
+  "Nesting feature enabled": "Función de anidamiento habilitada",
+  "NetBIOS Service: RUNNING": "Servicio NetBIOS: EN EJECUCIÓN",
+  "NetBIOS Service: STOPPED": "Servicio NetBIOS: DETENIDO",
+  "NetBIOS port 139:": "Puerto NetBIOS 139:",
+  "Network": "Red",
+  "Network  :": "Red  :",
+  "Network (interfaces, DNS)": "Red (interfaces, DNS)",
+  "Network Bridge": "Puente de red",
+  "Network Commands": "Comandos de red",
+  "Network Configuration": "Configuración de red",
+  "Network Configuration Analysis": "Análisis de configuración de red",
+  "Network Configuration File": "Archivo de configuración de red",
+  "Network Diagnostics": "Diagnóstico de red",
+  "Network Error": "Error de red",
+  "Network Interface Setup": "Configuración de la interfaz de red",
+  "Network Interfaces": "Interfaces de red",
+  "Network Management": "Gestión de red",
+  "Network Management - SAFE MODE": "Gestión de red - MODO SEGURO",
+  "Network Restart": "Reinicio de la red",
+  "Network Restart Failed": "Error al reiniciar la red",
+  "Network Restarted": "Red reiniciada",
+  "Network Tools": "Herramientas de red",
+  "Network access:": "Acceso a la red:",
+  "Network configuration backed up": "Configuración de red respaldada",
+  "Network configuration has been restored from backup.": "La configuración de red se ha restaurado desde la copia de seguridad.",
+  "Network connection failed to": "La conexión de red no pudo",
+  "Network connectivity": "Conectividad de red",
+  "Network connectivity to": "Conectividad de red a",
+  "Network interfaces added:": "Se agregaron interfaces de red:",
+  "Network monitoring tool (iptraf-ng)": "Herramienta de monitorización de red (iptraf-ng)",
+  "Network optimization completed": "Optimización de la red completada",
+  "Network optimizations removed": "Optimizaciones de red eliminadas",
+  "Network service restarted successfully": "El servicio de red se reinició exitosamente",
+  "Network service restarted successfully.": "El servicio de red se reinició exitosamente.",
+  "Network share mounting (NFS/Samba) requires a PRIVILEGED container.": "El montaje de recursos compartidos de red (NFS/Samba) requiere un contenedor PRIVILEGED.",
+  "Network throughput test (client/server)": "Prueba de rendimiento de la red (cliente/servidor)",
+  "NetworkManager Detected": "Administrador de red detectado",
+  "NetworkManager has been removed successfully": "NetworkManager se ha eliminado correctamente",
+  "NetworkManager is running (may cause conflicts)": "NetworkManager se está ejecutando (puede causar conflictos)",
+  "NetworkManager is running, which may conflict with Proxmox.": "NetworkManager se está ejecutando, lo que puede entrar en conflicto con Proxmox.",
+  "NetworkManager not running": "NetworkManager no se ejecuta",
+  "New Folder in /mnt": "Nueva carpeta en /mnt",
+  "New Group": "Nuevo grupo",
+  "New Search": "Nueva búsqueda",
+  "New VM:": "Nueva máquina virtual:",
+  "New Virtual Machine": "Nueva máquina virtual",
+  "New backup job": "Nuevo trabajo de copia de seguridad",
+  "New backups on this host will be unencrypted until a new keyfile is set up.": "Las nuevas copias de seguridad en este host no estarán cifradas hasta que se configure un nuevo archivo de claves.",
+  "New mount options to apply:": "Nuevas opciones de montaje para aplicar:",
+  "New scheduled job (own timer + retention)": "Nuevo trabajo programado (temporizador propio + retención)",
+  "New version available": "Nueva versión disponible",
+  "New version:": "Nueva versión:",
+  "Next Step Required": "Se requiere el siguiente paso",
+  "Next Steps:": "Próximos pasos:",
+  "Next step: stop that VM first, then run": "Siguiente paso: detenga esa VM primero y luego ejecútela",
+  "No": "No",
+  "No .link files found in": "No se encontraron archivos .link en",
+  "No .ova or .ovf files found in:": "No se encontraron archivos .ova o .ovf en:",
+  "No .ovf descriptor found inside OVA.": "No se encontró ningún descriptor .ovf dentro de OVA.",
+  "No .pxar archives were found in this backup:": "No se encontraron archivos .pxar en esta copia de seguridad:",
+  "No AMD CPU detected. Skipping AMD fixes.": "No se detectó ninguna CPU AMD. Saltarse las correcciones de AMD.",
+  "No AMD GPU detected on this system.": "No se detectó ninguna GPU AMD en este sistema.",
+  "No Available Exports": "No hay exportaciones disponibles",
+  "No Available Shares": "No hay acciones disponibles",
+  "No Backups": "Sin copias de seguridad",
+  "No CIFS Proxmox storage and no CIFS fstab mount found on this host.": "No se encontró almacenamiento CIFS Proxmox ni montaje fstab CIFS en este host.",
+  "No CIFS Proxmox storage configured.": "No hay almacenamiento CIFS Proxmox configurado.",
+  "No CIFS Proxmox storages configured.": "No hay almacenamientos CIFS Proxmox configurados.",
+  "No CIFS mounts active.": "No hay montajes CIFS activos.",
+  "No CT was selected.": "No se seleccionó ningún CT.",
+  "No CTs available in the system.": "No hay CT disponibles en el sistema.",
+  "No Changes Needed": "No se necesitan cambios",
+  "No Cleanup Needed": "No se necesita limpieza",
+  "No Controller/NVMe selected for now.": "No se ha seleccionado ningún controlador/NVMe por ahora.",
+  "No Coral Detected": "No se han detectado corales",
+  "No Coral TPU device was found on this host (neither PCIe/M.2 nor USB).": "No se encontró ningún dispositivo Coral TPU en este host (ni PCIe/M.2 ni USB).",
+  "No Custom Logos Found": "No se encontraron logotipos personalizados",
+  "No Disk Images Found": "No se encontraron imágenes de disco",
+  "No Disk Storage": "Sin almacenamiento en disco",
+  "No Disks Available": "No hay discos disponibles",
+  "No Disks Found": "No se encontraron discos",
+  "No Exports": "Sin exportaciones",
+  "No Exports Found": "No se encontraron exportaciones",
+  "No Folders": "Sin carpetas",
+  "No GPU Detected": "No se detectó ninguna GPU",
+  "No GPU selected.": "No se seleccionó ninguna GPU.",
+  "No GPU selected. Please select at least one GPU to continue.": "No se seleccionó ninguna GPU. Seleccione al menos una GPU para continuar.",
+  "No GPUs detected on this host.": "No se detectaron GPU en este host.",
+  "No Guest Shares": "No hay acciones para invitados",
+  "No IP": "Sin IP",
+  "No IP assigned": "Ninguna IP asignada",
+  "No ISO file detected after UUP Dump process.": "No se detectó ningún archivo ISO después del proceso de volcado UUP.",
+  "No ISO images found in Proxmox ISO storages.": "No se encontraron imágenes ISO en los almacenamientos ISO de Proxmox.",
+  "No ISO selected.": "No se seleccionó ningún ISO.",
+  "No ISO was generated.": "No se generó ninguna ISO.",
+  "No Images Found": "No se encontraron imágenes",
+  "No Intel GPU detected on this system.": "No se detectó ninguna GPU Intel en este sistema.",
+  "No LXC containers available": "No hay contenedores LXC disponibles",
+  "No LXC containers found": "No se encontraron contenedores LXC",
+  "No LXC containers found on this system.": "No se encontraron contenedores LXC en este sistema.",
+  "No MAC": "Sin MAC",
+  "No Method Selected": "Ningún método seleccionado",
+  "No Mounts": "Sin monturas",
+  "No NFS Proxmox storage and no NFS fstab mount found on this host.": "No se encontró almacenamiento NFS Proxmox ni montaje fstab NFS en este host.",
+  "No NFS Proxmox storage configured.": "No hay almacenamiento NFS Proxmox configurado.",
+  "No NFS Proxmox storages configured.": "No hay almacenamientos NFS Proxmox configurados.",
+  "No NFS mounts active.": "No hay montajes NFS activos.",
+  "No NFS mounts found.": "No se encontraron montajes NFS.",
+  "No NFS ports found": "No se encontraron puertos NFS",
+  "No NFS servers configured to test.": "No hay servidores NFS configurados para realizar pruebas.",
+  "No NFS servers found on the network.": "No se encontraron servidores NFS en la red.",
+  "No NFS shares currently mounted.": "Actualmente no hay acciones NFS montadas.",
+  "No NVIDIA GPU detected on this system.": "No se detectó ninguna GPU NVIDIA en este sistema.",
+  "No NVIDIA GPU has been detected on this system. The installer will now exit.": "No se ha detectado ninguna GPU NVIDIA en este sistema. El instalador ahora saldrá.",
+  "No NVIDIA driver installed.": "No hay ningún controlador NVIDIA instalado.",
+  "No PBS keyfile is installed on this host and no automatic recovery was possible.": "No hay ningún archivo de claves PBS instalado en este host y no fue posible la recuperación automática.",
+  "No PVE vzdump job uses a": "Ningún trabajo PVE vzdump utiliza un",
+  "No PVs with old headers found.": "No se encontraron PV con encabezados antiguos.",
+  "No ProxMenux ZFS autotrim state file found.": "No se encontró ningún archivo de estado de recorte automático de ProxMenux ZFS.",
+  "No ProxMenux host-backup archives were found in:": "No se encontraron archivos de copia de seguridad del host de ProxMenux en:",
+  "No Recent Servers": "No hay servidores recientes",
+  "No Samba mounts found.": "No se encontraron monturas Samba.",
+  "No Samba ports found": "No se encontraron puertos Samba",
+  "No Samba servers configured to test.": "No hay servidores Samba configurados para realizar pruebas.",
+  "No Samba servers found on the network.": "No se encontraron servidores Samba en la red.",
+  "No Samba shares currently mounted.": "Actualmente no hay acciones de Samba montadas.",
+  "No Samba users found": "No se encontraron usuarios de Samba",
+  "No Selection": "Sin selección",
+  "No Servers Found": "No se encontraron servidores",
+  "No Shares": "Sin acciones",
+  "No Shares Available": "No hay acciones disponibles",
+  "No Shares Found": "No se encontraron acciones",
+  "No Storage Found": "No se encontró almacenamiento",
+  "No USB drives detected. Enter the mountpoint path manually:": "No se detectaron unidades USB.Ingrese la ruta del punto de montaje manualmente:",
+  "No USB drives mounted by ProxMenux yet. Mount one first to use it as a target.": "Aún no hay unidades USB montadas por ProxMenux.Monta uno primero para usarlo como objetivo.",
+  "No UUP folder found.": "No se encontró ninguna carpeta UUP.",
+  "No VM was selected.": "No se seleccionó ninguna máquina virtual.",
+  "No VMID defined. Cannot apply guest agent config.": "No hay VMID definido. No se puede aplicar la configuración del agente invitado.",
+  "No VMs Found": "No se encontraron máquinas virtuales",
+  "No VMs available in the system.": "No hay máquinas virtuales disponibles en el sistema.",
+  "No VMs available on this host.": "No hay máquinas virtuales disponibles en este host.",
+  "No VMs found": "No se encontraron máquinas virtuales",
+  "No Valid Servers": "No hay servidores válidos",
+  "No VirtIO ISO found. Please download one.": "No se encontró ningún ISO de VirtIO. Descargue uno.",
+  "No VirtIO ISO selected. Please choose again.": "No se seleccionó ningún ISO de VirtIO. Por favor elige de nuevo.",
+  "No Virtual Machines found on this system.": "No se encontraron máquinas virtuales en este sistema.",
+  "No ZFS pools detected. Skipping ZFS autotrim.": "No se detectaron grupos ZFS. Saltarse el recorte automático de ZFS.",
+  "No accessible": "No accesible",
+  "No accessible NFS servers found.": "No se encontraron servidores NFS accesibles.",
+  "No accessible Samba servers found.": "No se encontraron servidores Samba accesibles.",
+  "No accessible exports found.": "No se encontraron exportaciones accesibles.",
+  "No accessible shares found.": "No se encontraron recursos compartidos accesibles.",
+  "No active exports or showmount not available": "No hay exportaciones activas o showmount no disponible",
+  "No active session": "Ninguna sesión activa",
+  "No additional GPU can be added.": "No se puede agregar ninguna GPU adicional.",
+  "No additional device needs to be added.": "No es necesario agregar ningún dispositivo adicional.",
+  "No archives": "Sin archivos",
+  "No archives found in this Borg repository.": "No se encontraron archivos en este repositorio Borg.",
+  "No available Controllers/NVMe devices were found.": "No se encontraron controladores/dispositivos NVMe disponibles.",
+  "No available disks found.": "No se encontraron discos disponibles.",
+  "No backup found, logrotate configuration not changed": "No se encontró ninguna copia de seguridad, la configuración de logrotate no cambió",
+  "No backups": "Sin copias de seguridad",
+  "No backups found": "No se encontraron copias de seguridad",
+  "No bridge configuration issues found": "No se encontraron problemas de configuración del puente",
+  "No bridges found in system": "No se encontraron puentes en el sistema.",
+  "No changes are required for": "No se requieren cambios para",
+  "No changes are required.": "No se requieren cambios.",
+  "No changes have been made to your system": "No se han realizado cambios en su sistema",
+  "No changes will be made to the running system.": "No se realizarán cambios en el sistema en ejecución.",
+  "No compatible GPU detected for VM passthrough. Skipping GPU wizard option.": "No se detectó ninguna GPU compatible para el paso a través de VM. Omitir la opción del asistente de GPU.",
+  "No compatible GPU was detected on this host.": "No se detectó ninguna GPU compatible en este host.",
+  "No compatible GPUs detected on this host.": "No se detectaron GPU compatibles en este host.",
+  "No compatible GPUs were detected on this host.": "No se detectaron GPU compatibles en este host.",
+  "No compatible PVE jobs": "No hay tareas PVE compatibles",
+  "No compatible disk images found in:": "No se encontraron imágenes de disco compatibles en:",
+  "No compatible versions found for your kernel": "No se encontraron versiones compatibles para su kernel",
+  "No configuration issues found": "No se encontraron problemas de configuración",
+  "No container runtime available.": "No hay tiempo de ejecución de contenedor disponible.",
+  "No container selected. Exiting.": "No se seleccionó ningún contenedor. Saliendo.",
+  "No controller/NVMe selected.": "No se seleccionó ningún controlador/NVMe.",
+  "No controllers remaining after conflict resolution.": "No quedan controladores después de la resolución del conflicto.",
+  "No custom key (rely on default SSH config)": "Sin clave personalizada (confía en la configuración SSH predeterminada)",
+  "No custom logos were found in /usr/local/share/fastfetch/logos/.\n\nPlease add a logo and try again.": "No se encontraron logotipos personalizados en /usr/local/share/fastfetch/logos/.\n\nAgregue un logotipo e inténtelo nuevamente.",
+  "No desktop UI backup found, will reinstall packages": "No se encontró ninguna copia de seguridad de la interfaz de usuario del escritorio; se reinstalarán los paquetes",
+  "No directories found in": "No se encontraron directorios en",
+  "No disk images found in /var/lib/vz/images/. Please add an image first.": "No se encontraron imágenes de disco en /var/lib/vz/images/. Primero agregue una imagen.",
+  "No disks available for this CT.": "No hay discos disponibles para este CT.",
+  "No disks available for this VM.": "No hay discos disponibles para esta máquina virtual.",
+  "No disks were added.": "No se agregaron discos.",
+  "No disks were configured for processing.": "No se configuró ningún disco para el procesamiento.",
+  "No disks were selected.": "No se seleccionaron discos.",
+  "No duplicate IP addresses": "Sin direcciones IP duplicadas",
+  "No duplicate repositories found": "No se encontraron repositorios duplicados",
+  "No eligible Controller/NVMe devices remain after SR-IOV filtering. Skipping.": "No quedan dispositivos de controlador/NVMe elegibles después del filtrado SR-IOV. Salto a la comba.",
+  "No eligible controllers remain after SR-IOV filtering.": "No quedan controladores elegibles después del filtrado SR-IOV.",
+  "No encryption key is stored on this host. Choose how to set one up:": "No se almacena ninguna clave de cifrado en este host.Elija cómo configurar uno:",
+  "No exportable VM disks were found (CD-ROM/cloud-init are excluded).": "No se encontraron discos de VM exportables (se excluyen CD-ROM/cloud-init).",
+  "No exportable disks": "No hay discos exportables",
+  "No exports configured.": "No hay exportaciones configuradas.",
+  "No exports file found.": "No se encontró ningún archivo de exportación.",
+  "No exports found in /etc/exports.": "No se encontraron exportaciones en /etc/exports.",
+  "No exports found on server": "No se encontraron exportaciones en el servidor",
+  "No files found": "No se encontraron archivos",
+  "No folders found in /mnt.": "No se encontraron carpetas en /mnt.",
+  "No folders found in /mnt. Please create a new folder.": "No se encontraron carpetas en /mnt. Por favor cree una nueva carpeta.",
+  "No folders found inside /mnt in the CT.": "No se encontraron carpetas dentro de /mnt en el CT.",
+  "No format-safe disks are available.": "No hay discos con formato seguro disponibles.",
+  "No group creation required — uses world-writable sticky bit permissions.": "No se requiere creación de grupos: utiliza permisos de bits adhesivos de escritura mundial.",
+  "No host VFIO reconfiguration expected": "No se espera reconfiguración del VFIO del host",
+  "No host VFIO/native binding changes were required.": "No se requirieron cambios de enlace nativo/VFIO del host.",
+  "No host backups were found in this PBS repository:": "No se encontraron copias de seguridad del host en este repositorio de PBS:",
+  "No host reboot expected": "No se espera reiniciar el host",
+  "No host write access — server-side ACL or root_squash. Continuing anyway.": "Sin acceso de escritura al host: ACL del lado del servidor o root_squash. Continuando de todos modos.",
+  "No host write access — server-side ACL. Continuing anyway.": "Sin acceso de escritura al host: ACL del lado del servidor. Continuando de todos modos.",
+  "No iSCSI Storage": "Sin almacenamiento iSCSI",
+  "No iSCSI storage configured in Proxmox.": "No hay almacenamiento iSCSI configurado en Proxmox.",
+  "No iSCSI storage configured.": "No hay almacenamiento iSCSI configurado.",
+  "No iSCSI storage found in Proxmox.": "No se encontró almacenamiento iSCSI en Proxmox.",
+  "No iSCSI targets found on portal": "No se encontraron objetivos iSCSI en el portal",
+  "No import disks selected for now.": "No se han seleccionado discos de importación por ahora.",
+  "No importable disks available. System disks and protected disks are hidden.": "No hay discos importables disponibles. Los discos del sistema y los discos protegidos están ocultos.",
+  "No installation information available.": "No hay información de instalación disponible.",
+  "No interface type was selected for the disks.": "No se seleccionó ningún tipo de interfaz para los discos.",
+  "No jobs": "Sin trabajos",
+  "No language selected.": "No se seleccionó ningún idioma.",
+  "No local disk storage configured.": "No hay almacenamiento en disco local configurado.",
+  "No main sources.list present (skipped)": "No hay ninguna lista de fuentes principales presente (omitida)",
+  "No mount point was specified.": "No se especificó ningún punto de montaje.",
+  "No mount points found in any container": "No se encontraron puntos de montaje en ningún contenedor.",
+  "No mount points found in container": "No se encontraron puntos de montaje en el contenedor",
+  "No network configuration backups found.": "No se encontraron copias de seguridad de la configuración de red.",
+  "No network interfaces configured (besides loopback)": "No hay interfaces de red configuradas (aparte del loopback)",
+  "No new Controller/NVMe entries were added.": "No se agregaron nuevas entradas de Controlador/NVMe.",
+  "No optimizations detected to uninstall.": "No se detectaron optimizaciones para desinstalar.",
+  "No partitions found on disk. Nothing was wiped.": "No se encontraron particiones en el disco. No se borró nada.",
+  "No password provided.": "No se proporcionó contraseña.",
+  "No paths available": "No hay rutas disponibles",
+  "No paths selected. Select at least one path.": "No hay rutas seleccionadas. Seleccione al menos una ruta.",
+  "No pending paths to schedule for reboot.": "No hay rutas pendientes para programar el reinicio.",
+  "No permanent NFS mounts configured.": "No se han configurado montajes NFS permanentes.",
+  "No permanent Samba mounts configured.": "No hay montajes Samba permanentes configurados.",
+  "No persistent path found for": "No se encontró ninguna ruta persistente para",
+  "No physical disks detected for SMART testing.": "No se detectaron discos físicos para las pruebas SMART.",
+  "No physical interfaces found": "No se encontraron interfaces físicas",
+  "No ports configured": "No hay puertos configurados",
+  "No privileged containers available in Proxmox.": "No hay contenedores privilegiados disponibles en Proxmox.",
+  "No pve-enterprise.list present (skipped)": "No hay pve-enterprise.list presente (omitido)",
+  "No recent": "No reciente",
+  "No recent Samba servers found.": "No se encontraron servidores Samba recientes.",
+  "No routing information found.": "No se encontró información de ruta.",
+  "No scheduled backup jobs configured.": "No se han configurado trabajos de copia de seguridad programados.",
+  "No scheduled backup jobs found.": "No se encontraron tareas de copia de seguridad programadas.",
+  "No scripts found for:": "No se encontraron secuencias de comandos para:",
+  "No self-test history found for": "No se encontró ningún historial de autoevaluación para",
+  "No self-test log available for": "No hay ningún registro de autoprueba disponible para",
+  "No server IP or hostname provided.": "No se proporcionó ninguna IP de servidor ni nombre de host.",
+  "No shared mount detected. Applying standard local access.": "No se detectó ningún montaje compartido. Aplicando acceso local estándar.",
+  "No shares configured.": "No hay recursos compartidos configurados.",
+  "No shares found in smb.conf.": "No se encontraron acciones en smb.conf.",
+  "No shares found on server": "No se encontraron recursos compartidos en el servidor",
+  "No smb.conf file found.": "No se encontró ningún archivo smb.conf.",
+  "No specific LXC action selected": "No se seleccionó ninguna acción LXC específica",
+  "No specific VM action selected": "No se seleccionó ninguna acción de VM específica",
+  "No storage": "Sin almacenamiento",
+  "No storage volumes available for VM images.": "No hay volúmenes de almacenamiento disponibles para imágenes de VM.",
+  "No storage volumes available for disk images.": "No hay volúmenes de almacenamiento disponibles para imágenes de disco.",
+  "No stored credentials found.": "No se encontraron credenciales almacenadas.",
+  "No suitable disks found.": "No se encontraron discos adecuados.",
+  "No sysfs ROM entry — trying ACPI VFCT table...": "No hay entrada de ROM sysfs: probando la tabla ACPI VFCT...",
+  "No target configured.": "No hay destino configurado.",
+  "No test currently running": "No hay ninguna prueba actualmente en ejecución",
+  "No uninstaller found for:": "No se encontró ningún desinstalador para:",
+  "No unprivileged containers available in Proxmox.": "No hay contenedores sin privilegios disponibles en Proxmox.",
+  "No updates available — run a scan first or wait for the Monitor to refresh.": "No hay actualizaciones disponibles: primero ejecute un análisis o espere a que se actualice el monitor.",
+  "No updates or failed to fetch templates": "No hay actualizaciones o no se pudieron recuperar las plantillas",
+  "No user groups found.": "No se encontraron grupos de usuarios.",
+  "No user-created disk storage or fstab mount found.": "No se encontró ningún almacenamiento en disco creado por el usuario ni montaje fstab.",
+  "No username provided.": "No se proporcionó ningún nombre de usuario.",
+  "No utilities selected": "No se seleccionaron utilidades",
+  "No utilities were selected": "No se seleccionaron utilidades",
+  "No valid containers found": "No se encontraron contenedores válidos",
+  "No valid mount points found": "No se encontraron puntos de montaje válidos",
+  "No version in this branch is currently supported by keylase/nvidia-patch — the NVENC patch will not reapply after reinstall.": "Actualmente, keylase/nvidia-patch no admite ninguna versión de esta rama; el parche NVENC no se volverá a aplicar después de la reinstalación.",
+  "No virtual machines were found on this host.": "No se encontraron máquinas virtuales en este host.",
+  "No write permissions on:": "Sin permisos de escritura en:",
+  "No, keep local only": "No, mantener solo local",
+  "No-subscription repository present": "Repositorio sin suscripción presente",
+  "No: the key stays only at": "No: la clave permanece solo en",
+  "Non-Debian container detected": "Se detectó un contenedor que no es Debian",
+  "Non-free firmware warnings disabled": "Advertencias de firmware no libre deshabilitadas",
+  "None": "Ninguno",
+  "Normalizing stable monitor service...": "Normalizando el servicio de monitor estable...",
+  "Not Mounted": "No montado",
+  "Not all platforms support Controller/NVMe passthrough reliably.": "No todas las plataformas admiten el paso a través de Controller/NVMe de manera confiable.",
+  "Not an OVH server, skipping RTM installation": "No es un servidor OVH, se salta la instalación de RTM",
+  "Not currently mounted": "Actualmente no montado",
+  "Not currently mounted — skipping umount.": "Actualmente no montado: omitiendo el desmontaje.",
+  "Not found": "Extraviado",
+  "Not imported:": "No importado:",
+  "Not mounted": "No montado",
+  "Not portable:": "No portátil:",
+  "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "No registrado como almacenamiento enProxmox: use 'LXC Mount Manager' para vincular el montaje",
+  "Note: A system reboot will be required after enabling IOMMU.": "Nota: Será necesario reiniciar el sistema después de habilitar IOMMU.",
+  "Note: this only works if the NFS server does NOT use 'all_squash' for root.": "Nota: esto sólo funciona si el servidor NFS NO usa 'all_squash' como root.",
+  "Notes": "Notas",
+  "Nothing inside the container is modified": "No se modifica nada dentro del contenedor.",
+  "Nothing selectable": "Nada seleccionable",
+  "Nothing selected": "Nada seleccionado",
+  "Nothing to apply — none of the selected updates have a runnable function on disk.": "No hay nada que aplicar: ninguna de las actualizaciones seleccionadas tiene una función ejecutable en el disco.",
+  "Nothing to remove": "Nada que quitar",
+  "Nothing to restore": "Nada que restaurar",
+  "Nothing to schedule for reboot from selected paths.": "No hay nada que programar para reiniciar desde las rutas seleccionadas.",
+  "Nouveau module is loaded, attempting to unload...": "El módulo Nouveau está cargado, intentando descargarse...",
+  "Number of CPU cores (default: 2)": "Número de núcleos de CPU (predeterminado: 2)",
+  "OCI containers require Proxmox VE 9.1 or later.": "Los contenedores OCI requieren Proxmox VE 9.1 o posterior.",
+  "OK": "DE ACUERDO",
+  "OR add new PVE 9 no-subscription repository:": "O agregue un nuevo repositorio PVE 9 sin suscripción:",
+  "OS hint:": "Sugerencia del sistema operativo:",
+  "OS release details": "Detalles de la versión del sistema operativo",
+  "OS type  :": "Tipo de sistema operativo:",
+  "OS type:": "Tipo de sistema operativo:",
+  "OS:": "SO:",
+  "OVA (single portable file)": "OVA (archivo portátil único)",
+  "OVF (descriptor + VMDK files)": "OVF (descriptor + archivos VMDK)",
+  "OVF parsed:": "OVF analizado:",
+  "OVH RTM installed successfully": "OVH RTM instalado correctamente",
+  "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM eliminado (los artefactos de las marionetas pueden necesitar una limpieza manual)",
+  "OVH server detected": "Servidor OVH detectado",
+  "OVH server detection and RTM installation process completed": "Finalizado el proceso de detección del servidor OVH e instalación de RTM",
+  "Offer as exit node?": "¿Oferta como nodo de salida?",
+  "Official Linux Distributions": "Distribuciones oficiales de Linux",
+  "Old debian.sources file removed to prevent duplication": "Se eliminó el antiguo archivo debian.sources para evitar la duplicación",
+  "Old memory configuration detected. Replacing with balanced optimization...": "Se detectó una configuración de memoria antigua. Reemplazando con optimización equilibrada...",
+  "Old time services removed successfully": "Servicios antiguos eliminados con éxito",
+  "On a privileged CT the mount options carry the only permissions.": "En un CT privilegiado, las opciones de montaje tienen los únicos permisos.",
+  "On some systems, when starting the VM the host may slow down for several minutes until it stabilizes, or freeze completely.": "En algunos sistemas, al iniciar la máquina virtual, el host puede ralentizarse durante varios minutos hasta que se estabilice o se congele por completo.",
+  "On the Borg server, append the following line to:": "en el servidor Borg, agregue la siguiente línea a:",
+  "Once finished, re-run 'PVE 8 to 9 check' to verify that all issues are resolved \n    before executing the PVE 8 → PVE 9 upgrade.": "Una vez terminado, vuelva a ejecutar la 'verificación PVE 8 a 9' para verificar que todos los problemas estén resueltos. \n    antes de ejecutar la actualización PVE 8 → PVE 9.",
+  "Once finished, re-run the script 'PVE 8 to 9 check' to verify that all issues are resolved \n   before rebooting.": "Una vez terminado, vuelva a ejecutar el script 'PVE 8 to 9 check' para verificar que todos los problemas estén resueltos. \n   antes de reiniciar.",
+  "Once finished, re-run the script 'PVE 8 to 9 check' to verify that all issues.": "Una vez terminado, vuelva a ejecutar el script 'PVE 8 to 9 check' para verificar que todos los problemas.",
+  "Once installed, open the VirtIO ISO and run the installer to complete driver setup.": "Una vez instalado, abra VirtIO ISO y ejecute el instalador para completar la configuración del controlador.",
+  "One or more NVIDIA GPUs are currently configured for VM passthrough (vfio-pci):": "Actualmente, una o más GPU NVIDIA están configuradas para el paso a través de VM (vfio-pci):",
+  "Only convert to privileged if absolutely necessary for your use case.": "Convierta a privilegiado solo si es absolutamente necesario para su caso de uso.",
+  "Only fully free disks are shown (not system-used and not referenced by VM/LXC).": "Solo se muestran los discos completamente libres (no utilizados por el sistema y a los que VM/LXC no hace referencia).",
+  "Only if using enterprise subscription": "Solo si usa una suscripción empresarial",
+  "Only if using no-subscription repository": "Sólo si se utiliza un repositorio sin suscripción",
+  "Only needed if you mounted the filesystem in step 6b": "Solo es necesario si montó el sistema de archivos en el paso 6b",
+  "Only removes storage definition, not remote data.": "Solo elimina la definición de almacenamiento, no los datos remotos.",
+  "Only run this if you used LVM (step 6b):": "Ejecute esto solo si usó LVM (paso 6b):",
+  "Only the host backup hook is removed — PVE vzdump jobs targeting this storage stay intact.": "solo se elimina el enlace de copia de seguridad del host; las tareas de PVE vzdump destinados a este almacenamiento permanecen intactos.",
+  "Open": "Abierto",
+  "Open rwx + default inheritance for new files": "Abra rwx + herencia predeterminada para archivos nuevos",
+  "Open the VM console and wait for the installer to boot": "Abra la consola VM y espere a que se inicie el instalador.",
+  "Open the VM console and wait for the loader to boot": "Abra la consola VM y espere a que se inicie el cargador.",
+  "Open the dashboard from this host on port 8008 to create a new admin account.": "Abra el panel de este host en el puerto 8008 para crear una nueva cuenta de administrador.",
+  "Open the dashboard to create a new admin account:": "Abra el panel para crear una nueva cuenta de administrador:",
+  "OpenVSwitch installation could not be verified": "No se pudo verificar la instalación de OpenVSwitch",
+  "OpenVSwitch installed successfully": "OpenVSwitch se instaló exitosamente",
+  "OpenVSwitch is ready to use": "OpenVSwitch está listo para usar",
+  "OpenVSwitch removed": "OpenVSwitch eliminado",
+  "Operation": "Operación",
+  "Operation cancelled by user": "Operación cancelada por el usuario",
+  "Operation cancelled by user to create backup.": "Operación cancelada por el usuario para crear copia de seguridad.",
+  "Operation cancelled by user.": "Operación cancelada por el usuario.",
+  "Operation cancelled. Cannot continue with an unprivileged container.": "Operación cancelada. No se puede continuar con un contenedor sin privilegios.",
+  "Operation log": "Registro de operaciones",
+  "Operator config re-applied via kernel-agnostic merge": "La configuración del operador se volvió a aplicar mediante una fusión independiente del kernel",
+  "Operator config that WILL be re-applied via kernel-agnostic merge": "Configuración del operador que se volverá a aplicar mediante una combinación independiente del kernel",
+  "Optimizations detected and ready to revert.": "Optimizaciones detectadas y listas para revertir.",
+  "Optimize": "Optimizar",
+  "Optimize Memory": "Optimizar memoria",
+  "Optimize ZFS ARC size": "Optimizar tamaño de ZFS ARC",
+  "Optimize journald": "Optimizar journald",
+  "Optimize logrotate": "Optimizar logrotate",
+  "Optimizing ZFS ARC size according to available memory...": "Optimizando el tamaño de ZFS ARC según la memoria disponible...",
+  "Optimizing logrotate configuration...": "Optimizando la configuración de logrotate...",
+  "Optimizing memory settings...": "Optimizando la configuración de la memoria...",
+  "Optimizing network settings...": "Optimizando la configuración de red...",
+  "Optimizing vzdump backup speed...": "Optimizando la velocidad de copia de seguridad de vzdump...",
+  "Optional": "Opcional",
+  "Optional GPU Passthrough": "Paso de GPU opcional",
+  "Optional safety helper if you ever need to re-apply manually:": "Ayudante de seguridad opcional si alguna vez necesita volver a aplicar manualmente:",
+  "Optional: Modernize repository sources:": "Opcional: Modernice las fuentes del repositorio:",
+  "Optional: apply default ACL so new files inherit permissions:": "Opcional: aplique la ACL predeterminada para que los archivos nuevos hereden permisos:",
+  "Optional: register this path as Proxmox dir storage:": "Opcional: registre esta ruta como almacenamiento de directorios de Proxmox:",
+  "Optionally remove": "Opcionalmente eliminar",
+  "Optionally update NVIDIA libs in LXC containers with passthrough": "Opcionalmente, actualice las bibliotecas de NVIDIA en contenedores LXC con transferencia",
+  "Options:": "Opciones:",
+  "Or press CTRL + D": "O presione CTRL + D",
+  "Or re-run this script and accept the 'apply host permissions' prompt.": "O vuelva a ejecutar este script y acepte el mensaje \"aplicar permisos de host\".",
+  "Or use ProxMenux update function": "O utilice la función de actualización de ProxMenux",
+  "Or, if your terminal can't select text, copy it from:": "O, si tu terminal no puede seleccionar texto, cópialo desde:",
+  "Original ZFS ARC config restored from .bak": "Configuración original de ZFS ARC restaurada desde .bak",
+  "Original bashrc restored": "Bashrc original restaurado.",
+  "Original logrotate configuration restored": "Configuración original de logrotate restaurada",
+  "Other Prebuilt Linux VMs": "Otras máquinas virtuales Linux prediseñadas",
+  "Output archive:": "Archivo de salida:",
+  "Owner:": "Dueño:",
+  "Ownership set to root:sharedfiles with 2775 on:": "Propiedad establecida en root:sharedfiles con 2775 en:",
+  "PAM limits configured": "Límites PAM configurados",
+  "PBS backup error log": "Registro de errores de copia de seguridad de PBS",
+  "PBS backup failed.": "La copia de seguridad de PBS falló.",
+  "PBS encryption keyfile (show / replace / remove)": "archivo de claves de cifrado PBS (mostrar/reemplazar/eliminar)",
+  "PBS encryption keyfile — detailed info": "archivo de claves de cifrado PBS: información detallada",
+  "PBS extraction failed": "Error en la extracción de PBS",
+  "PBS host or IP address:": "Host de PBS o dirección IP:",
+  "PBS upload": "carga de PBS",
+  "PCI Address": "Dirección PCI",
+  "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "Transferencia de PCI, estado de TPM, configuración de inicio en la nube, enlaces Proxmox",
+  "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "Transferencia de PCI, estado de TPM, inicio de nube, instantáneas, enlaces específicos de Proxmox",
+  "PCI reset method": "Método de reinicio de PCI",
+  "PCIe GPU passthrough requires:": "La transferencia de GPU PCIe requiere:",
+  "PCIe/M.2 gasket-dkms": "Junta PCIe/M.2-dkms",
+  "POSIX ACLs applied (access + default for inheritance).": "ACL POSIX aplicadas (acceso + valor predeterminado para herencia).",
+  "PVE application manager updated": "Administrador de aplicaciones PVE actualizado",
+  "PVE cache regenerated": "Caché PVE regenerado",
+  "PVE host (where the Borg LXC lives)": "anfitrión PVE (donde vive el Borg LXC)",
+  "PVE host, VMID and password are all required for this mode.": "Para este modo se requieren host PVE, VMID y contraseña.",
+  "PVE9: udev rules reloaded — new interfaces will get correct names without reboot": "PVE9: reglas de udev recargadas: las nuevas interfaces obtendrán nombres correctos sin reiniciar",
+  "Package Updates Available": "Actualizaciones de paquetes disponibles",
+  "Package lists": "Listas de paquetes",
+  "Package lists updated after GPG fix": "Listas de paquetes actualizadas después de la corrección de GPG",
+  "Package lists updated successfully": "Listas de paquetes actualizadas exitosamente",
+  "Package update completed with warnings, continuing...": "Actualización del paquete completada con advertencias, continúa...",
+  "Package update had issues, checking details...": "La actualización del paquete tuvo problemas, comprobando detalles...",
+  "Package update still has issues, continuing anyway...": "La actualización del paquete todavía tiene problemas, continúa de todos modos...",
+  "Packages from backup to install:": "Paquetes de copia de seguridad para instalar:",
+  "Packages upgrade successfull": "Actualización de paquetes exitosa",
+  "Packages upgraded": "Paquetes actualizados",
+  "Packages:": "Paquetes:",
+  "Packaging OVA file...": "Embalaje archivo OVA...",
+  "Packing installer archive...": "Empaquetando el archivo del instalador...",
+  "Parsing OVF descriptor...": "Analizando el descriptor OVF...",
+  "Partial VM removed": "Máquina virtual eliminada parcialmente",
+  "Partition": "Dividir",
+  "Partition created": "Partición creada",
+  "Partition created:": "Partición creada:",
+  "Partition table wiped": "Tabla de particiones limpiada",
+  "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "frase de contraseña utilizada para desbloquear el archivo de claves importado (déjelo en blanco si el archivo de claves no está cifrado/kdf=none):",
+  "Passphrases do not match.": "Las frases de contraseña no coinciden.",
+  "Passphrases do not match. Try again.": "Las frases de contraseña no coinciden. Intentar otra vez.",
+  "Passthrough may fail depending on hardware/firmware implementation.": "El paso a través puede fallar dependiendo de la implementación del hardware/firmware.",
+  "Passthrough may still work without a ROM file.": "Es posible que el paso a través siga funcionando sin un archivo ROM.",
+  "Passthrough may work, but startup/restart reliability is not guaranteed.": "El paso a través puede funcionar, pero no se garantiza la confiabilidad del inicio/reinicio.",
+  "Password": "Contraseña",
+  "Password Mismatch": "La contraseña no coincide",
+  "Password cannot be empty.": "La contraseña no puede estar vacía.",
+  "Password confirmation cannot be empty.": "La confirmación de contraseña no puede estar vacía.",
+  "Password confirmation is required.": "Se requiere confirmación de contraseña.",
+  "Password for": "Contraseña para",
+  "Password for:": "Contraseña para:",
+  "Password is correct": "La contraseña es correcta",
+  "Password or API token secret:": "Contraseña o token secreto de API:",
+  "Password reset completed.": "Restablecimiento de contraseña completado.",
+  "Passwords do not match. Please try again.": "Las contraseñas no coinciden. Por favor inténtalo de nuevo.",
+  "Paste the UUP Dump URL here": "Pegue la URL del volcado UUP aquí",
+  "Patching source for kernel compatibility...": "Fuente de parcheo para compatibilidad del kernel...",
+  "Path does not exist.": "La ruta no existe.",
+  "Path must be absolute (start with /)": "La ruta debe ser absoluta (comenzar con /)",
+  "Path must be absolute (start with /).": "La ruta debe ser absoluta (comenzar con /).",
+  "Path not found": "Ruta no encontrada",
+  "Path:": "Ruta:",
+  "Paths applied:": "Rutas aplicadas:",
+  "Paths included in backup": "Rutas incluidas en la copia de seguridad",
+  "Paths not found at backup time": "Rutas no encontradas en el momento de la copia de seguridad",
+  "Paths skipped:": "Rutas omitidas:",
+  "Paths to back up:": "Rutas para realizar copias de seguridad:",
+  "Paths:": "Rutas:",
+  "Pending restore ID:": "ID de restauración pendiente:",
+  "Pending restore dir:": "Directorio de restauración pendiente:",
+  "Pending restore prepared. A reboot is required to complete it.": "Restauración pendiente preparada.Es necesario reiniciar para completarlo.",
+  "Pending restore prepared. It will run automatically at next boot.": "Pendiente de restauración preparada. Se ejecutará automáticamente en el próximo arranque.",
+  "Pending restore script not found or not executable:": "Script de restauración pendiente no encontrado o no ejecutable:",
+  "Pending upgrades detected on a clustered node.\n\nTo proceed safely, update this node to the latest Proxmox VE 8.x before switching to Trixie/PVE 9.\n\nSelect Yes for AUTOMATIC upgrade (recommended), or No for MANUAL instructions.": "Actualizaciones pendientes detectadas en un nodo agrupado.\n\nPara proceder de forma segura, actualice este nodo a la última versión de Proxmox VE 8.x antes de cambiar a Trixie/PVE 9.\n\nSeleccione Sí para actualización AUTOMÁTICA (recomendado) o No para instrucciones MANUALES.",
+  "Pending upgrades detected on a clustered node. Perform AUTOMATIC upgrade now? (y = automatic, n = manual):": "Actualizaciones pendientes detectadas en un nodo agrupado. ¿Realizar actualización AUTOMÁTICA ahora? (y = automático, n = manual):",
+  "Per official known issues; ensures proper boot after upgrade": "Según problemas oficiales conocidos; garantiza un arranque adecuado después de la actualización",
+  "Performance": "Rendimiento",
+  "Performance optimized": "Rendimiento optimizado",
+  "Performing complete package reinstallation...": "Realizando la reinstalación completa del paquete...",
+  "Performing packages upgrade...": "Realizando actualización de paquetes...",
+  "Performing system cleanup...": "Realizando limpieza del sistema...",
+  "Performs automatic cleanup after updating": "Realiza una limpieza automática después de la actualización.",
+  "Permanent Mount": "Montaje permanente",
+  "Permanent Mounts (fstab):": "Montajes permanentes (fstab):",
+  "Permanent:": "Permanente:",
+  "Permanently delete saved target:": "eliminar permanentemente el objetivo guardado:",
+  "Permanently delete this archive and its sidecar?": "¿Eliminar permanentemente este archivo y su sidecar?",
+  "Permission error": "error de permiso",
+  "Permissions:": "Permisos:",
+  "Persist mount in CT /etc/fstab (optional):": "Montaje persistente en CT /etc/fstab (opcional):",
+  "Persistent:": "Persistente:",
+  "Physical Function with": "Función física con",
+  "Physical interface": "Interfaz física",
+  "Physical interfaces available": "Interfaces físicas disponibles",
+  "Pick PVE vzdump job": "Elija la tarea PVE vzdump",
+  "Pick USB target": "Elija el destino USB",
+  "Pick Yes to destroy them now (before reboot). Pick No to keep the additive restore and clean up manually later.": "elija Sí para destruirlos ahora (antes de reiniciar).Elija No para mantener el aditivo restaurado y limpiado manualmente más tarde.",
+  "Pick a USB disk:": "Elige un disco USB:",
+  "Pick a drive to unmount:": "Elige una unidad para desmontar:",
+  "Pick a mounted USB as target": "Elija un USB montado como objetivo",
+  "Pick a target to remove:": "elija un objetivo para eliminar:",
+  "Pick an SSH private key (auto-detected on this host):": "elija una clave privada SSH (detectada automáticamente en este host):",
+  "Pick an alternative way to authorize the new key:": "elija una forma alternativa de autorizar la nueva clave:",
+  "Please check network connectivity.": "Por favor verifique la conectividad de la red.",
+  "Please check permissions and try again.": "Por favor verifique los permisos e inténtelo nuevamente.",
+  "Please check the installation.": "Por favor verifique la instalación.",
+  "Please check:": "Por favor, compruebe:",
+  "Please choose another path.": "Por favor elige otra ruta.",
+  "Please configure it manually and reboot.": "Configúrelo manualmente y reinicie.",
+  "Please expand the container disk and run this option again.": "Expanda el disco contenedor y ejecute esta opción nuevamente.",
+  "Please install the NVIDIA drivers first using the option:": "Primero instale los controladores NVIDIA usando la opción:",
+  "Please mark at least one option, or press Cancel to exit.": "Marque al menos una opción o presione Cancelar para salir.",
+  "Please reboot manually and run the passthrough step again.": "Reinicie manualmente y ejecute el paso de paso nuevamente.",
+  "Please reboot manually to complete the switch.": "Reinicie manualmente para completar el cambio.",
+  "Please reboot the system manually to complete the GPU switch.": "Reinicie el sistema manualmente para completar el cambio de GPU.",
+  "Please reselect GPU(s) and choose only compatible devices for VM mode.": "Vuelva a seleccionar las GPU y elija solo dispositivos compatibles para el modo VM.",
+  "Please resolve the problem(s) as described above, then re-run the upgrade script.": "Resuelva los problemas como se describe anteriormente y luego vuelva a ejecutar el script de actualización.",
+  "Please select GPU(s) that are currently in the same mode and try again.": "Seleccione las GPU que se encuentran actualmente en el mismo modo e inténtelo de nuevo.",
+  "Please select a valid option": "Por favor seleccione una opción válida",
+  "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Utilice una sesión SSH (Linux, macOS, Windows/PuTTY) o una consola física para realizar la actualización.",
+  "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "El grupo no parece utilizar dispositivos SSD/NVMe con soporte de descarte. Saltar el ajuste automático de ZFS para el grupo:",
+  "Pool exists": "Pool existe",
+  "Pool name matches but GUID differs (fresh ZFS install):": "el nombre del grupo coincide pero el GUID difiere (instalación nueva de ZFS):",
+  "Pool:": "Pool",
+  "Port": "Puerto",
+  "Port:": "Puerto:",
+  "Portal IP and port are correct": "La IP y el puerto del portal son correctos",
+  "Portal is reachable": "El portal es accesible",
+  "Portal:": "Portal:",
+  "Portuguese": "portugués",
+  "Post-Installation Options": "Opciones Post-Install",
+  "Post-Installation Scripts": "Scripts Post-Install",
+  "Postfix configuration": "Configuración de sufijo",
+  "Potential QEMU startup/assertion failures": "Posibles fallos de inicio/afirmación de QEMU",
+  "Power state D3cold/D0 transitions may be inaccessible": "Las transiciones del estado de energía D3cold/D0 pueden ser inaccesibles",
+  "Pre-check found": "Pre-comprobación encontrada",
+  "Pre-configure destinations so you don't have to enter them every time you back up.": "preconfigure los destinos para que no tenga que ingresarlos cada vez que realice una copia de seguridad.",
+  "Pre-existing gasket-dkms package removed.": "Se eliminó el paquete de junta-dkms preexistente.",
+  "Pre-restore backup:": "Copia de seguridad previa a la restauración:",
+  "Pre-upgrade check FAILED: the simulation shows that 'proxmox-ve' would be REMOVED.\n    This indicates a repository or dependency issue and upgrading now could break your Proxmox installation.": "La verificación previa a la actualización FALLÓ: la simulación muestra que 'proxmox-ve' sería ELIMINADO.\n    Esto indica un problema de repositorio o dependencia y actualizar ahora podría interrumpir la instalación de Proxmox.",
+  "Pre-upgrade simulation passed: 'proxmox-ve' will be kept or upgraded safely.": "Se pasó la simulación previa a la actualización: 'proxmox-ve' se mantendrá o se actualizará de forma segura.",
+  "Preparing Log2RAM configuration": "Preparando la configuración de Log2RAM",
+  "Preparing files for backup...": "Preparando archivos para copia de seguridad...",
+  "Preparing host mount...": "Preparando el montaje del host...",
+  "Preparing pending restore (network-safe)": "Preparando restauración pendiente (segura para la red)",
+  "Preparing staging area...": "Preparando el área de preparación...",
+  "Preserving logs to /var/log.hdd before unmounting...": "Preservando registros en /var/log.hdd antes de desmontar...",
+  "Press 'q' to exit": "Presione 'q' para salir",
+  "Press Ctrl+C to stop the server and return to menu.": "Presione Ctrl+C para detener el servidor y regresar al menú.",
+  "Press ENTER to continue...": "Presione ENTER para continuar...",
+  "Press ENTER to return to the menu...": "Presione ENTER para regresar al menú...",
+  "Press ENTER to return...": "Presione ENTRAR para regresar...",
+  "Press Enter to close...": "Presione Entrar para cerrar...",
+  "Press Enter to continue": "Presione Entrar para continuar",
+  "Press Enter to continue...": "Presione Entrar para continuar...",
+  "Press Enter to exit and repair": "Presione Enter para salir y reparar",
+  "Press Enter to exit the script after reading instructions...": "Presione Enter para salir del script después de leer las instrucciones...",
+  "Press Enter to exit...": "Presione Entrar para salir...",
+  "Press Enter to return": "Presione Entrar para regresar",
+  "Press Enter to return to menu...": "Presione Enter para regresar al menú...",
+  "Press Enter to return to the main menu...": "Presione Enter para regresar al menú principal...",
+  "Press Enter to return...": "Presione Entrar para regresar...",
+  "Press Enter when the line has been pasted on the server...": "presione Entrar cuando la línea se haya pegado en el servidor...",
+  "Press OK to see the preview, then confirm": "Presione OK para ver la vista previa, luego confirme",
+  "Pretty uptime format": "Formato bastante tiempo de actividad",
+  "Preview Backup": "Vista previa de copia de seguridad",
+  "Preview Changes": "Vista previa de cambios",
+  "Preview changes (diff)": "Vista previa de cambios (diff)",
+  "Preview: changes that would be applied": "Vista previa: cambios que se aplicarían",
+  "Previous DKMS tree cleared.": "Se borró el árbol DKMS anterior.",
+  "Previous installation cleaned": "Instalación anterior limpia",
+  "Previous installation removed": "Instalación anterior eliminada",
+  "Previous shutdowns": "Paradas anteriores",
+  "Privileged": "Privilegiado",
+  "Privileged Container": "Contenedor privilegiado",
+  "Privileged Container Required": "Se requiere contenedor privilegiado",
+  "Privileged container": "Contenedor privilegiado",
+  "Privileged container selected:": "Contenedor privilegiado seleccionado:",
+  "Privileged container — UID-shift remapping skipped (not applicable)": "Contenedor privilegiado: se omitió la reasignación de cambio de UID (no aplicable)",
+  "Privileged container — direct root access": "Contenedor privilegiado: acceso directo a la raíz",
+  "Privileged container — host root maps directly, no permission changes needed": "Contenedor privilegiado: aloja mapas raíz directamente, no se necesitan cambios de permisos",
+  "Privileged containers can access host devices directly": "Los contenedores privilegiados pueden acceder a los dispositivos host directamente",
+  "Privileged containers have full root access to the host system!": "¡Los contenedores privilegiados tienen acceso raíz completo al sistema host!",
+  "Privileged: Full host access (less secure)": "Privilegiado: acceso completo al host (menos seguro)",
+  "Proceed": "Proceder",
+  "Proceed with removal": "Proceder con la eliminación",
+  "Proceed?": "¿Proceder?",
+  "Proceeding with Log2RAM setup on non-SSD disk as requested by user.": "Continuando con la configuración de Log2RAM en un disco que no es SSD según lo solicitado por el usuario.",
+  "Process may take several minutes depending on container size": "El proceso puede tardar varios minutos dependiendo del tamaño del contenedor.",
+  "Process may take several minutes for large containers": "El proceso puede tardar varios minutos para contenedores grandes.",
+  "Processes using NVIDIA:": "Procesos usando NVIDIA:",
+  "Profile": "Perfil",
+  "Profile:": "Perfil:",
+  "Proposed Changes": "Cambios propuestos",
+  "Provided by newer version — skipping": "Proporcionado por una versión más reciente: omitir",
+  "ProxMenux Information": "Información de ProxMenux",
+  "ProxMenux Monitor": "Monitor ProxMenux",
+  "ProxMenux Monitor Service Verification": "Verificación del servicio de monitor ProxMenux",
+  "ProxMenux Monitor authentication is not configured on this host — there is no password to reset.": "La autenticación de ProxMenux Monitor no está configurada en este host; no hay contraseña para restablecer.",
+  "ProxMenux Monitor filter configured": "Filtro ProxMenux Monitor configurado",
+  "ProxMenux Monitor has been activated.": "Se ha activado el Monitor ProxMenux.",
+  "ProxMenux Monitor has been deactivated.": "ProxMenux Monitor ha sido desactivado.",
+  "ProxMenux Monitor is not installed": "ProxMenux Monitor no está instalado",
+  "ProxMenux Monitor is not installed.": "ProxMenux Monitor no está instalado.",
+  "ProxMenux Monitor jail configured": "Jail del monitor ProxMenux configurado",
+  "ProxMenux Monitor protection": "Protección del monitor ProxMenux",
+  "ProxMenux Monitor unit repaired and restarted": "Unidad de monitor ProxMenux reparada y reiniciada",
+  "ProxMenux Monitor → Backups tab (live progress card with estimated time, logs, rollback delta)": "Monitor ProxMenux → pestaña Copias de seguridad (tarjeta de progreso en vivo con tiempo estimado, registros, delta de reversión)",
+  "ProxMenux can apply open permissions on this NFS directory from the host so the container can read and write:": "ProxMenux puede aplicar permisos de apertura en este directorio NFS desde el host para que el contenedor pueda leer y escribir:",
+  "ProxMenux can remount it with open permissions so any LXC can read and write.": "ProxMenux puede volver a montarlo con permisos abiertos para que cualquier LXC pueda leer y escribir.",
+  "ProxMenux cannot override NFS server-side permissions from the host.": "ProxMenux no puede anular los permisos del lado del servidor NFS del host.",
+  "ProxMenux customizations removed from bashrc": "Personalizaciones de ProxMenux eliminadas de bashrc",
+  "ProxMenux does not validate the contents; any keyfile your PBS accepts is accepted here.": "ProxMenux no valida los contenidos;cualquier archivo clave que acepte su PBS se acepta aquí.",
+  "ProxMenux files:": "Archivos ProxMenux:",
+  "ProxMenux logo applied": "Logotipo de ProxMenux aplicado",
+  "ProxMenux only acts as a launcher — once the script starts, control leaves ProxMenux.": "ProxMenux solo actúa como Lanzador del script.",
+  "ProxMenux saved it locally at:": "ProxMenux lo guardó localmente en:",
+  "Proxmology logo applied": "Logotipo de Proxmología aplicado.",
+  "Proxmox 9 system update allready": "Actualización del sistema Proxmox 9 ya",
+  "Proxmox APT repositories configured": "Repositorios Proxmox APT configurados",
+  "Proxmox Backup Server (PBS) destinations": "destinos de Proxmox Backup Server (PBS)",
+  "Proxmox CIFS Storage Status:": "Estado de almacenamiento CIFS de Proxmox:",
+  "Proxmox NFS Storage Status:": "Estado de almacenamiento NFS de Proxmox:",
+  "Proxmox System Update": "Actualización del sistema Proxmox",
+  "Proxmox Update": "Actualización de Proxmox",
+  "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 system update completed successfully": "La actualización del sistema Proxmox VE 8 se completó con éxito",
+  "Proxmox VE 8 to 9 Manual Upgrade Guide": "Guía de actualización manual de Proxmox VE 8 a 9",
+  "Proxmox VE 9.x no-subscription repository created": "Se creó el repositorio sin suscripción Proxmox VE 9.x",
+  "Proxmox VE Helper Scripts": "Proxmox VE Helper Scripts",
+  "Proxmox VE configuration completed.": "Configuración de Proxmox VE completada.",
+  "Proxmox auth logger service created and started": "Servicio de registro de autenticación Proxmox creado e iniciado",
+  "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "Es posible que falte el repositorio empresarial de Proxmox o que no se pueda acceder a él. Intentando cambiar a sin suscripción...",
+  "Proxmox filter configured": "Filtro Proxmox configurado",
+  "Proxmox iSCSI Storage Status:": "Estado de almacenamiento Proxmox iSCSI:",
+  "Proxmox jail configured": "Cárcel de Proxmox configurada",
+  "Proxmox local storages:": "Almacenamientos locales de Proxmox:",
+  "Proxmox repository OK (candidate is 9.x)": "Repositorio de Proxmox OK (el candidato es 9.x)",
+  "Proxmox repository configuration completed": "Configuración del repositorio Proxmox completada",
+  "Proxmox repository fixed (no-subscription, candidate is 9.x)": "Repositorio de Proxmox arreglado (sin suscripción, el candidato es 9.x)",
+  "Proxmox status:": "Estado de Proxmox:",
+  "Proxmox storages:": "Almacenamientos Proxmox:",
+  "Proxmox system repair completed successfully!": "¡La reparación del sistema Proxmox se completó con éxito!",
+  "Proxmox system repair completed with some issues.": "Reparación del sistema Proxmox completada con algunos problemas.",
+  "Proxmox system update": "Actualización del sistema Proxmox",
+  "Proxmox web interface protection": "Protección de la interfaz web de Proxmox",
+  "Proxmox web interface: Datacenter > Storage > Add > Directory": "Interfaz web de Proxmox: Centro de datos > Almacenamiento > Agregar > Directorio",
+  "Proxmox web interface: Datacenter > Storage > Add > NFS": "Interfaz web de Proxmox: Centro de datos > Almacenamiento > Agregar > NFS",
+  "Proxmox web interface: Datacenter > Storage > Add > SMB/CIFS": "Interfaz web de Proxmox: Centro de datos > Almacenamiento > Agregar > SMB/CIFS",
+  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Interfaz web de Proxmox: Centro de datos > Almacenamiento > Agregar > ZFS",
+  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Interfaz web de Proxmox: Centro de datos > Almacenamiento > Agregar > iSCSI",
+  "Pulling latest changes from GitHub...": "Sacando los últimos cambios de GitHub...",
+  "Purging log2ram apt package...": "Purgando el paquete log2ram apt...",
+  "Quick health check (PASSED / FAILED)": "Chequeo de salud rápido (APROBADO / FALLADO)",
+  "Quick health status   — overall SMART result + key attributes": "Estado de salud rápido: resultado SMART general + atributos clave",
+  "RAID Detected": "RAID detectado",
+  "RAID member detected": "Miembro RAID detectado",
+  "RAM Size": "Tamaño de RAM",
+  "RAM and swap usage": "Uso de RAM y swap",
+  "REPAIR SUMMARY": "RESUMEN DE REPARACIÓN",
+  "REQUIREMENTS:": "REQUISITOS:",
+  "ROM dump not available — configuring without romfile.": "Volcado de ROM no disponible: configuración sin archivo rom.",
+  "ROM file used": "archivo ROM utilizado",
+  "RPC Bind Service: RUNNING": "Servicio de enlace RPC: EN EJECUCIÓN",
+  "RPC Bind Service: STOPPED": "Servicio de enlace RPC: DETENIDO",
+  "RPC Bind Service: STOPPED - starting...": "Servicio de enlace RPC: DETENIDO - iniciando...",
+  "Re-enter the BORG REPOKEY passphrase to confirm:": "Vuelva a ingresar la frase de contraseña de BORG REPOKEY para confirmar:",
+  "Re-running pre-check after repairs...": "Volviendo a ejecutar la verificación previa después de las reparaciones...",
+  "Reachable": "Accesible",
+  "Read-Only": "Sólo lectura",
+  "Read-Only access": "Acceso de sólo lectura",
+  "Read-Write (universal)": "Lectura-Escritura (universal)",
+  "Read-Write access": "Acceso de lectura-escritura",
+  "Read-only": "Sólo lectura",
+  "Read-only access (or no write permissions).": "Acceso de solo lectura (o sin permisos de escritura).",
+  "Read-only mount": "Montaje de solo lectura",
+  "Read/Write (default)": "Lectura/Escritura (predeterminado)",
+  "Read/write CPU model-specific registers": "Leer/escribir registros específicos del modelo de CPU",
+  "Readable user table (UID, shell, etc.)": "Tabla de usuarios legible (UID, shell, etc.)",
+  "Reading NVMe SMART data...": "Leyendo datos NVMe SMART...",
+  "Reading NVMe self-test log...": "Leyendo el registro de autoprueba de NVMe...",
+  "Reading SMART data...": "Leyendo datos SMART...",
+  "Reading SMART self-test log...": "Leyendo el registro de autoprueba SMART...",
+  "Reading full SMART report...": "Leyendo el informe SMART completo...",
+  "Real-time bandwidth usage (press q to exit)": "Uso de ancho de banda en tiempo real (presione q para salir)",
+  "Real-time network monitoring (press q to exit)": "Monitoreo de red en tiempo real (presione q para salir)",
+  "Real-time network usage (iftop)": "Uso de red en tiempo real (iftop)",
+  "Reason: Access denied": "Razón: Acceso denegado",
+  "Reason: Authentication required": "Razón: Se requiere autenticación",
+  "Reason: Permission denied": "Razón: Permiso denegado",
+  "Reboot Recommended": "Reiniciar recomendado",
+  "Reboot Required": "Reiniciar requerido",
+  "Reboot is required to apply the scheduled restore.": "Es necesario reiniciar para aplicar la restauración programada.",
+  "Reboot is required to complete the pending restore.": "Es necesario reiniciar para completar la restauración pendiente.",
+  "Reboot now?": "¿Reiniciar ahora?",
+  "Reboot pending — changes will take full effect after the next restart.": "Reinicio pendiente: los cambios entrarán en vigor después del próximo reinicio.",
+  "Reboot the VM to complete the driver installation.": "Reinicie la VM para completar la instalación del controlador.",
+  "Reboot the system:": "Reinicie el sistema:",
+  "Rebooting the system...": "Reiniciando el sistema...",
+  "Rebuilding initramfs to apply nouveau blacklist before installation...": "Reconstruyendo initramfs para aplicar la nueva lista negra antes de la instalación...",
+  "Recent": "Reciente",
+  "Recent Samba Servers": "Servidores Samba recientes",
+  "Recent Samba server": "Servidor Samba reciente",
+  "Recent logs:": "Registros recientes:",
+  "Recent test results:": "Resultados de pruebas recientes:",
+  "Recommendation: reformat the disk to ext4 for a robust setup — see docs.": "Recomendación: vuelva a formatear el disco a ext4 para una configuración sólida; consulte los documentos.",
+  "Recommendation: start with Complete restore.": "Recomendación: comience con la restauración completa.",
+  "Recommendation: use 'Export to file' for these paths and apply manually during a maintenance window.": "Recomendación: use 'Exportar a archivo' para estas rutas y aplíquelo manualmente durante una ventana de mantenimiento.",
+  "Recommended diagnostic commands": "Comandos de diagnóstico recomendados",
+  "Recommended: Install the QEMU Guest Agent in the VM": "Recomendado: Instale el agente invitado QEMU en la VM",
+  "Recommended: run": "Recomendado: correr",
+  "Recommended: schedule these paths for next boot to avoid immediate SSH disconnection.": "Recomendado: programe estas rutas para el próximo inicio para evitar la desconexión SSH inmediata.",
+  "Recommended: use GPU -> LXC mode for these devices.": "Recomendado: use GPU -> modo LXC para estos dispositivos.",
+  "Recommended: use GPU with LXC workloads instead of VM passthrough on this hardware.": "Recomendado: use GPU con cargas de trabajo LXC en lugar de transferencia de VM en este hardware.",
+  "Recover the keyfile using your recovery passphrase?": "¿Recuperar el archivo clave usando su frase de contraseña de recuperación?",
+  "Recoverable:": "Recuperable:",
+  "Recovery blob upload failed — main backup is OK, but keyfile recovery from PBS will not be available for this backup.": "Error en la carga del blob de recuperación: la copia de seguridad principal está bien, pero la recuperación del archivo clave de PBS no estará disponible para esta copia de seguridad.",
+  "Recovery blob:": "blob de recuperación:",
+  "Recovery failed": "La recuperación falló",
+  "Recovery passphrase": "frase de contraseña de recuperación",
+  "Recovery setup failed": "Error en la configuración de recuperación",
+  "Refresh APT index and verify repositories:": "Actualizar el índice APT y verificar los repositorios:",
+  "Refresh your browser (Ctrl+Shift+R) to see changes": "Actualiza tu navegador (Ctrl+Shift+R) para ver los cambios",
+  "Refresh your browser to see changes (server restart may be required)": "Actualice su navegador para ver los cambios (es posible que sea necesario reiniciar el servidor)",
+  "Refreshing apt cache...": "Actualizando caché de apt...",
+  "Regenerating PVE package cache...": "Regenerando caché de paquetes PVE...",
+  "Regenerating boot artifacts for the merged kernel-agnostic changes...": "Regenerando artefactos de arranque para los cambios fusionados independientes del kernel...",
+  "Regenerating certificates and restarting services...": "Regenerando certificados y reiniciando servicios...",
+  "Register mount path in Proxmox:": "Registre la ruta de montaje en Proxmox:",
+  "Registering disk as Proxmox storage...": "Registrando disco como almacenamiento en Proxmox...",
+  "Registering module with DKMS...": "Registrando módulo con DKMS...",
+  "Reinstall / update Coral drivers": "Reinstalar/actualizar los controladores Coral",
+  "Reinstall Fail2Ban": "Reinstale Fail2Ban",
+  "Reinstall Lynis": "Reinstale Lynis",
+  "Reinstall and reconfigure Fail2Ban": "Reinstale y reconfigure Fail2Ban",
+  "Reinstall/Update NVIDIA drivers": "Reinstalar/actualizar controladores NVIDIA",
+  "Reinstalled": "Reinstalado",
+  "Reinstalled Proxmox packages successfully": "Paquetes Proxmox reinstalados exitosamente",
+  "Reinstalling core Proxmox packages...": "Reinstalando los paquetes principales de Proxmox...",
+  "Release Channel": "Canal de lanzamiento",
+  "Release channel set to Beta.": "Canal de lanzamiento configurado en Beta.",
+  "Release channel set to Stable.": "Canal de liberación configurado en Estable.",
+  "Release channel:": "Canal de lanzamiento:",
+  "Reload Proxmox firewall rules": "Recargar las reglas del firewall de Proxmox",
+  "Reload network configuration (ifupdown2)": "Recargar la configuración de red (ifupdown2)",
+  "Remapped Users:": "Usuarios reasignados:",
+  "Remapped users:": "Usuarios reasignados:",
+  "Reminder: You must install the QEMU Guest Agent inside the Windows VM": "Recordatorio: debe instalar el agente invitado QEMU dentro de la máquina virtual de Windows",
+  "Remote repository path:": "Ruta del repositorio remoto:",
+  "Remote server via SSH  (recommended — off-host, dedup across machines)": "servidor remoto a través de SSH (recomendado: fuera del host, desduplicación entre máquinas)",
+  "Remounting CIFS share with open permissions...": "Remontando el recurso compartido CIFS con permisos abiertos...",
+  "Remove CIFS Mount": "Quitar montaje CIFS",
+  "Remove CIFS Mount (pvesm or fstab)": "Quitar montaje CIFS (pvesm o fstab)",
+  "Remove CIFS Storage": "Eliminar almacenamiento CIFS",
+  "Remove CIFS fstab Mount": "Quitar el montaje fstab de CIFS",
+  "Remove CIFS fstab mount:": "Quitar el montaje fstab de CIFS:",
+  "Remove CIFS storage:": "Eliminar el almacenamiento CIFS:",
+  "Remove Disk Storage": "Quitar almacenamiento en disco",
+  "Remove Disk from fstab": "Quitar disco de fstab",
+  "Remove FS labels  — partitions and data preserved": "Eliminar etiquetas FS: particiones y datos preservados",
+  "Remove FS labels — partitions and data preserved": "Eliminar etiquetas FS: particiones y datos preservados",
+  "Remove Fail2Ban": "Quitar Fail2Ban",
+  "Remove GPU from LXC config (keep Start on boot)": "Elimine la GPU de la configuración de LXC (mantenga Iniciar en el arranque)",
+  "Remove GPU from LXC config + keep Start on boot unchanged": "Elimine la GPU de la configuración de LXC + mantenga el inicio al arrancar sin cambios",
+  "Remove GPU from VM config (keep Start on boot)": "Elimine la GPU de la configuración de la VM (mantenga Iniciar en el arranque)",
+  "Remove GPU from source VM config (keep Start on boot)": "Elimine la GPU de la configuración de la VM de origen (mantenga Iniciar en el arranque)",
+  "Remove GPU from source VM config + keep Start on boot unchanged": "Elimine la GPU de la configuración de la máquina virtual de origen + mantenga el inicio al arrancar sin cambios",
+  "Remove LXC Mount Point": "Quitar el punto de montaje LXC",
+  "Remove Lynis": "Eliminar Lynis",
+  "Remove Mount Point": "Quitar punto de montaje",
+  "Remove Mount Point Confirmation:": "Eliminar confirmación del punto de montaje:",
+  "Remove NFS Mount": "Quitar montaje NFS",
+  "Remove NFS Mount (pvesm or fstab)": "Quitar montaje NFS (pvesm o fstab)",
+  "Remove NFS Storage": "Eliminar almacenamiento NFS",
+  "Remove NFS fstab Mount": "Quitar el montaje fstab de NFS",
+  "Remove NFS fstab mount:": "Quitar el montaje fstab de NFS:",
+  "Remove NFS storage:": "Eliminar el almacenamiento NFS:",
+  "Remove Proxmox CIFS storage:": "Eliminar el almacenamiento CIFS de Proxmox:",
+  "Remove Proxmox NFS storage:": "Eliminar el almacenamiento Proxmox NFS:",
+  "Remove Proxmox iSCSI storage:": "Eliminar el almacenamiento iSCSI de Proxmox:",
+  "Remove Secure Gateway? State will be preserved.": "¿Quitar puerta de enlace segura? Se preservará el estado.",
+  "Remove custom paths": "eliminar rutas personalizadas",
+  "Remove disk references from affected VM(s)/CT(s) config": "Eliminar referencias de disco de la configuración de VM/CT(s) afectados",
+  "Remove iSCSI Storage": "Eliminar almacenamiento iSCSI",
+  "Remove iSCSI storage definition:": "Eliminar la definición de almacenamiento iSCSI:",
+  "Remove invalid port": "Eliminar puerto no válido",
+  "Remove invalid port(s)": "Eliminar puertos no válidos",
+  "Remove keyfile from this host": "eliminar el archivo de claves de este host",
+  "Remove mount point:": "Eliminar punto de montaje:",
+  "Remove obsolete systemd-boot meta-package": "Eliminar el metapaquete obsoleto systemd-boot",
+  "Remove old repository files:": "Eliminar archivos antiguos del repositorio:",
+  "Remove passthrough device from VM": "Eliminar el dispositivo de paso de la VM",
+  "Remove subscription banner": "Eliminar banner de suscripción",
+  "Remove the unprivileged flag from configuration:": "Elimine la bandera sin privilegios de la configuración:",
+  "Remove unused packages and their config": "Eliminar paquetes no utilizados y su configuración.",
+  "Removed": "Remoto",
+  "Removed KVM MSR options from configuration": "Se eliminaron las opciones de KVM MSR de la configuración.",
+  "Removed Mount:": "Montaje eliminado:",
+  "Removed all .link files from": "Se eliminaron todos los archivos .link de",
+  "Removed bwlimit/ionice tuning (no .bak found)": "Se eliminó el ajuste de bwlimit/ionice (no se encontró .bak)",
+  "Removed configurations for": "Configuraciones eliminadas para",
+  "Removed credentials file:": "Archivo de credenciales eliminado:",
+  "Removed empty KVM configuration file": "Se eliminó el archivo de configuración KVM vacío.",
+  "Removed empty mount directory:": "Se eliminó el directorio de montaje vacío:",
+  "Removed entry from /etc/fstab": "Entrada eliminada de /etc/fstab",
+  "Removed from /etc/fstab": "Eliminado de /etc/fstab",
+  "Removed from /etc/fstab.": "Eliminado de /etc/fstab.",
+  "Removed idle=nomwait from /etc/kernel/cmdline (ZFS)": "Se eliminó idle=nomwait de /etc/kernel/cmdline (ZFS)",
+  "Removed idle=nomwait from GRUB configuration": "Se eliminó idle=nomwait de la configuración de GRUB.",
+  "Removed remapped user:": "Usuario reasignado eliminado:",
+  "Removed sharedfiles group.": "Se eliminó el grupo de archivos compartidos.",
+  "Removed:": "Remoto:",
+  "Removing APT IPv4 configuration...": "Eliminando la configuración de APT IPv4...",
+  "Removing Coral packages...": "Eliminando paquetes de Coral...",
+  "Removing Fail2Ban...": "Eliminando Fail2Ban...",
+  "Removing GPU from VM": "Quitar GPU de la VM",
+  "Removing Lynis...": "Eliminando a Lynis...",
+  "Removing NVIDIA DKMS entries...": "Eliminando entradas de NVIDIA DKMS...",
+  "Removing NVIDIA packages...": "Eliminando paquetes de NVIDIA...",
+  "Removing OVH RTM...": "Eliminando OVH RTM...",
+  "Removing OpenVSwitch...": "Eliminando OpenVSwitch...",
+  "Removing VFIO ownership for selected GPU(s)...": "Eliminando la propiedad de VFIO para GPU seleccionadas...",
+  "Removing all .link files from": "Eliminando todos los archivos .link de",
+  "Removing any pre-existing gasket-dkms package...": "Eliminando cualquier paquete de junta-dkms preexistente...",
+  "Removing conflicting utilities...": "Eliminando utilidades en conflicto...",
+  "Removing entropy generation optimization...": "Eliminando la optimización de la generación de entropía...",
+  "Removing filesystem signatures...": "Eliminando firmas del sistema de archivos...",
+  "Removing from /etc/fstab...": "Eliminando de /etc/fstab...",
+  "Removing gasket DKMS modules...": "Extracción de juntas de módulos DKMS...",
+  "Removing gateway...": "Eliminando puerta de enlace...",
+  "Removing guest agent...": "Eliminando agente invitado...",
+  "Removing invalid configurations...": "Eliminando configuraciones no válidas...",
+  "Removing invalid existing file...": "Eliminando archivo existente no válido...",
+  "Removing kernel panic configuration...": "Eliminando la configuración de pánico del kernel...",
+  "Removing memory optimizations...": "Eliminando optimizaciones de memoria...",
+  "Removing mount point": "Quitar el punto de montaje",
+  "Removing network optimizations...": "Eliminando optimizaciones de red...",
+  "Removing no longer required packages and purging old cached updates...": "Eliminando paquetes que ya no son necesarios y eliminando actualizaciones antiguas almacenadas en caché...",
+  "Removing partial VM": "Eliminación de VM parcial",
+  "Removing previous DKMS source tree...": "Eliminando el árbol de fuentes DKMS anterior...",
+  "Removing previous Lynis installation...": "Eliminando la instalación anterior de Lynis...",
+  "Removing remapped users...": "Eliminando usuarios reasignados...",
+  "Removing storage from Proxmox...": "Eliminando almacenamiento de Proxmox...",
+  "Removing system limits optimizations...": "Eliminando optimizaciones de límites del sistema...",
+  "Removing zfs-auto-snapshot...": "Eliminando zfs-auto-snapshot...",
+  "Renamed": "Renombrado",
+  "Renamed NIC:": "NIC renombrada:",
+  "Repair Complete": "Reparación completa",
+  "Repair Options:": "Opciones de reparación:",
+  "Repairs and optimizes repositories": "Repara y optimiza repositorios",
+  "Replace": "Reemplazar",
+  "Replace <container-id> with the actual ID.": "Reemplace <container-id> con el ID real.",
+  "Replace <container-id> with your actual container ID": "Reemplace <container-id> con su ID de contenedor real",
+  "Replace <storage-identifier> with the value from step 4": "Reemplace <identificador-de-almacenamiento> con el valor del paso 4",
+  "Replace invalid port(s)": "Reemplazar puerto(s) no válido(s)",
+  "Replace it?": "¿Reemplazarlo?",
+  "Replace paths with your actual values from step 5": "Reemplace las rutas con sus valores reales del paso 5",
+  "Replace with your actual path from step 5": "Reemplace con su ruta real del paso 5",
+  "Replacing gzip with pigz wrapper...": "Reemplazo de gzip con envoltorio pigz...",
+  "Repositories switched to no-subscription": "Los repositorios cambiaron a sin suscripción",
+  "Repository ready.": "Repositorio listo.",
+  "Repository:": "Repositorio:",
+  "Require reboot": "Requerir reinicio",
+  "Required command not found:": "Comando requerido no encontrado:",
+  "Required if using a VirtIO or SCSI disk.": "Requerido si se utiliza un disco VirtIO o SCSI.",
+  "Required install helpers not available.": "Los ayudantes de instalación necesarios no están disponibles.",
+  "Requires acl package. Skip if setfacl is not available.": "Requiere paquete acl. Omita si setfacl no está disponible.",
+  "Requires authentication": "Requiere autenticación",
+  "Reset Capability Blocked": "Capacidad de reinicio bloqueada",
+  "Reset Capability Warning": "Advertencia de capacidad de reinicio",
+  "Reset Monitor Password": "Restablecer contraseña del monitor",
+  "Reset ProxMenux Monitor Password": "Restablecer la contraseña del monitor ProxMenux",
+  "Reset current storage selection": "Restablecer la selección de almacenamiento actual",
+  "Resetting time synchronization...": "Restableciendo la sincronización horaria...",
+  "Residual Bookworm entries commented where applicable": "Entradas residuales de Bookworm comentadas cuando corresponda",
+  "Resolve package conflicts": "Resolver conflictos de paquetes",
+  "Restart Network": "Reiniciar la red",
+  "Restart Network Service": "Reiniciar el servicio de red",
+  "Restart Web UI proxy": "Reinicie el proxy de la interfaz de usuario web",
+  "Restart and enable Samba:": "Reinicie y habilite Samba:",
+  "Restart container to activate mount?": "¿Reiniciar el contenedor para activar el montaje?",
+  "Restarting ProxMenux Monitor service...": "Reiniciando el servicio ProxMenux Monitor...",
+  "Restarting Proxmox services...": "Reiniciando los servicios de Proxmox...",
+  "Restarting container...": "Reiniciando contenedor...",
+  "Restarting gateway...": "Reiniciando la puerta de enlace...",
+  "Restarting network service...": "Reiniciando el servicio de red...",
+  "Restarting the server...": "Reiniciando el servidor...",
+  "Restore Backup": "Restaurar copia de seguridad",
+  "Restore Network Backup": "Restaurar la copia de seguridad de la red",
+  "Restore a CT from backup": "Restaurar un CT desde la copia de seguridad",
+  "Restore a VM from backup": "Restaurar una VM desde la copia de seguridad",
+  "Restore actions": "Restaurar acciones",
+  "Restore applied:": "Restauración aplicada:",
+  "Restore can now proceed.": "La restauración ahora puede continuar.",
+  "Restore failed": "Error en la restauración",
+  "Restore from Borg  →  staging": "Restaurar desde Borg → puesta en escena",
+  "Restore from Borg repository": "Restaurar desde el repositorio Borg",
+  "Restore from PBS  →  staging": "Restaurar desde PBS → puesta en escena",
+  "Restore from Proxmox Backup Server (PBS)": "Restaurar desde Proxmox Backup Server (PBS)",
+  "Restore from local archive  (.tar.gz / .tar.zst)": "Restaurar desde un archivo local (.tar.gz / .tar.zst)",
+  "Restore from local archive  →  staging": "Restaurar desde archivo local → puesta en escena",
+  "Restore host configuration": "Restaurar la configuración del host",
+  "Restore it ONLY if the target host has the same pools and disks as the source. Otherwise Proxmox may try to import non-existent pools at next boot.": "restaurarlo SÓLO si el host de destino tiene los mismos grupos y discos que el origen.De lo contrario, Proxmox puede intentar importar grupos inexistentes en el próximo arranque.",
+  "Restore plan": "plan de restauración",
+  "Restore plan summary": "Resumen del plan de restauración",
+  "Restore source location": "Restaurar ubicación de origen",
+  "Restored config is on disk; reboot the host to apply.": "La configuración restaurada está en el disco; reinicie el host para aplicar.",
+  "Restored original /bin/gzip": "Restaurado original /bin/gzip",
+  "Restored original /etc/vzdump.conf from .bak": "Restaurado /etc/vzdump.conf original desde .bak",
+  "Restoring APT language downloads...": "Restaurando descargas del idioma APT...",
+  "Restoring container memory to": "Restaurar la memoria del contenedor a",
+  "Restoring default journald configuration...": "Restaurando la configuración predeterminada del diario...",
+  "Restoring enterprise repositories...": "Restaurando repositorios empresariales...",
+  "Restoring guest configs (LXC + QEMU)...": "Restaurando configuraciones de invitados (LXC + QEMU)...",
+  "Restoring original bashrc...": "Restaurando bashrc original...",
+  "Restoring original logrotate configuration...": "Restaurando la configuración original de logrotate...",
+  "Restoring subscription banner...": "Restaurando el banner de suscripción...",
+  "Results will be saved automatically to:": "Los resultados se guardarán automáticamente en:",
+  "Results will be saved to:": "Los resultados se guardarán en:",
+  "Retention": "Retención",
+  "Return": "Volver",
+  "Return to Main Menu": "Volver al menú principal",
+  "Return to Share Menu": "Volver al menú Compartir",
+  "Return to main menu": "Volver al menú principal",
+  "Reused the encryption key from the PVE storage entry.": "reutilizó la clave de cifrado de la entrada de almacenamiento PVE.",
+  "Reverting AMD (Ryzen/EPYC) fixes...": "Revertir correcciones de AMD (Ryzen/EPYC)...",
+  "Reverting IOMMU/VFIO configuration...": "Revirtiendo la configuración de IOMMU/VFIO...",
+  "Reverting TCP BBR + Fast Open...": "Revertir TCP BBR + Apertura rápida...",
+  "Reverting ZFS ARC tuning...": "Revirtiendo el ajuste ZFS ARC...",
+  "Reverting pigz wrapper...": "Revertir la envoltura de pigz...",
+  "Reverting vzdump speed tuning...": "Revertir el ajuste de velocidad de vzdump...",
+  "Review passthrough config files": "Revisar los archivos de configuración de paso a través",
+  "Review what will be removed": "Revisa lo que se eliminará",
+  "Rollback: nothing to remove (host matches backup)": "Revertir: nada que eliminar (el host coincide con la copia de seguridad)",
+  "Root SSH keys/config": "Configuración/claves SSH raíz",
+  "Root inside container = root on host system": "Raíz dentro del contenedor = raíz en el sistema host",
+  "Root shell/profile config": "Configuración de perfil/shell raíz",
+  "Root user on the PVE host (default 'root'):": "Usuario root en el host PVE ('root' predeterminado):",
+  "Rotate the recovery passphrase": "rotar la frase de contraseña de recuperación",
+  "Routing Information": "Información de ruta",
+  "Routing Table": "Tabla de enrutamiento",
+  "Run 'Mount NFS Share' to install NFS client automatically.": "Ejecute 'Montar NFS Share' para instalar el cliente NFS automáticamente.",
+  "Run 'Mount Samba Share' to install CIFS client automatically.": "Ejecute 'Mount Samba Share' para instalar el cliente CIFS automáticamente.",
+  "Run PVE 8 to 9": "Ejecuta PVE 8 a 9",
+  "Run PVE 8 to 9 check": "Ejecute la verificación PVE 8 a 9",
+  "Run \\\"Install NVIDIA Drivers on Host\\\" first so the installer is cached.": "Primero ejecute \\\"Instalar controladores NVIDIA en el host\\\" para que el instalador se almacene en caché.",
+  "Run a full security audit": "Ejecute una auditoría de seguridad completa",
+  "Run a job now": "Ejecute un trabajo ahora",
+  "Run as server or client? [s/c]:": "¿Ejecutar como servidor o cliente? [Carolina del Sur]:",
+  "Run checklist again to verify upgrade:": "Ejecute la lista de verificación nuevamente para verificar la actualización:",
+  "Run from console, or SSH inside tmux/screen": "Ejecutar desde la consola o SSH dentro de tmux/screen",
+  "Run job now": "Ejecutar trabajo ahora",
+  "Run mode selected: Automatic": "Modo de ejecución seleccionado: Automático",
+  "Run mode selected: Automatic/Unattended": "Modo de ejecución seleccionado: Automático/Desatendido",
+  "Run mode selected: Interactive": "Modo de ejecución seleccionado: Interactivo",
+  "Run mode: Unattended": "Modo de ejecución: desatendido",
+  "Run security audit now": "Ejecute la auditoría de seguridad ahora",
+  "Run the following inside the VM:": "Ejecute lo siguiente dentro de la VM:",
+  "Run upgrade checklist script:": "Ejecute el script de la lista de verificación de actualización:",
+  "Running": "Correr",
+  "Running Lynis security audit...": "Ejecutando auditoría de seguridad de Lynis...",
+  "Running NVIDIA installer in container. This may take several minutes...": "Ejecutando el instalador de NVIDIA en un contenedor. Esto puede tardar varios minutos...",
+  "Running NVIDIA uninstaller...": "Ejecutando el desinstalador de NVIDIA...",
+  "Running VM detected": "VM en ejecución detectada",
+  "Running backup job:": "Ejecutando trabajo de respaldo:",
+  "Running containers detected": "Contenedores en ejecución detectados",
+  "Running pre-upgrade simulation to verify 'proxmox-ve' will remain installed...": "Ejecutando una simulación previa a la actualización para verificar que 'proxmox-ve' permanecerá instalado...",
+  "SATA   (standard - high compatibility)": "SATA (estándar - alta compatibilidad)",
+  "SCSI   (recommended for Linux and Windows)": "SCSI (recomendado para Linux y Windows)",
+  "SCSI   (recommended for Linux)": "SCSI (recomendado para Linux)",
+  "SECURITY CONSIDERATIONS:": "CONSIDERACIONES DE SEGURIDAD:",
+  "SECURITY WARNING:": "ADVERTENCIA DE SEGURIDAD:",
+  "SMART Action": "Acción INTELIGENTE",
+  "SMART Disk Health & Test": "Estado y prueba del disco SMART",
+  "SMART health status: PASSED": "Estado de salud INTELIGENTE: PASADO",
+  "SMB Client Error": "Error del cliente PYME",
+  "SMB Client Tools: AVAILABLE": "Herramientas para clientes Pymes: DISPONIBLES",
+  "SMB Client Tools: NOT AVAILABLE": "Herramientas de cliente SMB: NO DISPONIBLES",
+  "SMB Error": "Error de PYME",
+  "SMB port 445:": "Puerto SMB 445:",
+  "SMB ports:": "Puertos PYME:",
+  "SR-IOV Configuration Detected": "Configuración SR-IOV detectada",
+  "SSD Emulation": "Emulación de SSD",
+  "SSH access (host + root)": "Acceso SSH (host + raíz)",
+  "SSH auth logger service created and started": "Servicio de registro de autenticación SSH creado e iniciado",
+  "SSH hardening: MaxAuthTries set to 3 (Lynis recommendation)": "Endurecimiento SSH: MaxAuthTries establecido en 3 (recomendación de Lynis)",
+  "SSH host or IP:": "Host SSH o IP:",
+  "SSH key strategy": "estrategia clave SSH",
+  "SSH login failed": "Error al iniciar sesión en SSH",
+  "SSH network risk": "Riesgo de red SSH",
+  "SSH password auth refused on server": "Autenticación de contraseña SSH rechazada en el servidor",
+  "SSH protection (aggressive mode)": "Protección SSH (modo agresivo)",
+  "STEP 6: Choose commands based on your storage type": "PASO 6: Elige comandos según el tipo de almacenamiento",
+  "STEP 9: Cleanup (LVM only)": "PASO 9: Limpieza (solo LVM)",
+  "STORAGE TYPE IDENTIFICATION:": "IDENTIFICACIÓN DEL TIPO DE ALMACENAMIENTO:",
+  "SUGGESTION FOR": "SUGERENCIA PARA",
+  "Safe design: no automatic ACL/ownership mutation on host or CT.": "Diseño seguro: sin mutación automática de ACL/propiedad en el host o CT.",
+  "Safe to apply now": "Es seguro aplicar ahora",
+  "Safety Backup": "Respaldo de seguridad",
+  "Safety backup created": "Copia de seguridad creada",
+  "Safety check failed: selected disk is now used by host/system.": "La comprobación de seguridad falló: el host/sistema ahora utiliza el disco seleccionado.",
+  "Safety check failed: selected disk is referenced by a VM/LXC config.": "Error en la verificación de seguridad: una configuración VM/LXC hace referencia al disco seleccionado.",
+  "Samba Client Manager - CT": "Administrador de clientes Samba - CT",
+  "Samba Client in LXC (Privileged)": "Cliente Samba en LXC (privilegiado)",
+  "Samba Client in LXC (privileged)": "Cliente Samba en LXC  (privilegiado)",
+  "Samba Credentials": "Credenciales de Samba",
+  "Samba Host Manager - Proxmox Host": "Administrador de host Samba - Host Proxmox",
+  "Samba LXC Manager": "Gerente de Samba LXC",
+  "Samba Manager - CT": "Gerente de Samba - CT",
+  "Samba Not Installed": "Samba no instalada",
+  "Samba Password": "Contraseña de Samba",
+  "Samba Server": "Servidor Samba",
+  "Samba Server Selection": "Selección del servidor Samba",
+  "Samba Server in LXC (Privileged)": "Servidor Samba en LXC (privilegiado)",
+  "Samba Server in LXC (privileged)": "Servidor Samba en LXC (privilegiado)",
+  "Samba Server: INSTALLED": "Servidor Samba: INSTALADO",
+  "Samba Server: NOT INSTALLED": "Servidor Samba: NO INSTALADO",
+  "Samba Service Status in CT": "Estado del servicio Samba en CT",
+  "Samba Service: RUNNING": "Servicio Samba: EN EJECUCIÓN",
+  "Samba Service: STOPPED": "Servicio Samba: DETENIDO",
+  "Samba User": "Usuario de samba",
+  "Samba Username": "Nombre de usuario de Samba",
+  "Samba client tools installed": "Herramientas cliente Samba instaladas",
+  "Samba configuration backed up.": "Se realizó una copia de seguridad de la configuración de Samba.",
+  "Samba group kept (has users assigned).": "Se mantiene el grupo Samba (tiene usuarios asignados).",
+  "Samba group removed.": "Se eliminó el grupo de samba.",
+  "Samba packages removed.": "Paquetes de Samba eliminados.",
+  "Samba server has been completely uninstalled!": "¡El servidor Samba se ha desinstalado por completo!",
+  "Samba server installed successfully.": "El servidor Samba se instaló correctamente.",
+  "Samba server is already installed.": "El servidor Samba ya está instalado.",
+  "Samba server is not installed in this CT.": "El servidor Samba no está instalado en este CT.",
+  "Samba server is running": "El servidor Samba se está ejecutando.",
+  "Samba servers detected": "Servidores Samba detectados",
+  "Samba services stopped and disabled.": "Los servicios de Samba se detuvieron y deshabilitaron.",
+  "Samba share": "compartir samba",
+  "Samba share created successfully!": "¡El recurso compartido de Samba se creó con éxito!",
+  "Samba share mounted successfully!": "¡El recurso compartido de Samba se montó correctamente!",
+  "Samba share unmount successfully. Reboot LXC required to take effect.": "El recurso compartido de Samba se desmontó correctamente. Es necesario reiniciar LXC para que surta efecto.",
+  "Samba users removed.": "Se eliminaron los usuarios de Samba.",
+  "Samba users:": "Usuarios de Samba:",
+  "Samba/CIFS Client Status in CT": "Estado del cliente Samba/CIFS en CT",
+  "Samba/CIFS client installed successfully.": "El cliente Samba/CIFS se instaló correctamente.",
+  "Samba/CIFS mounts in CT": "Montajes Samba/CIFS en CT",
+  "Samba/NFS clients will likely receive 'permission denied'. Review the steps above.": "Los clientes Samba/NFS probablemente recibirán un \"permiso denegado\". Revise los pasos anteriores.",
+  "Same Version Detected": "Misma versión detectada",
+  "Same host:": "Mismo anfitrión:",
+  "Same major series:": "Misma serie principal:",
+  "Same major.minor:": "Mismo mayor.menor:",
+  "Sanitizing NVIDIA host services for VFIO mode...": "Desinfectando los servicios de host de NVIDIA para el modo VFIO...",
+  "Save the passphrase somewhere safe NOW, before continuing.": "guarde la frase de contraseña en un lugar seguro AHORA, antes de continuar.",
+  "Save this Borg target so you don't need to enter the details again?": "¿Guardar este objetivo Borg para no tener que volver a introducir los detalles?",
+  "Scan storage for new content": "Escanear el almacenamiento en busca de contenido nuevo",
+  "Scanning available physical disks...": "Escaneando discos físicos disponibles...",
+  "Scanning network for NFS servers...": "Escaneando la red en busca de servidores NFS...",
+  "Scanning network for Samba servers...": "Escaneando red en busca de servidores Samba...",
+  "Schedule": "Cronograma",
+  "Schedule:": "Cronograma:",
+  "Scheduled backup job created": "Tarea de copia de seguridad programada creada",
+  "Scheduled backup jobs": "Tareas de copia de seguridad programadas",
+  "Scheduled backups and retention policies": "Tareas de copia de seguridad programadas y políticas de retención",
+  "Scheduled tasks (cron)": "Tareas programadas (cron)",
+  "Scheduler script not found:": "Script del programador no encontrado:",
+  "Script Information": "Información del guión",
+  "Script not found:": "Guión no encontrado:",
+  "Scripts in": "Guiones en",
+  "Search Results for:": "Resultados de búsqueda para:",
+  "Search/Filter Scripts": "Scripts de búsqueda/filtro",
+  "Secure Disk Formatter": "Formateador de disco seguro",
+  "Secure Gateway (Tailscale VPN)": "Puerta de enlace segura (VPN de escala trasera)",
+  "Secure Gateway deployed successfully!": "¡Secure Gateway se implementó con éxito!",
+  "Secure Gateway is already installed.": "Secure Gateway ya está instalado.",
+  "Security": "Seguridad",
+  "Security Updates": "Actualizaciones de seguridad",
+  "Security Warning — read before applying": "Advertencia de seguridad: lea antes de aplicar",
+  "See": "Ver",
+  "See /tmp/proxmenux-mount.log for details.": "consulte /tmp/proxmenux-mount.log para obtener más detalles.",
+  "Select": "Seleccionar",
+  "Select Borg target": "Seleccionar objetivo Borg",
+  "Select CPU model": "Seleccione el modelo de CPU",
+  "Select CT": "Seleccione TC",
+  "Select CT for destination disk": "Seleccione CT para el disco de destino",
+  "Select Disk": "Seleccionar disco",
+  "Select Disk Images": "Seleccionar imágenes de disco",
+  "Select Disk Interface": "Seleccionar interfaz de disco",
+  "Select Disks": "Seleccionar discos",
+  "Select Existing Folder": "Seleccionar carpeta existente",
+  "Select Filesystem": "Seleccionar sistema de archivos",
+  "Select Folder": "Seleccionar carpeta",
+  "Select GPU for VM Passthrough": "Seleccione GPU para paso a través de VM",
+  "Select GPU(s)": "Seleccionar GPU(s)",
+  "Select Host Directory": "Seleccionar directorio de host",
+  "Select Host Folder": "Seleccionar carpeta de host",
+  "Select LXC Container": "Seleccione el contenedor LXC",
+  "Select Mount Point": "Seleccione el punto de montaje",
+  "Select Mount Point to Remove": "Seleccione el punto de montaje para eliminar",
+  "Select NFS Export": "Seleccione Exportar NFS",
+  "Select NFS Server": "Seleccione el servidor NFS",
+  "Select OVA/OVF file": "Seleccione el archivo OVA/OVF",
+  "Select PBS repository": "Seleccione el repositorio de PBS",
+  "Select Privileged Container": "Seleccionar contenedor privilegiado",
+  "Select SSH private key": "seleccione la clave privada SSH",
+  "Select SSH private key file": "seleccione el archivo de clave privada SSH",
+  "Select Samba Server": "Seleccione el servidor Samba",
+  "Select Samba Share": "Seleccione Samba Compartir",
+  "Select Shared Directory Location": "Seleccione la ubicación del directorio compartido",
+  "Select Storage": "Seleccionar almacenamiento",
+  "Select Storage Volume": "Seleccionar volumen de almacenamiento",
+  "Select System Type": "Seleccione el tipo de sistema",
+  "Select Unprivileged Container": "Seleccionar contenedor sin privilegios",
+  "Select VM": "Seleccionar máquina virtual",
+  "Select VM to export:": "Seleccione VM para exportar:",
+  "Select Virtual Machine": "Seleccionar máquina virtual",
+  "Select a Custom Logo": "Seleccione un logotipo personalizado",
+  "Select a VirtIO ISO to use:": "Seleccione una ISO de VirtIO para usar:",
+  "Select a category of useful commands:": "Seleccione una categoría de comandos útiles:",
+  "Select a category or search for scripts:": "Seleccione una categoría o busque scripts:",
+  "Select a custom ISO to use:": "Seleccione una ISO personalizada para usar:",
+  "Select a job:": "Seleccione un trabajo:",
+  "Select a network management option:": "Seleccione una opción de administración de red:",
+  "Select a new language for the menu:": "Seleccione un nuevo idioma para el menú:",
+  "Select a post-installation script:": "Seleccione un script posterior a la instalación:",
+  "Select a pre-configured Linux VM script to execute:": "Seleccione un script de VM Linux preconfigurado para ejecutar:",
+  "Select a script or action:": "Seleccione un script o acción:",
+  "Select a share to delete:": "Seleccione un recurso compartido para eliminar:",
+  "Select access mode": "Seleccionar modo de acceso",
+  "Select an existing group": "Seleccione un grupo existente",
+  "Select an existing group:": "Seleccione un grupo existente:",
+  "Select an export to delete:": "Seleccione una exportación para eliminar:",
+  "Select an option": "Seleccione una opción",
+  "Select an option:": "Seleccione una opción:",
+  "Select another source path and try again.": "Seleccione otra ruta de origen e inténtelo de nuevo.",
+  "Select archive": "Seleccionar archivo",
+  "Select archive to restore": "Seleccione el archivo para restaurar",
+  "Select at least one path to continue.": "seleccione al menos una ruta para continuar.",
+  "Select authentication mode:": "Seleccione el modo de autenticación:",
+  "Select authentication type:": "Seleccione el tipo de autenticación:",
+  "Select available Controllers/NVMe to add:": "Seleccione Controladores/NVMe disponibles para agregar:",
+  "Select backup archive": "Seleccionar archivo de copia de seguridad",
+  "Select backup archive to restore": "Seleccione el archivo de copia de seguridad para restaurar",
+  "Select backup backend:": "Seleccione el backend de respaldo:",
+  "Select backup method and profile:": "Seleccione el método de copia de seguridad y el perfil:",
+  "Select backup profile:": "Seleccione el perfil de respaldo:",
+  "Select backup to restore": "seleccione la copia de seguridad para restaurar",
+  "Select backup to restore:": "Seleccione copia de seguridad para restaurar:",
+  "Select bridge for network interface(s):": "Seleccione el puente para las interfaces de red:",
+  "Select container:": "Seleccionar contenedor:",
+  "Select content types for this storage:": "Seleccione tipos de contenido para este almacenamiento:",
+  "Select conversion guide:": "Seleccione la guía de conversión:",
+  "Select conversion option:": "Seleccione la opción de conversión:",
+  "Select destination": "Seleccionar destino",
+  "Select disk interface type:": "Seleccione el tipo de interfaz de disco:",
+  "Select driver version": "Seleccione la versión del controlador",
+  "Select export format:": "Seleccione el formato de exportación:",
+  "Select export permissions:": "Seleccione permisos de exportación:",
+  "Select from /mnt directories": "Seleccionar de los directorios /mnt",
+  "Select from existing folders in /mnt": "Seleccionar entre carpetas existentes en /mnt",
+  "Select from folders inside /mnt": "Seleccionar de carpetas dentro de /mnt",
+  "Select from recent servers": "Seleccionar entre servidores recientes",
+  "Select help topic:": "Seleccione tema de ayuda:",
+  "Select how to provide VirtIO drivers": "Seleccione cómo proporcionar controladores VirtIO",
+  "Select iSCSI Target": "Seleccione el destino iSCSI",
+  "Select local archive format:": "Seleccione el formato de archivo local:",
+  "Select machine type": "Seleccionar tipo de máquina",
+  "Select mount configuration:": "Seleccione la configuración de montaje:",
+  "Select mount options. Open uid/gid/file_mode are always applied so unprivileged LXC bind-mounts can write:": "Seleccione las opciones de montaje. Open uid/gid/file_mode siempre se aplican para que los montajes de enlace LXC sin privilegios puedan escribir:",
+  "Select mount options:": "Seleccione opciones de montaje:",
+  "Select mount point to remove from container": "Seleccione el punto de montaje para eliminar del contenedor",
+  "Select mount point to unmount:": "Seleccione el punto de montaje para desmontar:",
+  "Select network access level:": "Seleccione el nivel de acceso a la red:",
+  "Select one of the ready-to-run Linux VMs:": "Seleccione una de las máquinas virtuales Linux listas para ejecutar:",
+  "Select one or more GPU(s) to switch mode:": "Seleccione una o más GPU para cambiar de modo:",
+  "Select one or more disk images to import:": "Seleccione una o más imágenes de disco para importar:",
+  "Select operation:": "Seleccionar operación:",
+  "Select optimizations to uninstall:": "Seleccione optimizaciones para desinstalar:",
+  "Select option": "Seleccionar opción",
+  "Select option [1-2] (default: 2):": "Seleccione la opción [1-2] (predeterminado: 2):",
+  "Select option [1-3] (default: 3):": "Seleccione la opción [1-3] (predeterminado: 3):",
+  "Select repository destination:": "Seleccione el destino del repositorio:",
+  "Select restore source:": "Seleccione la fuente de restauración:",
+  "Select run mode": "Seleccione el modo de ejecución",
+  "Select share permissions:": "Seleccione permisos para compartir:",
+  "Select storage for imported disk(s):": "Seleccione el almacenamiento para los discos importados:",
+  "Select storage to remove:": "Seleccione el almacenamiento para eliminar:",
+  "Select target IQN:": "Seleccione el IQN objetivo:",
+  "Select target mode for selected GPU(s):": "Seleccione el modo de destino para las GPU seleccionadas:",
+  "Select the CT to manage NFS/Samba client:": "Seleccione el CT para administrar el cliente NFS/Samba:",
+  "Select the CT to which you want to add disks:": "Seleccione el CT al que desea agregar discos:",
+  "Select the GPU to pass through to the VM:": "Seleccione la GPU para pasar a la VM:",
+  "Select the GPU(s) to add to LXC": "Seleccione las GPU para agregar a LXC",
+  "Select the LXC container:": "Seleccione el contenedor LXC:",
+  "Select the Linux distribution to install:": "Seleccione la distribución de Linux para instalar:",
+  "Select the NAS system to install:": "Seleccione el sistema NAS a instalar:",
+  "Select the NVIDIA driver version to install:": "Seleccione la versión del controlador NVIDIA para instalar:",
+  "Select the VM to add the GPU to:": "Seleccione la VM a la que agregar la GPU:",
+  "Select the VM to which you want to add disks:": "Seleccione la VM a la que desea agregar discos:",
+  "Select the VM where you want to import the disk image:": "Seleccione la VM donde desea importar la imagen del disco:",
+  "Select the bus type for the disks:": "Seleccione el tipo de bus para los discos:",
+  "Select the directory containing disk images:": "Seleccione el directorio que contiene las imágenes de disco:",
+  "Select the directory to bind to container:": "Seleccione el directorio para vincular al contenedor:",
+  "Select the disk to add as Proxmox storage:": "Seleccione el disco para agregar como almacenamiento en Proxmox:",
+  "Select the disk to test or inspect:": "Seleccione el disco para probar o inspeccionar:",
+  "Select the disk you want to format:": "Seleccione el disco que desea formatear:",
+  "Select the disks you want to add:": "Seleccione los discos que desea agregar:",
+  "Select the disks you want to import (use spacebar to toggle):": "Seleccione los discos que desea importar (use la barra espaciadora para alternar):",
+  "Select the entry to remove. [pvesm] entries are removed from Proxmox storage; [fstab] entries are unmounted and removed from /etc/fstab.": "Seleccione la entrada para eliminar. Las entradas [pvesm] se eliminan del almacenamiento de Proxmox; Las entradas [fstab] se desmontan y eliminan de /etc/fstab.",
+  "Select the entry to remove. [pvesm] entries are removed from Proxmox storage; [fstab] entries are unmounted, removed from /etc/fstab and have their credentials file deleted.": "Seleccione la entrada para eliminar. Las entradas [pvesm] se eliminan del almacenamiento de Proxmox; Las entradas [fstab] se desmontan, se eliminan de /etc/fstab y se elimina su archivo de credenciales.",
+  "Select the file to import:": "Seleccione el archivo a importar:",
+  "Select the filesystem for": "Seleccione el sistema de archivos para",
+  "Select the folder to mount:": "Seleccione la carpeta a montar:",
+  "Select the interface type for all disks:": "Seleccione el tipo de interfaz para todos los discos:",
+  "Select the interface type for:": "Seleccione el tipo de interfaz para:",
+  "Select the mounted USB to use as backup target:": "seleccione el USB montado para usarlo como destino de respaldo:",
+  "Select the optimizations to update. Each one re-runs its post-install function and registers the new version.": "Seleccione las optimizaciones para actualizar. Cada uno vuelve a ejecutar su función posterior a la instalación y registra la nueva versión.",
+  "Select the parent job to attach to:": "seleccione el trabajo principal al que desea adjuntar:",
+  "Select the paths to restore (one per backup entry):": "seleccione las rutas para restaurar (una por entrada de respaldo):",
+  "Select the privileged LXC container to convert:": "Seleccione el contenedor LXC privilegiado para convertir:",
+  "Select the storage volume for disk import:": "Seleccione el volumen de almacenamiento para la importación de disco:",
+  "Select the sync interval (in hours):": "Seleccione el intervalo de sincronización (en horas):",
+  "Select the target VM for PCI passthrough:": "Seleccione la máquina virtual de destino para la transferencia PCI:",
+  "Select the type of Linux installation:": "Seleccione el tipo de instalación de Linux:",
+  "Select the type of Windows installation:": "Seleccione el tipo de instalación de Windows:",
+  "Select the unprivileged LXC container to convert:": "Seleccione el contenedor LXC sin privilegios para convertir:",
+  "Select utilities to install": "Seleccionar utilidades para instalar",
+  "Select what to do with this disk:": "Seleccione qué hacer con este disco:",
+  "Select where to export VM files (OVA/OVF + temporary workspace):": "Seleccione dónde exportar archivos VM (OVA/OVF + espacio de trabajo temporal):",
+  "Selected GPU function": "Función de GPU seleccionada",
+  "Selected GPU(s)": "GPU seleccionadas",
+  "Selected GPU(s):": "GPU seleccionadas:",
+  "Selected LXC action": "Acción LXC seleccionada",
+  "Selected VM": "Máquina virtual seleccionada",
+  "Selected VM action": "Acción de VM seleccionada",
+  "Selected container": "Contenedor seleccionado",
+  "Selected controller/NVMe is already assigned to other VM(s):": "El controlador/NVMe seleccionado ya está asignado a otras máquinas virtuales:",
+  "Selected device is already assigned to other VM(s):": "El dispositivo seleccionado ya está asignado a otras máquinas virtuales:",
+  "Selected devices": "Dispositivos seleccionados",
+  "Selected optimizations have been uninstalled.": "Se han desinstalado las optimizaciones seleccionadas.",
+  "Selected paths produced no entries to apply.": "Las rutas seleccionadas no generaron entradas para aplicar.",
+  "Selected utilities installation completed": "Instalación de utilidades seleccionadas completada",
+  "Sending backup to Borg repository...": "Enviando copia de seguridad al repositorio Borg...",
+  "Sending backup to PBS...": "Enviando copia de seguridad a PBS...",
+  "Server": "Servidor",
+  "Server (listen for incoming tests on TCP 5201)": "Servidor (escuche las pruebas entrantes en TCP 5201)",
+  "Server IP/hostname is correct": "La IP/nombre de host del servidor es correcta",
+  "Server IP:": "IP del servidor:",
+  "Server is accessible:": "El servidor es accesible:",
+  "Server is online": "El servidor está en línea.",
+  "Server is running": "El servidor está funcionando",
+  "Server response:": "Respuesta del servidor:",
+  "Server stopped. Press Enter to return to menu...": "El servidor se detuvo. Presione Enter para regresar al menú...",
+  "Server will listen on TCP port 5201.": "El servidor escuchará en el puerto TCP 5201.",
+  "Server:": "Servidor:",
+  "Servers": "Servidores",
+  "Service Status": "Estado del servicio",
+  "Service is active and running": "El servicio está activo y funcionando.",
+  "Service is inactive": "El servicio está inactivo.",
+  "Service restarted.": "Servicio reiniciado.",
+  "Service restarts:": "El servicio se reinicia:",
+  "Service stopped.": "El servicio se detuvo.",
+  "Services failed": "Los servicios fallaron",
+  "Services restarted": "Servicios reiniciados",
+  "Services:": "Servicios:",
+  "Set Display > Graphic card (VGA, SPICE or VirtIO) to match the guest": "Configure Pantalla > Tarjeta gráfica (VGA, SPICE o VirtIO) para que coincida con el invitado",
+  "Set Hostname": "Establecer nombre de host",
+  "Set Interface MTU Size (leave blank for default)": "Establecer el tamaño de MTU de la interfaz (dejar en blanco por defecto)",
+  "Set MAC Address (leave empty for automatic)": "Establecer dirección MAC (déjelo vacío para automático)",
+  "Set MTU (leave empty for default)": "Establecer MTU (dejar vacío por defecto)",
+  "Set VLAN (leave empty for none)": "Establecer VLAN (dejar vacío para ninguno)",
+  "Set VM boot order": "Establecer el orden de inicio de la máquina virtual",
+  "Set Virtual Machine ID": "Establecer ID de máquina virtual",
+  "Set a Bridge": "Establecer un puente",
+  "Set a MAC Address": "Establecer una dirección MAC",
+  "Set a Vlan(leave blank for default)": "Configure una Vlan (déjela en blanco por defecto)",
+  "Set network bridge (default: vmbr0)": "Establecer puente de red (predeterminado: vmbr0)",
+  "Set ownership and permissions:": "Establecer propiedad y permisos:",
+  "Set this disk as the primary boot disk?": "¿Configurar este disco como disco de arranque principal?",
+  "Set up custom MOTD banner": "Configurar banner MOTD personalizado",
+  "Set up the apex group and udev rules": "Configurar el grupo apex y las reglas de udev",
+  "Set up time synchronization and entropy generation": "Configurar la sincronización horaria y la generación de entropía.",
+  "Setting APT language configuration...": "Configurando la configuración del idioma APT...",
+  "Setting VM description": "Configuración de la descripción de la máquina virtual",
+  "Setting boot order...": "Configurando el orden de arranque...",
+  "Setting directory ownership and permissions...": "Configurando la propiedad y los permisos del directorio...",
+  "Setting sharedfiles group with UID remapping...": "Configurando el grupo de archivos compartidos con reasignación de UID...",
+  "Setting systemd ulimits...": "Configurando los límites de systemd...",
+  "Setting ulimit for the shell user...": "Configurando ulimit para el usuario de shell...",
+  "Setting up persistent network interfaces": "Configurar interfaces de red persistentes",
+  "Setting up persistent network interfaces successfully.": "Configuración exitosa de interfaces de red persistentes.",
+  "Setting up the Google Coral APT repository...": "Configurando el repositorio Google Coral APT...",
+  "Settings": "Ajustes",
+  "Settings post-install Proxmox": "Configuración post instalación de Proxmox",
+  "Setup Persistent Network Names": "Configurar nombres de red persistentes",
+  "Share Access Error": "Error de acceso al recurso compartido",
+  "Share Name": "Nombre compartido",
+  "Share Options": "Opciones para compartir",
+  "Share added successfully.": "Compartir agregado exitosamente.",
+  "Share deleted and Samba service restarted.": "Compartir eliminado y servicio Samba reiniciado.",
+  "Share exists:": "Compartir existe:",
+  "Share name:": "Nombre compartido:",
+  "Share not found on server:": "Compartir no encontrado en el servidor:",
+  "Share path:": "Compartir ruta:",
+  "Share updated successfully.": "Compartir actualizado con éxito.",
+  "Share:": "Compartir:",
+  "Shared Directory Ready:": "Directorio compartido listo:",
+  "Shared Group": "Grupo compartido",
+  "Shared group: CONFIGURED": "Grupo compartido: CONFIGURADO",
+  "Shared group: sharedfiles (GID:": "Grupo compartido: archivos compartidos (GID:",
+  "Sharedfiles group already exists (GID: 101000)": "El grupo Sharedfiles ya existe (GID: 101000)",
+  "Shares found:": "Acciones encontradas:",
+  "Shell user ulimit set": "Conjunto de ulimit de usuario de Shell",
+  "Short self-test started on": "Autotest breve iniciado el",
+  "Short test            — ~2 minutes, basic surface check": "Prueba corta: ~2 minutos, verificación básica de la superficie",
+  "Should show 'unprivileged: 0' or no unprivileged line": "Debería mostrar 'sin privilegios: 0' o ninguna línea sin privilegios",
+  "Should show 'unprivileged: 1'": "Debería mostrar 'sin privilegios: 1'",
+  "Should show 'unprivileged: 1' if it's unprivileged": "Debería mostrar 'sin privilegios: 1' si no tiene privilegios",
+  "Should show fewer or no issues": "Debería mostrar menos o ningún problema",
+  "Should show pve-manager/9.x.x": "Debería mostrar pve-manager/9.x.x",
+  "Show All Scripts": "Mostrar todos los guiones",
+  "Show CT users in table format": "Mostrar usuarios de CT en formato de tabla",
+  "Show Container Privilege Status": "Mostrar estado de privilegios de contenedor",
+  "Show DNS resolution status": "Mostrar estado de resolución DNS",
+  "Show Ethernet device info": "Mostrar información del dispositivo Ethernet",
+  "Show GPU frequency": "Mostrar frecuencia de GPU",
+  "Show GPU kernel driver in use": "Mostrar el controlador del kernel de GPU en uso",
+  "Show GPU time": "Mostrar tiempo de GPU",
+  "Show Monitor Service Status": "Mostrar estado del servicio del monitor",
+  "Show Network Config File": "Mostrar archivo de configuración de red",
+  "Show Proxmox storage configuration": "Mostrar la configuración de almacenamiento de Proxmox",
+  "Show Proxmox version": "Mostrar versión de Proxmox",
+  "Show Routing Table": "Mostrar tabla de enrutamiento",
+  "Show UUID and filesystem type of block devices": "Mostrar UUID y tipo de sistema de archivos de dispositivos de bloque",
+  "Show VM configuration. Use the correct <vmid>": "Mostrar la configuración de la máquina virtual. Utilice el <vmid> correcto",
+  "Show Version Information": "Mostrar información de versión",
+  "Show ZFS pool status": "Mostrar el estado del grupo ZFS",
+  "Show active firewall rules (iptables)": "Mostrar reglas de firewall activas (iptables)",
+  "Show all active mounts from the kernel": "Mostrar todos los montajes activos del kernel",
+  "Show available Proxmox upgrades": "Mostrar actualizaciones de Proxmox disponibles",
+  "Show configured network bridges": "Mostrar puentes de red configurados",
+  "Show container configuration. Use the correct <ctid>": "Mostrar la configuración del contenedor. Utilice el <ctid> correcto",
+  "Show detailed keyfile info": "Mostrar información detallada del archivo clave",
+  "Show disk usage by mount point": "Mostrar uso del disco por punto de montaje",
+  "Show jobs and last run status": "Mostrar tareas y estado de la última ejecución",
+  "Show listening ports (TCP/UDP)": "Mostrar puertos de escucha (TCP/UDP)",
+  "Show manual repair commands": "Mostrar comandos de reparación manual",
+  "Show me the line to paste manually on the server": "Muéstrame la línea para pegar manualmente en el servidor",
+  "Show mounted storage devices": "Mostrar dispositivos de almacenamiento montados",
+  "Show network interfaces and IPs": "Mostrar interfaces de red e IP",
+  "Show nftables rules": "Mostrar reglas de nftables",
+  "Show raw network configuration": "Mostrar configuración de red sin formato",
+  "Show routing table": "Mostrar tabla de enrutamiento",
+  "Show size of a directory": "Mostrar tamaño de un directorio",
+  "Show standard exclude patterns": "Mostrar patrones de exclusión estándar",
+  "Show status of all storage pools": "Mostrar el estado de todos los grupos de almacenamiento",
+  "Show traffic statistics per interface": "Mostrar estadísticas de tráfico por interfaz",
+  "Show vzdump backup configuration": "Mostrar configuración de copia de seguridad de vzdump",
+  "Shows status and type (nfs/cifs/dir/iscsi...).": "Muestra el estado y el tipo (nfs/cifs/dir/iscsi...).",
+  "Shutdown timeout": "Tiempo de espera de apagado",
+  "Signatures removed. Partition table preserved.": "Firmas eliminadas. Se conserva la tabla de particiones.",
+  "Single GPU Warning": "Advertencia de GPU única",
+  "Single target found — selected automatically:": "Objetivo único encontrado: seleccionado automáticamente:",
+  "Size": "Tamaño",
+  "Size:": "Tamaño:",
+  "Skip downloading additional languages": "Omitir la descarga de idiomas adicionales",
+  "Skip this device": "Saltar este dispositivo",
+  "Skip this step for ZFS/BTRFS": "Omita este paso para ZFS/BTRFS",
+  "Skip this step if using no-subscription repository": "Omita este paso si utiliza un repositorio sin suscripción",
+  "Skip — I will add it as PCIe device": "Saltar: lo agregaré como dispositivo PCIe",
+  "Skip — leave as-is": "Saltar: dejar como está",
+  "Skipped device": "Dispositivo omitido",
+  "Skipped to protect target system (would cascade-remove packages)": "omitido para proteger el sistema de destino (eliminaría paquetes en cascada)",
+  "Skipped, not in apt cache:": "omitido, no en caché apto:",
+  "Skipping LXC": "Saltarse LXC",
+  "Skipping SR-IOV device": "Saltar el dispositivo SR-IOV",
+  "Skipping installation.": "Saltarse la instalación.",
+  "Skipping manual patches — feranick fork already supports this kernel.": "Saltarse parches manuales: feranick fork ya es compatible con este kernel.",
+  "Smart restore plan — hardware compatibility check": "Plan de restauración inteligente: verificación de compatibilidad de hardware",
+  "Snippets          — hook scripts / config": "Fragmentos: scripts de enlace/configuración",
+  "SoC-integrated GPU: tight coupling with other SoC components": "GPU integrada en SoC: estrecho acoplamiento con otros componentes de SoC",
+  "Some changes require a reboot to take effect. Do you want to restart now?": "Algunos cambios requieren un reinicio para que surtan efecto. ¿Quieres reiniciar ahora?",
+  "Some essential Proxmox packages may not have been installed": "Es posible que algunos paquetes esenciales de Proxmox no se hayan instalado",
+  "Some log2ram files may still exist. Manual cleanup may be required.": "Es posible que aún existan algunos archivos log2ram. Es posible que se requiera una limpieza manual.",
+  "Some old time services could not be removed (not installed)": "Algunos servicios antiguos no se pudieron eliminar (no instalar)",
+  "Some operations failed — review messages above. Press Enter to continue...": "Algunas operaciones fallaron: revise los mensajes anteriores. Presione Entrar para continuar...",
+  "Some repairs failed. Please fix manually and re-run the script.": "Algunas reparaciones fallaron. Corrija manualmente y vuelva a ejecutar el script.",
+  "Some repositories are not available, continuing with available ones...": "Algunos repositorios no están disponibles, continuando con los disponibles...",
+  "Some selected GPUs are already configured in this container.": "Algunas GPU seleccionadas ya están configuradas en este contenedor.",
+  "Some signatures could not be removed (see warnings above).": "Algunas firmas no se pudieron eliminar (consulte las advertencias anteriores).",
+  "Something is already mounted at": "Ya hay algo montado en",
+  "Something is already mounted at:": "Ya hay algo montado en:",
+  "Source": "Fuente",
+  "Source VM": "Máquina virtual de origen",
+  "Source patched successfully.": "Fuente parcheada exitosamente.",
+  "Source:": "Fuente:",
+  "Sources copied to": "Fuentes copiadas a",
+  "Spanish": "Español",
+  "Specific host (enter IP)": "Host específico (ingrese IP)",
+  "Specific subnet (enter manually)": "Subred específica (ingresar manualmente)",
+  "Stable (main branch)": "Estable (rama principal)",
+  "Stable monitor service normalized.": "Servicio de monitor estable normalizado.",
+  "Staging directory:": "Directorio de preparación:",
+  "Staging ready.": "Puesta en escena lista.",
+  "Staging source:": "Fuente de puesta en escena:",
+  "Standard NAS   (backup, iso, vztmpl)": "NAS estándar (copia de seguridad, iso, vztmpl)",
+  "Start VM": "Iniciar máquina virtual",
+  "Start VM after creation": "Iniciar VM después de la creación",
+  "Start VM after creation?": "¿Iniciar VM después de la creación?",
+  "Start a container. Use the correct <ctid>": "Inicie un contenedor. Utilice el <ctid> correcto",
+  "Start a virtual machine. Use the correct <vmid>": "Inicie una máquina virtual. Utilice el <vmid> correcto",
+  "Start long self-test (hours)": "Iniciar autotest largo (horas)",
+  "Start long test now?": "¿Iniciar una prueba larga ahora?",
+  "Start on boot already disabled for VM": "Iniciar al arrancar ya está deshabilitado para VM",
+  "Start on boot disabled for LXC": "Inicio al arrancar deshabilitado para LXC",
+  "Start on boot disabled for VM": "Inicio al arrancar deshabilitado para VM",
+  "Start on boot enabled": "Iniciar al arrancar habilitado",
+  "Start on boot enabled (onboot=1)": "Iniciar al arrancar habilitado (onboot=1)",
+  "Start on boot will be disabled on source VM only if currently enabled": "El inicio al arrancar se deshabilitará en la máquina virtual de origen solo si está actualmente habilitado",
+  "Start scrub for a ZFS pool": "Iniciar limpieza para un grupo ZFS",
+  "Start short self-test (~2 min)": "Iniciar una autoprueba breve (~2 min)",
+  "Start terminal multiplexer (recommended):": "Iniciar multiplexor de terminal (recomendado):",
+  "Start the VM": "Inicie la máquina virtual",
+  "Start the VM to begin Windows installation from the mounted ISO.": "Inicie la VM para comenzar la instalación de Windows desde la ISO montada.",
+  "Start the converted container:": "Inicie el contenedor convertido:",
+  "Start the main system upgrade:": "Inicie la actualización principal del sistema:",
+  "Start uploading to PBS — sets a recovery passphrase": "comience a cargar en PBS: establece una frase de contraseña de recuperación",
+  "Starting Borg backup...": "Iniciando copia de seguridad de Borg...",
+  "Starting CT": "TC inicial",
+  "Starting LXC Privileged to Unprivileged conversion process...": "Iniciando el proceso de conversión de LXC privilegiado a no privilegiado...",
+  "Starting LXC Unprivileged to Privileged conversion process...": "Iniciando el proceso de conversión de LXC sin privilegios a privilegiados...",
+  "Starting NVIDIA installer. This may take several minutes...": "Iniciando el instalador de NVIDIA. Esto puede tardar varios minutos...",
+  "Starting NVMe long self-test...": "Iniciando la autoprueba larga de NVMe...",
+  "Starting NVMe short self-test...": "Iniciando autoprueba breve de NVMe...",
+  "Starting ProxMenux update...": "Iniciando actualización de ProxMenux...",
+  "Starting Proxmox storage integration...": "Iniciando la integración del almacenamiento de Proxmox...",
+  "Starting Proxmox system repair...": "Iniciando la reparación del sistema Proxmox...",
+  "Starting SMART long self-test...": "Iniciando la autoprueba larga SMART...",
+  "Starting SMART short self-test...": "Iniciando la autoprueba corta SMART...",
+  "Starting container": "Contenedor inicial",
+  "Starting container...": "Contenedor inicial...",
+  "Starting direct conversion of container": "Iniciar la conversión directa del contenedor",
+  "Starting gateway...": "Iniciando puerta de enlace...",
+  "Starting installation...": "Iniciando instalación...",
+  "Starting installer...": "Iniciando el instalador...",
+  "Starting privileged container...": "Iniciando contenedor privilegiado...",
+  "Starting rpcbind service...": "Iniciando el servicio rpcbind...",
+  "Starting unprivileged container...": "Iniciando contenedor sin privilegios...",
+  "Status": "Estado",
+  "Status:": "Estado:",
+  "Step": "Paso",
+  "Step 2: Testing actual share access with guest...": "Paso 2: Probar el acceso compartido real con los invitados...",
+  "Steps that will run:": "Pasos que se ejecutarán:",
+  "Still has issues": "Todavía tiene problemas",
+  "Stop it first and run this option again.": "Deténgalo primero y ejecute esta opción nuevamente.",
+  "Stop the CT, unmount the disk on the HOST, and remount with:": "Detenga el CT, desmonte el disco en el HOST y vuelva a montarlo con:",
+  "Stop the VM/CT before formatting this disk.": "Detenga el VM/CT antes de formatear este disco.",
+  "Stop the container if it's running:": "Detenga el contenedor si se está ejecutando:",
+  "Stop them first and run this script again.": "Deténgalos primero y ejecute este script nuevamente.",
+  "Stop uploading to PBS": "dejar de subir a PBS",
+  "Stop uploading?": "¿Dejar de subir?",
+  "Stopped": "Interrumpido",
+  "Stopped and disabled": "Detenido y deshabilitado",
+  "Stopping Coral kernel modules...": "Deteniendo los módulos del kernel de Coral...",
+  "Stopping LXC": "Detener LXC",
+  "Stopping NFS services...": "Deteniendo los servicios NFS...",
+  "Stopping ProxMenux Monitor service...": "Deteniendo el servicio ProxMenux Monitor...",
+  "Stopping Samba services...": "Deteniendo los servicios de Samba...",
+  "Stopping VM": "Detener la máquina virtual",
+  "Stopping and disabling NVIDIA services...": "Deteniendo y deshabilitando los servicios de NVIDIA...",
+  "Stopping container": "Contenedor de parada",
+  "Stopping gateway...": "Deteniendo la puerta de enlace...",
+  "Stopping the container before applying configuration...": "Deteniendo el contenedor antes de aplicar la configuración...",
+  "Stopping the container before conversion...": "Deteniendo el contenedor antes de la conversión...",
+  "Storage": "Almacenamiento",
+  "Storage & Share Manager": "Administrador de almacenamiento y recursos compartidos",
+  "Storage Added:": "Almacenamiento agregado:",
+  "Storage Exists": "El almacenamiento existe",
+  "Storage ID": "ID de almacenamiento",
+  "Storage ID already exists. Do you want to remove and recreate it?": "El ID de almacenamiento ya existe. ¿Quieres eliminarlo y recrearlo?",
+  "Storage ID already exists:": "El ID de almacenamiento ya existe:",
+  "Storage ID is available": "El ID de almacenamiento está disponible",
+  "Storage ID:": "ID de almacenamiento:",
+  "Storage and Disks Commands": "Comandos de almacenamiento y discos",
+  "Storage controller: VirtIO SCSI": "Controlador de almacenamiento: VirtIO SCSI",
+  "Storage disk identifier:": "Identificador del disco de almacenamiento:",
+  "Storage is now available in Proxmox web interface under Datacenter > Storage": "El almacenamiento ahora está disponible en la interfaz web de Proxmox en Centro de datos > Almacenamiento",
+  "Storage plan selection cancelled.": "Se canceló la selección del plan de almacenamiento.",
+  "Storage plan selection failed or cancelled": "La selección del plan de almacenamiento falló o se canceló",
+  "Storage:": "Almacenamiento:",
+  "Stored Credentials:": "Credenciales almacenadas:",
+  "Stored credentials:": "Credenciales almacenadas:",
+  "Subnet": "Subred",
+  "Subscription banner removed successfully": "El banner de suscripción se eliminó correctamente",
+  "Subscription banner restored successfully (desktop and mobile)": "El banner de suscripción se restauró correctamente (escritorio y móvil)",
+  "Success": "Éxito",
+  "Successful": "Exitoso",
+  "Supported formats: .img, .qcow2, .vmdk, .raw": "Formatos admitidos: .img, .qcow2, .vmdk, .raw",
+  "Swap partition detected": "Intercambiar partición detectada",
+  "Swappiness configuration created successfully": "Configuración de intercambio creada exitosamente",
+  "Switch GPU Mode  (VM <-> LXC)": "Cambiar el modo GPU (VM <-> LXC)",
+  "Switch Script Not Found": "Script de cambio no encontrado",
+  "Switch to GPU -> LXC (native driver mode)": "Cambie a GPU -> LXC (modo de controlador nativo)",
+  "Switch to GPU -> VM (VFIO passthrough mode)": "Cambie a GPU -> VM (modo de paso VFIO)",
+  "Switches to the free no-subscription repository": "Cambia al repositorio gratuito sin suscripción",
+  "Switching to GPU -> LXC mode removes VFIO exclusivity.": "Cambiar a GPU -> modo LXC elimina la exclusividad de VFIO.",
+  "Switching to GPU -> VM mode requires exclusive VFIO binding.": "Cambiar a GPU -> modo VM requiere un enlace VFIO exclusivo.",
+  "Synchronize time automatically": "Sincronizar la hora automáticamente",
+  "System": "Sistema",
+  "System CLI Tools": "Herramientas CLI del sistema",
+  "System Disk Size (GB)": "Tamaño del disco del sistema (GB)",
+  "System Update Information": "Información de actualización del sistema",
+  "System Utilities Installer": "Instalador de utilidades del sistema",
+  "System disk is SSD or M.2. Proceeding with Log2RAM setup.": "El disco del sistema es SSD o M.2. Continuando con la configuración de Log2RAM.",
+  "System errors and logs": "Errores y registros del sistema",
+  "System group apex already exists.": "El vértice del grupo del sistema ya existe.",
+  "System group apex created.": "Vértice del grupo de sistemas creado.",
+  "System hardening scoring (0-100)": "Puntuación de endurecimiento del sistema (0-100)",
+  "System hostname and kernel info": "Nombre de host del sistema e información del kernel",
+  "System is already up to date": "El sistema ya está actualizado.",
+  "System is already up to date. No update needed.": "El sistema ya está actualizado. No se necesita actualización.",
+  "System limits increase completed.": "Aumento de los límites del sistema completado.",
+  "System limits optimizations removed": "Se eliminaron las optimizaciones de los límites del sistema",
+  "System must be updated to latest PVE 8.4+ before starting": "El sistema debe actualizarse a la última versión de PVE 8.4+ antes de comenzar.",
+  "System reboot required": "Es necesario reiniciar el sistema",
+  "System upgrade completed": "Actualización del sistema completada",
+  "System uptime": "Tiempo de actividad del sistema",
+  "Systemd ulimits set": "Ulimites de Systemd establecidos",
+  "TCP BBR configuration created successfully": "Configuración TCP BBR creada exitosamente",
+  "TCP Fast Open configuration created successfully": "Configuración de TCP Fast Open creada exitosamente",
+  "TCP optimizations configuration completed": "Configuración de optimizaciones TCP completada",
+  "TCP optimizations reverted (defaults restored on next reboot)": "Optimizaciones de TCP revertidas (los valores predeterminados se restauran en el próximo reinicio)",
+  "TCP port 5201 is reachable (firewall on server)": "Se puede acceder al puerto TCP 5201 (firewall en el servidor)",
+  "TPM device added to VM": "Dispositivo TPM agregado a la VM",
+  "TPM storage selection failed or was cancelled. VM creation aborted.": "La selección de almacenamiento de TPM falló o se canceló. Se canceló la creación de la máquina virtual.",
+  "TROUBLESHOOTING:": "SOLUCIÓN DE PROBLEMAS:",
+  "TUI mode": "modo TUI",
+  "TUI mode (requires root)": "Modo TUI (requiere root)",
+  "Target IQN:": "IQN objetivo:",
+  "Target VM": "Máquina virtual de destino",
+  "Target VM validated": "VM de destino validada",
+  "Target channel:": "Canal objetivo:",
+  "Target disk": "Disco de destino",
+  "Target host runs": "Ejecuciones del host de destino",
+  "Target mode": "Modo objetivo",
+  "Target server:": "Servidor de destino:",
+  "Target:": "Objetivo:",
+  "Temporary working directory (if present):": "Directorio de trabajo temporal (si está presente):",
+  "Terminal Multiplexers": "Multiplexores de terminales",
+  "Terminal multiplexer (Ctrl+b then d to detach, or type exit)": "Multiplexor de terminal (Ctrl+b y luego d para desconectar, o escriba exit)",
+  "Test Connectivity": "Prueba de Conectividad",
+  "Test NFS Connectivity": "Probar la conectividad NFS",
+  "Test Samba Connectivity": "Probar la conectividad Samba",
+  "Test iSCSI Connectivity": "Probar la conectividad iSCSI",
+  "Test in progress:": "Prueba en curso:",
+  "Test runs on the drive hardware — safe to close this terminal.": "Ejecuciones de prueba en el hardware de la unidad: es seguro cerrar este terminal.",
+  "Test share visibility:": "Pruebe la visibilidad del recurso compartido:",
+  "Test typically completes in ~2 minutes.": "La prueba normalmente se completa en aproximadamente 2 minutos.",
+  "Testing": "Pruebas",
+  "Testing NFS connection...": "Probando conexión NFS...",
+  "Testing comprehensive guest access to server": "Probando el acceso integral de invitados al servidor",
+  "Testing connectivity to portal...": "Probando la conectividad al portal...",
+  "Testing network connectivity...": "Probando la conectividad de la red...",
+  "Thank you for using ProxMenux. Goodbye!": "Gracias por utilizar ProxMenux. ¡Hasta pronto!",
+  "That VM is currently stopped, so the GPU can be reassigned now.": "Esa VM está actualmente detenida, por lo que la GPU se puede reasignar ahora.",
+  "That doesn't look like an SSH private key. Pick the private key file (no .pub extension, parseable by ssh-keygen).": "Eso no parece una clave privada SSH.Elige el archivo de clave privada (sin extensión .pub, analizable mediante ssh-keygen).",
+  "The GPU has been moved out of VM": "La GPU se ha sacado de la VM",
+  "The GPU is being detached from VM": "La GPU se está desconectando de la VM",
+  "The NVIDIA installer needs at least": "El instalador de NVIDIA necesita al menos",
+  "The URL does not contain the required parameters (id, pack, edition).": "La URL no contiene los parámetros requeridos (id, paquete, edición).",
+  "The VM also has these audio devices assigned via PCI passthrough — typically added together with the GPU. Remove them too?": "La VM también tiene estos dispositivos de audio asignados mediante transferencia PCI, que generalmente se agregan junto con la GPU. ¿Quitarlos también?",
+  "The VM guest will have exclusive access to the GPU.": "El invitado de la VM tendrá acceso exclusivo a la GPU.",
+  "The VM is powered on. Turn it off before adding disks.": "La máquina virtual está encendida. Apáguelo antes de agregar discos.",
+  "The VM/LXC will lose access to this disk after formatting.": "El VM/LXC perderá el acceso a este disco después de formatear.",
+  "The archive could not be extracted.": "No se pudo extraer el archivo.",
+  "The archive destination directory is INSIDE one of the paths you are about to back up. Writing the archive there would copy the backup into itself — producing a corrupted archive, or growing without limit until the disk fills up.": "El directorio de destino del archivo está DENTRO de una de las rutas de las que está a punto de realizar una copia de seguridad.Escribir el archivo allí copiaría la copia de seguridad en sí mismo, lo que produciría un archivo corrupto o crecería sin límite hasta que el disco se llenara.",
+  "The backup metadata was compared against this host. The following items will be SKIPPED to keep the boot safe:": "los metadatos de la copia de seguridad se compararon con este host.Se SALTARÁN los siguientes elementos para mantener el arranque seguro:",
+  "The backup was taken on a different PVE or kernel major.minor. These paths will be SKIPPED to keep the boot safe:": "La copia de seguridad se realizó en un PVE o kernel mayor.menor diferente.Estas rutas se SALTARÁN para mantener el arranque seguro:",
+  "The compatibility check raised failures that may break the system after restore.": "La verificación de compatibilidad generó fallas que pueden dañar el sistema después de la restauración.",
+  "The container is currently stopped. Do you want to start it now to install the package?": "El contenedor se encuentra actualmente detenido. ¿Quieres iniciarlo ahora para instalar el paquete?",
+  "The container should now start as privileged": "El contenedor ahora debería comenzar como privilegiado.",
+  "The container should now start as unprivileged": "El contenedor ahora debería comenzar sin privilegios.",
+  "The current driver will be completely uninstalled before installing the new version. Continue?": "El controlador actual se desinstalará por completo antes de instalar la nueva versión. ¿Continuar?",
+  "The directory does not exist in the CT.": "El directorio no existe en el CT.",
+  "The disk": "el disco",
+  "The file does not exist, is empty or is not readable.": "El archivo no existe, está vacío o no es legible.",
+  "The filesystem": "El sistema de archivos",
+  "The following LXC containers have NVIDIA passthrough configured:": "Los siguientes contenedores LXC tienen configurado el paso a través de NVIDIA:",
+  "The following backup paths are kernel-tied and are excluded from the picker to keep the target's boot safe. The operator's own tuning inside these paths (IOMMU cmdline, VFIO IDs, custom quirks) is merged back automatically via kernel-agnostic merge:": "las siguientes rutas de respaldo están vinculadas al kernel y se excluyen del selector para mantener seguro el arranque del destino.El propio ajuste del operador dentro de estas rutas (línea cmd de IOMMU, ID de VFIO, peculiaridades personalizadas) se fusiona automáticamente mediante una fusión independiente del kernel:",
+  "The following changes will be applied": "Se aplicarán los siguientes cambios.",
+  "The following devices were excluded because they are part of an SR-IOV configuration:": "Se excluyeron los siguientes dispositivos porque forman parte de una configuración SR-IOV:",
+  "The following devices were excluded from Controller/NVMe passthrough because they are part of an SR-IOV configuration:": "Los siguientes dispositivos se excluyeron del paso directo de Controlador/NVMe porque forman parte de una configuración SR-IOV:",
+  "The following entries exist on the host but were NOT in the backup. To make the host EXACTLY match the backup state, they must be removed:": "Las siguientes entradas existen en el host pero NO estaban en la copia de seguridad.Para que el host coincida EXACTAMENTE con el estado de la copia de seguridad, se deben eliminar:",
+  "The following selected GPU(s) are currently in GPU -> VM mode (vfio-pci):": "Las siguientes GPU seleccionadas se encuentran actualmente en modo GPU -> VM (vfio-pci):",
+  "The following selected device(s) are Physical Functions with active Virtual Functions:": "Los siguientes dispositivos seleccionados son funciones físicas con funciones virtuales activas:",
+  "The following selected device(s) are SR-IOV Virtual Functions (VFs):": "Los siguientes dispositivos seleccionados son funciones virtuales (VF) SR-IOV:",
+  "The fstab entry will still be removed; reboot or manual umount needed.": "La entrada fstab seguirá siendo eliminada; Es necesario reiniciar o desmontar manualmente.",
+  "The gateway should appear in your Tailscale admin console shortly.": "La puerta de enlace debería aparecer en su consola de administración de Tailscale en breve.",
+  "The host directory may not be accessible from an unprivileged container.": "Es posible que no se pueda acceder al directorio del host desde un contenedor sin privilegios.",
+  "The installation requires a server restart to apply changes. Do you want to restart now?": "La instalación requiere reiniciar el servidor para aplicar los cambios. ¿Quieres reiniciar ahora?",
+  "The installation/changes require a server restart to apply correctly. Do you want to reboot now?": "La instalación/los cambios requieren un reinicio del servidor para que se apliquen correctamente. ¿Quieres reiniciar ahora?",
+  "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "El sobre local se elimina y las copias de seguridad futuras no cargan nada.Los sobres cargados que ya están en PBS permanecen intactos y recuperables con su frase de contraseña original.",
+  "The long test runs directly on the disk hardware.": "La prueba larga se ejecuta directamente en el hardware del disco.",
+  "The new SSH key was installed and is now authorized on the server.\nKey file:": "La nueva clave SSH se instaló y ahora está autorizada en el servidor.\nArchivo clave:",
+  "The new SSH key was pushed to the LXC via 'pct exec' on": "La nueva clave SSH se envió al LXC a través de 'pct exec' en",
+  "The next visit to the dashboard will show the initial setup wizard.": "La próxima visita al panel mostrará el asistente de configuración inicial.",
+  "The passwords do not match. Please try again.": "Las contraseñas no coinciden. Por favor inténtalo de nuevo.",
+  "The preselected VMID does not exist on this host:": "El VMID preseleccionado no existe en este host:",
+  "The same GPU cannot be used by two VMs at the same time.": "Dos máquinas virtuales no pueden utilizar la misma GPU al mismo tiempo.",
+  "The script clones the osx-proxmox.com repository and once the setup is complete, the server will automatically reboot.": "El script clona el repositorio osx-proxmox.com y una vez que se completa la configuración, el servidor se reiniciará automáticamente.",
+  "The script will continue to restore VM passthrough mode on the host and reuse existing hostpci entries.": "El script continuará restaurando el modo de paso a través de VM en el host y reutilizará las entradas hostpci existentes.",
+  "The script will preconfigure the selected GPU now and finalize hardware binding after reboot.": "El script preconfigurará la GPU seleccionada ahora y finalizará el enlace del hardware después del reinicio.",
+  "The selected AMD GPU does not report FLR reset support": "La GPU AMD seleccionada no informa compatibilidad con el restablecimiento de FLR",
+  "The selected AMD GPU is currently in power state D3cold": "La GPU AMD seleccionada se encuentra actualmente en estado de energía D3cold",
+  "The selected GPU configuration already exists in this container.": "La configuración de GPU seleccionada ya existe en este contenedor.",
+  "The selected GPU has no dedicated .1 audio sibling function.": "La GPU seleccionada no tiene una función hermana de audio .1 dedicada.",
+  "The selected GPU is already assigned to another VM that is currently running:": "La GPU seleccionada ya está asignada a otra VM que se está ejecutando actualmente:",
+  "The selected GPU is already assigned to this VM, but the host is not currently using vfio-pci for this device.": "La GPU seleccionada ya está asignada a esta VM, pero el host no utiliza actualmente vfio-pci para este dispositivo.",
+  "The selected GPU is already assigned to this VM.": "La GPU seleccionada ya está asignada a esta VM.",
+  "The selected GPU is already configured for passthrough to:": "La GPU seleccionada ya está configurada para el paso a:",
+  "The selected GPU is already present in this VM. Select another GPU to continue:": "La GPU seleccionada ya está presente en esta VM. Seleccione otra GPU para continuar:",
+  "The selected GPU is currently used by the following LXC container(s):": "La GPU seleccionada es utilizada actualmente por los siguientes contenedores LXC:",
+  "The selected GPU(s) are configured in these VM(s)": "Las GPU seleccionadas están configuradas en estas VM",
+  "The selected GPU(s) are configured in these VM(s):": "Las GPU seleccionadas se configuran en estas máquinas virtuales:",
+  "The selected GPU(s) are used in these LXC container(s)": "Las GPU seleccionadas se utilizan en estos contenedores LXC",
+  "The selected GPU(s) are used in these LXC container(s):": "Las GPU seleccionadas se utilizan en estos contenedores LXC:",
+  "The selected Intel GPU belongs to Apollo Lake generation and is blocked by policy for VM passthrough due to host instability risk.": "La GPU Intel seleccionada pertenece a la generación Apollo Lake y está bloqueada por la política para el paso de VM debido al riesgo de inestabilidad del host.",
+  "The selected Intel GPU does not expose a PCI reset interface": "La GPU Intel seleccionada no expone una interfaz de reinicio PCI",
+  "The selected Intel GPU has non-FLR reset support and unknown subtype": "La GPU Intel seleccionada tiene soporte de reinicio no FLR y subtipo desconocido",
+  "The selected Intel GPU is currently in power state D3cold": "La GPU Intel seleccionada se encuentra actualmente en estado de energía D3cold",
+  "The selected VM": "La máquina virtual seleccionada",
+  "The selected VM is running.": "La VM seleccionada se está ejecutando.",
+  "The selected base folder does not exist and could not be created:": "La carpeta base seleccionada no existe y no se pudo crear:",
+  "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "El contenedor seleccionado no tiene privilegios. Se requiere un contenedor privilegiado para el paso directo del dispositivo.",
+  "The selected device": "El dispositivo seleccionado",
+  "The selected directory does not exist:": "El directorio seleccionado no existe:",
+  "The selected disk has an active swap partition. Aborting.": "El disco seleccionado tiene una partición de intercambio activa. Abortando.",
+  "The selected disk is currently used by a RUNNING VM or CT. Stop it before formatting.": "El disco seleccionado lo utiliza actualmente una VM o CT EN EJECUCIÓN. Deténgalo antes de formatear.",
+  "The selected disk is now part of the system ZFS pool. Aborting.": "El disco seleccionado ahora forma parte del grupo ZFS del sistema. Abortando.",
+  "The selected disk now contains a system-critical mount. Aborting.": "El disco seleccionado ahora contiene un montaje crítico para el sistema. Abortando.",
+  "The selected path does not exist on this host:": "la ruta seleccionada no existe en este host:",
+  "The selected path is not a valid directory:": "La ruta seleccionada no es un directorio válido:",
+  "The server connected you as guest instead of the specified user.": "El servidor lo conectó como invitado en lugar del usuario especificado.",
+  "The server may not have accessible shares.": "Es posible que el servidor no tenga recursos compartidos accesibles.",
+  "The server may require authentication for actual share access.": "El servidor puede requerir autenticación para el acceso real al recurso compartido.",
+  "The server refused password authentication for": "El servidor rechazó la autenticación de contraseña para",
+  "The server rejected": "El servidor rechazó",
+  "The share already exists in smb.conf:": "El recurso compartido ya existe en smb.conf:",
+  "The source VM also has these audio devices, likely added together with the GPU. Remove them too?": "La máquina virtual de origen también tiene estos dispositivos de audio, probablemente agregados junto con la GPU. ¿Quitarlos también?",
+  "The specified directory does not exist:": "El directorio especificado no existe:",
+  "The storage has been removed and the disk unmounted.": "Se eliminó el almacenamiento y se desmontó el disco.",
+  "The test will continue even if you close this terminal.": "La prueba continuará incluso si cierra esta terminal.",
+  "Then bind-mount to container": "Luego vincule el montaje al contenedor",
+  "Then change the VM display to none (vga: none) when the guest is stable.": "Luego cambie la visualización de la VM a ninguno (vga: ninguno) cuando el invitado esté estable.",
+  "Then change the VM display to none (vga: none) when the system is stable.": "Luego cambie la visualización de VM a ninguno (vga: ninguno) cuando el sistema esté estable.",
+  "Then run this option again:": "Luego ejecute esta opción nuevamente:",
+  "Then update /etc/fstab on the host with the same options.": "Luego actualice /etc/fstab en el host con las mismas opciones.",
+  "These are the changes that will be made": "Estos son los cambios que se harán",
+  "These interface configurations will be removed": "Estas configuraciones de interfaz serán eliminadas.",
+  "These paths will not be restored live and will be extracted for manual recovery.": "Estas rutas no se restaurarán en vivo y se extraerán para su recuperación manual.",
+  "This CIFS share is mounted with restrictive permissions.": "Este recurso compartido CIFS está montado con permisos restrictivos.",
+  "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Esta GPU se considera incompatible con el paso de GPU a una VM en ProxMenux.",
+  "This NFS share is fully restricted — even the host root cannot write to it.": "Este recurso compartido NFS está completamente restringido: ni siquiera la raíz del host puede escribir en él.",
+  "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Esta máquina virtual requiere pasos de instalación adicionales; consulte la guía de instalación en:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
+  "This action will:": "Esta acción:",
+  "This archive does not contain a recognized backup layout.": "Este archivo no contiene un diseño de copia de seguridad reconocido.",
+  "This backup does not contain any restorable paths.": "esta copia de seguridad no contiene rutas restaurables.",
+  "This backup includes /etc/zfs/zpool.cache (host-specific ZFS state).": "esta copia de seguridad incluye /etc/zfs/zpool.cache (estado ZFS específico del host).",
+  "This backup is encrypted.": "esta copia de seguridad está cifrada.",
+  "This backup was taken on kernel": "Esta copia de seguridad se realizó en el kernel",
+  "This container does not have apt-get. NFS client installation only supports Debian/Ubuntu containers.": "Este contenedor no tiene apt-get. La instalación del cliente NFS solo admite contenedores Debian/Ubuntu.",
+  "This container does not have apt-get. Samba client installation only supports Debian/Ubuntu containers.": "Este contenedor no tiene apt-get. La instalación del cliente Samba solo admite contenedores Debian/Ubuntu.",
+  "This container has no GPU configured. Coral TPU works best alongside hardware video decoding (Quick Sync, VA-API, NVENC) for apps like Frigate.": "Este contenedor no tiene GPU configurada. Coral TPU funciona mejor junto con la decodificación de video por hardware (Quick Sync, VA-API, NVENC) para aplicaciones como Frigate.",
+  "This converts all directory UIDs/GIDs by adding 100000": "Esto convierte todos los UID/GID del directorio agregando 100000",
+  "This converts all file UIDs/GIDs by adding 100000": "Esto convierte todos los archivos UID/GID agregando 100000",
+  "This creates a backup in case you need to revert changes": "Esto crea una copia de seguridad en caso de que necesite revertir los cambios.",
+  "This erases existing metadata.": "Esto borra los metadatos existentes.",
+  "This explicitly marks the container as privileged": "Esto marca explícitamente el contenedor como privilegiado.",
+  "This guarantees that device nodes are available before applying LXC GPU config.": "Esto garantiza que los nodos del dispositivo estén disponibles antes de aplicar la configuración de GPU LXC.",
+  "This installation will:": "Esta instalación:",
+  "This installer will:": "Este instalador:",
+  "This interface is configured but doesn't exist physically": "Esta interfaz está configurada pero no existe físicamente.",
+  "This is IRREVERSIBLE.": "Esto es IRREVERSIBLE.",
+  "This is a destructive action": "Esta es una acción destructiva.",
+  "This is a simple configuration change": "Este es un cambio de configuración simple.",
+  "This is an external community script maintained by": "Este es un script externo mantenido por",
+  "This is an external script that creates a macOS VM in Proxmox VE in just a few steps, whether you are using AMD or Intel hardware.": "Este es un script externo que crea una máquina virtual macOS en Proxmox VE en solo unos pocos pasos, ya sea que esté utilizando hardware AMD o Intel.",
+  "This is unexpected since credentials were validated.": "Esto es inesperado ya que se validaron las credenciales.",
+  "This marks the container as unprivileged": "Esto marca el contenedor como sin privilegios.",
+  "This may be normal for a fresh installation": "Esto puede ser normal para una instalación nueva.",
+  "This may take a few seconds...": "Esto puede tardar unos segundos...",
+  "This may take several minutes...": "Esto puede tardar varios minutos...",
+  "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "Esto significa que Proxmox maneja el ciclo de vida del montaje de forma nativa (no se necesita /etc/fstab manual para almacenamientos de host NFS/CIFS).",
+  "This means the credentials are incorrect.": "Esto significa que las credenciales son incorrectas.",
+  "This might indicate network connectivity issues.": "Esto podría indicar problemas de conectividad de red.",
+  "This operation may take several minutes and requires internet connectivity.": "Esta operación puede tardar varios minutos y requiere conexión a Internet.",
+  "This passphrase is the ONLY way to access encrypted Borg backups.": "esta frase de contraseña es la ÚNICA forma de acceder a las copias de seguridad cifradas de Borg.",
+  "This path is already used as a mount point in this container.": "Esta ruta ya se utiliza como punto de montaje en este contenedor.",
+  "This path is not a registered mount point. Use it anyway?": "Esta ruta no es un punto de montaje registrado. ¿Usarlo de todos modos?",
+  "This process changes file ownership inside the container": "Este proceso cambia la propiedad del archivo dentro del contenedor.",
+  "This release channel is already active.": "Este canal de lanzamiento ya está activo.",
+  "This removes the 'unprivileged: 1' line from the config": "Esto elimina la línea 'sin privilegios: 1' de la configuración",
+  "This removes the storage from Proxmox. The iSCSI target is not affected.": "Esto elimina el almacenamiento de Proxmox. El destino iSCSI no se ve afectado.",
+  "This replaces the currently installed keyfile.": "esto reemplaza el archivo de claves instalado actualmente.",
+  "This returns available IQNs.": "Esto devuelve los IQN disponibles.",
+  "This script cannot be executed from the Proxmox web terminal.": "Este script no se puede ejecutar desde la terminal web de Proxmox.",
+  "This script must be run as root.": "Este script debe ejecutarse como root.",
+  "This script must be run on a Proxmox host.": "Este script debe ejecutarse en un host Proxmox.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Este script aplicará las siguientes optimizaciones y ajustes avanzados a su servidor Proxmox VE",
+  "This script will update your Proxmox VE system with advanced options:": "Este script actualizará su sistema Proxmox VE con opciones avanzadas:",
+  "This shows the storage type and disk identifier": "Esto muestra el tipo de almacenamiento y el identificador del disco.",
+  "This state has a high probability of VM startup/reset failures.": "Este estado tiene una alta probabilidad de que se produzcan errores de inicio/reinicio de la máquina virtual.",
+  "This state indicates a high risk of passthrough failure due to": "Este estado indica un alto riesgo de fallo de paso debido a",
+  "This tool is designed for systems with AMD GPUs.": "Esta herramienta está diseñada para sistemas con GPU AMD.",
+  "This tool is designed for systems with Intel GPUs.": "Esta herramienta está diseñada para sistemas con GPU Intel.",
+  "This will RESET the ProxMenux Monitor login credentials on this host:": "Esto RESTABLECERÁ las credenciales de inicio de sesión de ProxMenux Monitor en este host:",
+  "This will add the mount to /etc/fstab so it persists after reboot.": "Esto agregará el montaje a /etc/fstab para que persista después del reinicio.",
+  "This will completely remove Fail2Ban and its configuration. Continue?": "Esto eliminará por completo Fail2Ban y su configuración. ¿Continuar?",
+  "This will completely remove Lynis from the system. Continue?": "Esto eliminará completamente a Lynis del sistema. ¿Continuar?",
+  "This will create a new VM": "Esto creará una nueva máquina virtual.",
+  "This will deploy a Tailscale VPN gateway for secure remote access.": "Esto implementará una puerta de enlace VPN Tailscale para un acceso remoto seguro.",
+  "This will install and configure Fail2Ban with:": "Esto instalará y configurará Fail2Ban con:",
+  "This will install the Beta version from the develop branch and enable beta update checks.\n\nBeta builds may contain bugs or incomplete features.\n\nContinue?": "Esto instalará la versión Beta desde la rama de desarrollo y permitirá las comprobaciones de actualizaciones beta.\n\nLas versiones beta pueden contener errores o funciones incompletas.\n\n¿Continuar?",
+  "This will launch the GPU assistant after VM creation and may require a host reboot.": "Esto iniciará el asistente de GPU después de la creación de la VM y es posible que sea necesario reiniciar el host.",
+  "This will reinstall and reconfigure Fail2Ban with the default ProxMenux settings. Continue?": "Esto reinstalará y reconfigurará Fail2Ban con la configuración predeterminada de ProxMenux. ¿Continuar?",
+  "This will reinstall core Proxmox packages and regenerate certificates": "Esto reinstalará los paquetes principales de Proxmox y regenerará los certificados.",
+  "This will reinstall the Stable version from the main branch and disable beta update checks.\n\nContinue?": "Esto reinstalará la versión estable desde la rama principal y deshabilitará las comprobaciones de actualizaciones beta.\n\n¿Continuar?",
+  "This will remove NVIDIA drivers and related configuration. Do you want to continue?": "Esto eliminará los controladores NVIDIA y la configuración relacionada. ¿Quieres continuar?",
+  "This will remove and reinstall Lynis from the latest GitHub source. Continue?": "Esto eliminará y reinstalará Lynis desde la última fuente de GitHub. ¿Continuar?",
+  "This will remove the Coral TPU drivers (gasket DKMS + libedgetpu) and related configuration. Any LXC container with apex passthrough will lose access to /dev/apex_* after reboot. Continue?": "Esto eliminará los controladores Coral TPU (junta DKMS + libedgetpu) y la configuración relacionada. Cualquier contenedor LXC con acceso apex perderá el acceso a /dev/apex_* después del reinicio. ¿Continuar?",
+  "This will remove the mount from /etc/fstab and delete credentials if present.": "Esto eliminará el montaje de /etc/fstab y eliminará las credenciales si están presentes.",
+  "This will remove the mount from /etc/fstab.": "Esto eliminará el montaje de /etc/fstab.",
+  "This will restart the network service and may cause a brief disconnection. Continue?": "Esto reiniciará el servicio de red y puede provocar una breve desconexión. ¿Continuar?",
+  "This will take time. Answer prompts carefully - see notes below.": "Esto llevará tiempo. Responda las indicaciones con atención; consulte las notas a continuación.",
+  "This will upgrade this node to Proxmox VE 9 on Debian Trixie.": "Esto actualizará este nodo a Proxmox VE 9 en Debian Trixie.",
+  "Tick the paths to include in this backup. Press \"Add custom path\" to add a folder or file of your own to the list.": "marque las rutas que desea incluir en esta copia de seguridad.Presione \"Agregar ruta personalizada\" para agregar una carpeta o archivo propio a la lista.",
+  "Tick the paths to remove (they will not be deleted from disk — only from this list):": "marque las rutas a eliminar (no se eliminarán del disco, solo de esta lista):",
+  "Time settings configured - Timezone:": "Configuración de hora configurada - Zona horaria:",
+  "Time synchronization reset to UTC": "Restablecimiento de la sincronización horaria a UTC",
+  "Tip: Also mount the VirtIO ISO for drivers and guest agent installer": "Consejo: monte también VirtIO ISO para controladores y el instalador del agente invitado",
+  "Tip: You can install the QEMU Guest Agent inside the VM with:": "Consejo: Puede instalar el Agente Invitado QEMU dentro de la VM con:",
+  "Tip: zfs set acltype=posixacl xattr=sa <pool>/<dataset> enables full ACL support.": "Consejo: zfs set acltype=posixacl xattr=sa <pool>/<dataset> habilita la compatibilidad total con ACL.",
+  "To allow LXC write access, change the NFS export on the server to include:": "Para permitir el acceso de escritura a LXC, cambie la exportación NFS en el servidor para incluir:",
+  "To assign VFs to VMs or LXCs, edit the configuration manually via the Proxmox web interface. The Physical Function will remain bound to the native driver.": "Para asignar VF a VM o LXC, edite la configuración manualmente a través de la interfaz web de Proxmox. La Función Física permanecerá ligada al conductor nativo.",
+  "To continue with Add GPU to LXC, first switch the host to GPU -> LXC mode and reboot.": "Para continuar con Agregar GPU a un LXC, primero cambie el host a GPU -> modo LXC y reinicie.",
+  "To copy any of these files verbatim, restore this backup on a host with the same kernel major.minor.": "para copiar cualquiera de estos archivos palabra por palabra, restaure esta copia de seguridad en un host con el mismo kernel mayor.menor.",
+  "To exit iftop, press q": "Para salir de iftop, presione q",
+  "To exit iptraf-ng, press x": "Para salir de iptraf-ng, presione x",
+  "To fix this, do ONE of the following:": "Para solucionar este problema, haga UNO de los siguientes:",
+  "To install host drivers, first remove the GPU from VM passthrough configuration and reboot.": "Para instalar los controladores del host, primero elimine la GPU de la configuración de paso a través de la VM y reinicie.",
+  "To install the monitor, reinstall ProxMenux with the latest version": "Para instalar el monitor, reinstale ProxMenux con la última versión",
+  "To pass SR-IOV Virtual Functions to a VM, edit the VM configuration manually via the Proxmox web interface.": "Para pasar funciones virtuales SR-IOV a una VM, edite la configuración de la VM manualmente a través de la interfaz web de Proxmox.",
+  "To pass SR-IOV Virtual Functions to a container, edit the LXC configuration manually via the Proxmox web interface. The Physical Function will remain bound to the native driver.": "Para pasar funciones virtuales SR-IOV a un contenedor, edite la configuración de LXC manualmente a través de la interfaz web de Proxmox. La Función Física permanecerá ligada al conductor nativo.",
+  "To remove partial VM:": "Para eliminar una máquina virtual parcial:",
+  "To restore": "para restaurar",
+  "To revert changes:": "Para revertir cambios:",
+  "To start the VM:": "Para iniciar la máquina virtual:",
+  "To stop:": "Para parar:",
+  "To use Coral from a regular app, install the libedgetpu runtime via the usual method for your distro (community package or build from source). The simplest path is to run an app container that bundles the runtime — e.g. the Frigate Docker image — passing the device through with": "para usar Coral desde una aplicación normal, instale el tiempo de ejecución libedgetpu mediante el método habitual para su distribución (paquete comunitario o compilación desde el código fuente).La ruta más sencilla es ejecutar un contenedor de aplicaciones que incluya el tiempo de ejecución, p.la imagen de Fragate Docker: pasando el dispositivo con",
+  "To use GPU passthrough, please create a new VM configured with:": "Para utilizar la transferencia de GPU, cree una nueva máquina virtual configurada con:",
+  "To use a custom Fastfetch logo, place your ASCII logo file in:\n\n/usr/local/share/fastfetch/logos/\n\nThe file should not exceed 35 lines to fit properly in the terminal.\n\nPress OK to continue and select your logo.": "Para utilizar un logotipo Fastfetch personalizado, coloque su archivo de logotipo ASCII en:\n\n/usr/local/share/fastfetch/logos/\n\nEl archivo no debe exceder las 35 líneas para que quepa correctamente en la terminal.\n\nPresione OK para continuar y seleccionar su logotipo.",
+  "To use the GPU again in LXC, run Add GPU to LXC from GPUs and Coral-TPU Menu": "Para usar la GPU nuevamente en LXC, ejecute Agregar GPU a LXC desde GPU y Menú Coral-TPU",
+  "To use the VM without issues, the host must be restarted before starting it.": "Para utilizar la VM sin problemas, se debe reiniciar el host antes de iniciarlo.",
+  "To use this share from an LXC, bind-mount it via:": "Para usar este recurso compartido desde un LXC, móntelo mediante enlace:",
+  "Tool exit code:": "Código de salida de la herramienta:",
+  "Tool output:": "Salida de herramienta:",
+  "Top memory processes in CT": "Principales procesos de memoria en CT",
+  "Total": "Total",
+  "Total members:": "Total de miembros:",
+  "Total routes": "Rutas totales",
+  "Total size:": "Tamaño total:",
+  "Translation files:": "Archivos de traducción:",
+  "Tried pvesm path and manual detection methods": "Ruta pvesm probada y métodos de detección manual",
+  "Try Again": "Intentar otra vez",
+  "Try a different search term.": "Pruebe con un término de búsqueda diferente.",
+  "Try accessing": "Intenta acceder",
+  "Try another archive": "Pruebe con otro archivo",
+  "Try automatic repair of detected issues": "Pruebe la reparación automática de los problemas detectados",
+  "Two-factor authentication and backup codes will be removed.": "Se eliminarán la autenticación de dos factores y los códigos de respaldo.",
+  "Type": "Tipo",
+  "Type the device path EXACTLY to confirm formatting:": "escriba la ruta del dispositivo EXACTAMENTE para confirmar el formato:",
+  "Type the full disk path to confirm": "Escriba la ruta completa del disco para confirmar",
+  "Type:": "Tipo:",
+  "Type: attached to PVE storage": "Tipo: adjunto al almacenamiento PVE",
+  "Typed value does not match selected disk. Operation cancelled.": "El valor escrito no coincide con el disco seleccionado. Operación cancelada.",
+  "UID in CT": "UID en TC",
+  "UPGRADE PROMPTS - RECOMMENDED ANSWERS:": "INDICACIONES DE ACTUALIZACIÓN - RESPUESTAS RECOMENDADAS:",
+  "USB Accelerators:": "Aceleradores USB:",
+  "USB disk target": "destino de disco USB",
+  "USB drives mounted now:": "unidades USB montadas ahora:",
+  "USB libedgetpu1": "USB libedgetpu1",
+  "UUP Dump script not found.": "No se encontró el script de volcado UUP.",
+  "UUp Dump ISO creator Custom": "UUp Dump Creador de ISO Personalizado",
+  "Udev rules for Coral USB devices added and rules reloaded.": "Se agregaron reglas de Udev para dispositivos Coral USB y se recargaron reglas.",
+  "Udev rules for Coral USB devices already exist.": "Las reglas de Udev para dispositivos Coral USB ya existen.",
+  "Udev rules for Coral USB devices appended and rules reloaded.": "Se agregaron reglas de Udev para dispositivos Coral USB y se recargaron reglas.",
+  "Umbrel OS installer script by Helper Scripts\n\nVisit the GitHub repo to learn more, contribute, or support the project:\n\nhttps://community-scripts.github.io/ProxmoxVE/scripts?id=umbrel-os-vm": "Script de instalación del sistema operativo Umbrel de Helper Scripts\n\nVisite el repositorio de GitHub para obtener más información, contribuir o apoyar el proyecto:\n\nhttps://community-scripts.github.io/ProxmoxVE/scripts?id=umbrel-os-vm",
+  "Unable to detect Proxmox version.": "No se puede detectar la versión de Proxmox.",
+  "Understand the security implications of privileged containers": "Comprender las implicaciones de seguridad de los contenedores privilegiados",
+  "Uninstall Coral drivers and configuration": "Desinstalar los controladores y la configuración de Coral",
+  "Uninstall Fail2Ban": "Desinstalar Fail2Ban",
+  "Uninstall Lynis": "Desinstalar Lynis",
+  "Uninstall NFS Server": "Desinstalar el servidor NFS",
+  "Uninstall NVIDIA drivers and configuration": "Desinstalar los controladores y la configuración de NVIDIA",
+  "Uninstall Optimizations": "Desinstalar optimizaciones Post-Install",
+  "Uninstall ProxMenux": "Desinstalar ProxMenux",
+  "Uninstall Samba Server": "Desinstalar el servidor Samba",
+  "Uninstall optimizations": "Desinstalar optimizaciones Post-Install",
+  "Uninstallation Summary:": "Resumen de desinstalación:",
+  "Uninstallation completed. Press Enter to continue...": "Desinstalación completada. Presione Entrar para continuar...",
+  "Uninstalling Ceph...": "Desinstalando Ceph...",
+  "Uninstalling Fastfetch...": "Desinstalando Fastfetch...",
+  "Uninstalling Figurine...": "Desinstalando Figurine...",
+  "Uninstalling amdgpu_top...": "Desinstalando amdgpu_top...",
+  "Uninstalling current NVIDIA driver before installing new version": "Desinstalar el controlador NVIDIA actual antes de instalar una nueva versión",
+  "Uninstalling intel-gpu-tools...": "Desinstalando intel-gpu-tools...",
+  "Uninstalling kexec-tools and removing custom service...": "Desinstalando kexec-tools y eliminando el servicio personalizado...",
+  "Uninstalling log2ram (all versions)...": "Desinstalando log2ram (todas las versiones)...",
+  "Universal Group Configuration:": "Configuración de grupo universal:",
+  "Universal Group:": "Grupo Universal:",
+  "Universal NFS server has been completely uninstalled!": "¡El servidor NFS universal se ha desinstalado por completo!",
+  "Universal compatibility: ENABLED": "Compatibilidad universal: HABILITADA",
+  "Universal group: NOT CONFIGURED": "Grupo universal: NO CONFIGURADO",
+  "Universal sharedfiles group configured with": "Grupo universal de archivos compartidos configurado con",
+  "Unknown": "Desconocido",
+  "Unknown CPU type. IOMMU might not be properly enabled.": "Tipo de CPU desconocido. Es posible que IOMMU no esté habilitado correctamente.",
+  "Unknown CPU vendor. Cannot determine IOMMU parameter.": "Proveedor de CPU desconocido. No se puede determinar el parámetro IOMMU.",
+  "Unknown GPU": "GPU desconocida",
+  "Unknown model": "Modelo desconocido",
+  "Unknown size": "Tamaño desconocido",
+  "Unknown storage controller": "Controlador de almacenamiento desconocido",
+  "Unmount NFS Share": "Desmontar recurso compartido NFS",
+  "Unmount Samba Share": "Desmontar Samba Compartir",
+  "Unmount USB drive": "Desmontar la unidad USB",
+  "Unmount a USB drive": "Desmontar una unidad USB",
+  "Unmount and cleanup (LVM only):": "Desmontar y limpiar (solo LVM):",
+  "Unmount failed": "Error al desmontar",
+  "Unmount it before proceeding. The script will verify this at execution.": "Desmontarlo antes de continuar. El script verificará esto durante la ejecución.",
+  "Unmounted": "Desmontado",
+  "Unmounted successfully": "Desmontado exitosamente",
+  "Unmounted:": "Desmontado:",
+  "Unmounting": "Desmontaje",
+  "Unmounting disk...": "Desmontando disco...",
+  "Unprivileged": "Sin privilegios",
+  "Unprivileged Container Access": "Acceso a contenedores sin privilegios",
+  "Unprivileged container": "Contenedor sin privilegios",
+  "Unprivileged container selected:": "Contenedor sin privilegios seleccionado:",
+  "Unprivileged container — UID offset:": "Contenedor sin privilegios: compensación de UID:",
+  "Unprivileged containers map their UIDs to high host UIDs (e.g. 100000+), which appear as 'others' on the host filesystem.": "Los contenedores sin privilegios asignan sus UID a UID de host altos (por ejemplo, 100000+), que aparecen como \"otros\" en el sistema de archivos del host.",
+  "Unprivileged: Limited access (more secure)": "Sin privilegios: acceso limitado (más seguro)",
+  "Unreachable": "Inalcanzable",
+  "Unsupported Terminal": "Terminal no compatible",
+  "Unsupported format. Only .ova and .ovf files are supported.": "Formato no compatible. Sólo se admiten archivos .ova y .ovf.",
+  "Unsupported output format:": "Formato de salida no admitido:",
+  "Update Available": "Actualización disponible",
+  "Update Ceph repository (Only if using Ceph):": "Actualice el repositorio de Ceph (solo si usa Ceph):",
+  "Update Debian repositories to Trixie:": "Actualice los repositorios de Debian a Trixie:",
+  "Update Export": "Actualizar Exportación",
+  "Update Lynis to latest version": "Actualice Lynis a la última versión",
+  "Update NVIDIA in LXC Containers": "Actualizar NVIDIA en contenedores LXC",
+  "Update PVE enterprise repository (Only if using enterprise):": "Actualice el repositorio empresarial PVE (solo si usa Enterprise):",
+  "Update Proxmox VE Appliance Manager": "Actualizar Proxmox VE Appliance Manager",
+  "Update Proxmox package lists": "Actualizar las listas de paquetes de Proxmox",
+  "Update Share": "Actualizar Compartir",
+  "Update Status": "Estado de actualización",
+  "Update and upgrade all system packages": "Actualizar y actualizar todos los paquetes del sistema.",
+  "Update and upgrade system": "Actualizar el sistema",
+  "Update cancelled by user": "Actualización cancelada por el usuario",
+  "Update completed. Press Enter to continue...": "Actualización completada. Presione Entrar para continuar...",
+  "Update kernel to compatible version": "Actualizar el kernel a una versión compatible",
+  "Update package index:": "Actualizar índice del paquete:",
+  "Update system to latest PVE 8.4+ (if not done already):": "Actualice el sistema a la última versión de PVE 8.4+ (si aún no lo ha hecho):",
+  "Updated": "Actualizado",
+  "Updated sharedfiles group to GID: 101000": "Grupo de archivos compartidos actualizado a GID: 101000",
+  "Updates all Proxmox and Debian packages": "Actualiza todos los paquetes de Proxmox y Debian.",
+  "Updates and Packages Commands": "Comandos de actualizaciones y paquetes",
+  "Updates file is empty or unreadable.": "El archivo de actualizaciones está vacío o es ilegible.",
+  "Updating APT package lists...": "Actualizando listas de paquetes APT...",
+  "Updating Debian Bookworm → Trixie in sources.list...": "Actualizando Debian Bookworm → Trixie en fuentes.list...",
+  "Updating Figurine binary...": "Actualizando el binario de Figurine...",
+  "Updating Lynis to the latest version...": "Actualizando Lynis a la última versión...",
+  "Updating PVE application manager...": "Actualizando el administrador de aplicaciones PVE...",
+  "Updating amdgpu_top...": "Actualizando amdgpu_top...",
+  "Updating cluster certificates...": "Actualizando certificados de clúster...",
+  "Updating initramfs (this may take a minute)...": "Actualizando initramfs (esto puede tardar un minuto)...",
+  "Updating initramfs for all kernels...": "Actualizando initramfs para todos los kernels...",
+  "Updating initramfs, GRUB, and EFI boot, patience...": "Actualizando initramfs, GRUB y arranque EFI, paciencia...",
+  "Updating journald to store info-level messages...": "Actualizando el diario para almacenar mensajes a nivel de información...",
+  "Updating kernel panic configuration...": "Actualizando la configuración de pánico del kernel...",
+  "Updating package lists...": "Actualizando listas de paquetes...",
+  "Updating pve-enterprise.list (if present) to Trixie...": "Actualizando pve-enterprise.list (si está presente) a Trixie...",
+  "Updating release channel configuration...": "Actualizando la configuración del canal de lanzamiento...",
+  "Upgrade Ceph to compatible version": "Actualice Ceph a una versión compatible",
+  "Upgrade PVE 8 to PVE 9": "Actualiza PVE 8 a PVE 9",
+  "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Asistente de actualización: Proxmox VE 8 → 9 (Trixie)",
+  "Upgrade canceled by user": "Actualización cancelada por el usuario",
+  "Upgrade one node at a time": "Actualice un nodo a la vez",
+  "Upgrade to Proxmox VE 9": "Actualice a Proxmox VE 9",
+  "Upgrading NVIDIA utils (Arch)...": "Actualizando las utilidades de NVIDIA (Arch)...",
+  "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "¿Cargar una copia cifrada de la clave a PBS para poder recuperarla en un host reinstalado con solo una frase de contraseña?",
+  "Upload key to PBS?": "¿Subir clave a PBS?",
+  "Upload to PBS disabled.": "Subir a PBS deshabilitado.",
+  "Upload to PBS enabled. The envelope is uploaded on every encrypted backup.": "Subir a PBS habilitado.El sobre se carga en cada copia de seguridad cifrada.",
+  "Upload to PBS is currently: no. Pick an action:": "Subir a PBS es actualmente: no.Elige una acción:",
+  "Upload to PBS is currently: yes. Pick an action:": "Subir a PBS actualmente es: sí.Elige una acción:",
+  "Upload to PBS: enable, disable or rotate the recovery passphrase": "cargar en PBS: habilitar, deshabilitar o rotar la frase de contraseña de recuperación",
+  "Uptime and who is logged in": "Tiempo de actividad y quién ha iniciado sesión",
+  "Use \"Check test progress\" to see results.": "Utilice \"Verificar el progreso de la prueba\" para ver los resultados.",
+  "Use 'Export to file' to save it and inspect manually.": "Utilice 'Exportar a archivo' para guardarlo e inspeccionarlo manualmente.",
+  "Use 'pct restore' / 'qmrestore' to recover their disks from your VM backups.": "utilice 'pct restaurar' / 'qmrestore' para recuperar sus discos de las copias de seguridad de su VM.",
+  "Use Custom backup and uncheck the conflicting path from the list": "use una copia de seguridad personalizada y desmarque la ruta conflictiva de la lista",
+  "Use Default Settings?": "¿Usar configuración predeterminada?",
+  "Use Download first if you want to save a copy of the current key. Continue?": "use Descargar primero si desea guardar una copia de la clave actual.¿Continuar?",
+  "Use SPACE to select, ENTER to confirm": "Utilice ESPACIO para seleccionar, ENTRAR para confirmar",
+  "Use SPACE to select/deselect, ENTER to confirm": "Utilice ESPACIO para seleccionar/deseleccionar, ENTER para confirmar",
+  "Use SSH or terminal access (SSH recommended)": "Utilice SSH o acceso a terminal (se recomienda SSH)",
+  "Use a USB disk": "use un disco USB",
+  "Use a custom path": "usar una ruta personalizada",
+  "Use a privileged LXC for NFS server/client workflows.": "Utilice un LXC privilegiado para flujos de trabajo de servidor/cliente NFS.",
+  "Use a privileged LXC for Samba client/server workflows.": "Utilice un LXC privilegiado para flujos de trabajo de cliente/servidor Samba.",
+  "Use an existing SSH private key file on this host": "use un archivo de clave privada SSH existente en este host",
+  "Use an existing keyfile": "usar un archivo de claves existente",
+  "Use as-is — keep data and filesystem": "Úselo tal cual: mantenga los datos y el sistema de archivos",
+  "Use content types according to your use case.": "Utilice tipos de contenido según su caso de uso.",
+  "Use default": "usar predeterminado",
+  "Use default (Yes)": "Usar predeterminado (Sí)",
+  "Use default group:": "Usar grupo predeterminado:",
+  "Use enterprise URL if you have subscription.": "Utilice la URL empresarial si tiene una suscripción.",
+  "Use existing VirtIO ISO from storage": "Utilice VirtIO ISO existente desde el almacenamiento",
+  "Use existing filesystem": "Usar el sistema de archivos existente",
+  "Use existing: mount without formatting": "Usar existente: montar sin formatear",
+  "Use images only if the directory is on suitable storage.": "Utilice imágenes sólo si el directorio está en un almacenamiento adecuado.",
+  "Use mp1/mp2/... for extra mount points.": "Utilice mp1/mp2/... para puntos de montaje adicionales.",
+  "Use only when unprivileged containers cannot meet your needs": "Úselo solo cuando los contenedores sin privilegios no puedan satisfacer sus necesidades.",
+  "Use option 1 to add a local disk (as Proxmox storage and/or as a host mount).": "Utilice la opción 1 para agregar un disco local (como almacenamiento y/o como montaje de host).",
+  "Use option 1 to add an iSCSI target as Proxmox storage.": "Utilice la opción 1 para agregar un destino iSCSI como almacenamiento.",
+  "Use pigz for faster gzip compression": "Usar pigz para comprimir gzip más rápido",
+  "Use the Guided Cleanup option to fix issues safely": "Utilice la opción Limpieza guiada para solucionar problemas de forma segura",
+  "Use the Guided Repair option to fix issues safely": "Utilice la opción Reparación guiada para solucionar problemas de forma segura",
+  "Use these commands on your Proxmox host to access an LXC container's terminal:": "Utilice estos comandos en su host Proxmox para acceder a la terminal de un contenedor LXC:",
+  "Use tmux or screen to avoid interruptions": "Utilice tmux o screen para evitar interrupciones",
+  "Use:": "Usar:",
+  "Useful System Commands": "Comandos útiles del sistema",
+  "Useful to verify options/content after script execution.": "Útil para verificar opciones/contenido después de la ejecución del script.",
+  "User": "Usuario",
+  "User account exists on server": "La cuenta de usuario existe en el servidor.",
+  "User activity and uptime": "Actividad del usuario y tiempo de actividad",
+  "User chose not to remove NetworkManager": "El usuario decidió no eliminar NetworkManager",
+  "User chose to exit for manual backup creation.": "El usuario eligió salir para la creación manual de la copia de seguridad.",
+  "Username": "Nombre de usuario",
+  "Username (e.g. root@pam or user@pbs!token):": "Nombre de usuario (por ejemplo, root@pam o usuario@pbs!token):",
+  "Username and password": "Nombre de usuario y contraseña",
+  "Username and password will be cleared.": "Se borrarán el nombre de usuario y la contraseña.",
+  "Username cannot be empty.": "El nombre de usuario no puede estar vacío.",
+  "Username is correct": "El nombre de usuario es correcto",
+  "Username on the Borg server that runs \"borg serve\" (typically \"borg\"). This is NOT the admin/root user of the server — that one is asked later only if you choose \"Generate a new key and authorize it\".": "nombre de usuario en el servidor Borg que ejecuta \"borg server\" (normalmente \"borg\").Este NO es el usuario administrador/root del servidor; ese se solicita más tarde solo si elige \"Generar una nueva clave y autorizarla\".",
+  "Username:": "Nombre de usuario:",
+  "Users:": "Usuarios:",
+  "Using UUID is recommended over /dev/sdX.": "Se recomienda usar UUID en lugar de /dev/sdX.",
+  "Using advanced configuration": "Usando configuración avanzada",
+  "Using default Proxmox logo...": "Usando el logotipo predeterminado de Proxmox...",
+  "Using existing encryption key:": "Usando la clave de cifrado existente:",
+  "Utilities Installation Menu": "Menú de instalación de utilidades",
+  "Utilities Menu": "Menú de utilidades",
+  "Utilities Verification": "Verificación de servicios públicos",
+  "Utilities and Tools": "Utilidades y herramientas",
+  "Utilities installation completed": "Instalación de servicios públicos completada",
+  "VFIO device IDs removed from /etc/modprobe.d/vfio.conf": "ID de dispositivos VFIO eliminados de /etc/modprobe.d/vfio.conf",
+  "VFIO modules configured in /etc/modules": "Módulos VFIO configurados en /etc/modules",
+  "VFIO modules configured.": "Módulos VFIO configurados.",
+  "VFIO modules in /etc/modules": "Módulos VFIO en /etc/modules",
+  "VFIO modules removed from /etc/modules": "Módulos VFIO eliminados de /etc/modules",
+  "VFIO orphans cleared and initramfs rebuilt — next boot will free the GPU.": "VFIO huérfano eliminado e initramfs reconstruido; el próximo arranque liberará la GPU.",
+  "VFIO orphans cleared but initramfs rebuild failed; check /var/log/proxmenux logs.": "Los huérfanos de VFIO se borraron pero la reconstrucción de initramfs falló;verifique los registros de /var/log/proxmenux.",
+  "VLAN": "VLAN",
+  "VM": "máquina virtual",
+  "VM Conflict Policy": "Política de conflictos de máquinas virtuales",
+  "VM ID": "ID de máquina virtual",
+  "VM ID:": "ID de máquina virtual:",
+  "VM Must Be Stopped": "La máquina virtual debe detenerse",
+  "VM Name": "Nombre de la máquina virtual",
+  "VM Storage     (images, backup)": "Almacenamiento de VM (imágenes, respaldo)",
+  "VM and CT Management Commands": "Comandos de gestión de VM y CT",
+  "VM creation cancelled before disk planning.": "La creación de VM se canceló antes de la planificación del disco.",
+  "VM creation cancelled by user.": "Creación de VM cancelada por el usuario.",
+  "VM creation completed": "Creación de VM completada",
+  "VM creation completed with GPU passthrough configured.": "La creación de VM se completó con el paso a través de GPU configurado.",
+  "VM creation completed. GPU passthrough was not applied.": "Se completó la creación de la máquina virtual. No se aplicó la transferencia de GPU.",
+  "VM creation completed. GPU passthrough was skipped (no compatible GPU detected).": "Se completó la creación de la máquina virtual. Se omitió el paso de GPU (no se detectó ninguna GPU compatible).",
+  "VM creation failed or was cancelled during storage setup.": "La creación de la máquina virtual falló o se canceló durante la configuración del almacenamiento.",
+  "VM description configured": "Descripción de VM configurada",
+  "VM imported successfully": "VM importada exitosamente",
+  "VM is running": "La máquina virtual se está ejecutando",
+  "VM is still running. Export cancelled.": "La máquina virtual todavía está ejecutándose. Exportación cancelada.",
+  "VM passthrough configuration failed. Review the log and VM config.": "Error en la configuración de paso a través de VM. Revise el registro y la configuración de la VM.",
+  "VM passthrough requires exclusive VFIO binding of the GPU.": "El paso de VM requiere un enlace VFIO exclusivo de la GPU.",
+  "VM removed:": "VM eliminada:",
+  "VM selected:": "Máquina virtual seleccionada:",
+  "VM shell created:": "Shell de VM creado:",
+  "VM started": "VM iniciada",
+  "VM stopped": "VM detenida",
+  "VM:": "Máquina virtual:",
+  "VMID in use": "VMID en uso",
+  "VMID must be a number.": "VMID debe ser un número.",
+  "VMID of the Borg server LXC on": "VMID del servidor Borg LXC en",
+  "VMs to destroy:": "VM para destruir:",
+  "VMs, LXCs, network, /etc/pve, users, cron, packages, drivers, ProxMenux state, etc.": "VM, LXC, red, /etc/pve, usuarios, cron, paquetes, controladores, estado de ProxMenux, etc.",
+  "Valid backups for all VMs/CTs": "Copias de seguridad válidas para todas las VM/CT",
+  "Validating Proxmox 9 repositories (checking 'proxmox-ve' candidate)...": "Validando repositorios de Proxmox 9 (marcando el candidato 'proxmox-ve')...",
+  "Validating credentials with server": "Validar credenciales con el servidor",
+  "Validating disk safety...": "Validando la seguridad del disco...",
+  "Verbose pool status": "Estado detallado del grupo",
+  "Verification": "Verificación",
+  "Verify IOMMU group for PCI device": "Verificar el grupo IOMMU para el dispositivo PCI",
+  "Verify Options > OS Type — currently set to:": "Verificar opciones > Tipo de sistema operativo: actualmente configurado en:",
+  "Verify PVE version (must be 8.4.1 or newer):": "Verifique la versión de PVE (debe ser 8.4.1 o más reciente):",
+  "Verify active exports:": "Verificar exportaciones activas:",
+  "Verify bridge assignment and NIC model — change to VirtIO if guest drivers are available": "Verifique la asignación del puente y el modelo de NIC: cambie a VirtIO si hay controladores invitados disponibles",
+  "Verify iSCSI sessions and storage status:": "Verifique las sesiones iSCSI y el estado del almacenamiento:",
+  "Verify inside container:": "Verificar el interior del contenedor:",
+  "Verify installations": "Verificar instalaciones",
+  "Verify mount:": "Verificar montaje:",
+  "Verify the conversion:": "Verifique la conversión:",
+  "Verify the credentials. Switching to manual paste mode so you can finish the setup without re-typing the password.": "Verifique las credenciales.Cambiar al modo de pegado manual para que pueda finalizar la configuración sin volver a escribir la contraseña.",
+  "Verifying Ceph installation...": "Verificando la instalación de Ceph...",
+  "Verifying Ceph packages availability...": "Verificando la disponibilidad de los paquetes de Ceph...",
+  "Verifying all utilities status": "Verificar el estado de todos los servicios públicos",
+  "Verifying disk accessibility in CT": "Verificación de la accesibilidad del disco en CT",
+  "Version": "Versión",
+  "Version Change Detected": "Cambio de versión detectado",
+  "Version info not available": "Información de versión no disponible",
+  "Version:": "Versión:",
+  "Version: Auto-negotiation (NFSv3/NFSv4)": "Versión: negociación automática (NFSv3/NFSv4)",
+  "Versions shown are compatible with your kernel. Latest available is recommended in most cases.": "Las versiones mostradas son compatibles con su kernel. En la mayoría de los casos se recomienda la última versión disponible.",
+  "View CIFS Mounts (pvesm + fstab)": "Ver montajes CIFS (pvesm + fstab)",
+  "View Current Exports": "Ver exportaciones actuales",
+  "View Current Mounts": "Ver montajes actuales",
+  "View Current Shares": "Ver acciones actuales",
+  "View Disk Storages": "Ver almacenamientos en disco",
+  "View Mount Points": "Ver puntos de montaje",
+  "View NFS Mounts (pvesm + fstab)": "Ver montajes NFS (pvesm + fstab)",
+  "View backup metadata": "Ver metadatos de respaldo",
+  "View current paths": "Ver rutas actuales",
+  "View existing folders in /mnt": "Ver carpetas existentes en /mnt",
+  "View iSCSI Storages": "Ver almacenamientos iSCSI",
+  "View raw CT configuration file": "Ver archivo de configuración CT sin formato",
+  "View raw VM configuration file": "Ver el archivo de configuración de VM sin formato",
+  "View restore plan": "Ver plan de restauración",
+  "View self-test log": "Ver registro de autoprueba",
+  "VirtIO (advanced - high performance)": "VirtIO (avanzado - alto rendimiento)",
+  "VirtIO ISO not found after selection.": "VirtIO ISO no encontrado después de la selección.",
+  "VirtIO ISO selection cancelled.": "Selección VirtIO ISO cancelada.",
+  "VirtIO driver ISO downloaded successfully.": "La ISO del controlador VirtIO se descargó correctamente.",
+  "Virtual Disks Created:": "Discos virtuales creados:",
+  "Virtual Function": "Función Virtual",
+  "Virtual Function (parent PF:": "Función virtual (PF principal:",
+  "Virtual Machine ID": "ID de máquina virtual",
+  "Virtual disk": "disco virtual",
+  "Virtual disks": "Discos virtuales",
+  "Virtual display already set to": "Pantalla virtual ya configurada en",
+  "Virtual display changed from": "La pantalla virtual cambió de",
+  "Virtual display normalized to vga: std (compatibility)": "Pantalla virtual normalizada a vga: std (compatibilidad)",
+  "Virtual display set to": "Pantalla virtual configurada en",
+  "Virtual interface (normal)": "Interfaz virtual (normal)",
+  "Virtualization": "Virtualización",
+  "Visit https://osx-proxmox.com for more information.": "Visite https://osx-proxmox.com para obtener más información.",
+  "Visit the website to discover more scripts, stay updated with the latest updates, and support the project:": "Visite el sitio web para descubrir más scripts, mantenerse actualizado con las últimas actualizaciones y respaldar el proyecto:",
+  "Visit the website to discover more scripts, stay updated with the latest updates, and support the project:\n\nhttps://community-scripts.github.io/ProxmoxVE": "Visite el sitio web para descubrir más scripts, mantenerse actualizado con las últimas actualizaciones y respaldar el proyecto:\n\nhttps://community-scripts.github.io/ProxmoxVE",
+  "Vulnerability detection": "Detección de vulnerabilidades",
+  "WARNING": "ADVERTENCIA",
+  "WARNING — This backup contains paths that are risky to restore on a running system:": "ADVERTENCIA: esta copia de seguridad contiene rutas cuya restauración es riesgosa en un sistema en ejecución:",
+  "WARNING — You selected risky paths for live restore:": "ADVERTENCIA: Seleccionó rutas riesgosas para la restauración en vivo:",
+  "WARNING: All data on selected disk will be ERASED if formatted.": "ADVERTENCIA: Todos los datos del disco seleccionado se BORRARÁN si se formatea.",
+  "WARNING: The NFS server is not affected. The mount directory contents are NOT deleted (data stays on the server).": "ADVERTENCIA: El servidor NFS no se ve afectado. El contenido del directorio de montaje NO se elimina (los datos permanecen en el servidor).",
+  "WARNING: The Samba server is not affected. The mount directory contents are NOT deleted.": "ADVERTENCIA: El servidor Samba no se ve afectado. El contenido del directorio de montaje NO se elimina.",
+  "WARNING: The selected directory is not empty!": "ADVERTENCIA: ¡El directorio seleccionado no está vacío!",
+  "WARNING: This disk has a mounted partition.": "ADVERTENCIA: Este disco tiene una partición montada.",
+  "WARNING: This disk is also assigned to:": "ADVERTENCIA: Este disco también está asignado a:",
+  "WARNING: This disk is referenced in a stopped VM/LXC config.": "ADVERTENCIA: Se hace referencia a este disco en una configuración de VM/LXC detenida.",
+  "WARNING: This is a single GPU system": "ADVERTENCIA: Este es un sistema de GPU única",
+  "WARNING: This may cause a brief disconnection.": "ADVERTENCIA: Esto puede provocar una breve desconexión.",
+  "WARNING: This removes the storage from Proxmox. The NFS server is not affected.": "ADVERTENCIA: Esto elimina el almacenamiento de Proxmox. El servidor NFS no se ve afectado.",
+  "WARNING: This removes the storage from Proxmox. The Samba server is not affected.": "ADVERTENCIA: Esto elimina el almacenamiento de Proxmox. El servidor Samba no se ve afectado.",
+  "WARNING: This will ERASE all data on this disk.": "ADVERTENCIA: Esto BORRARÁ todos los datos de este disco.",
+  "WARNING: This will FORMAT the disk": "ADVERTENCIA: Esto formateará el disco.",
+  "WARNING: This will completely remove NFS server from the CT.": "ADVERTENCIA: Esto eliminará completamente el servidor NFS del CT.",
+  "WARNING: This will completely remove Samba server from the CT.": "ADVERTENCIA: Esto eliminará completamente el servidor Samba del CT.",
+  "WARNING: You are about to remove this Proxmox storage:": "ADVERTENCIA: Está a punto de eliminar este almacenamiento de Proxmox:",
+  "WARNING: You are about to remove this disk mount:": "ADVERTENCIA: Está a punto de quitar este soporte de disco:",
+  "WARNING: this will ERASE EVERYTHING on the disk.": "ADVERTENCIA: esto BORRARÁ TODO lo que hay en el disco.",
+  "WILL BE PERMANENTLY ERASED.": "SE BORRARÁN PERMANENTEMENTE.",
+  "Wait for each node to complete before starting next": "Espere a que se complete cada nodo antes de comenzar el siguiente",
+  "Warning": "Advertencia",
+  "Warning: Auth key should start with 'tskey-'": "Advertencia: la clave de autenticación debe comenzar con 'tskey-'",
+  "Warning: Disk Images on CIFS": "Advertencia: imágenes de disco en CIFS",
+  "Warning: Limited PCI Reset Support": "Advertencia: soporte limitado para reinicio de PCI",
+  "Warning: both VMs have autostart enabled (onboot=1).": "Advertencia: ambas máquinas virtuales tienen el inicio automático habilitado (onboot=1).",
+  "Warnings": "Advertencias",
+  "Website": "Sitio web",
+  "What do you want to do?": "¿Qué es lo que quieres hacer?",
+  "What would you like to do?": "¿Qué te gustaría hacer?",
+  "When asked to select a disk, click Load Driver and load the VirtIO drivers.": "Cuando se le solicite seleccionar un disco, haga clic en Cargar controlador y cargue los controladores VirtIO.",
+  "When this GPU is passed through to a VM, the Proxmox host will lose all video output on the physical monitor.": "Cuando esta GPU pasa a una VM, el host Proxmox perderá toda la salida de video en el monitor físico.",
+  "Where are the backup archives stored?": "¿Dónde se almacenan los archivos de respaldo?",
+  "Where do you want the host folder?": "¿Dónde quieres la carpeta host?",
+  "Where do you want to mount inside container?": "¿Dónde desea montar dentro del contenedor?",
+  "Where do you want to mount the NFS export?": "¿Dónde desea montar la exportación NFS?",
+  "Where do you want to mount the Samba share?": "¿Dónde quieres montar el recurso compartido Samba?",
+  "Where is the OVA/OVF file located?": "¿Dónde se encuentra el archivo OVA/OVF?",
+  "Where to mount inside container?": "¿Dónde montarlo dentro del contenedor?",
+  "While the server allows guest listing, no shares are actually accessible without authentication.": "Si bien el servidor permite la lista de invitados, en realidad no se puede acceder a ningún recurso compartido sin autenticación.",
+  "Will be configured now": "Se configurará ahora",
+  "Windows Installation Options": "Opciones de instalación de Windows",
+  "Windows path:": "Ruta de Windows:",
+  "Wipe all          — erase partitions + metadata": "Limpiar todo: borrar particiones + metadatos",
+  "Wipe all — remove partitions + metadata": "Limpiar todo: eliminar particiones + metadatos",
+  "Wipe old signatures and partition table (DESTRUCTIVE):": "Limpiar firmas antiguas y tabla de particiones (DESTRUCTIVO):",
+  "Wiping existing partition table...": "Limpiando la tabla de particiones existente...",
+  "Wiping partitions and metadata...": "Limpiando particiones y metadatos...",
+  "Wired NICs in backup missing on target:": "Faltan NIC cableadas en la copia de seguridad en el objetivo:",
+  "With warnings": "Con advertencias",
+  "Without Function Level Reset (FLR), passthrough is not considered reliable": "Sin reinicio del nivel de función (FLR), el paso a través no se considera confiable",
+  "Without a usable reset path, passthrough reliability is poor and VM": "Sin una ruta de reinicio utilizable, la confiabilidad del paso a través es pobre y la VM",
+  "Working directory:": "Directorio de trabajo:",
+  "Works with LVM, ZFS, and BTRFS storage types": "Funciona con tipos de almacenamiento LVM, ZFS y BTRFS",
+  "Would you like to continue in passthrough-only mode? The libedgetpu APT install will be skipped, the Coral device will still be visible inside the container (e.g. /dev/apex_0), and you can install the runtime yourself or use an app container that bundles it (e.g. the Frigate Docker image).": "¿Le gustaría continuar en modo de solo paso?Se omitirá la instalación de libedgetpu APT, el dispositivo Coral seguirá siendo visible dentro del contenedor (por ejemplo, /dev/apex_0) y podrá instalar el tiempo de ejecución usted mismo o usar un contenedor de aplicaciones que lo incluya (por ejemplo, la imagen de Frigate Docker).",
+  "Would you like to see the current": "¿Quieres ver la actualidad?",
+  "Write access confirmed for user:": "Acceso de escritura confirmado para el usuario:",
+  "Write access confirmed.": "Acceso de escritura confirmado.",
+  "Write access test FAILED for user:": "La prueba de acceso de escritura FALLÓ para el usuario:",
+  "Write access verified for user:": "Acceso de escritura verificado para el usuario:",
+  "Wrong passphrase": "frase de contraseña incorrecta",
+  "Yes": "Sí",
+  "Yes, upload": "Sí, subir",
+  "Yes: set a recovery passphrase now; the encrypted key envelope is uploaded with every backup.": "Sí: establezca una contraseña de recuperación ahora;el sobre de la clave cifrada se carga con cada copia de seguridad.",
+  "You are connected via SSH and selected network-related restore paths.": "Está conectado a través de SSH y rutas de restauración relacionadas con la red seleccionadas.",
+  "You can add it manually through:": "Puedes agregarlo manualmente a través de:",
+  "You can add servers manually.": "Puede agregar servidores manualmente.",
+  "You can enter the export path manually.": "Puede ingresar la ruta de exportación manualmente.",
+  "You can enter the share name manually.": "Puede ingresar el nombre del recurso compartido manualmente.",
+  "You can now monitor your AMD GPU using:": "Ahora puedes monitorear tu GPU AMD usando:",
+  "You can now monitor your Intel GPU using:": "Ahora puedes monitorear tu GPU Intel usando:",
+  "You can now select Controller/NVMe devices in Storage Plan.": "Ahora puede seleccionar dispositivos Controlador/NVMe en el Plan de almacenamiento.",
+  "You can reboot later manually with: reboot": "Puedes reiniciar más tarde manualmente con: reiniciar",
+  "You can reboot later manually.": "Puede reiniciar más tarde manualmente.",
+  "You can restore it anytime with": "Puedes restaurarlo en cualquier momento con",
+  "You can restore the backup with": "Puede restaurar la copia de seguridad con",
+  "You can run a security audit with:": "Puede ejecutar una auditoría de seguridad con:",
+  "You can still install amdgpu_top if needed.": "Aún puedes instalar amdgpu_top si es necesario.",
+  "You can still install intel-gpu-tools if needed.": "Aún puede instalar intel-gpu-tools si es necesario.",
+  "You can still mount this share for READ-ONLY access.": "Aún puedes montar este recurso compartido para acceso de SÓLO LECTURA.",
+  "You can use the following credentials to login to the Nextcloud vm:": "Puede utilizar las siguientes credenciales para iniciar sesión en la máquina virtual de Nextcloud:",
+  "You haven't added any custom paths yet.": "aún no has agregado ninguna ruta personalizada.",
+  "You may need to run 'pveceph install' manually": "Es posible que tengas que ejecutar 'pveceph install' manualmente",
+  "You must select a logo to continue.": "Debes seleccionar un logotipo para continuar.",
+  "You must select at least one mount method to continue.": "Debe seleccionar al menos un método de montaje para continuar.",
+  "You need to use username and password authentication.": "Debe utilizar la autenticación de nombre de usuario y contraseña.",
+  "You selected 'Disk image' content on a CIFS/SMB storage.": "Seleccionó el contenido de 'Imagen de disco' en un almacenamiento CIFS/SMB.",
+  "You should now be able to access the Proxmox web interface.": "Ahora debería poder acceder a la interfaz web de Proxmox.",
+  "You will need a Tailscale auth key from: https://login.tailscale.com/admin/settings/keys": "Necesitará una clave de autenticación de Tailscale de: https://login.tailscale.com/admin/settings/keys",
+  "ZFS ARC config removed (kernel defaults will apply on reboot)": "Se eliminó la configuración de ZFS ARC (los valores predeterminados del kernel se aplicarán al reiniciar)",
+  "ZFS ARC configuration file created/updated successfully": "Archivo de configuración ZFS ARC creado/actualizado correctamente",
+  "ZFS ARC configuration is up to date": "La configuración de ZFS ARC está actualizada",
+  "ZFS ARC optimization completed": "Optimización ZFS ARC completada",
+  "ZFS Management Commands": "Comandos de gestión ZFS",
+  "ZFS Pool Name": "Nombre del grupo ZFS",
+  "ZFS auto-snapshot installation and configuration completed": "Instalación y configuración de instantánea automática de ZFS completadas",
+  "ZFS autotrim already enabled for pool:": "Autotrim ZFS ya habilitado para el grupo:",
+  "ZFS autotrim disabled for pool:": "Autotrim ZFS deshabilitado para el grupo:",
+  "ZFS autotrim enabled for pool:": "Autotrim ZFS habilitado para el grupo:",
+  "ZFS autotrim is not supported for pool:": "El recorte automático de ZFS no es compatible con el grupo:",
+  "ZFS autotrim setup completed": "Configuración de ajuste automático de ZFS completada",
+  "ZFS command history": "Historial de comandos ZFS",
+  "ZFS configuration": "Configuración ZFS",
+  "ZFS member detected": "Miembro ZFS detectado",
+  "ZFS not detected. Nothing to disable.": "ZFS no detectado. Nada que desactivar.",
+  "ZFS not detected. Skipping ZFS ARC optimization.": "ZFS no detectado. Saltándose la optimización ZFS ARC.",
+  "ZFS not detected. Skipping ZFS autotrim.": "ZFS no detectado. Saltarse el recorte automático de ZFS.",
+  "ZFS pool": "grupo ZFS",
+  "ZFS pool created": "Grupo ZFS creado",
+  "ZFS pool created and mounted at": "Grupo ZFS creado y montado en",
+  "ZFS pool exported:": "Grupo ZFS exportado:",
+  "ZFS pool is not available after creation:": "El grupo ZFS no está disponible después de la creación:",
+  "ZFS pool not found:": "Grupo ZFS no encontrado:",
+  "ZFS pool:": "Grupo ZFS:",
+  "ZFS storage added successfully to Proxmox!": "¡Almacenamiento ZFS agregado exitosamente a Proxmox!",
+  "ZFS tools not found. Install zfsutils-linux and retry.": "No se encontraron herramientas ZFS. Instale zfsutils-linux y vuelva a intentarlo.",
+  "ZFS:": "ZFS:",
+  "Zero all data     — partition table preserved, data wiped": "Cero todos los datos: tabla de particiones preservada, datos borrados",
+  "Zero all data — partition table preserved": "Cero todos los datos: se conserva la tabla de particiones",
+  "Zeroing partition": "Partición de puesta a cero",
+  "active VF(s)": "FV activas",
+  "active VFs": "FV activas",
+  "active Virtual Functions. Changing its driver binding would destroy every VF.": "Funciones virtuales activas. Cambiar la vinculación del controlador destruiría todos los VF.",
+  "after copy; source tree is incomplete.": "después de la copia; El árbol fuente está incompleto.",
+  "after update.": "después de la actualización.",
+  "all_squash,anonuid=65534,anongid=65534": "all_squash,anonuid=65534,anongid=65534",
+  "amdgpu_top installed successfully": "amdgpu_top instalado correctamente",
+  "amdgpu_top is already installed:": "amdgpu_top ya está instalado:",
+  "amdgpu_top is not installed": "amdgpu_top no está instalado",
+  "amdgpu_top is up to date": "amdgpu_top está actualizado",
+  "amdgpu_top uninstalled successfully": "amdgpu_top se desinstaló exitosamente",
+  "amdgpu_top updated to": "amdgpu_top actualizado a",
+  "and": "y",
+  "and could not be unmounted — disk may be busy.": "y no se pudo desmontar; es posible que el disco esté ocupado.",
+  "and upgrade the system (disables the enterprise repo)": "y actualizar el sistema (deshabilita el repositorio empresarial)",
+  "apex device node not found yet; a reboot may be required.": "el nodo del dispositivo Apex aún no se ha encontrado; Es posible que sea necesario reiniciar.",
+  "apex group and udev rules are in place.": "Las reglas del grupo Apex y de udev están vigentes.",
+  "apex group removed.": "grupo ápice eliminado.",
+  "apex group still has members; left in place:": "el grupo principal todavía tiene miembros; dejado en su lugar:",
+  "apex kernel module not loaded on host. Run \"Install Coral on Host\" first or the container will not see /dev/apex_0.": "El módulo del kernel de Apex no está cargado en el host. Primero ejecute \"Instalar Coral en el host\" o el contenedor no verá /dev/apex_0.",
+  "appears to be part of a": "parece ser parte de un",
+  "applying minimal banner patch": "aplicando un parche de banner mínimo",
+  "apt cache refreshed.": "caché apto actualizado.",
+  "apt-get exited": "apt-salir",
+  "apt-get update returned warnings. Continuing anyway; check": "apt-get update devolvió advertencias. Continuando de todos modos; controlar",
+  "as": "como",
+  "automatically. Install it manually inside the container.": "automáticamente. Instálelo manualmente dentro del contenedor.",
+  "automatically. Reboot LXC to fully release.": "automáticamente. Reinicie LXC para liberarlo por completo.",
+  "available for LXC bind-mounts via 'LXC Mount Manager'": "disponible para montajes de enlace LXC a través de 'LXC Mount Manager'",
+  "available in this same GPU and TPU menu.": "disponible en este mismo menú de GPU y TPU.",
+  "backup at /etc/fstab.proxmenux.bak": "copia de seguridad en /etc/fstab.proxmenux.bak",
+  "ban": "prohibición",
+  "blocking issue(s).": "problema(s) de bloqueo.",
+  "btrfs — Proxmox dir storage (snapshots, compression)": "btrfs: almacenamiento de directorios de Proxmox (instantáneas, compresión)",
+  "btrfs — snapshots and compression": "btrfs: instantáneas y compresión",
+  "but it does not match the one used to create the backup. Replace it with the correct keyfile from the source host and retry.": "pero no coincide con el utilizado para crear la copia de seguridad.Reemplácelo con el archivo de claves correcto del host de origen y vuelva a intentarlo.",
+  "bytes": "bytes",
+  "can write to": "puede escribir a",
+  "chmod 1777 + setfacl o::rwx (applied on the NFS share from this host)": "chmod 1777 + setfacl o::rwx (aplicado en el recurso compartido NFS de este host)",
+  "chmod failed — NFS server may be restricting changes from root": "chmod falló: el servidor NFS puede estar restringiendo los cambios desde la raíz",
+  "chown/chmod failed — likely unprivileged CT against host bind mount. Falling back to ACL.": "chown/chmod falló: probablemente CT sin privilegios contra el montaje de enlace del host. Regresando a ACL.",
+  "content:": "contenido:",
+  "custom path(s) saved.": "rutas personalizadas guardadas.",
+  "default": "por defecto",
+  "delete the credentials file (if any)": "eliminar el archivo de credenciales (si corresponde)",
+  "delete the matching line from /etc/fstab": "elimine la línea coincidente de /etc/fstab",
+  "descriptor + VMDK files": "descriptor + archivos VMDK",
+  "device(s) added to VM": "Dispositivo(s) agregado(s) a la VM",
+  "devices": "dispositivos",
+  "did not become ready. Skipping.": "no estuvo listo. Salto a la comba.",
+  "disk(s) added to CT": "disco(s) agregado(s) a CT",
+  "disk(s) added to VM": "discos agregados a la VM",
+  "dkms.conf generated.": "dkms.conf generado.",
+  "does not exist on this host. Path not added.": "no existe en este host.Ruta no agregada.",
+  "does not exist. Exiting.": "no existe. Saliendo.",
+  "driver:": "conductor:",
+  "exFAT (portable: Windows/Linux/macOS)": "exFAT (portátil: Windows/Linux/macOS)",
+  "exFAT tools installed successfully.": "Herramientas exFAT instaladas correctamente.",
+  "ext4  — Proxmox dir storage (recommended)": "ext4 — Almacenamiento de directorios de Proxmox (recomendado)",
+  "ext4  — recommended, most compatible": "ext4: recomendado, más compatible",
+  "fail2ban-client could not communicate with the server": "El cliente fail2ban no pudo comunicarse con el servidor.",
+  "fail2ban-client successfully communicated with the server": "El cliente fail2ban se comunicó exitosamente con el servidor.",
+  "failed:": "fallido:",
+  "feranick fork unreachable. Falling back to google/gasket-driver...": "horquilla feranick inalcanzable. Volviendo a google/gasket-driver...",
+  "feranick/gasket-driver cloned (actively maintained, kernel 6.12+ ready).": "feranick/gasket-driver clonado (mantenido activamente, kernel 6.12+ listo).",
+  "file?": "¿archivo?",
+  "files": "archivos",
+  "files/folders": "archivos/carpetas",
+  "filesystem. Skipping format.": "sistema de archivos. Saltar formato.",
+  "filesystem...": "sistema de archivos...",
+  "for better performance and stability": "para un mejor rendimiento y estabilidad",
+  "for next boot (needs reboot to take effect)": "para el próximo arranque (es necesario reiniciar para que surta efecto)",
+  "for this policy and may fail after first use or on subsequent VM starts.": "para esta política y puede fallar después del primer uso o en inicios posteriores de la máquina virtual.",
+  "formatted as": "formateado como",
+  "found": "encontró",
+  "from Proxmox web interface (you will be asked)": "desde la interfaz web de Proxmox (se le preguntará)",
+  "from container": "del contenedor",
+  "from the GPUs and Coral-TPU menu first, then run this option again.": "Primero desde el menú GPU y Coral-TPU, luego ejecute esta opción nuevamente.",
+  "fstab entry exists": "la entrada fstab existe",
+  "fstab line:": "línea fstab:",
+  "fstab references UUIDs/devices not present on this host:": "fstab hace referencia a UUID/dispositivos que no están presentes en este host:",
+  "gasket DKMS entries removed.": "Se quitaron las entradas DKMS de la junta.",
+  "gawk installed": "gawk instalado",
+  "google/gasket-driver cloned (fallback — will apply local patches).": "google/gasket-driver clonado (respaldo: aplicará parches locales).",
+  "gpg not found; trying apt-key fallback": "gpg no encontrado; probando el respaldo de clave apta",
+  "gzip replaced with pigz wrapper successfully": "gzip reemplazado con el contenedor pigz exitosamente",
+  "has": "tiene",
+  "has a different MAC than the backup — update any DHCP static reservation": "tiene una MAC diferente a la de la copia de seguridad: actualice cualquier reserva estática de DHCP",
+  "has a new MAC": "tiene una nueva MAC",
+  "has only": "solo tiene",
+  "host fstab only (not registered as Proxmox storage)": "host fstab solamente (no registrado como almacenamiento en Proxmox)",
+  "hostpci entries for all IOMMU group devices": "entradas hostpci para todos los dispositivos del grupo IOMMU",
+  "hostpci entries for selected GPU functions (full IOMMU group will be enforced after reboot)": "Entradas de hostpci para funciones de GPU seleccionadas (el grupo IOMMU completo se aplicará después del reinicio)",
+  "hour(s)": "horas)",
+  "iSCSI Content Type": "Tipo de contenido iSCSI",
+  "iSCSI Daemon (iscsid): RUNNING": "Demonio iSCSI (iscsid): EN EJECUCIÓN",
+  "iSCSI Daemon (iscsid): STOPPED": "Demonio iSCSI (iscsid): DETENIDO",
+  "iSCSI Host Manager - Proxmox Host": "Administrador de host iSCSI - Host Proxmox",
+  "iSCSI Initiator: AVAILABLE": "Iniciador iSCSI: DISPONIBLE",
+  "iSCSI Initiator: NOT INSTALLED": "Iniciador iSCSI: NO INSTALADO",
+  "iSCSI Portal": "Portal iSCSI",
+  "iSCSI Storages in Proxmox": "Almacenamientos iSCSI en Proxmox",
+  "iSCSI Storages:": "Almacenamientos iSCSI:",
+  "iSCSI discovery failed": "Falló el descubrimiento de iSCSI",
+  "iSCSI port": "puerto iSCSI",
+  "iSCSI service is running on the target": "El servicio iSCSI se está ejecutando en el objetivo.",
+  "iSCSI storage added successfully to Proxmox!": "¡Almacenamiento iSCSI agregado exitosamente a Proxmox!",
+  "iSCSI storage provides raw block devices for VM disk images.": "El almacenamiento iSCSI proporciona dispositivos de bloques sin formato para imágenes de disco de VM.",
+  "iSCSI tools installed": "Herramientas iSCSI instaladas",
+  "iftop usage": "uso de iftop",
+  "imported:": "importado:",
+  "in CT": "en TC",
+  "initramfs updated": "initramfs actualizado",
+  "initramfs updated.": "initramfs actualizado.",
+  "installed but command not immediately available": "instalado pero el comando no está disponible inmediatamente",
+  "installed correctly and available": "instalado correctamente y disponible",
+  "installed in CT": "instalado en TC",
+  "installed inside CT": "instalado dentro de CT",
+  "installed successfully.": "instalado exitosamente.",
+  "intel-gpu-tools installed successfully": "Intel-gpu-tools instalado correctamente",
+  "intel-gpu-tools is already installed:": "Intel-gpu-tools ya está instalado:",
+  "intel-gpu-tools is up to date": "Intel-gpu-tools está actualizado",
+  "intel-gpu-tools uninstalled successfully": "Intel-gpu-tools se desinstaló exitosamente",
+  "intel-gpu-tools updated to": "Intel-gpu-tools actualizado a",
+  "intel_iommu/amd_iommu is set in cmdline but no IOMMU groups exist — IOMMU appears disabled in BIOS. Enable VT-d / AMD-Vi in firmware before continuing.": "intel_iommu/amd_iommu está configurado en cmdline pero no existen grupos IOMMU; IOMMU aparece deshabilitado en BIOS. Habilite VT-d/AMD-Vi en el firmware antes de continuar.",
+  "interfaces": "interfaces",
+  "into an LXC.": "en un LXC.",
+  "iperf3 - Bandwidth test": "iperf3 - Prueba de ancho de banda",
+  "iperf3 - Bandwidth test (Client mode)": "iperf3 - Prueba de ancho de banda (modo cliente)",
+  "iperf3 - Bandwidth test (Server mode)": "iperf3 - Prueba de ancho de banda (modo servidor)",
+  "iperf3 client": "cliente iperf3",
+  "iperf3 client output": "salida del cliente iperf3",
+  "iperf3 server": "servidor iperf3",
+  "iperf3 server is running on": "El servidor iperf3 se está ejecutando.",
+  "iperf3 server output": "salida del servidor iperf3",
+  "iperf3 test failed": "La prueba iperf3 falló",
+  "iptraf-ng usage": "uso de iptraf-ng",
+  "is UNPRIVILEGED.": "NO ES PRIVILEGIADO.",
+  "is a Physical Function with": "es una función física con",
+  "is already assigned to the following VM(s) or CT(s):": "ya está asignado a las siguientes VM o CT:",
+  "is already installed. Do you want to reinstall it? This will perform a clean uninstall first.": "ya está instalado. ¿Quieres reinstalarlo? Esto realizará primero una desinstalación limpia.",
+  "is already unprivileged.": "ya no tiene privilegios.",
+  "is an SR-IOV Virtual Function (VF). Its parent Physical Function is": "es una función virtual SR-IOV (VF). Su función física principal es",
+  "is in use by running VM": "está en uso ejecutando VM",
+  "is in use by the following running VM(s) or CT(s):": "está en uso por las siguientes VM o CT en ejecución:",
+  "is mounted at": "está montado en",
+  "is not configured as machine type q35.": "no está configurado como tipo de máquina q35.",
+  "is not in the patch.sh supported list. The patch may no-op or fail; review keylase/nvidia-patch README before continuing.": "no está en la lista compatible con patch.sh. Es posible que el parche no funcione o falle; revise el archivo README de keylase/nvidia-patch antes de continuar.",
+  "is not supported by the official Google libedgetpu APT repository.": "no es compatible con el repositorio oficial de Google libedgetpu APT.",
+  "is referenced in the following stopped VM(s)/CT(s):": "se hace referencia en las siguientes VM/CT detenidas:",
+  "journald MaxLevelStore is adequate for auth logging": "journald MaxLevelStore es adecuado para el registro de autenticación",
+  "journald drop-in created: /etc/systemd/journald.conf.d/proxmenux-loglevel.conf": "drop-in de diario creado: /etc/systemd/journald.conf.d/proxmenux-loglevel.conf",
+  "journald log level restored": "nivel de registro diario restaurado",
+  "journald restarted - auth messages will now be stored": "Journald reiniciado: los mensajes de autenticación ahora se almacenarán",
+  "jq is required for this operation but is not installed.": "Se requiere jq para esta operación pero no está instalado.",
+  "jq is required to apply updates from this menu.": "Se requiere jq para aplicar actualizaciones desde este menú.",
+  "jq not available — skipping rollback execution": "jq no disponible: omitir la ejecución de reversión",
+  "keep-daily (0 disables)": "mantener diario (0 deshabilitados)",
+  "keep-hourly (0 disables)": "mantener cada hora (0 inhabilitaciones)",
+  "keep-last (0 disables)": "mantener último (0 desactiva)",
+  "keep-monthly (0 disables)": "mantener mensualmente (0 deshabilitados)",
+  "keep-weekly (0 disables)": "mantener semanal (0 inhabilitaciones)",
+  "keep-yearly (0 disables)": "mantener anual (0 inhabilitaciones)",
+  "keeping current settings": "manteniendo la configuración actual",
+  "kexec configured successfully. Use the command: reboot-quick": "kexec configurado correctamente. Utilice el comando: reinicio rápido",
+  "kexec-pve service enabled": "servicio kexec-pve habilitado",
+  "kexec-pve service file created": "archivo de servicio kexec-pve creado",
+  "kexec-tools and related settings removed": "Se eliminaron kexec-tools y configuraciones relacionadas",
+  "kexec-tools installed successfully": "kexec-tools instalado correctamente",
+  "kexec-tools is not installed or already removed.": "kexec-tools no está instalado o ya se ha eliminado.",
+  "log2ram completely removed from system": "log2ram completamente eliminado del sistema",
+  "manually inside the container before starting it.": "manualmente dentro del contenedor antes de ponerlo en marcha.",
+  "manually inside the container.": "manualmente dentro del contenedor.",
+  "maximum performance": "máximo rendimiento",
+  "may be closed — trying discovery anyway...": "puede estar cerrado; intentando el descubrimiento de todos modos...",
+  "missing": "desaparecido",
+  "mkfs.btrfs not found. Install btrfs-progs and retry.": "mkfs.btrfs no encontrado. Instale btrfs-progs y vuelva a intentarlo.",
+  "more": "más",
+  "mount.cifs command not found after installation.": "El comando mount.cifs no se encuentra después de la instalación.",
+  "mount.nfs command not found after installation.": "El comando mount.nfs no se encuentra después de la instalación.",
+  "never": "nunca",
+  "nftables not available - using iptables ban action": "nftables no disponible - usando la acción de prohibición de iptables",
+  "no": "no",
+  "no (kdf=none, not needed)": "no (kdf=ninguno, no es necesario)",
+  "no (no escrow blob — set a recovery passphrase to enable recovery)": "no (sin blob de depósito en garantía: establezca una frase de contraseña de recuperación para habilitar la recuperación)",
+  "no passphrase": "sin frase de contraseña",
+  "no password": "sin contraseña",
+  "no_root_squash": "no_root_squash",
+  "non-ProxMenux .tar archive(s) in this path": "archivo(s) .tar que no son de ProxMenux en esta ruta",
+  "not found.": "extraviado.",
+  "not installed": "no instalado",
+  "not reliable on this hardware due to the following limitations": "No es confiable en este hardware debido a las siguientes limitaciones.",
+  "nouveau driver has been blacklisted.": "El nuevo conductor ha sido incluido en la lista negra.",
+  "nouveau module unloaded after initramfs rebuild.": "El módulo nouveau se descargó después de la reconstrucción de initramfs.",
+  "nouveau module unloaded successfully.": "El módulo nouveau se descargó correctamente.",
+  "nouveau still active. Proceeding with installation. A reboot will be required for the driver to work.": "nouveau sigue activo. Continuando con la instalación. Será necesario reiniciar para que el controlador funcione.",
+  "now": "ahora",
+  "now?": "¿ahora?",
+  "nvidia-smi not found after install. Check log:": "nvidia-smi no se encuentra después de la instalación. Registro de verificación:",
+  "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi no encontrado en RUTA. Verifique la instalación del controlador.",
+  "nvidia-smi not found in container": "nvidia-smi no encontrado en el contenedor",
+  "of": "de",
+  "of free disk space.": "de espacio libre en disco.",
+  "older firmware may increase passthrough instability": "el firmware más antiguo puede aumentar la inestabilidad del paso",
+  "on SSD/NVMe pools that support discard": "en grupos de SSD/NVMe que admiten descarte",
+  "openssl encryption failed.": "falló el cifrado de openssl.",
+  "openssl is not installed — cannot create recovery copy. Install openssl and retry.": "openssl no está instalado; no se puede crear una copia de recuperación.Instale openssl y vuelva a intentarlo.",
+  "or format it manually using external tools.": "o formatéelo manualmente utilizando herramientas externas.",
+  "or use the ProxMenux LXC Mount Manager.": "o utilice el Administrador de montaje ProxMenux LXC.",
+  "orphan iface lines, no impact on restore": "líneas de iface huérfanas, sin impacto en la restauración",
+  "other .tar archive(s) — not ProxMenux host backups (e.g. PVE vzdump or unrelated tarballs).": "otros archivos .tar, no copias de seguridad del host ProxMenux (por ejemplo, PVE vzdump o archivos tar no relacionados).",
+  "packages (this may take a few minutes)...": "paquetes (esto puede tardar unos minutos)...",
+  "packages.": "paquetes.",
+  "parent PF:": "padre PF:",
+  "partition(s). Partition table preserved.": "partición(es). Se conserva la tabla de particiones.",
+  "paths for next boot (/etc/pve, guests, drivers, ...)": "rutas para el próximo arranque (/etc/pve, invitados, controladores, ...)",
+  "pci_passthrough_helpers.sh missing — SR-IOV / orphan-audio guards will be skipped": "Falta pci_passthrough_helpers.sh: se omitirán las protecciones SR-IOV/orphan-audio",
+  "pct exec authorization failed": "error en la autorización ejecutiva de PCT",
+  "pct push failed. Check log:": "Error al enviar el PCT. Registro de verificación:",
+  "pending (reboot required to enumerate full group)": "pendiente (es necesario reiniciar para enumerar el grupo completo)",
+  "pigz configuration completed": "configuración de pigz completada",
+  "pigz enabled in vzdump configuration": "pigz habilitado en la configuración de vzdump",
+  "pigz installed successfully": "pigz instalado exitosamente",
+  "pigz removed": "cerdo eliminado",
+  "pigz wrapper script created": "script contenedor pigz creado",
+  "port": "puerto",
+  "portmapper/rpcbind has been disabled and removed": "portmapper/rpcbind ha sido deshabilitado y eliminado",
+  "proxmox-backup-client reported:": "proxmox-backup-client informó:",
+  "proxmox-boot-tool refreshed": "herramienta de arranque proxmox actualizada",
+  "pve-enterprise.list update skipped (no change)": "Actualización de pve-enterprise.list omitida (sin cambios)",
+  "pve-enterprise.list updated to Trixie": "pve-enterprise.list actualizado a Trixie",
+  "pvecm command not found (might not be in a cluster)": "No se encontró el comando pvecm (puede que no esté en un clúster)",
+  "pvesm command found": "comando pvesm encontrado",
+  "pvesm command not found. This should not happen on Proxmox.": "Comando pvesm no encontrado. Esto no debería suceder en Proxmox.",
+  "pvesm not available.": "pvesm no disponible.",
+  "pvesm not found.": "pvesm no encontrado.",
+  "pvesm path failed, trying manual detection...": "La ruta pvesm falló, intentando la detección manual...",
+  "pvesm status failed": "el estado de pvesm falló",
+  "raw USB disk — no filesystem (will be FORMATTED)": "disco USB sin formato: sin sistema de archivos (se FORMATEARÁ)",
+  "reboot-quick alias added": "alias de reinicio rápido agregado",
+  "recommended": "recomendado",
+  "remapped users": "usuarios reasignados",
+  "remove the (now-empty) directory if possible": "elimine el directorio (ahora vacío) si es posible",
+  "removed from Proxmox": "eliminado de Proxmox",
+  "removed successfully from Proxmox.": "eliminado exitosamente de Proxmox.",
+  "requires the package": "requiere el paquete",
+  "restarted successfully": "reiniciado exitosamente",
+  "restoring /etc/network would lose connectivity": "restaurar /etc/network perdería conectividad",
+  "restoring on:": "restaurar en:",
+  "retries": "reintentos",
+  "reverse proxy": "proxy inverso",
+  "root and real users only": "Sólo usuarios root y reales.",
+  "rpcbind service has been disabled and stopped": "El servicio rpcbind ha sido deshabilitado y detenido",
+  "running": "correr",
+  "safe paths now (configs, packages, /etc, /root, ...)": "rutas seguras ahora (configuraciones, paquetes, /etc, /root, ...)",
+  "same MAC": "misma MAC",
+  "seconds (default)": "segundos (predeterminado)",
+  "see log:": "ver registro:",
+  "selected path(s):": "ruta(s) seleccionada(s):",
+  "server": "servidor",
+  "server IP or hostname:": "IP del servidor o nombre de host:",
+  "server?": "¿servidor?",
+  "servers found on the network.": "servidores encontrados en la red.",
+  "servers found.": "servidores encontrados.",
+  "sha256sum not found. Cannot verify Borg binary.": "sha256sum no encontrado. No se puede verificar el binario Borg.",
+  "showmount command is not working properly.": "El comando showmount no funciona correctamente.",
+  "showmount command not found after installation.": "El comando showmount no se encuentra después de la instalación.",
+  "single portable archive": "archivo portátil único",
+  "skipped (already exist)": "omitido (ya existe)",
+  "smbclient command is not working properly.": "El comando smbclient no funciona correctamente.",
+  "smbclient command not found after installation.": "El comando smbclient no se encuentra después de la instalación.",
+  "sources.list update skipped (no change)": "Actualización de fuentes.list omitida (sin cambios)",
+  "sources.list updated to Trixie": "fuentes.lista actualizada a Trixie",
+  "ssh-keygen failed. Cannot create a new SSH key.": "ssh-keygen falló.No se puede crear una nueva clave SSH.",
+  "standard performance": "rendimiento estándar",
+  "start/restart failures and reset instability.": "fallos de inicio/reinicio y reinicio de inestabilidad.",
+  "started successfully.": "comenzó exitosamente.",
+  "started.": "comenzó.",
+  "startup/restart errors are likely.": "Es probable que se produzcan errores de inicio/reinicio.",
+  "stop source VM first": "detener la VM de origen primero",
+  "stopped": "interrumpido",
+  "storage yet.": "almacenamiento todavía.",
+  "storage(s) from backup exist on target": "los almacenamientos de la copia de seguridad existen en el destino",
+  "storage.": "almacenamiento.",
+  "successfully formatted with": "formateado exitosamente con",
+  "suggested:": "sugerido:",
+  "switch_gpu_mode.sh was not found.": "No se encontró switch_gpu_mode.sh.",
+  "sysfs ROM dump failed — trying ACPI VFCT table...": "Error en el volcado de ROM de sysfs: al intentar la tabla ACPI VFCT...",
+  "systemctl restart networking failed:": "El reinicio de red systemctl falló:",
+  "systemd OnCalendar expression": "expresión systemd OnCalendar",
+  "this distribution": "esta distribución",
+  "to": "a",
+  "to CT": "a TC",
+  "to VM": "a la máquina virtual",
+  "to move the GPU safely.": "para mover la GPU de forma segura.",
+  "to run without being killed by the OOM killer.": "para ejecutarse sin que el sistema lo termine por falta de memoria.",
+  "to sharedfiles group": "al grupo de archivos compartidos",
+  "total": "total",
+  "umount the path if currently mounted": "desmontar la ruta si actualmente está montada",
+  "updating NVIDIA userspace libs": "actualizando las bibliotecas del espacio de usuario de NVIDIA",
+  "user packages missing — will be installed automatically:": "faltan paquetes de usuario; se instalarán automáticamente:",
+  "users": "usuarios",
+  "users (for unprivileged compatibility)": "usuarios (para compatibilidad sin privilegios)",
+  "using": "usando",
+  "using direct path (not guaranteed to survive reboots).": "utilizando una ruta directa (no se garantiza que sobreviva a los reinicios).",
+  "vCPUs:": "vCPU:",
+  "vfio-pci IDs configured": "ID de vfio-pci configurados",
+  "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "ID de vfio-pci en /etc/modprobe.d/vfio.conf",
+  "vzdump backup speed optimization completed": "Optimización de la velocidad de copia de seguridad de vzdump completada",
+  "was": "era",
+  "wipefs failed on": "los borrados fallaron",
+  "with": "con",
+  "with the password you provided.": "con la contraseña que proporcionaste.",
+  "xfs   — Proxmox dir storage (large files and VMs)": "xfs: almacenamiento de directorios de Proxmox (archivos grandes y máquinas virtuales)",
+  "xfs   — better for large files": "xfs: mejor para archivos grandes",
+  "years old": "años",
+  "yes": "si",
+  "yes (scrypt-unlock passphrase stored)": "sí (frase de contraseña de desbloqueo de scrypt almacenada)",
+  "yes (survives reboot)": "sí (sobrevive al reinicio)",
+  "yes (via PBS escrow + recovery passphrase)": "sí (a través del depósito en garantía de PBS + frase de contraseña de recuperación)",
+  "zeroed.": "puesto a cero.",
+  "zfs   — Proxmox ZFS pool storage": "zfs — Almacenamiento en grupo Proxmox ZFS",
+  "zfs-auto-snapshot installed successfully": "zfs-auto-snapshot se instaló correctamente",
+  "zfs-auto-snapshot is already installed": "zfs-auto-snapshot ya está instalado",
+  "zfs-auto-snapshot removed (existing snapshots preserved on the pool)": "zfs-auto-snapshot eliminado (las instantáneas existentes se conservan en el grupo)",
+  "zpool command not found. Install zfsutils-linux and retry.": "Comando zpool no encontrado. Instale zfsutils-linux y vuelva a intentarlo.",
+  "zpool not found. Install zfsutils-linux and retry.": "zpool no encontrado. Instale zfsutils-linux y vuelva a intentarlo.",
+  "— Full/Custom restore will skip kernel-tied paths": "— La restauración completa/personalizada omitirá las rutas vinculadas al kernel",
+  "— disk may be busy. Skipping fstab removal.": "— el disco puede estar ocupado. Saltarse la eliminación de fstab.",
+  "— restore proceeds as same-version (verified safe)": "- la restauración procede como la misma versión (segura verificada)",
+  "— safe restore mode will skip boot/kernel/apt config": "- el modo de restauración segura omitirá la configuración de arranque/kernel/apt",
+  "— that part works on any distro and is harmless.": "esa parte funciona en cualquier distribución y es inofensiva.",
+  "• Both: mounts twice (pvesm + an independent fstab entry)": "• Ambos: se monta dos veces (pvesm + una entrada fstab independiente)",
+  "• Both: registers as Proxmox storage AND keeps the mount available for LXC bind-mounts": "• Ambos: se registra como almacenamiento enProxmox Y mantiene la montura disponible para montajes enlazados de LXC",
+  "• Both: two independent CIFS mounts (one for Proxmox UI, one for LXC bind-mounts with open perms)": "• Ambos: dos montajes CIFS independientes (uno para Proxmox UI, otro para montajes enlazados LXC con permisos abiertos)",
+  "• Clean up remapped users": "• Limpiar usuarios reasignados",
+  "• Host fstab: mounted at a path you choose, NOT visible as Proxmox storage": "• Host fstab: montado en la ruta que usted elija, NO visible como almacenamiento en Proxmox",
+  "• Host fstab: mounted at host path only, for LXC bind-mounts (NOT visible as Proxmox storage)": "• Host fstab: montado solo en la ruta del host, para montajes vinculados LXC (NO visible como almacenamiento en Proxmox)",
+  "• Host fstab: mounted with open uid/gid/file_mode at a path you choose, ideal for LXC bind-mounts": "• Host fstab: montado con uid/gid/file_mode abierto en la ruta que usted elija, ideal para montajes enlazados de LXC",
+  "• Proxmox storage (pvesm): visible in Datacenter > Storage, mount at /mnt/pve/<id>": "• Almacenamiento Proxmox (pvesm): visible en Centro de datos > Almacenamiento, montaje en /mnt/pve/<id>",
+  "• Proxmox storage (pvesm): visible in Datacenter > Storage, usable for VMs/backups/ISOs": "• Almacenamiento Proxmox (pvesm): visible en Centro de datos > Almacenamiento, utilizable para VM/copias de seguridad/ISO",
+  "• Remove Samba groups": "• Eliminar grupos de Samba",
+  "• Remove all Samba users": "• Eliminar todos los usuarios de Samba",
+  "• Remove all exports": "• Eliminar todas las exportaciones",
+  "• Remove all shares": "• Eliminar todos los recursos compartidos",
+  "• Remove universal sharedfiles group": "• Eliminar el grupo universal de archivos compartidos",
+  "• Stop all NFS services": "• Detener todos los servicios NFS",
+  "• Stop all Samba services": "• Detener todos los servicios de Samba",
+  "• Uninstall NFS packages": "• Desinstalar paquetes NFS",
+  "• Uninstall Samba packages": "• Desinstalar paquetes de Samba",
+  "← Return": "← Volver",
+  "− Remove a path": "− Eliminar una ruta",
+  "──── [ Finish and continue ] ────": "──── [Terminar y continuar] ────",
+  "─────── Custom profile (choose paths manually) ───────": "────── Perfil personalizado (elegir rutas manualmente) ──────",
+  "────────────────── Default profile ───────────────────": "────── Perfil predeterminado ────────────────────────────────",
+  "⚠ Disk data will NOT be erased.": "⚠ Los datos del disco NO se borrarán.",
+  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ El disco se desmontará y se eliminará de /etc/fstab.",
+  "⚠ The /etc/fstab entry will be removed.": "⚠ Se eliminará la entrada /etc/fstab.",
+  "⚠ The disk will be unmounted.": "⚠ El disco se desmontará."
+}
diff --git a/lang/es.lang b/lang/es.lang
deleted file mode 100644
index 64e96a43..00000000
--- a/lang/es.lang
+++ /dev/null
@@ -1,115 +0,0 @@
-# Mensajes generales del sistema
-MAIN_MENU_TITLE="ProxMenux - Menú Principal"
-CONFIG_TITLE="ProxMenux - Configuración"
-SELECT_OPTION="Selecciona una opción:"
-LANG_OPTION="Cambiar idioma"
-UNINSTALL_OPTION="Desinstalar ProxMenu"
-EXIT_MENU="Salir"
-EXIT_MESSAGE="Saliendo del menú. ¡Hasta luego!"
-
-# Opciones del menú principal
-OPTION_1="Configurar iGPU + TPU"
-OPTION_2="Reparar red"
-OPTION_3="Configuración"
-
-# Mensajes de versión
-VERSION_OPTION="Mostrar información de versión"
-VERSION_TITLE="Información de versión"
-VERSION_INFO="Versión actual: %s\n\nPara más información, visita:\nhttps://github.com/MacRimi/ProxMenux"
-
-# Mensajes de actualización
-UPDATE_CHECKING="Comprobando actualizaciones..."
-UPDATE_ERROR_REMOTE="Error al comprobar la versión remota."
-UPDATE_NEW_AVAILABLE="Nueva versión disponible: %s (actual: %s)"
-UPDATE_TITLE="Actualización disponible"
-UPDATE_PROMPT="¿Deseas actualizar a la última versión %s?"
-UPDATE_POSTPONED="Actualización pospuesta."
-UPDATE_CURRENT="El menú ya está actualizado (%s)."
-UPDATE_PROCESS="Actualizando a la versión %s..."
-UPDATE_COMPLETE="Actualización completada a la versión %s."
-UPDATE_ERROR_DOWNLOAD="Error al descargar la actualización."
-
-
-# Mensajes de desinstalación
-UNINSTALL_TITLE="Desinstalar ProxMenu"
-UNINSTALL_CONFIRM="¿Estás seguro de que quieres desinstalar ProxMenu?"
-UNINSTALL_COMPLETE="ProxMenu ha sido desinstalado correctamente."
-UNINSTALL_PROCESS="Desinstalando ProxMenu..."
-
-# Mensajes de script
-SCRIPT_RUNNING="Ejecutando script igpu_tpu.sh..."
-SCRIPT_SUCCESS="Script ejecutado correctamente."
-SCRIPT_ERROR="Error al ejecutar el script."
-
-# Mensajes de idioma
-LANG_SELECT="Seleccionar Idioma"
-LANG_PROMPT="Elige tu idioma:"
-LANG_ERROR="No se seleccionó ningún idioma. Saliendo..."
-LANG_SUCCESS="Idioma seleccionado:"
-LANG_LOADED="Idioma cargado:"
-LANG_DOWNLOAD="Descargando archivo de idioma..."
-LANG_DOWNLOAD_ERROR="Error al descargar el archivo de idioma. Verifica tu conexión a internet."
-LANG_EXISTS="Archivo de idioma existe localmente."
-
-# Mensajes de dependencias
-DEPS_INSTALLING="Instalando dependencias necesarias..."
-DEPS_SUCCESS="Dependencias instaladas."
-DEPS_ERROR="Error al instalar dependencias. Por favor, instala whiptail manualmente."
-
-# Mensajes bilingües (primera ejecución)
-INITIAL_LANG_SELECT="Seleccionar Idioma / Select Language"
-INITIAL_LANG_PROMPT="Elige tu idioma / Choose your language:"
-INITIAL_LANG_ERROR="No se seleccionó ningún idioma. Saliendo... / No language selected. Exiting..."
-
-# --- Mensajes para el script de reparación de red (repair_network.sh) ---
-REPAIR_MENU_TITLE="Menú de Reparación de Red"
-MENU_PROMPT="Por favor, seleccione una opción:"
-MENU_REPAIR="Reparar la red"
-MENU_VERIFY="Verificar la configuración de red"
-MENU_SHOW_IP="Mostrar información de IP"
-MENU_EXIT="Salir"
-MENU_CANCELED="Operación cancelada por el usuario."
-MENU_EXIT_MSG="Saliendo del script de reparación de red. ¡Hasta luego!"
-INVALID_OPTION="Opción no válida. Por favor, intente de nuevo."
-PRESS_ENTER="Presione Enter para continuar..."
-RESULT_TITLE="Resultado de la Operación"
-REPAIR_COMPLETED="Reparación de red completada."
-VERIFY_COMPLETED="Verificación de red completada."
-IP_INFO_COMPLETED="Información de IP mostrada."
-NETWORK_ERROR="ERROR"
-NETWORK_SUCCESS="ÉXITO"
-NETWORK_WARNING="ADVERTENCIA"
-NETWORK_PHYSICAL_INTERFACES="Interfaces físicas detectadas"
-NETWORK_CONFIGURED_INTERFACES="Interfaces configuradas"
-NETWORK_CHECKING_BRIDGES="Verificando configuración de puentes"
-NETWORK_BRIDGE_PORT_MISSING="Puerto de puente no existente o no activo"
-NETWORK_BRIDGE_PORT_UPDATED="Puerto de puente actualizado"
-NETWORK_NO_PHYSICAL_INTERFACE="No se encontró una interfaz física adecuada"
-NETWORK_BRIDGE_PORT_OK="Puerto de puente correcto"
-NETWORK_CLEANING_INTERFACES="Limpiando configuraciones de interfaces no existentes"
-NETWORK_INTERFACE_REMOVED="Interfaz eliminada"
-NETWORK_CONFIGURING_INTERFACES="Configurando interfaces"
-NETWORK_INTERFACE_ADDED="Interfaz añadida"
-NETWORK_RESTARTING="Reiniciando el servicio de red"
-NETWORK_RESTART_SUCCESS="Servicio de red reiniciado con éxito"
-NETWORK_RESTART_FAILED="Error al reiniciar el servicio de red"
-NETWORK_CONNECTIVITY_OK="Conectividad de red OK"
-NETWORK_CONNECTIVITY_FAILED="Fallo en la conectividad de red"
-NETWORK_IP_INFO="Información de IP"
-NETWORK_NO_IP="No IP"
-NETWORK_REPAIR_STARTED="Iniciando reparación de red"
-NETWORK_REPAIR_COMPLETED="Reparación de red completada"
-NETWORK_REPAIR_FAILED="Fallo en la reparación de red"
-NETWORK_REPAIR_PROCESS_FINISHED="Proceso de reparación de red finalizado"
-NETWORK_VERIFY_STARTED="Iniciando verificación de red"
-NETWORK_VERIFY_FINISHED="Verificación de red finalizada"
-NETWORK_REPAIR_RUNNING="Ejecutando reparación de red..."
-NETWORK_REPAIR_SUCCESS="Reparación de red ejecutada con éxito."
-NETWORK_REPAIR_ERROR="Error al ejecutar la reparación de red."
-NETWORK_VERIFY_RUNNING="Ejecutando verificación de red..."
-NETWORK_VERIFY_SUCCESS="Verificación de red completada con éxito."
-NETWORK_VERIFY_ERROR="Error al ejecutar la verificación de red."
-NETWORK_IP_INFO_RUNNING="Obteniendo información de IP..."
-NETWORK_IP_INFO_SUCCESS="Información de IP obtenida con éxito."
-NETWORK_IP_INFO_ERROR="Error al obtener información de IP."
-# --- Fin de mensajes para repair_network.sh ---
diff --git a/lang/es/CHANGELOG.md b/lang/es/CHANGELOG.md
deleted file mode 100644
index 09a77865..00000000
--- a/lang/es/CHANGELOG.md
+++ /dev/null
@@ -1,1240 +0,0 @@
-
-## 2026-06-02
-
-### Nueva versión ProxMenux v1.2.2 — *Consolidación estable del ciclo v1.2.1.x*
-
-Release estable que lleva al canal principal las cuatro prereleases del ciclo **v1.2.1.x** en un solo movimiento. El trabajo a lo largo de esas cuatro betas se centró en tres temas: hacer del Health Monitor algo realmente configurable en lugar de solo observable (thresholds por categoría, duraciones de dismiss por evento, un audit log de supresiones activas), expandir el stack de notificaciones para cubrir alrededor de 80 servicios a través de Apprise mientras se persisten eventos durante las Quiet Hours, y convertir el propio proceso del Monitor en un ciudadano del sistema más silencioso y predecible en hosts idle. Por encima de eso, esta release entrega detección automática de updates en contenedores LXC, una reescritura end-to-end del instalador de Coral TPU con los últimos drivers upstream, y una larga lista de fixes visibles para el operador — handshake del terminal HTTPS, detección de kernel updates en PVE 9.x, flujo del instalador NVIDIA en Alpine LXC, gestión del audio acompañante en passthrough de GPU mixta, y varias optimizaciones runtime en los bucles de scan del Monitor. Cinco contribuciones de código directas de la comunidad shipean junto con esta release ([@jcastro](https://github.com/jcastro) ×5, [@pespinel](https://github.com/pespinel) ×1) y el trabajo de GPU passthrough lo impulsaron los reports detallados de campo de [@ghosthvj](https://github.com/ghosthvj) — ver los Acknowledgments al final.
-
----
-
-## 🩺 Health Monitor — Configurable, granular, auditable
-
-Tres piezas acopladas que juntas permiten al operador ajustar el Health Monitor a la envoltura real de su host en lugar de trabajar alrededor de sus defaults, y gestionar dismisses con el mismo control fino que ya tienen sobre el resto del dashboard.
-
-### Thresholds Warning / Critical por categoría
-
-Cada check que corre el Health Monitor está parametrizado por un par de números — un *Warning* y un *Critical* — y ambos están ahora expuestos bajo **Settings → Health Monitor Thresholds**. Los defaults que shipean con ProxMenux son razonables para el host Proxmox medio, pero cada entorno tiene su propia envoltura:
-
-- Un homelab pequeño con un único SSD quiere paginar antes en capacidad (75 / 90 %) para dejar margen a snapshots.
-- Un nodo de datacenter con almacenamiento Ceph redundante puede ser mucho más relajado con los warnings de memoria (un working set del 90 % es normal con ZFS ARC).
-- Un mini-PC refrigerado pasivamente necesita thresholds de temperatura más bajos que un servidor con refrigeración forzada — misma clase de disco, distinta envoltura física.
-
-Los cambios surten efecto en el siguiente scan — el Health Monitor relee los valores desde `/usr/local/share/proxmenux/health_thresholds.json` en cada ciclo, sin restart del servicio. Los mismos números también alimentan los rangos de color de cada widget del dashboard (barras de almacenamiento, anillos de CPU/memoria, chips de temperatura, el punto del modal de disco), de forma que la clasificación visual en cualquier punto del Monitor mapea a un rango definido respecto al par configurado.
-
-### Duración de dismiss por evento con badge Permanent
-
-El botón *Dismiss* en cada alerta del Health Monitor abre ahora un pequeño dropdown con tres opciones:
-
-- **24 hours** — default anterior, se comporta exactamente como antes
-- **7 days** — útil para una condición temporal de la que no quieres oír durante una migración de una semana
-- **Permanently** — silencia este `error_key` concreto indefinidamente
-
-Los dismisses permanentes se persisten con `suppression_hours = -1` en la base de datos de persistencia, nunca re-emiten, nunca re-notifican y se marcan con un badge ámbar **Permanent** distinto en el Health Monitor para que el operador siempre sepa qué alertas están silenciadas intencionadamente. La infraestructura backend para el centinela permanente ya existía — solo le faltaba a la UI una forma de fijarlo. El contrato de API es pequeño y backwards-compatible: `POST /api/health/acknowledge` acepta un campo body opcional `suppression_hours` (entero positivo para horas, `-1` para permanente); omitirlo preserva el comportamiento previo y usa la supresión configurada de la categoría. Un segundo endpoint nuevo `POST /api/health/un-acknowledge {error_key}` limpia un acknowledgment previamente registrado para que la alerta vuelva a ser elegible para dispararse — usado por el panel Active Suppressions abajo.
-
-### Panel Active Suppressions en Settings
-
-Una nueva sección dentro de **Settings → Health Monitor**, justo debajo de las duraciones de supresión por categoría, lista cada alerta actualmente silenciada — tanto los dismisses con tiempo limitado (con un badge *22h remaining* / *6d remaining*) como los permanentes (con el badge ámbar *Permanent* del dashboard). Cada fila lleva el `error_key`, la categoría, la severidad, el timestamp en que se registró el dismiss, y un botón **Re-enable** que limpia el acknowledgment server-side. Los re-enables están **encolados** — pulsar el botón marca la fila en verde con texto tachado y cambia el botón a *Undo*, y el `POST /api/health/un-acknowledge` real solo se dispara cuando el usuario pulsa **Save**, de modo que un lote de re-enables se entrega atómicamente junto a cualquier cambio pendiente de dropdown por categoría. La acción está protegida por el toggle de *Edit* del Health Monitor en la parte superior de la card. Los dismisses permanentes **solo pueden revertirse desde aquí** — el dashboard no expone intencionadamente un affordance per-alerta de un-dismiss para evitar re-enables accidentales, por lo que el panel de Settings es la superficie deliberada de auditoría + revert para ellos. La lista también se refresca automáticamente cuando se hace un dismiss de una alerta desde el modal del Health Monitor mientras la página de Settings ya está abierta, vía un evento `health-suppression-changed` del navegador más listeners en `window focus` y `document visibilitychange`.
-
-### Tiers de severidad de Disk I/O
-
-Una ventana deslizante de 24 h clasifica ahora los errores ATA / SCSI de dmesg en tres buckets: silencioso (0–10 eventos transitorios), WARNING (11–100) y CRITICAL (100+, o cualquier error duro como UNC / Buffer I/O / Sense Key Hardware Error). Los días tranquilos se quedan tranquilos, pero un único evento de Buffer I/O sigue paginando inmediatamente.
-
----
-
-## 📨 Canal de notificación Apprise — Paridad completa de features
-
-La integración Apprise que aterrizó como un adapter básico en 1.2.1.4-beta se ha graduado a paridad completa con los canales nativos. Una sola URL de Apprise llega ahora a alrededor de 80 servicios de notificación (Pushover, ntfy, Slack, Matrix, mailto, signal, Pushbullet, Mattermost, Microsoft Teams vía webhooks, …) sin que ProxMenux necesite un adapter dedicado para cada uno. La pestaña Apprise en Notifications expone los mismos controles que Telegram, Gotify, Discord y Email:
-
-- El bloque **Notification Categories** completo — las mismas 10 categorías con sus sub-toggles por evento, idéntico a los otros canales
-- **Quiet Hours** — ventana start/end por canal, con el mismo comportamiento de buffering (los eventos disparados durante la ventana se persisten en SQLite y se liberan como un resumen agrupado cuando la ventana cierra, en lugar de dropearse silenciosamente)
-- **Daily Digest** — entrega opt-in de un resumen una vez al día a una hora elegida
-
-El filtrado per-channel del backend ya aplicaba genéricamente a cada canal incluyendo Apprise vía el bloque `channel_overrides` — la UI simplemente no estaba surfaceando los controles.
-
-Tres fixes de fiabilidad shipean junto, todos surfaceados después del rollout beta inicial:
-
-1. **Mobile overflow** en viewports estrechos. La fila de Apprise URL solía romper el diseño — el placeholder empaquetaba cuatro URLs de ejemplo completas en una línea y los `<code>` inline de los ejemplos no tenían regla `break-all`. El placeholder es ahora un único ejemplo conciso (`tgram://bottoken/ChatID`), el wrapper del input URL fuerza `min-w-0 / flex-1 / shrink-0` en sus children, y el párrafo de ejemplos usa `break-all min-w-0` para que envuelva limpiamente a cualquier ancho.
-
-2. **Regresión del whitelist backend** que rechazaba Apprise con HTTP 400. El conjunto de canales hardcodeado del validador de notifications-test (`{telegram, gotify, discord, email, all}`) tenía a `apprise` ausente, por lo que cada test o send de Apprise devolvía `400 Invalid channel` antes de que la librería fuera siquiera invocada. El whitelist se deriva ahora en vivo desde `notification_channels.CHANNEL_TYPES`, de forma que añadir una nueva implementación de canal en el futuro no puede regresionar silenciosamente este validador otra vez.
-
-3. **Error reporting opaco** cuando el destino devolvía una respuesta no-2xx. Cuando un destino (`jsons://`, `ntfy://`, `slack://`, …) rechazaba el payload, el operador solo veía un mensaje genérico *"Apprise rejected the notification (transport failure)"*. El canal captura ahora el logger interno de Apprise durante `notify()` y surfacea el HTTP status code real más el response body del destino (capado a 300 caracteres) — de forma que un beta tester debuggeando un webhook custom puede ver inmediatamente si el servidor upstream está rechazando su schema de payload.
-
----
-
-## 📦 Detección de updates en LXC
-
-Una nueva sección dedicada en **Settings** (entre *Health Monitor Thresholds* y *Notifications*) con un único toggle que protege el scan per-CT de `apt list --upgradable` / `apk list -u` end-to-end. Default ON. Cuando está OFF el scan para completamente (sin llamadas `pct exec`), cada entrada `type=lxc` se purga inmediatamente del registry de managed-installs, y el toggle de notificación correspondiente en *Notifications → Services* desaparece de la UI mientras preserva su preferencia almacenada.
-
-El checker lee también el `mtime` de la caché de metadata del package-manager de cada CT y dispara `apt-get update` / `apk update` desde fuera vía `pct exec` si tiene más de 24 h, con timeout de 60 s y fallo silencioso. Los CTs appliance long-running cuyas cachés estaban meses obsoletas surfacean por fin su backlog real upstream — un CT Debian 12 con caché de 524 días pasó de "0 updates" a "117 (12 security)" en hardware de lab.
-
----
-
-## 🐧 Coral TPU en LXC — Últimos drivers upstream
-
-El instalador de Coral para LXC (`scripts/gpu_tpu/install_coral_lxc.sh`) se ha reescrito end-to-end para instalar el **último driver `gasket-dkms` upstream** y el **último runtime `libedgetpu1`** (220 líneas añadidas, 150 eliminadas). Los módulos Coral M.2 / mPCIe que antes fallaban al compilar en kernels PVE 9 ahora instalan y bindean limpiamente. Las notificaciones de update registry-driven que aterrizaron en 1.2.1.2 mantienen ambos paquetes frescos en adelante: la pestaña Hardware + Notifications señalizan cuando feranick/gasket-driver publica una release nueva, y el runtime `libedgetpu1` tracked vía `apt` recibe el flujo estándar de System Updates.
-
-El **path de uninstall del instalador Coral** acompañante también aterriza en este ciclo — espejando el flujo NVIDIA para que una instalación Coral pueda revertirse limpiamente si el usuario re-despliega el host sin aceleración TPU.
-
----
-
-## ⚡ Optimizaciones de rendimiento del Monitor
-
-Una corrida de strace + sampling de 10 minutos sobre un host live surfaceó tres sitios donde el scanner de background del Monitor estaba spawning subprocesos más agresivamente de lo necesario. Los tres están arreglados en 1.2.2:
-
-### Tormenta de subprocesos fail2ban
-En hosts donde `fail2ban-client` no estaba instalado, el wrapper de caché alrededor de `_f2b_get_banned_ips()` solo actualizaba su timestamp en éxito. Cada request HTTP al dashboard caía a través del check de caché y disparaba un `execve("fail2ban-client", ...)` fresco que inmediatamente fallaba con `ENOENT` — 250+ llamadas `execve` fallidas en una ventana de 10 minutos. `shutil.which('fail2ban-client')` se resuelve ahora **una vez** al cargar el módulo y el timestamp de caché se actualiza incondicionalmente. Los hosts sin Fail2Ban tienen ahora cero syscalls de `fail2ban-client` por request.
-
-### Colisión del scheduler de smartctl
-El polling de temperatura SMART de discos, la lectura de temperatura CPU y la probe de latency solían dispararse en el mismo offset dentro de cada minuto, produciendo un spike medible de CPU / IO cuando todos sus subprocesos spawneaban juntos. Las polls están ahora staggered (latency primero, luego temperatura CPU, luego SMART de disco) preservando la cadencia per-disco de 60 s — el spike ha desaparecido, el CPU total bajo carga no cambia.
-
-### Subproceso de inventario LXC
-El mount monitor solía llamar `lxc-info -n <vmid> -p` por cada CT corriendo solo para obtener su PID init. Ahora lee `/proc/<lxc-start-pid>/task/<lxc-start-pid>/children` directamente y solo cae a `lxc-info` cuando la lectura de `/proc` falla. Un subproceso por CT por ciclo de scan eliminado — medible en hosts con 20+ contenedores.
-
----
-
-## 🔌 Handshake del terminal HTTPS
-
-Cada modal de terminal en el Monitor (terminal del dashboard, terminal LXC, terminal de scripts) solía fallar con *WebSocket connection error* en hosts donde HTTPS estaba habilitado. La root cause era específica al path `gevent + SSL`: el `WebSocketHandler` de gevent-websocket estaba apilado sobre la implementación de protocolo de flask-sock, por lo que el servidor emitía **dos** cabeceras `HTTP/1.1 101 Switching Protocols` consecutivas y el navegador cerraba la conexión como un frame corrupto. Quitar el argumento explícito `handler_class=WebSocketHandler` restaura una única respuesta 101 y el handshake completa con normalidad. El fix es invisible para operadores corriendo en HTTP plano — no estaban afectados — pero desbloquea cada install fronteada por HTTPS (reverse proxies, deployments con certificate-managed, cualquier cosa detrás de nginx/Traefik).
-
-Adicionalmente, el panel de terminal solía perder su conexión WebSocket cuando el usuario activaba la feature de auto-traducción del navegador (los prompts "translate this page" de Chrome / Edge / Safari). El traductor mueve nodos del DOM que React aún mantiene como refs, y el componente WebSocket React se rompe porque su ref de contenedor apunta a un nodo movido. Añadido `translate="no"` en los divs contenedores del terminal para que el traductor salte el tty embebido por completo — las traducciones en el resto de la página siguen funcionando.
-
----
-
-## 🐧 Health Monitor — Detección de kernel updates en PVE 9.x (#208)
-
-En hosts Proxmox VE 9.x, la fila *System Updates → Kernel / PVE* reportaba "Kernel/PVE up to date" incluso cuando un update para el kernel corriendo estaba esperando upstream. Tres causas combinadas, tres fixes combinados:
-
-1. **La lista de prefijos de kernel-packages** incluye ahora `proxmox-kernel-*` y `proxmox-firmware-*` — PVE 9.x shipea kernels bajo `proxmox-kernel-`, no el prefijo `pve-kernel-` de 7.x / 8.x. El regex anterior nunca matcheaba los paquetes nuevos y por tanto nunca flagueaba ningún update de kernel en 9.x.
-
-2. **El dry-run cambió de `apt-get upgrade --dry-run` a `apt-get dist-upgrade --dry-run`**. PVE 9 shipea kernel updates empaquetados como instalaciones nuevas (no como upgrades directas de un paquete existente), y el `upgrade --dry-run` plano no considera nuevas instalaciones en absoluto. `dist-upgrade --dry-run` sí.
-
-3. **La detección del kernel corriendo** lee ahora `uname -r` y flaguea un update como *running-kernel update* cuando el paquete matchea la release corriendo exactamente o su meta-package de branch (p. ej. `proxmox-kernel-6.14` para un host en `6.14.11-4-pve`). El texto de la fila distingue *"Running kernel update available (reboot required)"* de *"N kernel update(s) available (none for running kernel)"* para que el operador sepa si necesita reboot o solo instalar.
-
----
-
-## 🟢 Instalador NVIDIA
-
-Varias mejoras impulsadas por los reports detallados de campo de [@ghosthvj](https://github.com/ghosthvj) sobre configuraciones de GPU mixta (ver Acknowledgments):
-
-- **Ventana de compatibilidad de kernel** — el menú de versiones respeta ahora el rango de drivers compatibles del kernel corriendo, ofreciendo solo branches que no fallarán al compilar contra el kernel del host.
-- **Soporte Alpine LXC** — el install de userspace container-side se reescribió para que succeda en hosts Alpine; la detección de espacio libre funciona fiablemente en todos los layouts de almacenamiento (LVM-thin, ZFS, directory, etc).
-- **NVENC patch awareness** — cuando el host tiene el patch NVENC aplicado, el menú de versiones se estrecha a drivers soportados por el patch para que reinstalar nunca lo pierda silenciosamente.
-- **Feedback de uninstall** — el path de uninstall reporta ahora un mensaje claro de completación en lugar de volver al menú en silencio.
-
----
-
-## 🌐 Sitio de documentación — Migración i18n completa
-
-El sitio de documentación acompañante (proxmenux.com) shipea ahora bajo URLs prefijadas por locale (`/en/...` y `/es/...`) con la plumbing de next-intl. Cada doc page es bilingüe — 107 páginas traducidas al español (sin placeholders copy-of-English). El root `/` redirige a `/en/` vía meta-refresh + JS para que la URL apex siga resolviendo a algo útil. Los RSS feeds funcionan per-locale en `/en/rss.xml` y `/es/rss.xml`, con el canonical `/rss.xml` conservado para backwards compatibility con suscriptores de feed existentes. La búsqueda client-side está wireada vía **Pagefind** — el índice se construye fresh en cada deploy de CI desde el HTML output final y se descarga fragmentariamente por el cliente, así que la búsqueda funciona sin un servidor backend.
-
-Nuevas páginas de documentación cubren la sección **Active Suppressions** en la pestaña Settings y el **dropdown Dismiss por evento** en el modal del Health Monitor, ambas con capturas reflejando la nueva UI.
-
----
-
-## 🔧 Otras mejoras
-
-- **Sección AI Enhancement en Notifications** — reescrita de una fila uppercase atenuada que los testers consistentemente scrolleaban sin ver, a un label foreground normal-case con un icono `Sparkles` líder y un badge persistente (verde *Active* cuando IA está habilitada, neutro *Optional* cuando no lo está) para que la feature sea descubrible independientemente del estado.
-- **Monitorización de temperatura de discos** — readings mejorados, caching más inteligente entre probes SMART, y un modal de historia rediseñado que abre a 24 h por defecto con estadísticas min / avg / max.
-- **Detección de updates de funciones post-install** — el Monitor trackea optimizaciones ProxMenux instaladas (Log2Ram, Memory Settings, System Limits, Logrotate, …) y notifica cuando hay una versión más nueva disponible, con apply one-click desde Settings.
-- **Flujo de update de Secure Gateway (Tailscale)** — update one-click de Tailscale desde Settings con indicadores Last-checked / Installed / Latest y notificación cuando se publica una nueva versión.
-- **Menú Helper-Scripts** — context más rico e información útil para cada entrada, haciendo más fácil saber qué hace cada script antes de ejecutarlo.
-- **Wording de agregación burst** — los resúmenes burst reportan ahora solo los eventos *adicionales* que llegaron después de la alerta individual inicial, de forma que el operador ya no ve el primer evento contado dos veces.
-- **Clasificador de errores conocidos** — regex con word-boundary en patrones ATA / UNC para que mensajes de kernel como `nvidia_uvm:FatalError` ya no se clasifiquen mal como problemas de cable ATA.
-- **Errores de control de VM / CT** — start / stop / restart fallido surfacea ahora el stderr real de `pvesh` (p. ej. *"no space left on device"*) en el toast de la UI y dispara una notificación `vm_fail` / `ct_fail`, en lugar del bare 500 INTERNAL SERVER ERROR que el operador solía ver.
-- **Path de apply de log2ram** — el flujo auto / update reinicia ahora log2ram después de escribir el nuevo size, de forma que un `512M` configurado realmente surte efecto en el tmpfs corriendo sin restart manual.
-- **PVE webhook URL** — el webhook de notificación sigue ahora automáticamente el estado SSL activo, cambiando entre `http://` y `https://` cuando toggleas HTTPS en el panel.
-- **Cascada de 401 frontend** — la login screen ya no se traga un 401 para siempre tras un estado breve de token rancio; la flag de dedup se limpia al mount y al login exitoso.
-
----
-
-## 🙏 Acknowledgments
-
-Esta release incluye contribuciones de código directas de la comunidad y una cantidad sustancial de feedback que dio forma al diseño. Particular agradecimiento a:
-
-### Contributors de código
-
-**[@jcastro](https://github.com/jcastro)** entregó cinco mejoras directas que shipean con v1.2.2:
-
-- **Selección de ISOs de VM desde todos los almacenamientos ISO** — nuevo helper compartido `scripts/global/iso_storage_helpers.sh` más integración en `vm_creator.sh`, `select_linux_iso.sh` y `select_windows_iso.sh`. El picker de ISO lee ahora desde cada almacenamiento Proxmox tagueado como ISO content en lugar de estar pinned a `local`. Commit [`092b548d`](https://github.com/MacRimi/ProxMenux/commit/092b548d).
-- **Selector de canal de release en Settings** — un menú proper bajo `scripts/menus/config_menu.sh` para flipear entre los canales de install estable y beta in-place, con la gestión correcta de `version.txt` / `beta_version.txt` en cada lado. Commit [`f8a8c43d`](https://github.com/MacRimi/ProxMenux/commit/f8a8c43d).
-- **ZFS autotrim en el auto post-install** — `auto_post_install.sh` habilita ahora `autotrim=on` en pools ZFS root por defecto (con el disable correspondiente en el path de uninstall), de forma que installs SSD-backed reclaman espacio liberado sin intervención manual. Commit [`8877f987`](https://github.com/MacRimi/ProxMenux/commit/8877f987).
-- **Detección de webhook loopback + handoff de update** — `flask_notification_routes.py` clasifica correctamente webhooks de `127.0.0.1` / `localhost` como loopback, y el handoff de update del script `menu` ya no flackea en edge cases. Commit [`70ab072c`](https://github.com/MacRimi/ProxMenux/commit/70ab072c).
-- **Figurine bumped a 2.0.0** — refresh del banner tool en `customizable_post_install.sh`, con la página de docs actualizada para matchear. Commit [`aba94028`](https://github.com/MacRimi/ProxMenux/commit/aba94028).
-
-**[@pespinel](https://github.com/pespinel)** arregló una regresión del beta-installer que rompía los paths de servicio tras el move al nuevo layout runtime — `install_proxmenux_beta.sh` resuelve ahora los paths correctos de la unit systemd en first install y en update. Commit [`0daab74a`](https://github.com/MacRimi/ProxMenux/commit/0daab74a).
-
-### Field reports que dieron forma al trabajo de GPU + Coral
-
-Los reports detallados y sugerencias de **[@ghosthvj](https://github.com/ghosthvj)** sobre el flujo de hardware passthrough impulsaron las mejoras de scripts de GPU en esta release. Los fixes del instalador NVIDIA, el hardening del lifecycle de GPU + audio acompañante en `switch_gpu_mode.sh`, y el checklist de audio-companion iGPU en `add_gpu_vm.sh::detect_optional_gpu_audio` empezaron todos desde sus reports de edge cases que los paths de código previos manejaban pobremente.
-
-### Todos los demás
-
-Un gracias enorme a cada usuario que abrió un issue en GitHub, comentó en [GitHub Discussions](https://github.com/MacRimi/ProxMenux/discussions), reportó un bug en el canal de la comunidad, o pasó a compartir qué funcionaba y qué no en su hardware. **Muchas de las mejoras internas en esta release — el stagger del scheduler de smartctl, el fix de caché de fail2ban, el reemplazo `lxc-info /proc`, el handshake del terminal HTTPS, la detección de kernel-update en PVE 9.x, todo el wiring de Apprise — empezaron como un report de alguien encontrándose con el problema.** Seguid llegando.
-
----
-
-
-## 2026-04-20
-
-### Nueva versión ProxMenux v1.2.1 — *SR-IOV Awareness & GPU Passthrough Hardening*
-
-Release puntual sobre **v1.2.0** que aborda tres áreas reportadas por la comunidad y que necesitaban arreglo antes del siguiente ciclo estable: reconocimiento completo de SR-IOV en todo el subsistema GPU/PCI, gestión robusta de los dispositivos de audio acompañantes de la GPU durante el attach y detach de passthrough (Intel iGPU con audio del chipset, tarjetas discretas con audio HDMI, VMs con GPU mixta), y fixes de compatibilidad para los proveedores de notificaciones con IA (endpoints custom OpenAI-compatible tipo LiteLLM/MLX/LM Studio, modelos de razonamiento de OpenAI, y modelos thinking de Gemini 2.5+/3.x). También incluye mejoras de calidad de vida en el instalador NVIDIA, el Monitor de salud de discos, y los helpers de ciclo de vida de LXC usados por los wizards de passthrough.
-
----
-
-## 🎛️ SR-IOV Awareness en todo el subsistema GPU
-
-Intel `i915-sriov-dkms` y AMD MxGPU dividen la Physical Function (PF) de una GPU en Virtual Functions (VFs) que pueden asignarse de forma independiente a LXCs y VMs. Anteriormente ProxMenux no tenía reconocimiento alguno de SR-IOV: trataba VFs y PFs de manera idéntica, lo que podía reescribir `vfio.conf` con el vendor:device ID de la PF, colapsar el árbol de VFs en el siguiente arranque, y dejar a los usuarios sin poder iniciar sus guests. Se ha auditado y endurecido cada ruta que pudiera alterar un árbol de VFs activo.
-
-### Helpers de detección
-- Nuevos `_pci_is_vf`, `_pci_has_active_vfs`, `_pci_sriov_role`, `_pci_sriov_filter_array` en `scripts/global/pci_passthrough_helpers.sh`
-- Equivalentes HTTP/JSON en la ruta Flask de GPU — la UI del Monitor lee el estado VF/PF directamente desde sysfs (`physfn`, `sriov_totalvfs`, `sriov_numvfs`, `virtfn*`)
-
-### Pre-start hook (`gpu_hook_guard_helpers.sh`)
-El guard pre-start de las VMs ahora reconoce Virtual Functions. Tanto la rama de sintaxis slot-only (que solía iterar todas las funciones del slot y exigir `vfio-pci` en todas) como la rama full-BDF saltan las VFs, de modo que Proxmox puede realizar su rebind vfio-pci por VF con normalidad. El falso bloqueo "GPU passthrough device is not ready" en VMs SR-IOV ha desaparecido.
-
-### Los scripts de mode-switch rechazan operaciones SR-IOV
-`switch_gpu_mode.sh`, `switch_gpu_mode_direct.sh`, `add_gpu_vm.sh`, `add_gpu_lxc.sh`, `vm_creator.sh`, `synology.sh`, `zimaos.sh` y `add_controller_nvme_vm.sh` rechazan ahora las VFs y las PFs con VFs activas antes de tocar la configuración del host. Un dialog claro "SR-IOV Configuration Detected" explica la situación. Para los wizards invocados en mitad de flujo (creadores de VM) el mensaje se entrega por `whiptail` para que interrumpa limpiamente, seguido de una línea `msg_warn` por dispositivo para dejar rastro en el log.
-
-### Nuevo estado "SR-IOV active" en la UI del Monitor
-La tarjeta GPU de la página Hardware gana un tercer estado visual con un color teal dedicado, una pill in-line `SR-IOV ×N` (o `SR-IOV VF` para una Virtual Function), y ramas LXC y VM en discontinuo/atenuadas. El botón Edit se oculta porque el estado está gestionado por hardware.
-
-![SR-IOV active card and modal](https://raw.githubusercontent.com/MacRimi/ProxMenux/main/images/sriov-indicator.png)
-
-### Modal dashboard para GPUs SR-IOV
-Al abrir el modal de una Physical Function con VFs activas se muestra ahora:
-- Banner de métricas agregadas ("Metrics below reflect the Physical Function, aggregate across N VFs")
-- Telemetría normal en tiempo real de la GPU para la PF
-- Una tabla **Virtual Functions**, una fila por VF, con el driver actual (`i915`, `vfio-pci`, unbound) y la VM o LXC específica que la consume, incluyendo el estado running/stopped — los consumidores se descubren cruzando entradas `hostpci` y líneas de mount `/dev/dri/renderDN` contra el BDF de la VF y el nodo DRM render
-
-Al abrir el modal de una Virtual Function se muestran su PF padre (clickable para navegar de vuelta al modal de la PF), el driver actual y el consumidor.
-
-### El popup de VM Conflict Policy ya no se dispara para VFs de SR-IOV
-La regex en `detect_affected_vms_for_selected` casaba el slot (`00:02`) contra VMs que tenían una VF (`00:02.1`) asignada, produciendo un dialog confuso "Keep GPU in VM config". Con el gate SR-IOV upstream, el flujo nunca llega a ese camino de código para slots SR-IOV.
-
----
-
-## 🔊 GPU + Audio Passthrough — Hardening de ciclo de vida completo
-
-Una ronda de fixes en torno a cómo el passthrough de GPU gestiona su dispositivo de audio acompañante. Anteriormente, solo se recogía automáticamente el hermano `.1` de una GPU discreta; el passthrough de iGPU Intel a una VM — donde el audio vive separado en el chipset en `00:1f.3` y no en `00:02.1` — se saltaba silenciosamente. En el detach, el viejo `sed` que limpiaba líneas hostpci por substring de slot también podía eliminar una GPU no relacionada cuyo BDF contuviera el slot buscado como substring (p. ej. el slot `00:02` casando dentro de `0000:02:00.0`). Ambos caminos son ahora robustos.
-
-### Checklist de audio-companion de iGPU en el attach
-`add_gpu_vm.sh::detect_optional_gpu_audio` mantiene la fast path de auto-include para el clásico hermano `.1` (NVIDIA / AMD discretas con audio HDMI en la tarjeta). Cuando no existe audio `.1`, el script ahora:
-- Escanea sysfs en busca de cada controlador PCI de audio del host
-- Salta cualquier cosa ya cubierta por el IOMMU group de la GPU
-- Pregunta al usuario mediante un `_pmx_checklist` (`dialog` en modo standalone, `whiptail` en modo wizard llamado desde `vm_creator`/`synology`/`zimaos`) qué controladores de audio pasar junto con la GPU
-- Muestra cada entrada con su driver actual en el host (`snd_hda_intel`, `snd_hda_codec_*`, etc.) para que la decisión sea informada
-- Por defecto **none** — el usuario opta activamente por incluirlos
-
-### Cascada de audio huérfano en el detach
-Cuando el usuario elige "Remove GPU from VM config" durante un mode switch, los scripts hacen ahora un seguimiento con limpieza dirigida:
-- `switch_gpu_mode.sh`, `switch_gpu_mode_direct.sh` y `add_gpu_vm.sh::cleanup_vm_config` (limpieza de la VM origen en el flujo "move GPU") llaman todos al helper compartido `_vm_list_orphan_audio_hostpci`
-- El helper usa un escaneo en dos pasadas del config de la VM: pasada 1 registra las bases de slot de las entradas hostpci display/3D; pasada 2 clasifica las entradas de audio y **salta cualquier audio cuyo slot aún tenga un hermano display en la misma VM** — protegiendo el audio HDMI de otras dGPUs que queden en la VM
-- Antes el simple match por substring habría marcado el `02:00.1` de NVIDIA como huérfano al hacer detach de una iGPU Intel en `00:02.0`
-- El flujo interactivo de switch confirma las eliminaciones con un checklist de `dialog` (por defecto ON). La variante web hace auto-remove sin preguntar — el runner no tiene buena forma de renderizar un checklist — y loguea cada BDF que ha tocado
-
-### Extensión de la cascada a vfio.conf
-Para cada audio eliminado por la cascada, los scripts de switch-mode comprueban ahora si su BDF sigue referenciado por cualquier otra VM vía `_pci_bdf_in_any_vm`. Si nada más lo usa, el `vendor:device` se añade a `SELECTED_IOMMU_IDS` antes de que se ejecute el update de `/etc/modprobe.d/vfio.conf`. Eso cierra el bucle para el caso de la iGPU Intel: `8086:51c8` (PCH HD Audio) se retira ahora de `vfio.conf` junto con `8086:46a3` (iGPU) cuando ambos salen del modo VM y ninguna otra VM los referencia. Si otra VM aún usa el audio, el ID se conserva deliberadamente — sin efectos secundarios rompedores sobre otras VMs. `add_gpu_vm.sh` NO extiende la limpieza en el flujo *move*, porque la GPU sigue en uso en otro sitio y sus IDs deben permanecer.
-
-### Regex precisa de eliminación de hostpci
-Cada `sed` inline usado para hacer detach de una GPU del config de una VM casaba antes el slot como substring libre:
-```
-/^hostpci[0-9]+:.*${slot}/d
-```
-Para `slot=00:02` ese patrón casa la substring dentro de `0000:02:00.0` (una dGPU NVIDIA no relacionada en el slot `02:00`) y borraría ambas tarjetas. El fix ancla el match a la forma BDF real:
-```
-/^hostpci[0-9]+:[[:space:]]*(0000:)?${slot}\.[0-7]([,[:space:]]|$)/d
-```
-Aplicado en `switch_gpu_mode.sh`, `switch_gpu_mode_direct.sh` y `add_gpu_vm.sh::cleanup_vm_config`. El helper basado en awk en `vm_storage_helpers.sh::_remove_pci_slot_from_vm_config` (usado por los wizards NVMe) ya usaba el patrón correcto y no necesitó cambios.
-
----
-
-## 🤖 Compatibilidad de proveedores de IA — OpenAI-Compatible, modelos Reasoning y Thinking
-
-Tres fixes coordinados que desbloquean categorías de modelos previamente rechazadas por el pipeline de mejora de notificaciones.
-
-### Endpoints OpenAI-compatible
-LiteLLM, MLX, LM Studio, vLLM, LocalAI, Ollama-proxy — el `list_models()` del proveedor exigía antes `"gpt"` en cada nombre de modelo, así que los setups locales sirviendo `mlx-community/...`, `Qwen3-...`, `mistralai/...` veían una lista de modelos vacía. Cuando se establece una Custom Base URL, la comprobación de substring `"gpt"` se omite ahora y `EXCLUDED_PATTERNS` (embeddings, whisper, tts, dall-e) es el único filtro. La capa de ruta Flask también deja de intersectar el resultado contra `verified_ai_models.json` para endpoints custom — la lista verificada solo describe los IDs oficiales de modelo de OpenAI y estaba borrando cada modelo local que el usuario realmente servía.
-
-### Modelos reasoning de OpenAI
-`o1`, `o3`, `o3-mini`, `o4-mini`, `gpt-5`, `gpt-5-mini`, `gpt-5.1`, `gpt-5.2-pro`, `gpt-5.4-nano`, etc. (excluyendo las variantes `*-chat-latest`) usan un contrato API más estricto: `max_completion_tokens` en lugar de `max_tokens`, sin `temperature`. Enviar los parámetros clásicos de chat producía HTTP 400 Bad Request para todos ellos. Un detector en `openai_provider.py` bifurca ahora el payload en consecuencia y establece `reasoning_effort: "minimal"` — por defecto estos modelos gastan su presupuesto de output en razonamiento interno y devuelven una respuesta vacía para la breve petición de traducción de notificación.
-
-### Modelos thinking de Gemini 2.5+ / 3.x
-`gemini-2.5-flash`, `2.5-pro`, `gemini-3-pro-preview`, `gemini-3.1-pro-preview`, etc. tienen "thinking" interno activado por defecto. Con el pequeño presupuesto de tokens usado para el enriquecimiento de notificaciones (≤250 tokens), el presupuesto de thinking consumía toda la asignación y el modelo devolvía output vacío con `finishReason: MAX_TOKENS`. `gemini_provider.py` establece ahora `thinkingConfig.thinkingBudget: 0` para variantes no-`lite` de 2.5+ y 3.x, de modo que los tokens disponibles van a la respuesta visible al usuario. Las variantes lite (sin thinking activado) quedan intactas.
-
----
-
-## 📋 Refresh de Verified AI Models
-
-`AppImage/config/verified_ai_models.json` refrescado para los proveedores re-testeados contra APIs en vivo. La nueva herramienta privada de mantenimiento (mantenida fuera de la AppImage) re-ejecuta un test estandarizado de translate+explain contra cada modelo que anuncia cada proveedor, clasifica pass / warn / fail, e imprime un snippet JSON listo para pegar. Re-ejecutar antes de cada release de ProxMenux para mantener la lista al día.
-
-| Provider | New recommended | Notes |
-|----------|-----------------|-------|
-| **OpenAI** | `gpt-4.1-nano` | `gpt-4.1-nano`, `gpt-4.1-mini`, `gpt-4o-mini`, `gpt-4.1`, `gpt-4o`, `gpt-5-chat-latest`, más `gpt-5.4-nano` / `gpt-5.4-mini` desde 2026-03. Snapshots con fecha y modelos legacy excluidos. Modelos reasoning soportados por el código pero no listados por defecto — más lentos / más caros sin mejorar la calidad de las notificaciones |
-| **Gemini** | `gemini-2.5-flash-lite` | `gemini-2.5-flash-lite`, `gemini-2.5-flash` (funciona ahora), `gemini-3-flash-preview`. Aliases `latest` omitidos intencionadamente — resolvían a modelos distintos entre ejecuciones y producían timeouts en algunas regiones. Las variantes Pro rechazan `thinkingBudget=0` y son excesivas para traducción de notificaciones |
-| Groq / Anthropic / OpenRouter | *sin cambios* | Marcados con un `_note` — se re-verificarán en cuanto haya keys disponibles |
-
----
-
-## 🩺 Monitor de salud de discos — Persistencia de observaciones en el journal watcher
-
-Un bug latente en `notification_events.py::_check_disk_io` hacía que los errores de I/O del kernel en tiempo real capturados por el journal watcher se superficiaran como notificaciones pero nunca se escribieran en la tabla permanente de observaciones por disco. En la práctica el escaneo paralelo periódico de dmesg solía registrar la observación poco después, pero bajo casos límite de timing (ventana de dmesg obsoleta, restart de servicio justo después del error, rotación de buffer) la observación podía perderse.
-
-El journal watcher registra ahora la observación antes del gate de cooldown de notificación de 24h, usando la misma clasificación de signature por familia (`io_<disk>_ata_connection_error`, `io_<disk>_block_io_error`, `io_<disk>_ata_failed_command`) que el escaneo periódico. Ambos caminos deduplican ahora en la misma fila vía el UPSERT en `record_disk_observation`, de modo que los conteos de ocurrencias son precisos sin importar qué detector disparó primero.
-
----
-
-## 🔧 Pulido del instalador NVIDIA
-
-### Race condition de `lsmod` silenciada
-Durante la reinstalación, la verificación de unload de módulos en `unload_nvidia_modules` producía errores espurios `lsmod: ERROR: could not open '/sys/module/nvidia_uvm/holders'` porque `lsmod` lee `/proc/modules` y luego abre el directorio `holders/` de cada módulo, que desaparece transitoriamente mientras el módulo está siendo eliminado. La comprobación lee ahora `/proc/modules` directamente e inserta sleeps cortos para dejar que el kernel finalice el unload antes de re-verificar. Aplicado en el mismo espíritu a los otros cuatro call sites de `lsmod` en el script.
-
-### Dialog → whiptail en el flujo de update LXC
-El mensaje "Insufficient Disk Space" en `update_lxc_nvidia` y la confirmación "Update NVIDIA in LXC Containers" usan ahora dialogs estilo `whiptail` consistentes con el resto del messaging in-flow, evitando la rotura visual que `dialog --msgbox` causaba al renderizarse en mitad de la secuencia en la fase de update de contenedores.
-
----
-
-## 🧵 Helper de ciclo de vida LXC — Stop seguro con timeout
-
-Un `pct stop` simple puede colgarse indefinidamente cuando el contenedor tiene un lock obsoleto de una operación abortada previa, cuando los procesos de dentro (Plex, Jellyfin, bases de datos) ignoran TERM y caen en uninterruptible-sleep mientras la GPU que estaban usando es arrancada, o cuando `pct shutdown --timeout` no es respetado por pct mismo. Reportes de campo de esperas de 5+ min durante mode switches de GPU hicieron de esto un peligro real de UX.
-
-Nuevo helper compartido `_pmx_stop_lxc <ctid> [log_file]` en `pci_passthrough_helpers.sh`:
-1. Devuelve 0 inmediatamente si el contenedor no está corriendo
-2. `pct unlock` best-effort (silencioso ante fallo) — la mayoría de contenedores no están realmente bloqueados; solo nos importan los casos en que lo están
-3. `pct shutdown --forceStop 1 --timeout 30` envuelto en un `timeout 45` externo para no esperar nunca más que eso a la fase graceful, incluso si pct se atasca en I/O del backend
-4. Verifica el estado real vía `pct status` — pct puede devolver no-cero mientras el contenedor está de hecho parado
-5. Si sigue corriendo, `pct stop` envuelto en `timeout 60`. Verificar de nuevo
-6. Devuelve 1 solo si el contenedor está realmente atascado tras ~107 s totales — el wizard continúa en lugar de colgarse
-
-Cableado en las tres rutas de modo GPU que paran LXCs durante un switch: `switch_gpu_mode.sh`, `switch_gpu_mode_direct.sh`, y `add_gpu_vm.sh::cleanup_lxc_configs`.
-
----
-
-## ⚙️ Estabilidad del prompt de reboot en `add_gpu_vm.sh`
-
-El prompt final "Reboot Required" del wizard de asignación GPU-a-VM estaba disparando reboots espurios en ciertas invocaciones de cadena de menú (`menu` → `main_menu` → `hw_grafics_menu` → `add_gpu_vm`). Con el helper `_pmx_yesno` a veces devolvía exit 0 sin que el usuario hubiera confirmado realmente, llamando `reboot` de inmediato. Con un `read` simple en su lugar el proceso quedaba suspendido por SIGTTIN cuando la cadena de menú desligaba el script del grupo de proceso foreground del terminal, dejando `[N]+ Stopped menu` en el shell padre sin posibilidad de responder.
-
-El prompt usa ahora `whiptail --yesno` invocado directamente (el patrón verificado para funcionar de forma fiable en esa cadena de menú) e inserta una pausa `Press Enter to continue ... read -r` entre la respuesta "Yes" y la llamada real a `reboot` — de modo que un Enter accidental en el botón de confirmar no puede disparar un reboot inmediato sin un paso de confirmación visible primero.
-
----
-
-### 🙏 Gracias
-
-Gracias a los usuarios que reportaron los casos de SR-IOV, LiteLLM/MLX y GPU + audio — estas mejoras existen gracias a reportes detallados y reproducibles. No dudéis en seguir reportando issues o sugiriendo mejoras 🙌.
-
----
-
-
-## 2026-04-17
-
-### Nueva versión ProxMenux v1.2.0 — *AI-Enhanced Monitoring*
-
-
-![ProxMenux AI](https://raw.githubusercontent.com/MacRimi/ProxMenux/main/images/ProxMenux_ai.png)
-
-Esta release es la culminación del ciclo beta v1.1.9.1 → v1.1.9.6 e introduce la mayor evolución de **ProxMenux Monitor** hasta la fecha: notificaciones mejoradas con IA, un sistema de notificaciones multicanal rediseñado, una experiencia de hardware y almacenamiento totalmente reelaborada, y mejoras amplias de rendimiento en todo el stack de monitorización. También consolida todo el trabajo reciente en los scripts de Storage, Hardware y GPU/TPU.
-
----
-
-## 🤖 ProxMenux Monitor — Notificaciones mejoradas con IA
-
-Las notificaciones pueden mejorarse ahora usando IA para generar mensajes claros y contextuales en lugar del output técnico crudo.
-
-Ejemplo — en lugar de `backup completed exitcode=0 size=2.3GB`, la IA produce: *"The web server backup completed successfully. Size: 2.3GB"*.
-
-### Lo que hace la IA
-- Transforma notificaciones técnicas en mensajes legibles
-- Traduce a tu idioma preferido
-- Te deja elegir el nivel de detalle: minimal, standard o detailed
-- Funciona con Telegram, Discord, Email, Pushover y Webhooks
-
-### Lo que la IA NO hace
-- **No** es un chatbot ni un asistente
-- **No** analiza tu sistema ni toma decisiones
-- **No** tiene acceso a datos más allá de la notificación que está procesando
-- **No** ejecuta comandos ni modifica el servidor
-- **No** almacena historial ni aprende de tus datos
-
-### Soporte multi-proveedor
-Elige entre 6 proveedores de IA, cada uno con su propia API key almacenada de forma independiente:
-- **Groq** — inferencia rápida, free tier generoso
-- **Google Gemini** — excelente relación calidad/precio, free tier disponible
-- **OpenAI** — estándar de la industria
-- **Anthropic Claude** — excelente para escritura y traducción
-- **OpenRouter** — 300+ modelos con una sola API key
-- **Ollama** — ejecución 100% local, sin internet
-
-### Verified AI Models
-Una lista curada de modelos (`verified_ai_models.json`) testeada específicamente para mejora de notificaciones.
-
-- **Verificación híbrida**: el sistema obtiene los modelos del lado del proveedor y filtra para mostrar solo los testeados que funcionan correctamente
-- **Memoria de modelo por proveedor**: el modelo seleccionado se guarda por proveedor, de modo que cambiar de proveedor preserva cada elección
-- **Verificación diaria**: una tarea en background comprueba la disponibilidad de modelos y migra automáticamente a una alternativa verificada si el modelo actual desaparece
-- **Modelos incompatibles excluidos**: Whisper, TTS, image/video, embeddings, guard models, etc. se filtran por proveedor
-
-| Provider | Recommended | Also Verified |
-|----------|-------------|---------------|
-| Gemini | gemini-2.5-flash-lite | gemini-flash-lite-latest |
-| OpenAI | gpt-4o-mini | gpt-4.1-mini |
-| Groq | llama-3.3-70b-versatile | llama-3.1-70b-versatile, llama-3.1-8b-instant, llama3-70b-8192, llama3-8b-8192, mixtral-8x7b-32768, gemma2-9b-it |
-| Anthropic | claude-3-5-haiku-latest | claude-3-5-sonnet-latest, claude-3-opus-latest |
-| OpenRouter | meta-llama/llama-3.3-70b-instruct | meta-llama/llama-3.1-70b-instruct, anthropic/claude-3.5-haiku, google/gemini-flash-2.5-flash-lite, openai/gpt-4o-mini, mistralai/mixtral-8x7b-instruct |
-| Ollama | (todos los modelos locales) | Sin filtrado — muestra todos los modelos instalados |
-
-### Custom AI Prompts
-Los usuarios avanzados pueden definir su propio prompt para tener control total sobre el formato y la traducción.
-
-- **Selector de Prompt Mode** — Default Prompt o Custom Prompt
-- **Export / Import** — guarda y comparte prompts custom entre instalaciones
-- **Example Template** — punto de partida para construir tu propio prompt
-- **Community Prompts** — enlace directo a GitHub Discussions para compartir plantillas
-- El selector de idioma se oculta en modo Custom Prompt (defines el idioma de salida en el propio prompt)
-
-### Contexto enriquecido
-- El **uptime** del sistema se incluye solo para eventos de error/warning (no informativos) — ayuda a distinguir errores de arranque vs runtime
-- Tracking de **frecuencia de eventos** — indica problemas recurrentes vs puntuales
-- Datos de **SMART disk health** pasados para errores relacionados con discos
-- La base de datos de **errores conocidos de Proxmox** mejora la precisión del diagnóstico
-- Instrucciones de prompt más claras para prevenir alucinaciones de la IA
-
----
-
-## 📨 Rediseño del sistema de notificaciones
-
-- **Arquitectura multicanal** — canales Telegram, Discord, Pushover, Email y Webhook corriendo simultáneamente
-- **Configuración por evento** — habilita/deshabilita tipos de evento específicos por canal
-- **Channel Overrides** — personaliza el comportamiento de notificación por canal
-- **Endpoint webhook seguro** — sistemas externos pueden enviar notificaciones autenticadas
-- **Almacenamiento cifrado** — API keys y datos sensibles guardados cifrados
-- **Procesamiento basado en cola** — worker en background con reintento automático para notificaciones fallidas
-- **Almacenamiento de config basado en SQLite** — reemplaza el config basado en ficheros para mayor fiabilidad
-
-### Soporte de Telegram Topics
-Envía notificaciones a un topic específico dentro de grupos con Topics habilitado.
-- Nuevo campo **Topic ID** en el canal Telegram
-- Detección automática de grupos con topics habilitados
-- Totalmente retrocompatible
-
-### Notificaciones de update de ProxMenux
-El Monitor detecta ahora cuándo se publica una nueva versión de ProxMenux.
-- **Doble canal** — monitoriza tanto stable (`version.txt`) como beta (`beta_version.txt`)
-- **Integración con GitHub** — compara versiones locales vs remotas
-- **Dashboard Update Indicator** — el logo de ProxMenux cambia a una variante de update cuando se detecta una nueva versión (no intrusivo, sin popups)
-- **Estado persistente** — el estado se guarda en `config.json`, reseteado por los scripts de update
-- Un único toggle en Settings controla ambos canales (habilitado por defecto)
-
----
-
-## 🖥️ Panel de Hardware — Detección ampliada
-
-La página Hardware se ha ampliado significativamente, con mejor detección y detalle por dispositivo más rico.
-
-- **Controladoras SCSI / SAS / RAID** — modelo, driver y slot PCI mostrados en la sección de storage controllers
-- **Detección de PCIe Link Speed** — los drives NVMe muestran la velocidad de link actual (generación PCIe y ancho de carriles), facilitando detectar drives que rinden por debajo por ancho de banda limitado del slot
-- **Modal de detalle de disco mejorado** — los drives NVMe, SATA, SAS y USB exponen ahora sus campos específicos (info de link PCIe, versión/velocidad SAS, tipo de interfaz) en lugar de una vista genérica
-- **Reconocimiento más inteligente de tipo de disco** — etiquetado uniforme para NVMe SSDs, SATA SSDs, HDDs y discos extraíbles
-- **Caching de Hardware Info** (`lspci`, `lspci -vmm`) — la caché de 5 min evita escaneos repetidos de datos que no cambian
-
----
-
-## 💽 Storage Overview — Salud, observaciones, exclusiones
-
-El Storage Overview se ha reelaborado en torno al estado en tiempo real y al tracking controlado por el usuario.
-
-### Alineación del estado de salud de disco
-- Los badges reflejan ahora el estado **actual** SMART reportado por Proxmox, no un peor histórico
-- **Observaciones preservadas** — los hallazgos históricos siguen accesibles vía el badge "X obs."
-- **Recuperación automática** — cuando SMART reporta healthy de nuevo, el disco muestra inmediatamente **Healthy**
-- Eliminado el viejo tracking `worst_health` que requería limpieza manual
-
-### Mejoras del registro de discos
-- **Lookup inteligente por serial** — cuando un serial es desconocido el sistema comprueba si existe una entrada con serial antes de insertar una nueva
-- **Sin duplicados** — previene entradas separadas para el mismo disco apareciendo con/sin serial
-- **Soporte de discos USB** — gestiona drives USB que pueden aparecer bajo nombres de dispositivo distintos entre reboots
-
-### Exclusiones de Storage e interfaces de Red
-- Sección **Storage Exclusions** — excluye drives de la monitorización de salud y notificaciones
-- **Network Interface Exclusions** — nueva sección para excluir interfaces (bridges `vmbr`, bonds, NICs físicas, VLANs) de salud y notificaciones; ideal para interfaces deshabilitadas intencionadamente que de otro modo generarían falsas alertas
-- **Toggles separados** por ítem para Health monitoring y Notifications
-
-### Robustez en la detección de discos
-- **Validación de Power-On-Hours** — detecta y corrige valores absurdamente grandes (miles de millones de horas) en drives con codificación SMART no estándar
-- **Bit masking inteligente** — extrae el valor correcto de drives que empaquetan info extra en bytes altos
-- **Fallback elegante** — muestra "N/A" en lugar de números imposibles cuando los datos no pueden parsearse
-
----
-
-## 🧠 Monitor de salud y ciclo de vida de errores
-
-### Limpieza de errores obsoletos
-Los errores de recursos que ya no existen se resuelven ahora automáticamente.
-- **VMs / CTs eliminadas** — los errores relacionados se auto-resuelven cuando se elimina el recurso
-- **Discos retirados** — los errores de drives USB desconectados o hot-swap se limpian
-- **Cambios de cluster** — los errores de cluster se limpian cuando un nodo abandona el cluster
-- **Patrones de log** — los errores basados en logs se auto-resuelven tras 48 horas sin recurrencia
-- **Updates de seguridad** — las notificaciones de update se auto-resuelven tras 7 días
-
-### Sistema de migración de base de datos
-- **Detección automática de columnas** — las columnas faltantes se añaden en el arranque
-- **Compatibilidad de schema** — funciona tanto con convenciones de nombrado de columna antiguas como nuevas
-- **Retrocompatible** — se soportan bases de datos de versiones anteriores de ProxMenux
-- **Migración elegante** — sin pérdida de datos durante updates de schema
-
----
-
-## 🧩 Modal de detalle VM / CT
-
-El modal de detalle VM/CT se ha rediseñado por completo para mejorar la usabilidad.
-
-- **Navegación con tabs** — *Overview* (información general, estado, uso de recursos) y *Backups* (historial dedicado)
-- **Mejoras visuales** — iconos en todo, jerarquía y espaciado mejorados, mejor distinción VM vs CT
-- **Adaptación a móvil** — se adapta correctamente a pantallas móviles tanto en webapp como en acceso directo por navegador, sin más overflow en dispositivos pequeños
-- **Controles touch-friendly** — botones y espaciado mayores
-
-### Modal de Secure Gateway
-- **Lista de storage con scroll** cuando hay muchos destinos disponibles
-- Layout adaptado a móvil y jerarquía visual mejorada
-
-### Conexión de terminal
-- **Fix de bucle de reconexión** que afectaba a dispositivos móviles
-- Manejo mejorado de WebSocket para navegadores móviles
-- Recuperación más elegante de timeouts de conexión
-
-### Gestión de Fail2ban y Lynis
-- **Botones de delete** añadidos en Settings para ambas herramientas
-- Eliminación limpia de paquetes y ficheros de configuración
-- Dialog de confirmación para prevenir borrado accidental
-
----
-
-## ⚡ Optimizaciones de rendimiento
-
-Reducción importante de uso de CPU y eliminación de picos en el Monitor.
-
-### Intervalos de polling escalonados
-Los collectors corren ahora en schedules con offset para prevenir ejecución simultánea:
-
-| Collector | Schedule |
-|-----------|----------|
-| CPU sampling | Cada 30s en offset 0 |
-| Temperature sampling | Cada 15s en offset 7s |
-| Latency pings | Cada 60s en offset 25s |
-| Temperature record | Cada 60s en offset 40s |
-| Health collector | Arranca en offset 55s |
-| Notification polling | Health=10s, Updates=30s, ProxMenux=45s, AI=50s |
-
-### Información de sistema cacheada
-Los comandos costosos se cachean ahora para reducir ejecución repetida:
-
-| Command | Cache TTL | Impact |
-|---------|-----------|--------|
-| `pveversion` | 6 horas | Elimina picos de CPU del 23%+ por ejecución de Perl |
-| `apt list --upgradable` | 6 horas | Reduce consultas del gestor de paquetes |
-| `pvesh get /cluster/resources` | 30 segundos | 6 llamadas API por request reducidas a 1 |
-| `sensors` | 10 segundos | Lecturas de temperatura cacheadas entre polls |
-| `smartctl` (SMART health) | 30 minutos | Health checks de disco reducidos desde cada 5 min |
-| `lspci` / `lspci -vmm` | 5 minutos | Info de hardware cacheada (no cambia) |
-| `journalctl --since 24h` | 1 hora | Conteo de intentos de login cacheado (92% de reducción) |
-
-### Timeouts de journalctl aumentados
-Previene cascadas de timeout bajo carga del sistema:
-
-| Query Type | Before | After |
-|------------|--------|-------|
-| Short-term (3-10 min) | 3s | 10s |
-| Medium-term (1 hour) | 5s | 15s |
-| Long-term (24 hours) | 5s | 20s |
-
-### Frecuencia de polling reducida
-- Intervalo de `TaskWatcher` subido de **2s → 5s** (60% menos comprobaciones)
-
-### GitHub Actions
-- Todas las actions de workflow actualizadas a **v6** para compatibilidad con Node.js 24
-- Warnings de deprecación eliminados en CI/CD
-
----
-
-## 🧰 Scripts — Trabajo en Storage, Hardware y GPU/TPU
-
-Esta release también consolida trabajo significativo en los scripts core de ProxMenux.
-
-### Scripts de Storage
-- **Tests SMART programados** y flujo interactivo de test SMART mejorado con feedback de progreso más claro
-- Reelaboración de **formateo de disco** (`format-disk.sh`) con selección de dispositivo más segura y flujo de dialog
-- **Disk passthrough** para VMs y CTs — enumeración de dispositivos actualizada, identificación basada en serial, y teardown más limpio
-- **Adición de controladora NVMe para VMs** — selección de tipo de controladora y detección de slot mejoradas
-- **Import disk image** — validación de path más suave y reporte de progreso
-- Refresh de la guía manual de **Disk & storage**
-
-### Scripts de Hardware / GPU / TPU
-- **Coral TPU installer** actualizado para kernels y udev rules actuales (Proxmox VE 8 & VE 9)
-- **NVIDIA installer** — instalación de driver más limpia, manejo de kernel headers, y flujo de attachment VM/LXC
-- **GPU mode switch** (variantes directa e interactiva) — switching más seguro entre modos iGPU
-- **Add GPU to VM / LXC** — dialogs de selección unificados y gestión de permisos
-- **Herramientas de GPU Intel / AMD** mantenidas en sync con los nuevos patrones compartidos
-- **Hardware & graphics menu** reestructurado para consistencia con el resto de ProxMenux
-
-
-## 2026-03-14
-
-### Nueva versión v1.1.9 — *Helper Scripts Catalog Rebuilt*
-
-### Cambiado
-
-- **Helper Scripts Menu — Reconstrucción completa del catálogo**
-  El catálogo de Helper Scripts se ha reconstruido por completo para adaptarse a la nueva arquitectura de datos del proyecto [Community Scripts](https://community-scripts.github.io/ProxmoxVE/).
-
-  La implementación previa dependía de un fichero `metadata.json` que ya no existe en el repositorio upstream. El catálogo conecta ahora directamente a la **API de PocketBase** (`db.community-scripts.org`), que es la nueva fuente de datos oficial del proyecto.
-
-  Un nuevo workflow de GitHub Actions genera un índice local `helpers_cache.json` que reemplaza la antigua dependencia de metadata. Esta nueva caché es más rica, más estructurada, e incluye:
-  - Tipo de script, slug, descripción, notas y credenciales por defecto
-  - Variantes de OS por script (p. ej. Debian, Alpine) — cada una mostrada como una opción seleccionable separada en el menú
-  - URL directa de GitHub y **URL Mirror** (`git.community-scripts.org`) para cada script
-  - Nombres de categoría embebidos directamente en la caché — sin necesidad de requests externos para construir el menú
-  - Metadata adicional: puerto por defecto, website, logo, soporte de update, disponibilidad ARM
-
-  Los scripts que soportan múltiples variantes de OS (p. ej. Docker con Alpine y Debian) muestran ahora correctamente **una entrada por OS**, cada una con su propia opción de descarga GitHub y Mirror — restaurando el comportamiento que existía antes de la migración upstream.
-
----
-
-### 🎖 Reconocimiento especial
-
-Esta actualización no habría sido posible sin la apertura y colaboración de los mantenedores de **Community Scripts**.
-
-Cuando la estructura de metadata upstream cambió y rompió el catálogo de ProxMenux, los mantenedores respondieron rápidamente, explicaron la nueva arquitectura en detalle y proporcionaron toda la información necesaria para reconstruir la integración limpiamente.
-
-Agradecimientos especiales a:
-
-- **MickLeskCanbiZ ([@MickLesk](https://github.com/MickLesk))** — por documentar la nueva estructura de path de scripts por tipo y slug, y por la guía técnica clara y directa.
-- **Michel Roegl-Brunner ([@michelroegl-brunner](https://github.com/michelroegl-brunner))** — por explicar la nueva estructura de colecciones de PocketBase (`script_scripts`, `script_categories`).
-
-El proyecto Helper Scripts es un recurso extraordinario para la comunidad Proxmox. Los scripts pertenecen enteramente a sus autores y mantenedores — ProxMenux simplemente ofrece una forma guiada de descubrirlos y lanzarlos. Todo el crédito va a la comunidad detrás de [community-scripts/ProxmoxVE](https://github.com/community-scripts/ProxmoxVE).
-
-## 2025-09-18
-
-### Nueva versión v1.1.8 — *ProxMenux Offline Mode*
-
-![ProxMenux Offline](https://macrimi.github.io/ProxMenux/ProxMenux_offline.png)
-
----
-
-### Añadido
-
-- **Modo de ejecución offline (sin dependencia de GitHub)**  
-  Todos los scripts core de ProxMenux se ejecutan ahora **enteramente en local**, sin requerir requests en vivo a GitHub (`raw.githubusercontent.com`).  
-  Este cambio proporciona:
-  - Mayor estabilidad durante la ejecución
-  - Sin interrupciones por timeouts de red o bloqueos regionales de GitHub
-  - Soporte para **entornos offline o aislados**
-
-  ⚠️ Esta actualización resuelve issues recientes donde usuarios en ciertas regiones eran incapaces de ejecutar scripts debido a errores de CDN o filtrado TLS al descargar ficheros `.sh` desde URLs raw de GitHub.
-
-  **🎖 Reconocimiento especial: @cod378**  
-  Esta conversión offline ha sido posible gracias al extraordinario trabajo de **@cod378**,  
-  que rediseñó toda la lógica interna del installer y el updater, refactorizó el sistema de gestión de ficheros,  
-  e implementó el nuevo workflow de ejecución totalmente local.  
-  Sin su colaboración, dedicación y aportación técnica, esta transformación no habría sido posible.
-
-- **ProxMenux Monitor v1.0.1**  
-  Esta actualización trae un gran salto en la interfaz de **ProxMenux Monitor**.  
-  Nuevas funciones y mejoras:
-  - `Proxy Support`: Accede a ProxMenux a través de proxies inversos con plena funcionalidad
-  - `Authentication System`: Asegura tu dashboard con protección por contraseña
-  - `Two-Factor Authentication (2FA)`: Soporte opcional TOTP para mayor seguridad
-  - `PCIe Link Speed Detection`: Ver velocidades de conexión NVMe y detectar cuellos de botella de rendimiento
-  - `Enhanced Storage Display`: Auto-formatea tamaños de disco (GB → TB cuando corresponde)
-  - `SATA/SAS Interface Info`: Detecta y muestra el tipo de storage (SATA, SAS, NVMe, etc.)
-  - `Health Monitoring System`: Health check integrado del sistema con alertas descartables
-  - Renderizado mejorado entre navegadores y mejor rendimiento
-
-- **Helper Scripts Menu (Mirror Support)**  
-  El menú `Helper Scripts` ahora:
-  - Detecta **URLs mirror** y muestra opciones de descarga alternativas cuando están disponibles
-  - Lista las versiones de OS disponibles cuando un helper script depende de la versión (p. ej. instaladores de plantillas)
-
----
-
-### Arreglado
-
-- Fixes menores y refinamientos a lo largo del codebase para asegurar compatibilidad offline total y una experiencia de usuario más suave.
-
-
-
-## 2025-09-04
-
-### Nueva versión v1.1.7
-
-### Añadido
-
-- **ProxMenux Monitor**  
-  Tu nueva herramienta de monitorización para Proxmox. Descubre todas las funciones que te ayudarán a gestionar y supervisar tu infraestructura eficientemente.
-
-  ProxMenux Monitor está diseñado para soportar futuras actualizaciones donde **se puedan disparar acciones sin usar el terminal**, gestionadas a través de una **interfaz amigable** accesible en múltiples formatos y dispositivos.
-
-  Accede en: **http://your-server-ip:8008**
-
-  ![ProxMenux Monitor](https://macrimi.github.io/ProxMenux/monitor/welcome.png)
-- **Nuevo método de eliminación de banner**  
-  Una nueva función para deshabilitar el mensaje de suscripción de Proxmox con seguridad mejorada:
-  - Crea un backup completo antes de modificar ningún fichero
-  - Muestra un warning claro de que pueden producirse breaking changes con futuras actualizaciones de la GUI
-  - Si la GUI no carga, el usuario puede revertir los cambios por SSH desde el menú post-install usando la herramienta **"Uninstall Options → Restore Banner"**
-
-  Gracias especiales a **@eryonki** por proporcionar el método mejorado.
-
----
-
-### Mejorado
-
-- **CORAL TPU Installer actualizado para PVE 9**  
-  El instalador del driver CORAL TPU soporta ahora tanto **Proxmox VE 8 como VE 9**, asegurando compatibilidad con los kernels y udev rules más recientes.
-
-- **Instalación e integración de Log2RAM**  
-  - La instalación de Log2RAM es ahora idempotente y puede ejecutarse con seguridad múltiples veces.
-  - Ajusta automáticamente la configuración de `journald` para alinearse con el tamaño y comportamiento de Log2RAM.
-  - Asegura que el journaling esté correctamente afinado para evitar overflows o agotamiento de RAM en sistemas con poca memoria.
-
-- **Función de optimización de Red (LXC + NFS)**  
-  Mejorada para prevenir warnings de "martian source" en setups donde **contenedores LXC comparten storage con VMs** vía NFS dentro del mismo servidor.
-
-- **Progreso de APT Upgrade**  
-  Al ejecutar actualizaciones completas del sistema vía ProxMenux, se muestra ahora una **barra de progreso en tiempo real**, dando al usuario visibilidad clara del proceso de update.
-
----
-
-### Arreglado
-
-- Otras pequeñas mejoras y fixes para optimizar el rendimiento en runtime y eliminar bugs menores.
-
-
-
-## 2025-01-10
-
-### Nueva versión v1.1.6
-
-![Shared Resources Menu](https://macrimi.github.io/ProxMenux/share/main-menu.png)
-
-
-### Añadido
-
-- **Nuevo menú: Mount and Share Manager**  
-  Introducido un nuevo menú integral para gestionar recursos compartidos entre el host Proxmox y los contenedores LXC:
-
-  **Opciones de configuración del host:**
-  - **Configure NFS Shared on Host** - Añadir, ver y eliminar recursos NFS compartidos en el servidor Proxmox con gestión automática de exports
-  - **Configure Samba Shared on Host** - Añadir, ver y eliminar recursos Samba/CIFS compartidos en el servidor Proxmox con configuración de share
-  - **Configure Local Shared on Host** - Crear y gestionar directorios locales compartidos con los permisos adecuados en el host Proxmox
-
-  **Opciones de integración LXC:**
-  - **Configure LXC Mount Points (Host ↔ Container)** - **Función core** que permite montar directorios del host dentro de contenedores LXC con gestión automática de permisos. Incluye la capacidad de **ver los mount points existentes** para cada contenedor de forma clara y organizada y **eliminar mount points** con verificación apropiada de que el proceso se completó con éxito. Especialmente optimizado para **contenedores no privilegiados** donde el mapeo UID/GID es crítico.
-  - **Configure NFS Client in LXC** - Configura un cliente NFS dentro de contenedores privilegiados
-  - **Configure Samba Client in LXC** - Configura un cliente Samba dentro de contenedores privilegiados
-  - **Configure NFS Server in LXC** - Instala servidor NFS dentro de contenedores privilegiados
-  - **Configure Samba Server in LXC** - Instala servidor Samba dentro de contenedores privilegiados
-
-  **Documentación y soporte:**
-  - **Help & Info (commands)** - Guías integrales con instrucciones manuales paso a paso para todos los escenarios de compartición
-
-  Todo el sistema está construido en torno a la funcionalidad de **LXC Mount Points**, que detecta automáticamente los tipos de filesystem, gestiona el mapeo de permisos entre usuarios del host y del contenedor, y proporciona integración fluida tanto para contenedores privilegiados como no privilegiados.
-
----
-
-### Mejorado
-
-- **Mejora de auto-detección de Log2RAM**  
-  En el script automático de post-install, la función de instalación de Log2RAM ahora pregunta al usuario cuando la detección automática de disco ssd/m2 falla.
-  Esto asegura que Log2RAM pueda instalarse aún en sistemas donde la detección automática de disco no funciona correctamente.
-
----
-
-### Arreglado
-
-- **Verificación del repositorio de updates de Proxmox**  
-  Arreglado un issue en la función de update de Proxmox donde los ficheros source vacíos del repositorio causaban errores durante la verificación de conflictos. La función gestiona ahora correctamente ficheros vacíos de `/etc/apt/sources.list.d/` sin lanzar falsos warnings.
-
-  Gracias a **@JF_Car** por reportar este issue.
-
----
-
-### Reconocimientos
-
-Gracias especiales a **@JF_Car**, **@ghosthvj** y **@jonatanc** por sus pruebas, feedback valioso y sugerencias que ayudaron a refinar la funcionalidad de recursos compartidos y a mejorar la experiencia general de usuario.
-
-
-
-## 2025-08-20
-
-### Nueva versión v1.1.5
-
-### Añadido
-
-- **Nuevo script: Upgrade PVE 8 a PVE 9**  
-  Añadida una herramienta de upgrade completa ubicada bajo `Utilities and Tools`. Proporciona:
-  1. **Upgrade automático** de PVE 8 a 9
-  2. **Upgrade interactivo** con confirmaciones paso a paso
-  3. **Modo check-only** usando `check-pve8to9`
-  4. **Instrucciones manuales** mostradas en orden para usuarios que prefieren actualizar manualmente
-
-- **Nuevas herramientas en System Utilities**
-  - [`s-tui`](https://github.com/amanusk/s-tui): Monitorización de CPU basada en terminal con gráficas
-  - [`intel-gpu-tools`](https://gitlab.freedesktop.org/drm/igt-gpu-tools): Útil para diagnósticos de GPU Intel
-
----
-
-### Mejorado
-
-- **Gestión de APT Upgrade**  
-  La función de upgrade de PVE bloquea ahora el proceso si algún paquete pide confirmación manual. Esto evita upgrades parciales y asegura consistencia.
-
-- **Optimización de Red (sysctl)**  
-  - Parámetros de kernel obsoletos eliminados (p. ej. `tcp_tw_recycle`, `nf_conntrack_helper`) para prevenir warnings en **Proxmox 9 / kernel 6.14**
-  - Ahora genera solo parámetros sysctl válidos y al día
-
-- **Gestión de Patch de CPU AMD**  
-  - Aplica ahora `idle=nomwait` correcto y opciones KVM (`ignore_msrs=1`, `report_ignored_msrs=0`)
-  - El warning esperado está ahora documentado y gestionado con seguridad para estabilidad con Ryzen/EPYC
-
-- **Fixes de Timezone y NTP**  
-  - Detecta automáticamente la timezone usando geolocalización por IP pública
-  - Fallback a UTC si la detección falla
-  - Reinicia Postfix tras establecer la timezone → resuelve el warning de mismatch `/var/spool/postfix/etc/localtime`
-
-- **Lógica del Repository & Package Installer**  
-  - Verifica ahora que existan repositorios funcionales antes de instalar ningún paquete
-  - Si no hay ninguno disponible, añade un repositorio **Debian stable** como fallback
-  - Reemplaza el obsoleto `mlocate` por `plocate` (compatible con Debian 13 y Proxmox 9)
-
-- **Logs y Feedback de usuario mejorados**  
-  - Las acciones que fallan proporcionan ahora mensajes precisos (en lugar de marcarse falsamente como éxito)
-  - Ayuda a los usuarios a entender claramente qué se ha aplicado o saltado
-
-
-
-## 2025-08-06
-
-### Nueva versión v1.1.4
-
-### Añadido
-
-- **Preparación de compatibilidad con Proxmox 9**  
-  Esta versión prepara **ProxMenux** para el próximo **Proxmox VE 9**:
-  - La función para añadir los repositorios oficiales de Proxmox soporta ahora el nuevo formato `.sources` usado en Proxmox 9, manteniendo retrocompatibilidad con Proxmox 8.
-  - La eliminación de banner se soporta ahora opcionalmente para Proxmox 9.
-
-- **Detección de xshok-proxmox**  
-  Añadida una comprobación para detectar si el script post-install `xshok-proxmox` ya ha sido ejecutado.  
-  Si se detecta, se muestra un warning para evitar ajustes conflictivos:
-
-  ```
-  It appears that you have already executed the xshok-proxmox post-install script on this system.
-
-  If you continue, some adjustments may be duplicated or conflict with those already made by xshok.
-
-  Do you want to continue anyway?
-  ```
-
----
-
-### Mejorado
-
-- **Eliminación de banner (Proxmox 8.4.9+)**  
-  Actualizada la lógica para eliminar el banner de suscripción en **Proxmox 8.4.9**, debido a cambios en `proxmoxlib.js`.
-
-- **LXC Disk Passthrough (UUID persistente)**  
-  La función para añadir un disco físico a un contenedor LXC usa ahora **paths persistentes basados en UUID**.  
-  Esto asegura que los discos permanezcan correctamente montados, incluso si el orden `/dev/sdX` cambia por hardware nuevo.
-
-  ```bash
-  PERSISTENT_DISK=$(get_persistent_path "$DISK")
-  if [[ "$PERSISTENT_DISK" != "$DISK" ]] ...
-  ```
-
-- **System Utilities Installer**  
-  Comprueba ahora si las sources APT están disponibles antes de instalar las herramientas seleccionadas.  
-  Si una nueva instalación de Proxmox no tiene repos activos, **añadirá automáticamente las sources por defecto** para evitar fallos de instalación.
-
-- **Activación de IOMMU en sistemas ZFS**  
-  La función que habilita IOMMU para passthrough verifica ahora los parámetros de kernel existentes para evitar duplicación si el usuario ya los ha configurado manualmente.
-
----
-
-### Arreglado
-
-- Limpieza de código menor y rendimiento de runtime mejorado en varios módulos.
-
-
-
-## 2025-07-20
-
-### Cambiado
-
-- **Eliminación del banner de suscripción (Proxmox 8.4.5+)**  
-  Mejorada la función `remove_subscription_banner` para asegurar compatibilidad con Proxmox 8.4.5, donde el método de eliminación de banner fallaba tras instalaciones limpias.
-
-- **Detección de Log2RAM mejorada**  
-  Tanto en los scripts post-install automático como personalizable, se ha mejorado la lógica para la instalación de Log2RAM.  
-  Ahora detecta correctamente si Log2RAM ya está configurado y evita disparar errores o reconfiguración.
-
-- **Instalación de Figurine optimizada**  
-  La función `install_figurine` evita ahora duplicar entradas en `.bashrc` si la personalización del prompt root ya existe.
-
-
-### Añadido
-
-- **Nueva función: Nombrado persistente de interfaces de Red**  
-  Añadida una nueva función `setup_persistent_network` para crear nombres de interfaz de red estables usando ficheros `.link` basados en direcciones MAC.  
-  Esto evita renombrados impredecibles (p. ej. `enp2s0` convirtiéndose en `enp3s0`) cuando cambia el hardware, se reordena la topología PCI o se aplican configuraciones de passthrough.
-
-  **¿Por qué usar ficheros `.link`?**  
-  Porque los nombres predecibles de interfaz en `systemd` pueden cambiar con reordenamientos o reemplazos de hardware. Usar ficheros `.link` estáticos atados a direcciones MAC asegura consistencia, especialmente en sistemas con múltiples NICs o setups de passthrough.
-
-  Gracias especiales a [@Andres_Eduardo_Rojas_Moya] por contribuir la función de nombrado  
-  de red persistente y por la idea original.
-
-```bash
-[Match]
-MACAddress=XX:XX:XX:XX:XX:XX
-
-[Link]
-Name=eth0
-```
-
-
-## 2025-07-01
-
-### Nueva versión v1.1.3
-
-![Installer Menu](https://macrimi.github.io/ProxMenux/install/install.png)
-
-- **Dos modos de instalación para ProxMenux**  
-  El installer ofrece ahora dos modos distintos:  
-  1. **Versión Lite (sin traducciones):** Solo instala dos paquetes oficiales de Debian (`dialog`, `jq`) para habilitar menús y parsing JSON. No se escriben ficheros más allá del directorio de configuración.  
-  2. **Versión Full (con traducciones):** Usa un virtual environment y permite seleccionar el idioma de interfaz durante la instalación.  
-
-  Al actualizar, si el usuario cambia de full a lite, la versión vieja se **eliminará automáticamente** para una transición limpia.
-
-### Añadido
-
-- **Nuevo script: Setup automatizado de post-instalación**  
-  Un nuevo script post-install minimal que realiza el setup esencial automáticamente:  
-  - Upgrade y sync del sistema  
-  - Eliminar el banner enterprise  
-  - Optimizar APT, journald, logrotate, límites del sistema  
-  - Mejorar gestión de kernel panic, ajustes de memoria, entropía, red  
-  - Añadir tweaks a `.bashrc` y **auto-instalación de Log2RAM** (si se detecta SSD/M.2)
-
-- **Nueva función: Configuración de Log2RAM**  
-  Disponible ahora tanto en los scripts post-install personalizable como automático.  
-  En sistemas con SSD/NVMe, Log2RAM se **habilita automáticamente** para preservar la vida del disco.
-
-- **Nuevos menús:**
-  - 🧰 **System Utilities Menu**  
-    Permite a los usuarios seleccionar e instalar herramientas CLI útiles con validación de comando apropiada.
-  - 🌐 **Network Configuration & Repair**  
-    Un nuevo menú interactivo para analizar y reparar interfaces de red.
-
-### Mejorado
-
-- **Lógica del menú Post-Install**  
-  Las opciones están ahora agrupadas más lógicamente para mejor usabilidad.
-
-- **Menú VM Creation**  
-  Mejorado con soporte mejorado de modelo de CPU y opciones custom.
-
-- **Script UUP Dump ISO Creator**  
-  - Añadida opción para **personalizar la ubicación de la carpeta temporal**  
-  - Arreglado un issue donde se eliminaba la carpeta temp entera en lugar de solo el contenido  
-    💡 Sugerido por [@igrokit](https://github.com/igrokit)  
-    [#17](https://github.com/MacRimi/ProxMenux/issues/17), [#11](https://github.com/MacRimi/ProxMenux/issues/11)
-
-- **Script Physical Disk to LXC**  
-  Gestiona ahora **discos formateados con XFS** correctamente.  
-  ¡Gracias a [@antroxin](https://github.com/antroxin) por reportar y testear!
-
-- **System Utilities Installer**  
-  Reescrito para **verificar la disponibilidad del comando** tras la instalación, asegurando que las herramientas funcionen como se espera.  
-  🐛 Fix para [#18](https://github.com/MacRimi/ProxMenux/issues/18) por [@DST73](https://github.com/DST73)
-
-### Arreglado
-
-- **Habilitar IOMMU en ZFS**  
-  La detección y configuración para habilitar IOMMU en sistemas basados en ZFS es ahora totalmente funcional.  
-  🐛 Fix para [#15](https://github.com/MacRimi/ProxMenux/issues/15) por [@troponaut](https://github.com/troponaut)
-
-### Otros
-
-- Mejoras de rendimiento y limpieza de código en varios módulos.
-
-
-
-## 2025-06-06
-
-### Añadido
-
-- **Nuevo menú: Proxmox PVE Helper Scripts**  
-  Introducido oficialmente el nuevo menú **Proxmox PVE Helper Scripts**, reemplazando el anterior: Esenciales Proxmox.  
-  Este nuevo menú incluye:
-  - Búsqueda de script por nombre en tiempo real
-  - Navegación basada en categoría
-
-  Es una forma más limpia, rápida y funcional de acceder a los scripts de la comunidad en Proxmox.
-
-  ![Helper Scripts Menu](https://macrimi.github.io/ProxMenux/menu-helpers-script.png)
-
-
-- **Nuevos modelos de CPU en VM Creation**  
-  El menú de selección de CPU en VM creation ha sido ampliado considerablemente para soportar perfiles avanzados de CPU QEMU y x86-64.  
-  Esto permite mejor compatibilidad con sistemas guest modernos y fine-tuning del rendimiento para workloads específicos, incluyendo virtualización anidada y funciones asistidas por hardware.
-
-
-  ![CPU Config](https://macrimi.github.io/ProxMenux/vm/config-cpu.png)
-
-  Gracias a **@Nida Légé (Nidouille)** por sugerir esta mejora.
-
-
-- **Soporte para imágenes de disco `.raw`**  
-  La herramienta de import de disco para VMs soporta ahora ficheros `.raw`, además de `.img`, `.qcow2` y `.vmdk`.  
-  Esto mejora la compatibilidad cuando se trabaja con exports de disco de otros hypervisors o herramientas de backup.
-
-  💡 Sugerido por **@guilloking** en [GitHub Issue #5](https://github.com/MacRimi/ProxMenux/issues/5)
-
-
-- **Detección de Locale al saltarse idiomas**  
-  La función que deshabilita idiomas extra de APT incluye ahora:
-  - Detección automática de locale (`LANG`)
-  - Auto-generación de `en_US.UTF-8` si no se encuentra ninguno
-  - Previene warnings durante ejecución de scripts debido a locale indefinido
-
-
-### Mejorado
-
-- **Lógica de saltado de idioma APT**  
-  La gestión mejorada de locale asegura compatibilidad del sistema antes de deshabilitar traducciones:
-  ```bash
-  if ! locale -a | grep -qi "^${default_locale//-/_}$"; then
-      echo "$default_locale UTF-8" >> /etc/locale.gen
-      locale-gen "$default_locale"
-  fi
-  ```
-
-- **Velocidad de System Update**  
-  Los upgrades de sistema post-install son ahora más rápidos:  
-  - El proceso de upgrade (`dist-upgrade`) está separado de las actualizaciones de índice de plantillas de contenedor.
-  - El refresh de índice es ahora una función opcional seleccionada en el script.
-
-
-
-## 2025-05-27
-
-### Arreglado
-- **URL de ISO de Kali Linux actualizada**  
-  Arreglada la URL de descarga incorrecta para el ISO de Kali Linux en el módulo de instalador Linux. El nuevo path correcto es:  
-  ```
-  https://cdimage.kali.org/kali-2025.1c/kali-linux-2025.1c-installer-amd64.iso
-  ```
-
-### Mejorado
-- **Transiciones de menú dialog más rápidas**  
-  Mejorada la respuesta UI en todos los menús interactivos reemplazando `whiptail` por `dialog`, ofreciendo transiciones más rápidas y navegación más suave.
-
-- **Soporte Coral USB en LXC**  
-  Mejorada la lógica para configurar passthrough de Coral USB TPU en contenedores LXC:
-  - Refactorizada la configuración en bloques modulares con mejor estructura y comentarios inline.
-  - Separación clara de la lógica de Coral USB (`/dev/coral`) y Coral M.2 (`/dev/apex_0`).
-  - Mantiene retrocompatibilidad con configuraciones LXC existentes.
-  - Introducido passthrough Coral USB persistente usando una udev rule:
-    ```bash
-    # Create udev rule for Coral USB
-    SUBSYSTEM=="usb", ATTRS{idVendor}=="18d1", ATTRS{idProduct}=="9302", MODE="0666", TAG+="uaccess", SYMLINK+="coral"
-    
-    # Map /dev/coral if it exists
-    if [ -e /dev/coral ]; then
-        echo "lxc.mount.entry: /dev/coral dev/coral none bind,optional,create=file" >> "$CONFIG_FILE"
-    fi
-    ```
-  - Gracias especiales a **@Blaspt** por validar el passthrough Coral USB persistente y por sugerir el uso del symlink `/dev/coral`.
-
-
-### Añadido
-- **Soporte de passthrough Coral USB persistente**  
-  Añadido soporte de udev rule para dispositivos Coral USB para mapearlos persistentemente como `/dev/coral`, habilitando passthrough consistente entre reboots. Este path se detecta y mapea automáticamente en la configuración del contenedor.
-
-- **Integración de RSS Feed**  
-  Añadido soporte para generar un RSS feed para el changelog, permitiendo a los usuarios mantenerse informados de updates a través de clientes de noticias.
-
-- **Automatización del Release Service**  
-  Implementado un nuevo servicio de gestión de release para automatizar la publicación y tagging de versiones, empezando con la versión **v1.1.2**.
-
-
-## 2025-05-13
-
-### Arreglado
-
-- **Fix de startup en versiones recientes de Proxmox**\
-  Arreglado un issue donde algunas instalaciones recientes de Proxmox carecían del directorio `/usr/local/bin`, causando errores al instalar el menú de ejecución. El script crea ahora el directorio si no existe antes de descargar el menú principal.\
-  Gracias a **@danielmateos** por detectar y reportar este issue.
-
-### Mejorado
-
-- **Lógica de instalación de Lynis actualizada en Post-Install Settings**\
-  La función `install_lynis()` se ha mejorado para instalar siempre la **última versión** de Lynis clonando el repositorio oficial de GitHub:
-  ```
-  https://github.com/CISOfy/lynis.git
-  ```
-  El proceso de instalación asegura ahora que siempre se obtenga la última versión y se enlace correctamente dentro del path del sistema.
-
-  Gracias a **@Kamunhas** por reportar esta oportunidad de mejora.
-
-- **Optimización de memoria equilibrada para sistemas con poca memoria**  
-  Mejorados los ajustes de memoria por defecto para soportar mejor sistemas con RAM limitada. La configuración previa podía impedir que servidores de bajas specs arrancaran. Ahora se usa un conjunto más equilibrado de parámetros de kernel, y la compactación de memoria se habilita si el sistema la soporta.
-
-  ```bash
-  cat <<EOF | sudo tee /etc/sysctl.d/99-memory.conf
-  # Balanced Memory Optimization
-  vm.swappiness = 10
-  vm.dirty_ratio = 15
-  vm.dirty_background_ratio = 5
-  vm.overcommit_memory = 1
-  vm.max_map_count = 65530
-  EOF
-
-  # Enable memory compaction if supported by the system
-  if [ -f /proc/sys/vm/compaction_proactiveness ]; then
-    echo "vm.compaction_proactiveness = 20" | sudo tee -a /etc/sysctl.d/99-memory.conf
-  fi
-
-  # Apply settings
-  sudo sysctl -p /etc/sysctl.d/99-memory.conf
-  ```
-
-  Estos valores ayudan a mantener la capacidad de respuesta y la estabilidad del sistema incluso en condiciones de memoria constreñidas.
-
-  Gracias a **@chesspeto** por señalar este issue y ayudar a refinar la optimización.
-
-
-## 2025-05-04
-
-### Añadido
-- **Menú interactivo Help & Info**  
-  Añadido un nuevo script llamado `Help and Info`, que proporciona un menú interactivo de referencia de comandos para Proxmox VE a través de una interfaz basada en dialog.  
-  Esta herramienta ofrece a los usuarios una forma rápida de navegar y copiar comandos útiles para gestionar y mantener su servidor Proxmox, todo en una ubicación centralizada.
-
-  ![Help and Info Menu](https://macrimi.github.io/ProxMenux/help/help-info-menu.png)
-
-  *Figura 1: Menú interactivo de referencia de comandos Help and Info.*
-
-- **Uninstaller para utilidades Post-Install**  
-  Se ha añadido un nuevo script al menú **Post-instalación**, permitiendo a los usuarios desinstalar utilidades o paquetes que se instalaron previamente a través del script post-install.
-
-### Mejorado
-- **Menú de selección de utilidades en el script de Post-instalación**  
-  La sección `Install Common System Utilities` incluye ahora un menú donde los usuarios pueden elegir qué utilidades instalar, en lugar de instalar todas por defecto. Esto da más control sobre lo que se añade al sistema.
-
-- **Detección de PV Header antiguo y auto-fix**  
-  Tras actualizar el sistema, el script post-update incluye ahora una comprobación de seguridad para discos físicos con headers LVM PV (Physical Volume) obsoletos.  
-  Este issue puede ocurrir cuando las máquinas virtuales tienen acceso passthrough a discos y modifican involuntariamente la metadata del volumen. El script detecta y actualiza ahora automáticamente estos headers.  
-  Si ocurre algún error durante el proceso, se muestra un warning al usuario.
-
-- **Traducciones más rápidas en menús**  
-  Varios menús de post-instalación con auto-traducciones se han optimizado para reducir tiempos de carga y mejorar la experiencia de usuario.
-
-
-## 2025-04-14
-
-### Añadido
-- **Nuevo script: Disk Passthrough a un CT**
-Introducido un nuevo script que permite asignar un disco físico dedicado a un contenedor (CT) en Proxmox VE.
-Esta utilidad lista los discos físicos disponibles (excluyendo los discos de sistema y montados), permite al usuario seleccionar un contenedor y un disco, y luego formatea o reutiliza el disco antes de montarlo dentro del CT en un path especificado.
-Soporta detección de filesystems existentes y asegura que los permisos estén correctamente configurados. Ideal para casos de uso como contenedores Samba, Nextcloud, o de videovigilancia.
-
-### Mejorado  
-- Identificación visual de discos para passthrough a VMs
-Mejorada la lógica de detección de discos en el script Disk Passthrough a una VM incluyendo indicadores visuales y metadata.
-Los discos muestran ahora tags como ⚠ In use, ⚠ RAID, ⚠ LVM, o ⚠ ZFS, facilitando reconocer su estado actual de un vistazo. Esto ayuda a prevenir errores de selección y mejora la claridad para el usuario.
-
-## 2025-03-24  
-### Mejorado  
-- Mejorada la lógica para detectar discos físicos en el script **Disk Passthrough a una VM**. Anteriormente, el script mostraba en algunos setups discos que ya estaban montados en el sistema. Esta actualización asegura que solo se muestren discos no montados en Proxmox, previniendo confusión y conflictos potenciales.  
-
-- Esta mejora asegura que los discos ya montados o asignados a otras VMs se excluyan de la lista de discos disponibles, proporcionando un proceso de selección más preciso y fiable.
-
-## [1.1.1] - 2025-03-21
-### Mejorado
-- Mejorada la lógica del script post-install para prevenir sobrescribir o añadir ajustes duplicados si ajustes similares ya están configurados por el usuario.
-- Añadida una nota de warning a la documentación explicando que usar diferentes scripts post-instalación no se recomienda para evitar conflictos y ajustes duplicados.
-
-### Añadido
-- **Crear VM Synology DSM**:  
-  Un nuevo script que crea una VM para instalar Synology DSM. El script automatiza el proceso de descargar tres loaders distintos con la opción de usar un loader custom proporcionado por el usuario desde las opciones de almacenamiento local.  
-  Además, permite el uso tanto de discos virtuales como físicos, que son asignados automáticamente por el script.  
-
-  ![VM description](https://macrimi.github.io/ProxMenux/vm/synology/dsm_desc.png)
-  
-  *Figura 1: Resumen del setup de la VM Synology DSM.*
-
-- **Nuevo menú VM Creation**:  
-  Se ha creado un nuevo menú para habilitar la creación de VM desde plantillas o scripts custom.
-
-- **Actualización del menú principal**:  
-  Añadida una nueva entrada al menú principal para acceder al menú de creación de VM desde plantillas o scripts.
-
-## 2025-03-06
-### Añadido
-- Completada la sección de documentación web para ampliar la información sobre scripts actualizados.
-
-## [1.1.0] - 2025-03-04
-### Añadido
-- Creado un script post-install personalizable para Proxmox con 10 secciones y 35 opciones seleccionables distintas.
-
-## [1.0.7] - 2025-02-17
-### Añadido
-- Creado un menú con scripts esenciales de la comunidad Proxmox VE Helper-Scripts.
-
-## [1.0.6] - 2025-02-10
-### Añadido
-- Añadido soporte de traducción en tiempo real usando Google Translate.
-- Modificados los scripts existentes para soportar múltiples idiomas.
-- Actualizado el script de instalación para instalar y configurar:
-  - `jq` (para gestionar datos JSON)
-  - Python 3 y virtual environment (requerido para traducciones)
-  - Google Translate (`googletrans`) (para soporte multi-idioma)
-- Introducido soporte para los siguientes idiomas:
-  - English
-  - Spanish
-  - French
-  - German
-  - Italian
-  - Portuguese
-- Creado un script de utilidad para funciones auxiliares que soportan la ejecución de menús y scripts.
-
-## [1.0.5] - 2025-01-31
-### Añadido
-- Añadido el script **Repair Network**, que incluye:
-  - Verify Network
-  - Show IP Information
-- Creado el **Network Menu** para gestionar funciones relacionadas con la red.
-
-## [1.0.4] - 2025-01-20
-### Añadido
-- Creado un script para añadir un disco passthrough a una VM.
-- Creado el **Storage Menu** para gestionar funciones relacionadas con almacenamiento.
-
-## [1.0.3] - 2025-01-13
-### Añadido
-- Creado un script para importar imágenes de disco en una VM.
-
-## [1.0.2] - 2025-01-09
-### Modificado
-- Actualizado el **script de configuración de Coral TPU** para:
-  - Incluir también el setup de Intel iGPU.
-  - Instalar drivers de GPU para aplicaciones de videovigilancia para soportar VAAPI y QuickSync.
-- Añadida una función para **desinstalar ProxMenux**.
-
-## [1.0.1] - 2025-01-03
-### Añadido
-- Creado un script para añadir **soporte Coral TPU en un LXC** para uso en programas de videovigilancia.
-
-## [1.0.0] - 2024-12-18
-### Añadido
-- Release inicial de **ProxMenux**.
-- Creado un script para añadir **drivers Coral TPU** a Proxmox.
diff --git a/lang/fr.json b/lang/fr.json
new file mode 100644
index 00000000..5db308ac
--- /dev/null
+++ b/lang/fr.json
@@ -0,0 +1,5231 @@
+{
+  "# Alternative if you prefer screen": "# Alternative si vous préférez l'écran",
+  "# Recommended: avoids disconnection during upgrade": "# Recommandé : évite la déconnexion lors de la mise à niveau",
+  "(Checked entries will be removed. Uncheck to keep in VM.)": "(Les entrées cochées seront supprimées. Décochez pour conserver dans la VM.)",
+  "(Import is selected by default — required for disk image imports)": "(L'importation est sélectionnée par défaut - requise pour les importations d'images disque)",
+  "(Only the host directory is modified. Nothing inside the container is changed.": "(Seul le répertoire hôte est modifié. Rien à l’intérieur du conteneur n’est modifié.",
+  "(common default on Debian/LXC: PermitRootLogin prohibit-password).": "(par défaut courant sur Debian/LXC : PermitRootLogin prohibit-password).",
+  "(disabled)": "(désactivé)",
+  "(e.g.": "(par ex.",
+  "(for unprivileged LXCs)": "(pour les LXC non privilégiés)",
+  "(if only privileged LXCs need write access)": "(si seuls les LXC privilégiés ont besoin d'un accès en écriture)",
+  "(make.log not found — DKMS may have failed before invoking make)": "(make.log introuvable — DKMS a peut-être échoué avant d'invoquer make)",
+  "(need ≥ 1024MB)": "(besoin ≥ 1024 Mo)",
+  "(no credentials file — guest mode)": "(pas de fichier d'informations d'identification - mode invité)",
+  "(none)": "(aucun)",
+  "(not mounted — will be mounted)": "(non monté – sera monté)",
+  "(only on SSD/NVMe) to protect your disk": "(uniquement sur SSD/NVMe) pour protéger votre disque",
+  "(parent PF:": "(PF parent :",
+  "(recommended)": "(recommandé)",
+  "(same MAC — restored config adjusted automatically)": "(même MAC – config restaurée ajustée automatiquement)",
+  ")": ")",
+  "+ Add a path": "+ Ajouter un chemin",
+  "+ Add new Borg target": "+ Ajouter une nouvelle cible Borg",
+  "+ Add new PBS manually": "+ Ajouter un nouveau PBS manuellement",
+  "- Delete a saved target": "- Supprimer une cible enregistrée",
+  "/backup": "/sauvegarde",
+  "/etc/exports file does not exist.": "Le fichier /etc/exports n'existe pas.",
+  "/etc/fstab updated — permissions will persist after reboot": "/etc/fstab mis à jour — les autorisations persisteront après le redémarrage",
+  "/etc/network controls active interfaces. Applying may immediately change or drop network connectivity, including active SSH sessions.": "/etc/network contrôle les interfaces actives. La candidature peut immédiatement modifier ou abandonner la connectivité réseau, y compris les sessions SSH actives.",
+  "/etc/network/interfaces uses allow-hotplug. Renaming interfaces via systemd .link can break that flow — review the file after reboot.": "/etc/network/interfaces utilise allow-hotplug. Renommer les interfaces via systemd .link peut interrompre ce flux – examinez le fichier après le redémarrage.",
+  "/etc/pve is managed by pmxcfs (cluster filesystem). Applying this on a running node can corrupt cluster state. Use 'Export to file' and apply it manually during a maintenance window.": "/etc/pve est géré par pmxcfs (système de fichiers cluster). L'appliquer sur un nœud en cours d'exécution peut corrompre l'état du cluster. Utilisez « Exporter vers un fichier » et appliquez-le manuellement pendant une fenêtre de maintenance.",
+  "/etc/samba/smb.conf file does not exist.": "Le fichier /etc/samba/smb.conf n'existe pas.",
+  "/var/lib/pve-cluster is live cluster data. Never restore this while the node is running. Use 'Export to file' for manual recovery only.": "/var/lib/pve-cluster sont des données de cluster en direct. Ne restaurez jamais cela pendant que le nœud est en cours d'exécution. Utilisez « Exporter vers un fichier » pour la récupération manuelle uniquement.",
+  "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump (chemin vzdump par défaut de Proxmox)",
+  "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump (Proxmox par défaut)",
+  "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = bit collant + rwx pour tous. Aucun groupe partagé n’est nécessaire.",
+  "====== PVE UPDATE COMPLETED ======": "====== MISE À JOUR PVE TERMINÉE ======",
+  "A VirtIO ISO already exists. Do you want to overwrite it?": "Un ISO VirtIO existe déjà. Voulez-vous l'écraser ?",
+  "A ZFS pool with this name already exists.": "Un pool ZFS portant ce nom existe déjà.",
+  "A ZFS pool with this name already exists:": "Un pool ZFS portant ce nom existe déjà :",
+  "A complete restore will:": "Une restauration complète :",
+  "A host reboot is required after this change.": "Un redémarrage de l'hôte est requis après cette modification.",
+  "A host reboot is required before starting the VM. Reboot now?": "Un redémarrage de l'hôte est requis avant de démarrer la VM. Redémarrer maintenant ?",
+  "A job with this ID already exists.": "Une tâche avec cet ID existe déjà.",
+  "A keyfile is installed at:": "Un fichier de clés est installé à :",
+  "A newer version is available:": "Une version plus récente est disponible :",
+  "A reboot is required after installation to load the new kernel modules.": "Un redémarrage est requis après l'installation pour charger les nouveaux modules du noyau.",
+  "A reboot is required for VFIO binding to take effect. Do you want to restart now?": "Un redémarrage est requis pour que la liaison VFIO prenne effet. Voulez-vous redémarrer maintenant ?",
+  "A reboot is required to apply the new GPU mode. Do you want to restart now?": "Un redémarrage est nécessaire pour appliquer le nouveau mode GPU. Voulez-vous redémarrer maintenant ?",
+  "A reboot is required to finish the restore.": "Un redémarrage est nécessaire pour terminer la restauration.",
+  "A reboot will be required to complete the restore.": "Un redémarrage sera nécessaire pour terminer la restauration.",
+  "A server reboot is recommended for all changes to take full effect.": "Un redémarrage du serveur est recommandé pour que toutes les modifications prennent pleinement effet.",
+  "A system reboot is recommended to ensure all changes take effect.": "Un redémarrage du système est recommandé pour garantir que toutes les modifications prennent effet.",
+  "ACL Status:": "Statut de la liste de contrôle d'accès :",
+  "ACL permissions applied for local access for user:": "Autorisations ACL appliquées pour l'accès local pour l'utilisateur :",
+  "ADVANCED SETTINGS COMPLETE": "PARAMÈTRES AVANCÉS TERMINÉS",
+  "ALL DATA ON": "TOUTES LES DONNÉES SUR",
+  "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "TOUTES LES DONNÉES SUR CE DISQUE SERONT PERMANENTES DÉFINITIVEMENT !",
+  "ALL Utilities": "TOUS les utilitaires",
+  "AMD CPU detected": "Processeur AMD détecté",
+  "AMD CPU fixes applied successfully": "Correctifs du processeur AMD appliqués avec succès",
+  "AMD GPU Tools installation completed!": "Installation des outils GPU AMD terminée !",
+  "AMD GPU passthrough configured.": "Passthrough GPU AMD configuré.",
+  "AMD GPU(s) detected:": "GPU(s) AMD détecté(s) :",
+  "AMD fixes have been successfully reverted": "Les correctifs AMD ont été annulés avec succès",
+  "AMD mesa drivers installed.": "Pilotes AMD mesa installés.",
+  "AMD softdep configured": "AMD softdep configuré",
+  "AMD softdep configured in /etc/modprobe.d/vfio.conf": "AMD softdep configuré dans /etc/modprobe.d/vfio.conf",
+  "ANALYSIS SUMMARY": "RÉSUMÉ DE L'ANALYSE",
+  "API returned an invalid timezone": "L'API a renvoyé un fuseau horaire non valide",
+  "API tokens (Home Assistant, scripts) will keep working.": "Les jetons API (Home Assistant, scripts) continueront de fonctionner.",
+  "APT IPv4 configuration completed": "Configuration APT IPv4 terminée",
+  "APT IPv4 configuration removed": "Configuration APT IPv4 supprimée",
+  "APT and repositories": "APT et référentiels",
+  "APT configured to skip additional languages": "APT configuré pour ignorer les langues supplémentaires",
+  "APT configured to skip downloading additional languages": "APT configuré pour ignorer le téléchargement de langues supplémentaires",
+  "APT configured to use IPv4": "APT configuré pour utiliser IPv4",
+  "APT index update failed after switching to no-subscription. See log:": "La mise à jour de l'index APT a échoué après le passage en mode sans abonnement. Voir le journal :",
+  "APT index update failed. See log:": "La mise à jour de l'index APT a échoué. Voir le journal :",
+  "APT indexes updated for Trixie": "Index APT mis à jour pour Trixie",
+  "APT indexes updated for Trixie (no-subscription)": "Index APT mis à jour pour Trixie (sans abonnement)",
+  "APT language configuration already set": "Configuration du langage APT déjà définie",
+  "APT language configuration updated": "Configuration du langage APT mise à jour",
+  "APT language downloads restored": "Téléchargements de langues APT restaurés",
+  "APT package lists updated": "Listes de packages APT mises à jour",
+  "Aborted": "Avorté",
+  "About to restore": "Sur le point de restaurer",
+  "Absolute directory path to use as backup target:": "Chemin du répertoire absolu à utiliser comme cible de sauvegarde :",
+  "Absolute path to a file or directory you want backed up:": "Chemin absolu vers un fichier ou un répertoire que vous souhaitez sauvegarder :",
+  "Accept routes from other nodes?": "Accepter les routes d'autres nœuds ?",
+  "Access Scope:": "Portée d'accès :",
+  "Access profile:": "Profil d'accès :",
+  "Account is not locked": "Le compte n'est pas verrouillé",
+  "Action cancelled due to previous xshok-proxmox modifications.": "Action annulée en raison de modifications précédentes de xshok-proxmox.",
+  "Action:": "Action:",
+  "Activate Monitor": "Activer le moniteur",
+  "Activate ProxMenux Monitor": "Activer le moniteur ProxMenux",
+  "Active": "Actif",
+  "Active Connections": "Connexions actives",
+  "Active exports:": "Exportations actives :",
+  "Active session:": "Séance active :",
+  "Add Audio Passthrough": "Ajouter un relais audio",
+  "Add CIFS storage:": "Ajoutez un stockage CIFS :",
+  "Add Controller or NVMe (PCI passthrough)": "Ajouter un contrôleur ou NVMe (passthrough PCI)",
+  "Add Controller or NVMe PCIe to VM": "Ajouter un contrôleur ou NVMe PCIe à la VM",
+  "Add Coral TPU to LXC": "Ajouter du corail TPU à LXC",
+  "Add GPU to LXC": "Ajouter un GPU à LXC",
+  "Add GPU to LXC   (Intel | AMD | NVIDIA)": "Ajouter un GPU à LXC (Intel | AMD | NVIDIA)",
+  "Add GPU to VM    (Intel | AMD | NVIDIA)": "Ajouter un GPU à la VM (Intel | AMD | NVIDIA)",
+  "Add Local Disk   as Proxmox Storage": "Ajouter un disque local comme stockage Proxmox",
+  "Add Local Disk (Proxmox storage + host mount)": "Ajouter un disque local (stockage Proxmox + montage hôte)",
+  "Add Local Disk as Host Mount (for LXC bind-mounts)": "Ajouter un disque local en tant que support hôte (pour les montages liés LXC)",
+  "Add Local Disk as Proxmox Storage": "Ajouter un disque local comme stockage Proxmox",
+  "Add NFS Share as Proxmox Storage": "Ajouter le partage NFS en tant que stockage Proxmox",
+  "Add NFS share    as Proxmox Storage": "Ajouter le partage NFS en tant que stockage Proxmox",
+  "Add NFS storage:": "Ajoutez du stockage NFS :",
+  "Add PBS": "Ajouter du PBS",
+  "Add Samba Share as Proxmox Storage": "Ajouter le partage Samba comme stockage Proxmox",
+  "Add Samba share  as Proxmox Storage": "Ajouter le partage Samba en tant que stockage Proxmox",
+  "Add as IDE": "Ajouter en tant qu'EDI",
+  "Add as SATA": "Ajouter en tant que SATA",
+  "Add as SCSI": "Ajouter en tant que SCSI",
+  "Add as VirtIO": "Ajouter en tant que VirtIO",
+  "Add as disk (standard)": "Ajouter en tant que disque (standard)",
+  "Add bind mount to container:": "Ajoutez un montage de liaison au conteneur :",
+  "Add color prompts and useful aliases to the terminal environment": "Ajoutez des invites de couleur et des alias utiles à l'environnement du terminal",
+  "Add custom path": "Ajouter un chemin personnalisé",
+  "Add disk to LXC container": "Ajouter un disque au conteneur LXC",
+  "Add explicit privileged flag (optional but recommended):": "Ajoutez un indicateur privilégié explicite (facultatif mais recommandé) :",
+  "Add export rule:": "Ajouter une règle d'exportation :",
+  "Add iSCSI Target as Proxmox Storage": "Ajouter une cible iSCSI comme stockage Proxmox",
+  "Add iSCSI storage in Proxmox Storage": "Ajouter un stockage iSCSI dans Proxmox Storage",
+  "Add iSCSI storage in Proxmox:": "Ajoutez du stockage iSCSI dans Proxmox :",
+  "Add import disk": "Ajouter un disque d'importation",
+  "Add latest Ceph support": "ajouter la dernière prise en charge de Ceph",
+  "Add new PVE 9 enterprise repository (deb822 format) (Only if using enterprise):": "Ajouter un nouveau référentiel d'entreprise PVE 9 (format deb822) (uniquement si vous utilisez Enterprise) :",
+  "Add physical disk to VM via": "Ajouter un disque physique à la VM via",
+  "Add share block in /etc/samba/smb.conf:": "Ajoutez un bloc de partage dans /etc/samba/smb.conf :",
+  "Add unprivileged flag to container configuration:": "Ajoutez un indicateur sans privilèges à la configuration du conteneur :",
+  "Add virtual disk": "Ajouter un disque virtuel",
+  "Add: Mount Host Directory into LXC": "Ajouter : Monter le répertoire hôte dans LXC",
+  "Added to /etc/fstab": "Ajouté à /etc/fstab",
+  "Added to /etc/fstab for permanent mounting.": "Ajouté à /etc/fstab pour un montage permanent.",
+  "Added to /etc/fstab using UUID": "Ajouté à /etc/fstab en utilisant l'UUID",
+  "Added to /etc/fstab using device path": "Ajouté à /etc/fstab en utilisant le chemin du périphérique",
+  "Added to /etc/fstab.": "Ajouté à /etc/fstab.",
+  "Added user": "Utilisateur ajouté",
+  "Adding": "Ajout",
+  "Adding CIFS storage to Proxmox...": "Ajout du stockage CIFS à Proxmox...",
+  "Adding QEMU Guest Agent support...": "Ajout de la prise en charge de l'agent invité QEMU...",
+  "Adding disk using the generated command to the selected VM": "Ajout d'un disque à l'aide de la commande générée à la VM sélectionnée",
+  "Adding existing users to sharedfiles group...": "Ajout d'utilisateurs existants au groupe de fichiers partagés...",
+  "Adding iSCSI storage to Proxmox...": "Ajout du stockage iSCSI à Proxmox...",
+  "Adding new share to smb.conf...": "Ajout d'un nouveau partage à smb.conf...",
+  "Adding this NVMe as a PCIe device (via 'Add Controller or NVMe PCIe to VM') gives better performance.": "L'ajout de ce NVMe en tant que périphérique PCIe (via « Ajouter un contrôleur ou NVMe PCIe à la VM ») donne de meilleures performances.",
+  "Adding to /etc/fstab for permanent mounting...": "Ajout à /etc/fstab pour un montage permanent...",
+  "Additional audio function(s) to be added": "Fonction(s) audio supplémentaire(s) à ajouter",
+  "Adjust network/CIDR to your environment.": "Ajustez le réseau/CIDR à votre environnement.",
+  "Adjust options if needed (vers=4,hard,timeo,...).": "Ajustez les options si nécessaire (vers=4,hard,timeo,...).",
+  "Adjusting systemd-journald limits to match Log2RAM size...": "Ajustement des limites du journal système pour correspondre à la taille de Log2RAM...",
+  "Adjusts journald log level if needed (Proxmox defaults may block auth logs)": "Ajuste le niveau de journalisation du journal si nécessaire (les valeurs par défaut de Proxmox peuvent bloquer les journaux d'authentification)",
+  "Advanced": "Avancé",
+  "Advanced Diagnostics": "Diagnostic avancé",
+  "Advanced Network Diagnostics": "Diagnostics réseau avancés",
+  "Affected LXC containers": "Conteneurs LXC concernés",
+  "After completing GPU setup, start the VM manually when the host is ready.": "Après avoir terminé la configuration du GPU, démarrez la VM manuellement lorsque l'hôte est prêt.",
+  "After confirming, you will be asked to choose the NVIDIA driver version to install.": "Après confirmation, il vous sera demandé de choisir la version du pilote NVIDIA à installer.",
+  "After detailed analysis, no changes are needed.": "Après une analyse détaillée, aucune modification n’est nécessaire.",
+  "After detailed analysis, no cleanup is needed.": "Après une analyse détaillée, aucun nettoyage n’est nécessaire.",
+  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Après vous être connecté, exécutez : ip a pour obtenir l'adresse IP.\nEnsuite, saisissez cette adresse IP dans votre navigateur Web comme ceci :\n  http://ADRESSE_IP\n\nCela ouvrira le tableau de bord Umbral OS.",
+  "After pasting on the server, ensure the file is chmod 600 and owned by": "Après avoir collé sur le serveur, assurez-vous que le fichier est chmod 600 et appartient à",
+  "After reboot the system will be fully accessible (SSH, web UI, login), but the following components will be reinstalled in BACKGROUND — until they finish, commands like nvidia-smi may not yet be available:": "Après le redémarrage, le système sera entièrement accessible (SSH, interface utilisateur Web, connexion), mais les composants suivants seront réinstallés en ARRIÈRE-PLAN — jusqu'à ce qu'ils soient terminés, des commandes comme nvidia-smi peuvent ne pas encore être disponibles :",
+  "After reboot, these components will reinstall in background:": "Après le redémarrage, ces composants seront réinstallés en arrière-plan :",
+  "After reboot, verify PVE version:": "Après le redémarrage, vérifiez la version PVE :",
+  "After switching mode, reboot the host if requested.": "Après avoir changé de mode, redémarrez l'hôte si demandé.",
+  "After that, run this script again to add it.": "Après cela, exécutez à nouveau ce script pour l'ajouter.",
+  "After the reboot you can follow the post-restore work live from ProxMenux Monitor → Backups tab (estimated time, per-component status, log tail, rollback delta).": "Après le redémarrage, vous pouvez suivre le travail post-restauration en direct depuis ProxMenux Monitor → onglet Sauvegardes (durée estimée, état par composant, queue du journal, delta de restauration).",
+  "After the reboot, you will only be able to access the Proxmox host via:": "Après le redémarrage, vous ne pourrez accéder à l'hôte Proxmox que via :",
+  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Après ce commutateur LXC → VM, redémarrez l'hôte afin que le nouvel état de liaison soit appliqué proprement.",
+  "Aliases added to .bashrc": "Alias ​​ajoutés à .bashrc",
+  "All": "Tous",
+  "All Available Scripts": "Tous les scripts disponibles",
+  "All GPUs Already Assigned": "Tous les GPU déjà attribués",
+  "All ProxMenux optimizations are up to date.": "Toutes les optimisations de ProxMenux sont à jour.",
+  "All block devices:": "Tous les appareils bloqués :",
+  "All changes applied. No reboot required.": "Toutes les modifications ont été appliquées. Aucun redémarrage requis.",
+  "All changes are reversible using the ProxMenux uninstaller.": "Toutes les modifications sont réversibles à l'aide du programme de désinstallation ProxMenux.",
+  "All dependencies installed and verified.": "Toutes les dépendances installées et vérifiées.",
+  "All detected GPUs are already assigned to this VM.": "Tous les GPU détectés sont déjà attribués à cette VM.",
+  "All detected controllers/NVMe are already present in the selected VM.": "Tous les contrôleurs/NVMe détectés sont déjà présents dans la VM sélectionnée.",
+  "All disks may already be in use or mounted.": "Tous les disques sont peut-être déjà utilisés ou montés.",
+  "All images imported and configured successfully": "Toutes les images importées et configurées avec succès",
+  "All imports failed": "Toutes les importations ont échoué",
+  "All partitions and metadata removed.": "Toutes les partitions et métadonnées supprimées.",
+  "All physical interfaces from backup are present on target": "Toutes les interfaces physiques de la sauvegarde sont présentes sur la cible",
+  "All types      (images, backup, iso, vztmpl, snippets)": "Tous types (images, sauvegarde, iso, vztmpl, snippets)",
+  "All user-installed packages from the backup are present on this host": "Tous les packages installés par l'utilisateur à partir de la sauvegarde sont présents sur cet hôte",
+  "All users with UID and GID": "Tous les utilisateurs avec UID et GID",
+  "Allocate CPU Cores": "Allouer des cœurs de processeur",
+  "Allocate RAM in MiB": "Allouer de la RAM en MiB",
+  "Already Mounted": "Déjà monté",
+  "Already configured": "Déjà configuré",
+  "Already installed — skipping": "Déjà installé – sauter",
+  "Also comment any remaining 'bookworm' entries in *.list if present.": "Commentez également toutes les entrées « bookworm » restantes dans *.list si elles sont présentes.",
+  "Also install the VirtIO network driver during setup to enable network access.": "Installez également le pilote réseau VirtIO lors de l'installation pour activer l'accès au réseau.",
+  "Although VFIO can bind to this device, full passthrough to a VM is": "Bien que VFIO puisse se lier à cet appareil, le relais complet vers une VM est",
+  "Amount of RAM in MiB (default: 4096)": "Quantité de RAM en MiB (par défaut : 4096)",
+  "An AMD dedicated GPU has been detected without FLR support": "Un GPU dédié AMD a été détecté sans prise en charge FLR",
+  "An AMD integrated GPU (APU) has been detected": "Un GPU intégré (APU) AMD a été détecté",
+  "An Intel dedicated GPU has been detected without FLR support": "Un GPU dédié Intel a été détecté sans prise en charge FLR",
+  "An fstab entry already exists for:": "Une entrée fstab existe déjà pour :",
+  "Analysis Tools": "Outils d'analyse",
+  "Analyze Bridge Configuration": "Analyser la configuration du pont",
+  "Analyze Network Configuration": "Analyser la configuration du réseau",
+  "Analyzing Bridge Configuration - READ ONLY MODE": "Analyse de la configuration du pont - MODE LECTURE SEULE",
+  "Analyzing Network Configuration - READ ONLY MODE": "Analyse de la configuration réseau - MODE LECTURE SEULE",
+  "Analyzing selected disks...": "Analyse des disques sélectionnés...",
+  "Analyzing system for available PCIe storage devices...": "Système d'analyse des périphériques de stockage PCIe disponibles...",
+  "Apply": "Appliquer",
+  "Apply AMD CPU fixes": "appliquer les correctifs du processeur AMD",
+  "Apply Available Updates": "Appliquer les mises à jour disponibles",
+  "Apply and restart services:": "Appliquer et redémarrer les services :",
+  "Apply available updates": "appliquer les mises à jour disponibles",
+  "Apply boot/initramfs changes": "Appliquer les modifications de démarrage/initramfs",
+  "Apply fix now?": "Appliquer le correctif maintenant ?",
+  "Apply fix now? (The share will be briefly remounted)": "Appliquer le correctif maintenant ? (Le partage sera brièvement remonté)",
+  "Apply network optimizations": "appliquer les optimisations du réseau",
+  "Apply read+write access for 'others' on the host directory?": "Appliquer un accès en lecture et en écriture aux « autres » sur le répertoire hôte ?",
+  "Applying AMD-specific fixes...": "Application de correctifs spécifiques à AMD...",
+  "Applying Changes": "Application des modifications",
+  "Applying Controller/NVMe passthrough to VM": "Application du relais Controller/NVMe à la VM",
+  "Applying balanced memory optimization settings...": "Application des paramètres d'optimisation de la mémoire équilibrée...",
+  "Applying changes safely...": "Appliquer les modifications en toute sécurité...",
+  "Applying custom restore": "Application d'une restauration personnalisée",
+  "Applying default VM configuration": "Application de la configuration de VM par défaut",
+  "Applying host permissions for unprivileged LXC bind-mounts...": "Application des autorisations d'hôte pour les montages de liaison LXC non privilégiés...",
+  "Applying optimized logrotate configuration...": "Application de la configuration de rotation optimisée...",
+  "Applying passthrough to CT": "Application du relais au CT",
+  "Applying safe paths and preparing pending restore": "Application de chemins sécurisés et préparation de la restauration en attente",
+  "Applying selected LXC switch action": "Application de l'action du commutateur LXC sélectionnée",
+  "Archive deleted.": "Archive supprimée.",
+  "Archive extracted.": "Archive extraite.",
+  "Archive format": "Format d'archives",
+  "Archive ready": "Archiver prêt",
+  "Archive size:": "Taille des archives :",
+  "Archive:": "Archive:",
+  "Are you absolutely sure?": "Etes-vous absolument sûr ?",
+  "Are you sure you want to continue?": "Êtes-vous sûr de vouloir continuer ?",
+  "Are you sure you want to delete this export?": "Êtes-vous sûr de vouloir supprimer cette exportation ?",
+  "Are you sure you want to delete this share?": "Êtes-vous sûr de vouloir supprimer ce partage ?",
+  "Are you sure you want to remove these configurations?": "Êtes-vous sûr de vouloir supprimer ces configurations ?",
+  "Are you sure you want to restore this backup?\nCurrent configuration will be overwritten.": "Êtes-vous sûr de vouloir restaurer cette sauvegarde ?\nLa configuration actuelle sera écrasée.",
+  "Are you sure you want to uninstall ProxMenux?": "Êtes-vous sûr de vouloir désinstaller ProxMenux ?",
+  "Are you sure you want to uninstall the selected optimizations.": "Êtes-vous sûr de vouloir désinstaller les optimisations sélectionnées ?",
+  "Are you sure you want to unmount this NFS share?": "Êtes-vous sûr de vouloir démonter ce partage NFS ?",
+  "Are you sure you want to unmount this Samba share?": "Êtes-vous sûr de vouloir démonter ce partage Samba ?",
+  "Are you sure?": "Es-tu sûr?",
+  "As Proxmox storage": "Comme stockage Proxmox",
+  "As host fstab mount only": "En tant qu'hôte, montage fstab uniquement",
+  "Assign GPU PCI function to VM": "Attribuer la fonction GPU PCI à la VM",
+  "Assign controller/NVMe passthrough": "Attribuer un contrôleur/passthrough NVMe",
+  "Assigned to VM": "Attribué à la VM",
+  "Assigned to VM(s)": "Attribué à une ou plusieurs VM",
+  "Assigning imported disk to VM using the generated command": "Attribution du disque importé à la VM à l'aide de la commande générée",
+  "Associated Audio Devices": "Périphériques audio associés",
+  "Associated audio removed from VM": "Audio associé supprimé de la VM",
+  "At least 5GB free space on root filesystem": "Au moins 5 Go d'espace libre sur le système de fichiers racine",
+  "At least one selected GPU is blocked by policy for GPU -> VM mode due to passthrough instability risk.": "Au moins un GPU sélectionné est bloqué par la stratégie pour le mode GPU -> VM en raison d'un risque d'instabilité de transmission.",
+  "Attach imported disk to VM": "Attacher le disque importé à la VM",
+  "Attach to an existing PVE vzdump job (inherit schedule + retention)": "Attacher à une tâche vzdump PVE existante (hériter de la planification + rétention)",
+  "Attached to PVE job:": "Attaché au travail PVE :",
+  "Attempting automatic repair...": "Tentative de réparation automatique...",
+  "Attempting passthrough with this GPU typically results in": "Toute tentative de relais avec ce GPU entraîne généralement",
+  "Attention: Removing the subscription banner may cause issues in the web interface after a future update.": "Attention : La suppression de la bannière d'abonnement peut entraîner des problèmes dans l'interface Web après une future mise à jour.",
+  "Audit completed. Press Enter to continue...": "Vérification terminée. Appuyez sur Entrée pour continuer...",
+  "Auth key is required.": "La clé d'authentification est requise.",
+  "Auth:": "Authentification :",
+  "Authentication": "Authentification",
+  "Authentication Error": "Erreur d'authentification",
+  "Authentication failed.": "L'authentification a échoué.",
+  "Authentication required:": "Authentification requise :",
+  "Authentication:": "Authentification:",
+  "Authorization failed": "L'autorisation a échoué",
+  "Authorization successful": "Autorisation réussie",
+  "Authorize this key on the server": "Autoriser cette clé sur le serveur",
+  "Authorize via 'pct exec' (Borg server is an LXC on a PVE host I can SSH into)": "Autoriser via 'pct exec' (le serveur Borg est un LXC sur un hôte PVE sur lequel je peux me connecter en SSH)",
+  "Authorized": "Autorisé",
+  "Auto-detected firewall backend (nftables/iptables)": "Backend de pare-feu détecté automatiquement (nftables/iptables)",
+  "Auto-discover servers on network": "Détection automatique des serveurs sur le réseau",
+  "Auto-negotiate:": "Négociation automatique :",
+  "Auto-start was skipped because GPU passthrough setup was requested.": "Le démarrage automatique a été ignoré car la configuration du relais GPU a été demandée.",
+  "Auto-sync enabled when /var/log exceeds 80% of": "Synchronisation automatique activée lorsque /var/log dépasse 80 % de",
+  "Auto-sync was not enabled": "La synchronisation automatique n'a pas été activée",
+  "Automated Post-Install Script": "Script de post-installation automatisé",
+  "Automated post-installation script": "Script de post-installation automatisé",
+  "Automatic/Unattended": "Automatique/sans surveillance",
+  "Available": "Disponible",
+  "Available Borg archives (newest first):": "Archives Borg disponibles (les plus récentes en premier) :",
+  "Available Borg targets:": "Cibles Borg disponibles :",
+  "Available Disks on Host": "Disques disponibles sur l'hôte",
+  "Available ISO Images": "Images ISO disponibles",
+  "Available PBS repositories:": "Dépôts PBS disponibles :",
+  "Available PVE Version": "Version PVE disponible",
+  "Available Shares:": "Actions disponibles :",
+  "Available action": "Action disponible",
+  "Available archives:": "Archives disponibles :",
+  "Available disks detected.": "Disques disponibles détectés.",
+  "Available host backups:": "Sauvegardes d'hôte disponibles :",
+  "Available images in /var/lib/vz/images/:": "Images disponibles dans /var/lib/vz/images/ :",
+  "Available network interfaces:": "Interfaces réseau disponibles :",
+  "Available output formats include:": "Les formats de sortie disponibles incluent :",
+  "Available physical disks for passthrough:": "Disques physiques disponibles pour le relais :",
+  "Available shares for guest access:": "Partages disponibles pour l'accès invité :",
+  "Available space in /mnt:": "Espace disponible en /mnt :",
+  "Available storage information:": "Informations de stockage disponibles :",
+  "Available storage volumes:": "Volumes de stockage disponibles :",
+  "BIOS TYPE": "TYPE DE BIOS",
+  "BIOS Type": "Type de BIOS",
+  "BIOS from": "BIOS de",
+  "BIOS: OVMF (UEFI)": "BIOS : OVMF (UEFI)",
+  "BRIDGE CONFIGURATION ANALYSIS": "ANALYSE DE LA CONFIGURATION DU PONT",
+  "BTRFS:": "BTRFS :",
+  "Back to previous menu or Esc + Enter": "Retour au menu précédent ou Echap + Entrée",
+  "Backed up and cleared": "Sauvegarde et effacement",
+  "Backend": "Back-end",
+  "Backend:": "Back-end :",
+  "Backup            — VM and CT backups": "Sauvegarde – Sauvegardes VM et CT",
+  "Backup Created": "Sauvegarde créée",
+  "Backup ID (group name in PBS):": "ID de sauvegarde (nom du groupe dans PBS) :",
+  "Backup ID for this job:": "ID de sauvegarde pour ce travail :",
+  "Backup ID:": "ID de sauvegarde :",
+  "Backup Preview": "Aperçu de la sauvegarde",
+  "Backup Recommendation": "Recommandation de sauvegarde",
+  "Backup Restored": "Sauvegarde restaurée",
+  "Backup all VMs and CTs": "Sauvegarder toutes les machines virtuelles et CT",
+  "Backup and Restore Commands": "Commandes de sauvegarde et de restauration",
+  "Backup available at": "Sauvegarde disponible sur",
+  "Backup completed successfully.": "Sauvegarde terminée avec succès.",
+  "Backup completed:": "Sauvegarde terminée :",
+  "Backup created:": "Sauvegarde créée :",
+  "Backup declares unused NICs that are not on this host:": "La sauvegarde déclare les cartes réseau inutilisées qui ne se trouvent pas sur cet hôte :",
+  "Backup destination is inside the backup": "La destination de la sauvegarde se trouve à l'intérieur de la sauvegarde",
+  "Backup failed. See log:": "La sauvegarde a échoué.Voir le journal :",
+  "Backup file appears corrupted, will reinstall packages": "Le fichier de sauvegarde semble corrompu, réinstallera les packages",
+  "Backup host configuration": "Configuration de l'hôte de sauvegarde",
+  "Backup includes /etc/zfs/zpool.cache. Restore it (same host detected)?": "La sauvegarde inclut /etc/zfs/zpool.cache. Le restaurer (même hôte détecté) ?",
+  "Backup information": "Informations de sauvegarde",
+  "Backup location": "Emplacement de sauvegarde",
+  "Backup metadata": "Métadonnées de sauvegarde",
+  "Backup of original MOTD created": "Sauvegarde du MOTD original créé",
+  "Backup on newer kernel:": "Sauvegarde sur un noyau plus récent :",
+  "Backup on older kernel:": "Sauvegarde sur un noyau plus ancien :",
+  "Backup origin metadata:": "Métadonnées d'origine de la sauvegarde :",
+  "Backup path:": "Chemin de sauvegarde :",
+  "Backup pools not present on this host:": "Pools de sauvegarde non présents sur cet hôte :",
+  "Backup saved to:": "Sauvegarde enregistrée dans :",
+  "Backup scheduler and retention": "Planificateur et conservation des sauvegardes",
+  "Backup to Borg repository": "Sauvegarde sur le référentiel Borg",
+  "Backup to Proxmox Backup Server (PBS)": "Sauvegarde sur le serveur de sauvegarde Proxmox (PBS)",
+  "Backup to a specific directory": "Sauvegarde dans un répertoire spécifique",
+  "Backup to local archive  (.tar.zst)": "Sauvegarde vers une archive locale (.tar.zst)",
+  "Backup:": "Sauvegarde :",
+  "Backups already on PBS were encrypted with the current key — downloading them will fail unless you first Download the current keyfile to keep a copy.": "Les sauvegardes déjà sur PBS ont été chiffrées avec la clé actuelle. Leur téléchargement échouera à moins que vous ne téléchargiez d'abord le fichier de clé actuel pour en conserver une copie.",
+  "Backups already stored on PBS were encrypted with the current keyfile. After this action:": "les sauvegardes déjà stockées sur PBS ont été chiffrées avec le fichier de clés actuel.Après cette action :",
+  "Bandwidth limit configured": "Limite de bande passante configurée",
+  "Bandwidth test (iperf3)": "Test de bande passante (iperf3)",
+  "Bandwidth test completed successfully": "Test de bande passante terminé avec succès",
+  "Base VM created with ID": "VM de base créée avec l'ID",
+  "Bashrc customization completed": "Personnalisation de Bashrc terminée",
+  "Basic Settings": "Paramètres de base",
+  "Basic Utilities": "Utilitaires de base",
+  "Before making any changes, we'll create a safety backup.": "Avant d'apporter des modifications, nous créerons une sauvegarde de sécurité.",
+  "Beta (develop branch)": "Bêta (branche de développement)",
+  "Beta version:": "Version bêta :",
+  "Binary not found in extracted content.": "Binaire introuvable dans le contenu extrait.",
+  "Bind mount added:": "Support de liaison ajouté :",
+  "Blacklist nouveau driver": "Nouveau pilote de liste noire",
+  "Blacklisting GPU host drivers...": "Mise sur liste noire des pilotes hôtes GPU...",
+  "Blacklisting nouveau driver...": "Nouveau pilote sur liste noire...",
+  "Blocked GPU ID": "ID GPU bloqué",
+  "Blocked GPU ID for VM Mode": "ID GPU bloqué pour le mode VM",
+  "Blocked device(s)": "Appareil(s) bloqué(s)",
+  "Blocked device(s):": "Appareil(s) bloqué(s) :",
+  "Boot Disk": "Disque de démarrage",
+  "Boot artifacts regenerated — reboot the host to activate the merged config.": "Artefacts de démarrage régénérés – redémarrez l'hôte pour activer la configuration fusionnée.",
+  "Boot disk:": "Disque de démarrage :",
+  "Boot order set to": "Ordre de démarrage défini sur",
+  "Boot partition UUIDs from backup not found on this host:": "UUID de la partition de démarrage à partir de la sauvegarde introuvable sur cet hôte :",
+  "Boot type (grub/zfs):": "Type de démarrage (grub/zfs) :",
+  "Borg backup error log": "Journal des erreurs de sauvegarde Borg",
+  "Borg backup failed.": "La sauvegarde Borg a échoué.",
+  "Borg binary checksum verification failed.": "La vérification de la somme de contrôle binaire Borg a échoué.",
+  "Borg encryption": "Cryptage Borg",
+  "Borg extraction failed.": "L'extraction des Borgs a échoué.",
+  "Borg not found. Downloading borg": "Borg introuvable. Téléchargement de Borg",
+  "Borg passphrase:": "Phrase secrète de Borg :",
+  "Borg ready.": "Borg prêt.",
+  "Borg repositories": "Dépôts Borg",
+  "Borg repository location": "Emplacement du référentiel Borg",
+  "Borg repository passphrase": "Phrase secrète du référentiel Borg",
+  "Borg repository path:": "Chemin du référentiel Borg :",
+  "Borg restore error log": "Journal des erreurs de restauration Borg",
+  "Borg server SSH user": "Utilisateur SSH du serveur Borg",
+  "Bridge": "Pont",
+  "Bridge Analysis": "Analyse des ponts",
+  "Bridge Configuration Analysis": "Analyse de la configuration du pont",
+  "Bridge:": "Pont:",
+  "Bridges analyzed": "Ponts analysés",
+  "Broken gasket-dkms package state recovered.": "État du paquet joint-dkms cassé récupéré.",
+  "Browse manually (advanced)...": "Parcourir manuellement (avancé)...",
+  "Build and install the gasket and apex kernel modules (DKMS)": "Construire et installer les modules de joint et de noyau apex (DKMS)",
+  "Build dependencies installed.": "Dépendances de build installées.",
+  "CHANGES APPLIED SUCCESSFULLY": "MODIFICATIONS APPLIQUÉES AVEC SUCCÈS",
+  "CIFS Client Tools: AVAILABLE": "Outils clients CIFS : DISPONIBLES",
+  "CIFS Client Tools: NOT AVAILABLE - installing...": "Outils client CIFS : NON DISPONIBLE - installation...",
+  "CIFS Client: INSTALLED": "Client CIFS : INSTALLÉ",
+  "CIFS Client: NOT INSTALLED": "Client CIFS : NON INSTALLÉ",
+  "CIFS Mount Not Found": "Montage CIFS introuvable",
+  "CIFS Mounts on Host": "Montages CIFS sur l'hôte",
+  "CIFS Proxmox storages (pvesm):": "Stockages CIFS Proxmox (pvesm) :",
+  "CIFS can cause file locking issues with VM disk operations.": "CIFS peut entraîner des problèmes de verrouillage de fichiers avec les opérations de disque de VM.",
+  "CIFS client tools installed.": "Outils clients CIFS installés.",
+  "CIFS share mounted at:": "Partage CIFS monté à :",
+  "CIFS share remounted — LXC containers can now read and write": "Partage CIFS remonté – Les conteneurs LXC peuvent désormais lire et écrire",
+  "CIFS storage added successfully to Proxmox!": "Stockage CIFS ajouté avec succès à Proxmox !",
+  "CLEANUP COMPLETED SUCCESSFULLY": "NETTOYAGE TERMINÉ AVEC SUCCÈS",
+  "CLUSTER UPGRADE NOTES:": "REMARQUES SUR LA MISE À NIVEAU DU CLUSTER :",
+  "CONFIGURED INTERFACES": "INTERFACES CONFIGURÉES",
+  "CONFIRM FORMAT": "CONFIRMER LE FORMAT",
+  "CPU Cores": "Cœurs de processeur",
+  "CPU MODEL": "MODÈLE DE CPU",
+  "CPU Model": "Modèle de processeur",
+  "CPU set to host,hidden=1,flags=+pcid": "CPU défini sur hôte, caché = 1, flags = + pcid",
+  "CPU vendor (intel/amd):": "Fournisseur de processeur (Intel/AMD) :",
+  "CRITICAL: The selected disk is referenced by a RUNNING VM or CT.": "CRITIQUE : le disque sélectionné est référencé par une VM ou un CT en cours d'exécution.",
+  "CT": "CT",
+  "CT started successfully.": "CT a démarré avec succès.",
+  "Cancel": "Annuler",
+  "Cancel restore": "Annuler la restauration",
+  "Cancel this setup": "Annuler cette configuration",
+  "Cancelled by user or empty URL.": "Annulé par l'utilisateur ou URL vide.",
+  "Cancelled by user.": "Annulé par l'utilisateur.",
+  "Cannot connect to server": "Impossible de se connecter au serveur",
+  "Cannot continue": "Impossible de continuer",
+  "Cannot create:": "Impossible de créer :",
+  "Cannot detect filesystem on": "Impossible de détecter le système de fichiers sur",
+  "Cannot find": "Impossible de trouver",
+  "Cannot load backup library: lib_host_backup_common.sh": "Impossible de charger la bibliothèque de sauvegarde : lib_host_backup_common.sh",
+  "Cannot proceed with invalid export path.": "Impossible de poursuivre avec un chemin d'exportation non valide.",
+  "Cannot proceed with invalid share name.": "Impossible de continuer avec un nom de partage invalide.",
+  "Cannot reach Proxmox repositories": "Impossible d'accéder aux référentiels Proxmox",
+  "Cannot reach portal:": "Impossible d'accéder au portail :",
+  "Cannot reach server": "Ne peut pas atteindre le serveur",
+  "Cannot validate credentials - no shares available for testing.": "Impossible de valider les informations d'identification - aucun partage disponible pour les tests.",
+  "Category": "Catégorie",
+  "Caution: Maximum mode generates more heat.": "Attention : le mode maximum génère plus de chaleur.",
+  "Ceph check skipped by user flag (--ignore-ceph-check)": "Vérification Ceph ignorée par l'indicateur utilisateur (--ignore-ceph-check)",
+  "Ceph components": "Composants Ceph",
+  "Ceph detected as hyper-converged on this node. Checking version (require 19.x Squid)...": "Ceph détecté comme hyper-convergé sur ce nœud. Vérification de la version (nécessite 19.x Squid)...",
+  "Ceph enterprise repository present": "Référentiel d'entreprise Ceph présent",
+  "Ceph installation check completed": "Vérification de l'installation de Ceph terminée",
+  "Ceph installation completed successfully": "L'installation de Ceph s'est terminée avec succès",
+  "Ceph installation could not be verified": "L'installation de Ceph n'a pas pu être vérifiée",
+  "Ceph installation process completed": "Processus d'installation de Ceph terminé",
+  "Ceph installation process finished with warnings": "Processus d'installation de Ceph terminé avec des avertissements",
+  "Ceph installed but integration may need configuration": "Ceph est installé mais l'intégration peut nécessiter une configuration",
+  "Ceph integration with PVE 9 verified": "Intégration de Ceph avec PVE 9 vérifiée",
+  "Ceph is already installed": "Ceph est déjà installé",
+  "Ceph is not 19.x (Squid). Proceeding due to --warn-ceph-check. Detected:": "Ceph n'est pas 19.x (Squid). Poursuite en raison de --warn-ceph-check. Détecté :",
+  "Ceph is not 19.x (Squid). Upgrade Ceph first. Detected:": "Ceph n'est pas 19.x (Squid). Mettez d'abord à niveau Ceph. Détecté :",
+  "Ceph no-subscription repository present": "Référentiel Ceph sans abonnement présent",
+  "Ceph packages and repository removed": "Packages et référentiel Ceph supprimés",
+  "Ceph packages are available": "Des packages Ceph sont disponibles",
+  "Ceph packages installed and verified successfully": "Packages Ceph installés et vérifiés avec succès",
+  "Ceph packages installed but service verification failed": "Packages Ceph installés mais la vérification du service a échoué",
+  "Ceph packages may not be available, but continuing installation...": "Les packages Ceph peuvent ne pas être disponibles, mais la poursuite de l'installation...",
+  "Ceph repository configured for PVE 8": "Dépôt Ceph configuré pour PVE 8",
+  "Ceph repository configured for PVE 9": "Dépôt Ceph configuré pour PVE 9",
+  "Ceph version OK:": "Version Ceph OK :",
+  "Change Language": "Changer de langue",
+  "Change Release Channel": "Changer le canal de publication",
+  "Changes applied. A system reboot is recommended for them to take full effect.": "Modifications appliquées. Un redémarrage du système est recommandé pour qu'ils prennent pleinement effet.",
+  "Changes detected. Updating ZFS ARC configuration...": "Modifications détectées. Mise à jour de la configuration ZFS ARC...",
+  "Changes have been applied to the configuration file.": "Les modifications ont été appliquées au fichier de configuration.",
+  "Changes will apply after reboot.": "Les modifications s'appliqueront après le redémarrage.",
+  "Changing Release Channel": "Changer le canal de publication",
+  "Changing the machine type on an existing installed VM is not safe: it changes the chipset and PCI slot layout, which typically prevents the guest OS from booting.": "Changer le type de machine sur une VM installée existante n'est pas sûr : cela modifie la disposition du chipset et des emplacements PCI, ce qui empêche généralement le système d'exploitation invité de démarrer.",
+  "Check": "Vérifier",
+  "Check BIOS/UEFI in Hardware > BIOS — must match what the original VM used": "Vérifiez le BIOS/UEFI dans Matériel > BIOS : doit correspondre à ce que la VM d'origine a utilisée",
+  "Check Coral USB/M.2 detection": "Vérifier la détection Coral USB/M.2",
+  "Check LXC GPU/TPU mapping": "Vérifiez le mappage GPU/TPU LXC",
+  "Check NFS Status": "Vérifier l'état NFS",
+  "Check NVIDIA driver and devices": "Vérifiez le pilote et les périphériques NVIDIA",
+  "Check Proxmox Web UI status": "Vérifier l'état de l'interface utilisateur Web de Proxmox",
+  "Check Proxmox firewall status": "Vérifier l'état du pare-feu Proxmox",
+  "Check Samba Status": "Vérifier le statut de Samba",
+  "Check VM disk/PCI slots": "Vérifiez les emplacements disque/PCI de la VM",
+  "Check VM passthrough settings": "Vérifier les paramètres de relais de la VM",
+  "Check connectivity with another host": "Vérifiez la connectivité avec un autre hôte",
+  "Check container mount points": "Vérifier les points de montage du conteneur",
+  "Check if container is unprivileged:": "Vérifiez si le conteneur n'est pas privilégié :",
+  "Check kernel params (IOMMU flags)": "Vérifiez les paramètres du noyau (drapeaux IOMMU)",
+  "Check loaded GPU/TPU modules": "Vérifiez les modules GPU/TPU chargés",
+  "Check log:": "Journal de vérification :",
+  "Check resulting config:": "Vérifiez la configuration résultante :",
+  "Check script not found": "Script de vérification introuvable",
+  "Check test progress   — show active or last test result": "Vérifier la progression du test - afficher le résultat du test actif ou du dernier test",
+  "Check that:": "Vérifiez que :",
+  "Check the error messages above for details.": "Consultez les messages d'erreur ci-dessus pour plus de détails.",
+  "Check the service status manually if needed.": "Vérifiez l'état du service manuellement si nécessaire.",
+  "Checking MOTD configuration...": "Vérification de la configuration MOTD...",
+  "Checking NVIDIA driver status with nvidia-smi": "Vérification de l'état du pilote NVIDIA avec nvidia-smi",
+  "Checking VFIO modules...": "Vérification des modules VFIO...",
+  "Checking VM virtual display model...": "Vérification du modèle d'affichage virtuel de la VM...",
+  "Checking ZFS autotrim configuration...": "Vérification de la configuration du découpage automatique ZFS...",
+  "Checking and repairing old LVM PV headers (if needed)...": "Vérification et réparation des anciens collecteurs PV LVM (si nécessaire)...",
+  "Checking conflicting drivers blacklist...": "Vérification de la liste noire des pilotes en conflit...",
+  "Checking existing ZFS ARC configuration...": "Vérification de la configuration ZFS ARC existante...",
+  "Checking for updates...": "Vérification des mises à jour...",
+  "Checking free space in /var/cache/apt/archives...": "Vérification de l'espace libre dans /var/cache/apt/archives...",
+  "Checking if system disk is SSD or M.2...": "Vérifier si le disque système est SSD ou M.2...",
+  "Checking if the server belongs to OVH...": "Vérifier si le serveur appartient à OVH...",
+  "Checking kernel headers and build tools...": "Vérification des en-têtes du noyau et des outils de construction...",
+  "Checking remaining interfaces": "Vérification des interfaces restantes",
+  "Checklist post-upgrade finished. Warnings:": "Liste de contrôle après la mise à niveau terminée. Avertissements :",
+  "Checklist pre-check finished. Warnings:": "Pré-vérification de la liste de contrôle terminée. Avertissements :",
+  "Checks for LVM and storage issues": "Vérifie les problèmes de LVM et de stockage",
+  "Choose BIOS type": "Choisissez le type de BIOS",
+  "Choose No to abort and roll back to the legacy refuse behaviour.": "Choisissez Non pour abandonner et revenir au comportement de refus hérité.",
+  "Choose ZimaOS image option:": "Choisissez l'option d'image ZimaOS :",
+  "Choose a Samba server:": "Choisissez un serveur Samba :",
+  "Choose a Windows ISO to use:": "Choisissez un ISO Windows à utiliser :",
+  "Choose a ZimaOS image:": "Choisissez une image ZimaOS :",
+  "Choose a custom image:": "Choisissez une image personnalisée :",
+  "Choose a custom logo:": "Choisissez un logo personnalisé :",
+  "Choose a destination directory OUTSIDE of": "Choisissez un répertoire de destination EN DEHORS de",
+  "Choose a different path or unmount it first.": "Choisissez un autre chemin ou démontez-le d’abord.",
+  "Choose a folder to export:": "Choisissez un dossier à exporter :",
+  "Choose a folder to mount the export:": "Choisissez un dossier pour monter l'exportation :",
+  "Choose a folder to mount the share:": "Choisissez un dossier pour monter le partage :",
+  "Choose a folder to mount:": "Choisissez un dossier à monter :",
+  "Choose a folder to share:": "Choisissez un dossier à partager :",
+  "Choose a group policy for this shared directory:": "Choisissez une stratégie de groupe pour ce répertoire partagé :",
+  "Choose a loader for Synology DSM:": "Choisissez un chargeur pour Synology DSM :",
+  "Choose a logo for Fastfetch:": "Choisissez un logo pour Fastfetch :",
+  "Choose a recent server:": "Choisissez un serveur récent :",
+  "Choose a recovery passphrase (write it down somewhere safe):": "Choisissez une phrase secrète de récupération (notez-la dans un endroit sûr) :",
+  "Choose a script to execute:": "Choisissez un script à exécuter :",
+  "Choose a server:": "Choisissez un serveur :",
+  "Choose a share to mount:": "Choisissez un partage à monter :",
+  "Choose action for this controller/NVMe:": "Choisissez une action pour ce contrôleur/NVMe :",
+  "Choose action:": "Choisissez l'action :",
+  "Choose an NFS server:": "Choisissez un serveur NFS :",
+  "Choose an action:": "Choisissez une action :",
+  "Choose an export to mount:": "Choisissez une exportation à monter :",
+  "Choose an option:": "Choisissez une option :",
+  "Choose any host path you want to share with CTs.": "Choisissez n’importe quel chemin d’hôte que vous souhaitez partager avec les CT.",
+  "Choose conflict policy": "Choisissez la politique de conflit",
+  "Choose conflict policy for the source VM:": "Choisissez la stratégie de conflit pour la VM source :",
+  "Choose conflict policy:": "Choisissez la politique de conflit :",
+  "Choose filesystem for the disk:": "Choisissez le système de fichiers pour le disque :",
+  "Choose how this host backup will be triggered:": "Choisissez comment cette sauvegarde d'hôte sera déclenchée :",
+  "Choose how to continue:": "Choisissez comment continuer :",
+  "Choose how to handle affected LXC containers before switching to VM mode.": "Choisissez comment gérer les conteneurs LXC concernés avant de passer en mode VM.",
+  "Choose how to make the disk available on this host. Mark one or both options:": "Choisissez comment rendre le disque disponible sur cet hôte. Cochez une ou les deux options :",
+  "Choose how to mount the NFS share on this host. Mark one or both options:": "Choisissez comment monter le partage NFS sur cet hôte. Cochez une ou les deux options :",
+  "Choose how to mount the Samba share on this host. Mark one or both options:": "Choisissez comment monter le partage Samba sur cet hôte. Cochez une ou les deux options :",
+  "Choose how to perform the upgrade:": "Choisissez comment effectuer la mise à niveau :",
+  "Choose how to run the script:": "Choisissez comment exécuter le script :",
+  "Choose iperf3 mode:": "Choisissez le mode iperf3 :",
+  "Choose options to configure:": "Choisissez les options à configurer :",
+  "Choose the driver version for Coral M.2:": "Choisissez la version du pilote pour Coral M.2 :",
+  "Choose the filesystem for the new partition:": "Choisissez le système de fichiers pour la nouvelle partition :",
+  "Choose the release channel to use:": "Choisissez le canal de publication à utiliser :",
+  "Choose the storage volume for the EFI disk (4MB):\n\nUse Spacebar to select.": "Choisissez le volume de stockage du disque EFI (4 Mo) :\n\nUtilisez la barre d'espace pour sélectionner.",
+  "Choose the storage volume for the virtual disk:": "Choisissez le volume de stockage pour le disque virtuel :",
+  "Choose the type of virtual system to install:": "Choisissez le type de système virtuel à installer :",
+  "Choose what to do with the selected disk:": "Choisissez quoi faire avec le disque sélectionné :",
+  "Choose where to save the backup:": "Choisissez où enregistrer la sauvegarde :",
+  "Clean disk metadata": "Nettoyer les métadonnées du disque",
+  "Cleaned up": "Nettoyé",
+  "Cleaning cached files...": "Nettoyage des fichiers en cache...",
+  "Cleaning disk metadata...": "Nettoyage des métadonnées du disque...",
+  "Cleaning previous Log2RAM installation...": "Nettoyage de l'installation précédente de Log2RAM...",
+  "Cleaning temporary files...": "Nettoyage des fichiers temporaires...",
+  "Cleaning up Samba directories...": "Nettoyage des répertoires Samba...",
+  "Cleaning up duplicate parameters...": "Nettoyage des paramètres en double...",
+  "Cleaning up duplicate repositories...": "Nettoyage des référentiels en double...",
+  "Cleaning up remaining processes...": "Nettoyage des processus restants...",
+  "Cleaning up unused time synchronization services...": "Nettoyage des services de synchronisation de l'heure inutilisés...",
+  "Cleans duplicate or conflicting sources": "Nettoie les sources en double ou en conflit",
+  "Cleanup Complete": "Nettoyage terminé",
+  "Cleanup finished": "Nettoyage terminé",
+  "Cleanup partial VM?": "Nettoyer une VM partielle ?",
+  "Clear configured target": "Effacer la cible configurée",
+  "Clear pool error state": "Effacer l'état d'erreur du pool",
+  "Cleared": "Effacé",
+  "Clearing login credentials...": "Effacement des identifiants de connexion...",
+  "Client (run a bandwidth test to a server)": "Client (exécuter un test de bande passante sur un serveur)",
+  "Client determines best version to use": "Le client détermine la meilleure version à utiliser",
+  "Cloning Coral driver repository (feranick fork)...": "Clonage du référentiel de pilotes Coral (feranick fork)...",
+  "Cloning Lynis from GitHub...": "Clonage de Lynis depuis GitHub...",
+  "Cloning and applying NVIDIA patch (keylase/nvidia-patch)...": "Clonage et application du patch NVIDIA (keylase/nvidia-patch)...",
+  "Closed": "Fermé",
+  "Cloud-Init Automated Installers": "Installateurs automatisés Cloud-Init",
+  "Cluster certificates updated": "Certificats de cluster mis à jour",
+  "Cluster configuration (advanced)": "Configuration du cluster (avancé)",
+  "Cluster data will be applied automatically at next boot.": "les données du cluster seront appliquées automatiquement au prochain démarrage.",
+  "Cluster upgrade mode": "Mode de mise à niveau du cluster",
+  "Command": "Commande",
+  "Commenting any residual Bookworm lines in *.list...": "Commenter les lignes résiduelles de Bookworm dans *.list...",
+  "Commenting legacy PVE 8 repository .list files (if any)...": "Commentaire des anciens fichiers .list du référentiel PVE 8 (le cas échéant)...",
+  "Commenting legacy ceph.list (if present)...": "Commentaire de l'héritage ceph.list (si présent)...",
+  "Common Issues Check": "Vérification des problèmes courants",
+  "Community Scripts": "Scripts communautaires",
+  "Compatibility check": "Vérification de compatibilité",
+  "Compatibility check — OK": "Vérification de compatibilité - OK",
+  "Compatibility check — issues detected": "Vérification de compatibilité : problèmes détectés",
+  "Compatibility check — review warnings": "Vérification de compatibilité : consultez les avertissements",
+  "Compatible with privileged and unprivileged LXC containers": "Compatible avec les conteneurs LXC privilégiés et non privilégiés",
+  "Compatible with:": "Compatible avec :",
+  "Compile firewall rules for all nodes": "Compiler les règles de pare-feu pour tous les nœuds",
+  "Compiling Coral TPU drivers for current kernel...": "Compilation des pilotes Coral TPU pour le noyau actuel...",
+  "Complete": "Complet",
+  "Complete NVIDIA uninstallation finished.": "Désinstallation complète de NVIDIA terminée.",
+  "Complete post-installation optimization finished!": "Optimisation complète post-installation terminée !",
+  "Complete restore": "Restauration complète",
+  "Complete the DSM installation wizard": "Terminez l'assistant d'installation de DSM",
+  "Complete the ZimaOS installation wizard": "Terminez l'assistant d'installation de ZimaOS",
+  "Completed Successfully with GPU passthrough configured!": "Terminé avec succès avec le passthrough GPU configuré !",
+  "Completed Successfully!": "Terminé avec succès !",
+  "Completed with errors —": "Complété avec des erreurs —",
+  "Completed.": "Complété.",
+  "Completed. Press Enter to return to menu...": "Complété. Appuyez sur Entrée pour revenir au menu...",
+  "Compliance checking (PCI-DSS, HIPAA, etc.)": "Vérification de la conformité (PCI-DSS, HIPAA, etc.)",
+  "Component to uninstall manually (no --auto-uninstall yet):": "Composant à désinstaller manuellement (pas encore de --auto-uninstall) :",
+  "Component was installed on the backup source but no matching hardware was found on this host.": "Le composant a été installé sur la source de sauvegarde mais aucun matériel correspondant n'a été trouvé sur cet hôte.",
+  "Component:": "Composant :",
+  "Components to uninstall (manual for now):": "Composants à désinstaller (manuel pour l'instant) :",
+  "Compressed size:": "Taille compressée :",
+  "Compressing": "Compression",
+  "Compression Tools": "Outils de compression",
+  "Concise output of logical volumes": "Sortie concise des volumes logiques",
+  "Concise output of physical volumes": "Sortie concise des volumes physiques",
+  "Concise output of volume groups": "Sortie concise des groupes de volumes",
+  "Configuration Analysis": "Analyse de configuration",
+  "Configuration Menu": "Menu de configuration",
+  "Configuration Summary:": "Résumé de la configuration :",
+  "Configuration analysis": "Analyse de configuration",
+  "Configuration backup created:": "Sauvegarde de configuration créée :",
+  "Configuration can continue now and will be effective after reboot.": "La configuration peut continuer maintenant et sera effective après le redémarrage.",
+  "Configuration completed successfully!": "Configuration terminée avec succès !",
+  "Configuration file for container": "Fichier de configuration pour le conteneur",
+  "Configuration has been stopped due to high reset risk.": "La configuration a été arrêtée en raison d'un risque élevé de réinitialisation.",
+  "Configuration has been stopped to prevent an unusable VM state.": "La configuration a été arrêtée pour éviter un état de VM inutilisable.",
+  "Configuration has been stopped to prevent leaving the VM in an unusable state.": "La configuration a été arrêtée pour éviter de laisser la VM dans un état inutilisable.",
+  "Configuration name:": "Nom de la configuration :",
+  "Configuration sections that will be REMOVED": "Sections de configuration qui seront SUPPRIMÉES",
+  "Configuration to be Removed": "Configuration à supprimer",
+  "Configuration will continue now and be effective after reboot.": "La configuration va continuer maintenant et sera effective après le redémarrage.",
+  "Configuration:": "Configuration:",
+  "Configure": "Configurer",
+  "Configure GPU passthrough with VFIO": "Configurer le relais GPU avec VFIO",
+  "Configure LXC Mount Points    (Host ↔ Container)": "Configurer les points de montage LXC (hôte ↔ conteneur)",
+  "Configure LXC mount points": "Configurer les points de montage LXC",
+  "Configure Mount Point inside LXC": "Configurer le point de montage dans LXC",
+  "Configure NFS   Client in LXC (only privileged)": "Configurer le client NFS dans LXC (uniquement privilégié)",
+  "Configure NFS   Server in LXC (only privileged)": "Configurer le serveur NFS dans LXC (uniquement privilégié)",
+  "Configure Proxmox APT repositories": "Configurer les référentiels Proxmox APT",
+  "Configure Samba Client in LXC (only privileged)": "Configurer le client Samba dans LXC (uniquement privilégié)",
+  "Configure Samba Server in LXC (only privileged)": "Configurer le serveur Samba dans LXC (uniquement privilégié)",
+  "Configure as guest (no authentication)": "Configurer en tant qu'invité (pas d'authentification)",
+  "Configure backup destinations": "Configurer les destinations de sauvegarde",
+  "Configure backup destinations (PBS, Borg, local)": "Configurer les destinations de sauvegarde (PBS, Borg, local)",
+  "Configure the Google Coral APT repository": "Configurer le référentiel Google Coral APT",
+  "Configure with username and password": "Configurer avec nom d'utilisateur et mot de passe",
+  "Configured Ports": "Ports configurés",
+  "Configured but doesn't exist": "Configuré mais n'existe pas",
+  "Configuring AMD GPU passthrough...": "Configuration du relais GPU AMD...",
+  "Configuring AMD softdep...": "Configuration du logiciel AMD...",
+  "Configuring APT to skip downloading additional languages": "Configurer APT pour ignorer le téléchargement de langues supplémentaires",
+  "Configuring APT to skip downloading additional languages...": "Configuration d'APT pour ignorer le téléchargement de langues supplémentaires...",
+  "Configuring APT to use IPv4...": "Configuration d'APT pour utiliser IPv4...",
+  "Configuring Ceph repository for PVE": "Configuration du référentiel Ceph pour PVE",
+  "Configuring Coral USB support...": "Configuration de la prise en charge de Coral USB...",
+  "Configuring EFI disk": "Configuration du disque EFI",
+  "Configuring I/O priority for vzdump...": "Configuration de la priorité d'E/S pour vzdump...",
+  "Configuring Intel iGPU passthrough...": "Configuration du relais Intel iGPU...",
+  "Configuring MOTD (Message of the Day) banner...": "Configuration de la bannière MOTD (Message du jour)...",
+  "Configuring NVIDIA GPU passthrough...": "Configuration du relais GPU NVIDIA...",
+  "Configuring NVIDIA KVM hiding...": "Configuration du masquage NVIDIA KVM...",
+  "Configuring NVIDIA and VFIO modules...": "Configuration des modules NVIDIA et VFIO...",
+  "Configuring PAM limits...": "Configuration des limites PAM...",
+  "Configuring ProxMenux Monitor filter...": "Configuration du filtre du moniteur ProxMenux...",
+  "Configuring ProxMenux Monitor jail...": "Configuration de la prison ProxMenux Monitor...",
+  "Configuring Proxmox APT repositories...": "Configuration des référentiels Proxmox APT...",
+  "Configuring Proxmox filter...": "Configuration du filtre Proxmox...",
+  "Configuring Proxmox jail...": "Configuration de la prison Proxmox...",
+  "Configuring TCP optimizations...": "Configuration des optimisations TCP...",
+  "Configuring TPM device": "Configuration du périphérique TPM",
+  "Configuring VFIO modules...": "Configuration des modules VFIO...",
+  "Configuring VM": "Configuration de la VM",
+  "Configuring bandwidth limit for vzdump...": "Configuration de la limite de bande passante pour vzdump...",
+  "Configuring boot order...": "Configuration de l'ordre de démarrage...",
+  "Configuring disk as": "Configuration du disque comme",
+  "Configuring global Fail2Ban settings and SSH jail...": "Configuration des paramètres globaux Fail2Ban et de la prison SSH...",
+  "Configuring host for GPU -> VM mode...": "Configuration de l'hôte pour le GPU -> mode VM...",
+  "Configuring journald...": "Configuration de journald...",
+  "Configuring kernel max Key limit...": "Configuration de la limite de clé maximale du noyau...",
+  "Configuring kernel panic behavior": "Configuration du comportement de panique du noyau",
+  "Configuring kernel swappiness...": "Configuration du swappiness du noyau...",
+  "Configuring kexec for quick reboots...": "Configuration de kexec pour des redémarrages rapides...",
+  "Configuring max FD limit / ulimit...": "Configuration de la limite FD maximale / ulimit...",
+  "Configuring max user watches...": "Configuration du nombre maximal de montres utilisateur...",
+  "Configuring pigz as a faster replacement for gzip...": "Configuration de pigz comme remplacement plus rapide de gzip...",
+  "Configuring snapshot schedules...": "Configuration des planifications d'instantanés...",
+  "Configuring system time settings...": "Configuration des paramètres d'heure du système...",
+  "Configuring vfio-pci binding...": "Configuration de la liaison vfio-pci...",
+  "Confirm Borg passphrase": "Confirmer la phrase secrète Borg",
+  "Confirm Borg passphrase:": "Confirmez la phrase secrète de Borg :",
+  "Confirm Controller + NVMe Assignment": "Confirmer l'affectation du contrôleur + NVMe",
+  "Confirm Deletion": "Confirmer la suppression",
+  "Confirm Format": "Confirmer le format",
+  "Confirm GPU Switch Mode": "Confirmer le mode de changement de GPU",
+  "Confirm Import": "Confirmer l'importation",
+  "Confirm Mount": "Confirmer le montage",
+  "Confirm Mount Point Removal": "Confirmer la suppression du point de montage",
+  "Confirm Password": "Confirmez le mot de passe",
+  "Confirm Remove": "Confirmer la suppression",
+  "Confirm Restore": "Confirmer la restauration",
+  "Confirm Uninstallation": "Confirmer la désinstallation",
+  "Confirm Unmount": "Confirmer le démontage",
+  "Confirm complete restore": "Confirmer la restauration complète",
+  "Confirm custom restore": "Confirmer la restauration personnalisée",
+  "Confirm delete": "Confirmer la suppression",
+  "Confirm export": "Confirmer l'exportation",
+  "Confirm password for": "Confirmer le mot de passe pour",
+  "Confirm recovery passphrase:": "Confirmez la phrase secrète de récupération :",
+  "Confirm the keyfile passphrase:": "Confirmez la phrase secrète du fichier clé :",
+  "Confirm the mount path is visible.": "Confirmez que le chemin de montage est visible.",
+  "Confirm the password:": "Confirmez le mot de passe :",
+  "Confirmation": "Confirmation",
+  "Confirmation Failed": "Échec de la confirmation",
+  "Conflicting drivers blacklisted successfully.": "Pilotes en conflit mis sur liste noire avec succès.",
+  "Conflicting path included in backup:": "Chemin d'accès en conflit inclus dans la sauvegarde :",
+  "Conflicting utilities removed": "Utilitaires en conflit supprimés",
+  "Connect a Coral Accelerator and try again.": "Connectez un accélérateur de corail et réessayez.",
+  "Connected": "Connecté",
+  "Connecting to PBS and starting backup...": "Connexion à PBS et démarrage de la sauvegarde...",
+  "Connection Details:": "Détails de connexion :",
+  "Connection Error": "Erreur de connexion",
+  "Connection details:": "Détails de connexion :",
+  "Connectivity Test": "Test de connectivité",
+  "Connectivity Test Results": "Résultats des tests de connectivité",
+  "Consider adding physical interface": "Pensez à ajouter une interface physique",
+  "Consider removing its configuration": "Pensez à supprimer sa configuration",
+  "Consider security implications for production environments": "Tenir compte des implications en matière de sécurité pour les environnements de production",
+  "Consider visiting the repository and supporting the project.": "pensez à visiter le référentiel et à soutenir le projet.",
+  "Container": "Récipient",
+  "Container         — LXC root directories": "Conteneur — Répertoires racine LXC",
+  "Container ID": "ID du conteneur",
+  "Container ID not defined. Make sure to select a container first.": "ID de conteneur non défini. Assurez-vous de sélectionner d'abord un conteneur.",
+  "Container Mount Point": "Point de montage du conteneur",
+  "Container OS:": "Système d'exploitation du conteneur :",
+  "Container Path": "Chemin du conteneur",
+  "Container Path:": "Chemin du conteneur :",
+  "Container Status": "Statut du conteneur",
+  "Container configuration not found": "Configuration du conteneur introuvable",
+  "Container did not become ready in time. Skipping driver installation.": "Le conteneur n’est pas prêt à temps. Ignorer l'installation du pilote.",
+  "Container did not start in time.": "Le conteneur n'a pas démarré à temps.",
+  "Container distro": "Distribution de conteneurs",
+  "Container does not have apt-get available. Coral driver installation only supports Debian/Ubuntu containers.": "Le conteneur n’a pas apt-get disponible. L'installation du pilote Coral prend uniquement en charge les conteneurs Debian/Ubuntu.",
+  "Container is already stopped.": "Le conteneur est déjà arrêté.",
+  "Container is running. Restart to apply changes?": "Le conteneur est en cours d'exécution. Redémarrer pour appliquer les modifications ?",
+  "Container is stopped. Start it now to verify the mount works?": "Le conteneur est arrêté. Le démarrer maintenant pour vérifier que le montage fonctionne ?",
+  "Container mount point:": "Point de montage du conteneur :",
+  "Container must be stopped before conversion": "Le conteneur doit être arrêté avant la conversion",
+  "Container restarted successfully": "Le conteneur a redémarré avec succès",
+  "Container started successfully": "Le conteneur a démarré avec succès",
+  "Container started successfully.": "Le conteneur a démarré avec succès.",
+  "Container started.": "Le conteneur a démarré.",
+  "Container stopped.": "Conteneur arrêté.",
+  "Container successfully converted to privileged.": "Conteneur converti avec succès en privilège.",
+  "Container template— LXC templates": "Modèle de conteneur – Modèles LXC",
+  "Container will pick up the mount on next start": "Le conteneur récupérera la monture au prochain démarrage",
+  "Container with ID": "Conteneur avec ID",
+  "Container:": "Récipient:",
+  "Contains files": "Contient des fichiers",
+  "Contains:": "Contient:",
+  "Content Types": "Types de contenu",
+  "Content Types:": "Types de contenu :",
+  "Content is usually images for VM block devices.": "Le contenu est généralement constitué d’images pour les périphériques de bloc VM.",
+  "Content type is fixed to:": "Le type de contenu est fixé à :",
+  "Content:": "Contenu:",
+  "Continue": "Continuer",
+  "Continue anyway?": "Continuer quand même ?",
+  "Continue despite failures?": "Continuer malgré les échecs ?",
+  "Continue the VM wizard and reboot the host at the end.": "Continuez l'assistant VM et redémarrez l'hôte à la fin.",
+  "Continue the Windows installation as usual.": "Continuez l'installation de Windows comme d'habitude.",
+  "Continue with Coral TPU configuration only?": "Continuer avec la configuration Coral TPU uniquement ?",
+  "Continue with live apply now? SSH may disconnect immediately.": "Continuer avec la candidature en direct maintenant ? SSH peut se déconnecter immédiatement.",
+  "Continue with the import?": "Continuer l'importation ?",
+  "Continue: Proceed with conversion": "Continuer : procéder à la conversion",
+  "Continue?": "Continuer?",
+  "Continuing with your selection.": "Poursuivez votre sélection.",
+  "Controller": "Contrôleur",
+  "Controller + NVMe": "Contrôleur + NVMe",
+  "Controller + NVMe assignment will be written now and become active after host reboot.": "L'affectation Contrôleur + NVMe sera écrite maintenant et deviendra active après le redémarrage de l'hôte.",
+  "Controller + NVMe passthrough requires machine type q35. Skipping controller assignment.": "Le contrôleur + le relais NVMe nécessite une machine de type q35. Ignorer l'affectation du contrôleur.",
+  "Controller/NVMe Conflict Policy": "Politique de conflit contrôleur/NVMe",
+  "Controller/NVMe already present in VM config": "Contrôleur/NVMe déjà présent dans la configuration de la VM",
+  "Controller/NVMe assigned": "Contrôleur/NVMe attribué",
+  "Controller/NVMe is in use by running VM": "Le contrôleur/NVMe est utilisé en exécutant la VM",
+  "Controller/NVMe passthrough requires IOMMU enabled in BIOS/UEFI and kernel.": "Le relais contrôleur/NVMe nécessite l’activation d’IOMMU dans le BIOS/UEFI et le noyau.",
+  "Controller/NVMe passthrough requires machine type q35.": "Le relais contrôleur/NVMe nécessite le type de machine q35.",
+  "Controller/NVMe passthrough to VMs requires IOMMU enabled in BIOS/UEFI and kernel.": "Le relais du contrôleur/NVMe vers les machines virtuelles nécessite l’activation d’IOMMU dans le BIOS/UEFI et le noyau.",
+  "Controller/NVMe passthrough to VMs requires IOMMU to be enabled in the kernel.": "Le relais du contrôleur/NVMe vers les machines virtuelles nécessite que IOMMU soit activé dans le noyau.",
+  "Controller/NVMe passthrough — compatibility notice": "Passthrough contrôleur/NVMe — avis de compatibilité",
+  "Controller/NVMe removed from source VM": "Contrôleur/NVMe supprimé de la VM source",
+  "Controllers + NVMe": "Contrôleurs + NVMe",
+  "Controllers + NVMe Selected:": "Contrôleurs + NVMe sélectionnés :",
+  "Convert Privileged to Unprivileged": "Convertir privilégié en non privilégié",
+  "Convert Unprivileged to Privileged": "Convertir non privilégié en privilégié",
+  "Convert directory ownership:": "Convertir la propriété du répertoire :",
+  "Convert disk image format": "Convertir le format d'image disque",
+  "Convert disk image format using QEMU-IMG": "Convertir le format d'image disque à l'aide de QEMU-IMG",
+  "Convert file ownership (this takes time):": "Convertir la propriété du fichier (cela prend du temps) :",
+  "Converted + verified:": "Converti + vérifié :",
+  "Converted container ID:": "ID de conteneur converti :",
+  "Converting container to privileged...": "Conversion du conteneur en privilège...",
+  "Converting disk": "Conversion de disque",
+  "Converting file ownership (this may take several minutes)...": "Conversion de la propriété du fichier (cela peut prendre plusieurs minutes)...",
+  "Converting image using command:": "Conversion d'image à l'aide de la commande :",
+  "Converts to deb822; keeps .list backups as .bak": "Convertit en deb822 ; conserve les sauvegardes .list au format .bak",
+  "Copy failed": "échec de la copie",
+  "Copy that file offsite yourself, or download it from the Monitor.": "copiez vous-même ce fichier hors site ou téléchargez-le depuis le moniteur.",
+  "Copy the correct keyfile to this host and rerun Restore — or pick an unencrypted backup.": "copiez le fichier de clés correct sur cet hôte et réexécutez la restauration – ou choisissez une sauvegarde non cryptée.",
+  "Copy the keyfile to a path for offsite backup": "copiez le fichier de clés dans un chemin pour une sauvegarde hors site",
+  "Copy your PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to": "copiez d'abord votre fichier de clé PBS sur cet hôte (via scp, USB, sftp, etc.) et entrez son chemin absolu ci-dessous.Le fichier sera copié dans",
+  "Copy your existing PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to": "copiez d'abord votre fichier de clé PBS existant sur cet hôte (via scp, USB, sftp, etc.) et entrez son chemin absolu ci-dessous.Le fichier sera copié dans",
+  "Copying installer to container": "Copie du programme d'installation dans le conteneur",
+  "Copying sources to": "Copie des sources vers",
+  "Coral APT repository ready.": "Le référentiel Coral APT est prêt.",
+  "Coral Actions": "Actions de corail",
+  "Coral M.2 / PCIe detected — installing gasket and apex kernel modules...": "Coral M.2 / PCIe détecté — installation des modules de joint et de noyau apex...",
+  "Coral M.2 Apex configuration added - device ready": "Configuration Coral M.2 Apex ajoutée - appareil prêt",
+  "Coral M.2 Apex configuration added - device will be available after reboot": "Configuration Coral M.2 Apex ajoutée - l'appareil sera disponible après le redémarrage",
+  "Coral M.2 Apex detected, configuring...": "Coral M.2 Apex détecté, configuration...",
+  "Coral TPU Installation": "Installation du TPU corail",
+  "Coral TPU Uninstall": "Désinstallation de Coral TPU",
+  "Coral TPU device nodes detected with correct group (apex).": "Nœuds de périphérique Coral TPU détectés avec le groupe correct (apex).",
+  "Coral TPU driver installed successfully inside the container.": "Pilote Coral TPU installé avec succès dans le conteneur.",
+  "Coral TPU drivers installed and loaded successfully.": "Pilotes Coral TPU installés et chargés avec succès.",
+  "Coral TPU is already installed on this host:": "Coral TPU est déjà installé sur cet hôte :",
+  "Coral TPU is already installed:": "Coral TPU est déjà installé :",
+  "Coral USB Accelerator detected — installing Edge TPU runtime...": "Coral USB Accelerator détecté - installation du runtime Edge TPU...",
+  "Coral USB configuration added - device detected": "Configuration Coral USB ajoutée - périphérique détecté",
+  "Coral USB configured but device not currently connected": "Coral USB configuré mais l'appareil n'est pas actuellement connecté",
+  "Coral USB runtime installed. No reboot required.": "Le runtime Coral USB est installé. Aucun redémarrage requis.",
+  "Coral hardware configuration completed for container": "Configuration matérielle Coral terminée pour le conteneur",
+  "Coral kernel modules unloaded.": "Modules du noyau de corail déchargés.",
+  "Coral packages purged.": "Colis de corail purgés.",
+  "Coral uninstallation completed.": "Désinstallation de Coral terminée.",
+  "Core Proxmox packages reinstalled successfully": "Packages Core Proxmox réinstallés avec succès",
+  "Core packages": "Forfaits de base",
+  "Could not add": "Impossible d'ajouter",
+  "Could not add disk": "Impossible d'ajouter un disque",
+  "Could not assign disk": "Impossible d'attribuer le disque",
+  "Could not authorize the key via 'pct exec' on": "Impossible d'autoriser la clé via 'pct exec' sur",
+  "Could not back up the existing auth.json": "Impossible de sauvegarder le auth.json existant",
+  "Could not change VM virtual display to vga: std": "Impossible de changer l'affichage virtuel de la VM en VGA : std",
+  "Could not clone any gasket-driver repository. Check your internet connection and": "Impossible de cloner un référentiel de pilotes de joints. Vérifiez votre connexion Internet et",
+  "Could not configure IOMMU kernel parameters automatically. Configure manually and reboot.": "Impossible de configurer automatiquement les paramètres du noyau IOMMU. Configurez manuellement et redémarrez.",
+  "Could not copy the PVE keyfile into place. Check permissions on:": "Impossible de copier le fichier de clés PVE.Vérifiez les autorisations sur :",
+  "Could not copy the keyfile into place.": "Impossible de copier le fichier de clés.",
+  "Could not copy the keyfile into place. Check permissions on:": "Impossible de copier le fichier de clés.Vérifiez les autorisations sur :",
+  "Could not create converter directory:": "Impossible de créer le répertoire du convertisseur :",
+  "Could not create destination directory:": "Impossible de créer le répertoire de destination :",
+  "Could not create or access directory:": "Impossible de créer ou d'accéder au répertoire :",
+  "Could not create temporary directory:": "Impossible de créer le répertoire temporaire :",
+  "Could not create temporary working directory.": "Impossible de créer un répertoire de travail temporaire.",
+  "Could not detect apex major number from /proc/devices. Load the apex module first: modprobe apex": "Impossible de détecter le numéro majeur apex à partir de /proc/devices. Chargez d'abord le module apex : modprobe apex",
+  "Could not detect the CIFS mount for this directory. Try accessing it manually.": "Impossible de détecter le montage CIFS pour ce répertoire. Essayez d'y accéder manuellement.",
+  "Could not determine a valid ISO storage directory.": "Impossible de déterminer un répertoire de stockage ISO valide.",
+  "Could not determine disk path for:": "Impossible de déterminer le chemin du disque pour :",
+  "Could not determine the IOMMU group for the selected GPU.": "Impossible de déterminer le groupe IOMMU pour le GPU sélectionné.",
+  "Could not download recovery blob from PBS.": "Impossible de télécharger le blob de récupération depuis PBS.",
+  "Could not download the installer.": "Impossible de télécharger le programme d'installation.",
+  "Could not enable on-boot restore service.": "Impossible d'activer le service de restauration au démarrage.",
+  "Could not export ZFS pool": "Impossible d'exporter le pool ZFS",
+  "Could not extract from PBS.": "Impossible d'extraire du PBS.",
+  "Could not fetch keylase/nvidia-patch supported list — patch reapply compatibility is not verified.": "Impossible de récupérer la liste des correctifs keylase/nvidia pris en charge : la compatibilité de la réapplication du correctif n'est pas vérifiée.",
+  "Could not find a valid 'proxmox-ve' 9.x candidate after switching to no-subscription. Please verify your repository configuration and network, then retry.": "Impossible de trouver un candidat 9.x « proxmox-ve » valide après le passage à l'option sans abonnement. Veuillez vérifier la configuration et le réseau de votre référentiel, puis réessayez.",
+  "Could not find rootfs configuration for container.": "Impossible de trouver la configuration rootfs pour le conteneur.",
+  "Could not format the disk.": "Impossible de formater le disque.",
+  "Could not fully zero": "Impossible de mettre complètement à zéro",
+  "Could not identify the imported disk in VM config": "Impossible d'identifier le disque importé dans la configuration de la VM",
+  "Could not install": "Impossible d'installer",
+  "Could not install Git — Lynis cannot be cloned. Run 'apt-get install git' manually.": "Impossible d'installer Git — Lynis ne peut pas être cloné. Exécutez 'apt-get install git' manuellement.",
+  "Could not install exFAT tools automatically.": "Impossible d'installer automatiquement les outils exFAT.",
+  "Could not install sshpass automatically (no internet?). Falling back to manual paste mode — you'll see the line to copy onto the server next.": "Impossible d'installer sshpass automatiquement (pas d'Internet ?).En revenant au mode de collage manuel, vous verrez ensuite la ligne à copier sur le serveur.",
+  "Could not install vzdump hook in /etc/vzdump.conf": "Impossible d'installer le hook vzdump dans /etc/vzdump.conf",
+  "Could not load shared functions. Script cannot continue.": "Impossible de charger les fonctions partagées. Le script ne peut pas continuer.",
+  "Could not locate imported disk in VM config.": "Impossible de localiser le disque importé dans la configuration de la VM.",
+  "Could not mount": "Impossible de monter",
+  "Could not mount ISO on device": "Impossible de monter l'ISO sur l'appareil",
+  "Could not parse OVF file, or no disk image references found.": "Impossible d'analyser le fichier OVF ou aucune référence d'image disque n'a été trouvée.",
+  "Could not push the key. Check the password and that": "Impossible d'appuyer sur la clé. Vérifiez le mot de passe et cela",
+  "Could not read SMART data from": "Impossible de lire les données SMART de",
+  "Could not read VM configuration.": "Impossible de lire la configuration de la VM.",
+  "Could not remount automatically. Try manually or check credentials.": "Impossible de remonter automatiquement. Essayez manuellement ou vérifiez les informations d'identification.",
+  "Could not remove VM automatically. Run manually:": "Impossible de supprimer automatiquement la VM. Exécuter manuellement :",
+  "Could not remove previous DKMS tree at": "Impossible de supprimer l'arborescence DKMS précédente à",
+  "Could not restart ProxMenux Monitor service.": "Impossible de redémarrer le service ProxMenux Monitor.",
+  "Could not restart the service — start it manually with systemctl start": "Impossible de redémarrer le service - démarrez-le manuellement avec systemctl start",
+  "Could not retrieve versions list from NVIDIA. Please check your internet connection.": "Impossible de récupérer la liste des versions de NVIDIA. Veuillez vérifier votre connexion Internet.",
+  "Could not run NVIDIA patch script. Please verify repository and driver version.": "Impossible d'exécuter le script de correctif NVIDIA. Veuillez vérifier le référentiel et la version du pilote.",
+  "Could not set VM virtual display to vga: std": "Impossible de définir l'affichage virtuel de la VM sur VGA : std",
+  "Could not set boot order for": "Impossible de définir l'ordre de démarrage pour",
+  "Could not stop LXC": "Impossible d'arrêter LXC",
+  "Could not unload nouveau module (may be in use). The blacklist will take effect after reboot. Installation will continue but a reboot will be required.": "Impossible de décharger le nouveau module (peut-être en cours d'utilisation). La liste noire prendra effet après le redémarrage. L'installation continuera mais un redémarrage sera nécessaire.",
+  "Could not unmount": "Impossible de démonter",
+  "Could not unmount — disk may be busy. Removing fstab entry anyway.": "Impossible de démonter : le disque est peut-être occupé. Suppression de l'entrée fstab de toute façon.",
+  "Could not update config file.": "Impossible de mettre à jour le fichier de configuration.",
+  "Could not write to:": "impossible d'écrire vers :",
+  "Create": "Créer",
+  "Create Directory": "Créer un répertoire",
+  "Create GPT and one partition:": "Créez GPT et une partition :",
+  "Create GPT partition": "Créer une partition GPT",
+  "Create LXC server NFS": "Créer un serveur LXC NFS",
+  "Create Network Backup": "Créer une sauvegarde réseau",
+  "Create Samba server service": "Créer un service de serveur Samba",
+  "Create Samba user:": "Créer un utilisateur Samba :",
+  "Create Shared Directory": "Créer un répertoire partagé",
+  "Create Shared Directory on Host": "Créer un répertoire partagé sur l'hôte",
+  "Create Universal NFS Export": "Créer une exportation NFS universelle",
+  "Create VM from template or script": "Créer une VM à partir d'un modèle ou d'un script",
+  "Create a VM first (machine type q35 + UEFI BIOS), then run this option again.": "Créez d’abord une VM (type de machine q35 + BIOS UEFI), puis réexécutez cette option.",
+  "Create a backup of the container configuration:": "Créez une sauvegarde de la configuration du conteneur :",
+  "Create a backup of your container before proceeding": "Créez une sauvegarde de votre conteneur avant de continuer",
+  "Create a fresh GPT + ext4 partition and mount it?": "Créer une nouvelle partition GPT + ext4 et la monter ?",
+  "Create a new dataset in a ZFS pool": "Créer un nouvel ensemble de données dans un pool ZFS",
+  "Create a new group for isolation": "Créer un nouveau groupe pour l'isolement",
+  "Create credentials file (recommended):": "Créer un fichier d'informations d'identification (recommandé) :",
+  "Create directory": "Créer un répertoire",
+  "Create export directory:": "Créer un répertoire d'exportation :",
+  "Create mount point:": "Créer un point de montage :",
+  "Create new directory in /mnt": "Créer un nouveau répertoire dans /mnt",
+  "Create new folder in /mnt": "Créer un nouveau dossier dans /mnt",
+  "Create one first in Datacenter → Backup, then return here to attach.": "créez-en un d'abord dans Datacenter → Sauvegarde, puis revenez ici pour le joindre.",
+  "Create persistent network interface names?": "Créer des noms d'interface réseau persistants ?",
+  "Create scheduled backup job": "Créer une tâche de sauvegarde planifiée",
+  "Create share directory:": "Créer un répertoire de partage :",
+  "Create shared directory:": "Créer un répertoire partagé :",
+  "Created common remapped user": "Création d'un utilisateur remappé commun",
+  "Created directory on host:": "Répertoire créé sur l'hôte :",
+  "Created persistent names for": "Création de noms persistants pour",
+  "Created remapped user": "Utilisateur remappé créé",
+  "Created sharedfiles group (GID: 101000)": "Groupe de fichiers partagés créé (GID : 101000)",
+  "Creating APT configuration to force IPv4...": "Création d'une configuration APT pour forcer IPv4...",
+  "Creating Ceph repository for PVE 8 (legacy format)...": "Création du référentiel Ceph pour PVE 8 (format hérité)...",
+  "Creating Ceph repository for PVE 9 (deb822 format)...": "Création du référentiel Ceph pour PVE 9 (format deb822)...",
+  "Creating Proxmox VE 9.x no-subscription repository...": "Création du référentiel sans abonnement Proxmox VE 9.x...",
+  "Creating Proxmox auth logger service...": "Création du service d'enregistrement d'authentification Proxmox...",
+  "Creating SSH auth logger service...": "Création du service d'enregistrement d'authentification SSH...",
+  "Creating UID remapping for unprivileged container compatibility...": "Création d'un remappage UID pour une compatibilité de conteneurs non privilégiés...",
+  "Creating VM with the above configuration": "Création d'une VM avec la configuration ci-dessus",
+  "Creating VM...": "Création d'une VM...",
+  "Creating backup of configuration file...": "Création d'une sauvegarde du fichier de configuration...",
+  "Creating backup of network interfaces configuration...": "Création d'une sauvegarde de la configuration des interfaces réseau...",
+  "Creating compressed archive...": "Création d'une archive compressée...",
+  "Creating export archive...": "Création d'une archive d'exportation...",
+  "Creating local archive...": "Création d'archives locales...",
+  "Creating mount point...": "Création du point de montage...",
+  "Creating new ZFS ARC configuration...": "Création d'une nouvelle configuration ZFS ARC...",
+  "Creating partition table and partition...": "Création d'une table de partition et d'une partition...",
+  "Creating partition...": "Création d'une partition...",
+  "Creating pigz wrapper script...": "Création du script wrapper pigz...",
+  "Credentials are correct": "Les informations d'identification sont correctes",
+  "Credentials cleared. jwt_secret and API tokens preserved.": "Informations d'identification effacées. Jwt_secret et jetons API préservés.",
+  "Credentials file created securely.": "Fichier d’informations d’identification créé en toute sécurité.",
+  "Credentials file removed.": "Fichier d'informations d'identification supprimé.",
+  "Credentials file:": "Fichier d'informations d'identification :",
+  "Credentials validated successfully": "Identifiants validés avec succès",
+  "Cross-host restore: guest IDs in backup overlap live IDs on target:": "Restauration entre hôtes : les ID d'invité dans la sauvegarde chevauchent les ID actifs sur la cible :",
+  "Cross-kernel restore — kernel-tied paths merged, not copied": "Restauration inter-noyau – chemins liés au noyau fusionnés, non copiés",
+  "Cross-kernel — paths hidden from picker": "Cross-kernel – chemins cachés du sélecteur",
+  "Cross-version detected — safe restore mode": "Version croisée détectée – mode de restauration sécurisé",
+  "Current": "Actuel",
+  "Current CIFS mounts:": "Montages CIFS actuels :",
+  "Current Configuration": "Configuration actuelle",
+  "Current LXC Mount Points": "Points de montage LXC actuels",
+  "Current NFS Mounts": "Supports NFS actuels",
+  "Current NFS client script supports privileged LXC only.": "Le script client NFS actuel prend uniquement en charge LXC privilégié.",
+  "Current NFS exports in CT": "Exportations NFS actuelles dans CT",
+  "Current NFS mounts:": "Montages NFS actuels :",
+  "Current Network Configuration": "Configuration réseau actuelle",
+  "Current PVE Version": "Version PVE actuelle",
+  "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Les scripts hôtes ProxMenux actuels enregistrent les partages distants en tant que stockages Proxmox à l'aide de pvesm.",
+  "Current ProxMenux version:": "Version actuelle de ProxMenux :",
+  "Current Samba Mounts": "Montures Samba actuelles",
+  "Current Samba client script supports privileged LXC only.": "Le script client Samba actuel prend uniquement en charge LXC privilégié.",
+  "Current Samba shares in CT": "Actions actuelles de Samba dans CT",
+  "Current channel:": "Chaîne actuelle :",
+  "Current driver": "Pilote actuel",
+  "Current free space:": "Espace libre actuel :",
+  "Current language:": "Langue actuelle :",
+  "Current mode": "Mode actuel",
+  "Current mount options:": "Options de montage actuelles :",
+  "Current permissions:": "Autorisations actuelles :",
+  "Current power state: D3cold (device currently inaccessible)": "État d'alimentation actuel : D3cold (appareil actuellement inaccessible)",
+  "Current script uses native bind mounts with pct set -mpX.": "Le script actuel utilise des montages de liaison natifs avec pct set -mpX.",
+  "Current selection:": "Sélection actuelle :",
+  "Current status:": "Statut actuel :",
+  "Current user": "Utilisateur actuel",
+  "Current user UID, GID and groups": "UID, GID et groupes de l'utilisateur actuel",
+  "Current version:": "Version actuelle :",
+  "Currently": "Actuellement",
+  "Currently Mounted:": "Actuellement monté :",
+  "Currently configured target:": "cible actuellement configurée :",
+  "Currently mounted:": "Actuellement monté :",
+  "Custom": "Coutume",
+  "Custom Configuration": "Configuration personnalisée",
+  "Custom Content": "Contenu personnalisé",
+  "Custom Directory": "Répertoire personnalisé",
+  "Custom Logo Instructions": "Instructions pour le logo personnalisé",
+  "Custom Options": "Options personnalisées",
+  "Custom Path": "Chemin personnalisé",
+  "Custom backup paths": "Chemins de sauvegarde personnalisés",
+  "Custom backup profile": "Profil de sauvegarde personnalisé",
+  "Custom backup to Borg": "Sauvegarde personnalisée sur Borg",
+  "Custom backup to PBS": "Sauvegarde personnalisée sur PBS",
+  "Custom backup to local archive": "Sauvegarde personnalisée vers une archive locale",
+  "Custom local directory": "Répertoire local personnalisé",
+  "Custom message added to MOTD": "Message personnalisé ajouté à MOTD",
+  "Custom options": "Options personnalisées",
+  "Custom path": "Chemin personnalisé",
+  "Custom path...": "Chemin personnalisé...",
+  "Custom paths are included in BOTH default and custom backup profiles.": "Les chemins personnalisés sont inclus dans les profils de sauvegarde par défaut et personnalisés.",
+  "Custom restore by components": "Restauration personnalisée par composants",
+  "Custom restore by paths": "Restauration personnalisée par chemins",
+  "Custom scripts and ProxMenux files": "Scripts personnalisés et fichiers ProxMenux",
+  "Custom selection": "Sélection personnalisée",
+  "Custom systemd units": "Unités systemd personnalisées",
+  "Customizable post-installation script": "Script de post-installation personnalisable",
+  "Customization": "Personnalisation",
+  "Customize bashrc": "Personnaliser bashrc",
+  "Customizing bashrc for root user...": "Personnalisation de bashrc pour l'utilisateur root...",
+  "DISABLED unless you enable it": "DÉSACTIVÉ sauf si vous l'activez",
+  "DKMS add failed. Check": "L'ajout de DKMS a échoué. Vérifier",
+  "DKMS build failed.": "La construction de DKMS a échoué.",
+  "DKMS build failed. Last lines of make.log:": "La construction de DKMS a échoué. Dernières lignes de make.log :",
+  "DKMS install failed.": "L'installation de DKMS a échoué.",
+  "DKMS module registered.": "Module DKMS enregistré.",
+  "DNS Resolution": "Résolution DNS",
+  "DNS lookup for a domain": "Recherche DNS pour un domaine",
+  "Data size:": "Taille des données :",
+  "Data wipe complete.": "Effacement des données terminé.",
+  "Data wiped from": "Données effacées de",
+  "Datastore name:": "Nom de la banque de données :",
+  "Deactivate Monitor": "Désactiver le moniteur",
+  "Deactivate ProxMenux Monitor": "Désactiver le moniteur ProxMenux",
+  "Debian repositories missing; creating default source file": "Dépôts Debian manquants ; création du fichier source par défaut",
+  "Decompress backup manually": "Décompresser la sauvegarde manuellement",
+  "Decryption failed. The passphrase may be wrong, or the blob is corrupt. Try again?": "Le décryptage a échoué. La phrase secrète est peut-être erronée ou le blob est corrompu. Essayer à nouveau?",
+  "Default ACLs applied for group inheritance.": "ACL par défaut appliquées pour l’héritage de groupe.",
+  "Default Credentials": "Informations d'identification par défaut",
+  "Default Gateway": "Passerelle par défaut",
+  "Default ISO directory": "Répertoire ISO par défaut",
+  "Default Login Credentials:": "Identifiants de connexion par défaut :",
+  "Default Port": "Port par défaut",
+  "Default Proxmox logo applied": "Logo Proxmox par défaut appliqué",
+  "Default is none (video-only passthrough). Use SPACE to toggle selections.": "La valeur par défaut est aucune (passthrough vidéo uniquement). Utilisez ESPACE pour basculer les sélections.",
+  "Default journald configuration restored": "Configuration journald par défaut restaurée",
+  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "L'emplacement par défaut est /mnt/<nom>. Le partage sera monté ici sur l'hôte avec des autorisations ouvertes afin qu'un LXC non privilégié puisse y effectuer un montage en liaison et y écrire. Pour l'accès LXC, montez en liaison ce chemin avec le gestionnaire de montage LXC.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "L'emplacement par défaut est /mnt/<nom>. Le partage sera monté ici sur l'hôte. Utilisez ce chemin dans /etc/fstab. Pour l'accès LXC, montez en liaison ce chemin avec le gestionnaire de montage LXC.",
+  "Default options": "Options par défaut",
+  "Default options read/write": "Options par défaut lecture/écriture",
+  "Default will be used:": "la valeur par défaut sera utilisée :",
+  "Default:": "Par défaut :",
+  "Delete Borg target": "Supprimer la cible Borg",
+  "Delete Export": "Supprimer l'exportation",
+  "Delete Share": "Supprimer le partage",
+  "Delete a CT (irreversible). Use the correct <ctid>": "Supprimer un CT (irréversible). Utilisez le bon <ctid>",
+  "Delete a VM (irreversible). Use the correct <vmid>": "Supprimer une VM (irréversible). Utilisez le bon <vmid>",
+  "Delete archive": "Supprimer les archives",
+  "Delete job": "Supprimer le travail",
+  "Delete scheduled backup job?": "Supprimer la tâche de sauvegarde planifiée ?",
+  "Delete this corrupt archive and pick another": "Supprimez cette archive corrompue et choisissez-en une autre",
+  "Dependencies installed successfully": "Dépendances installées avec succès",
+  "Deploy with this configuration?": "Déployer avec cette configuration ?",
+  "Deploying Secure Gateway...": "Déploiement de Secure Gateway...",
+  "Deployment cancelled.": "Déploiement annulé.",
+  "Deployment failed": "Le déploiement a échoué",
+  "Description": "Description",
+  "Desktop UI backup created": "Sauvegarde de l'interface utilisateur du bureau créée",
+  "Desktop and Mobile UI patched": "Interface utilisateur de bureau et mobile corrigée",
+  "Destination Directory": "Répertoire des destinations",
+  "Destination directory does not exist:": "Le répertoire de destination n'existe pas :",
+  "Destination directory is not writable:": "Le répertoire de destination n'est pas accessible en écriture :",
+  "Destination path for the copy (typically outside ProxMenux state):": "chemin de destination de la copie (généralement en dehors de l'état ProxMenux) :",
+  "Destination:": "Destination:",
+  "Destroy a ZFS dataset (irreversible)": "Détruire un jeu de données ZFS (irréversible)",
+  "Destructive rollback": "Annulation destructrice",
+  "Detailed Proxmox version info": "Informations détaillées sur la version Proxmox",
+  "Detailed partition layout with GPT info": "Disposition détaillée des partitions avec informations GPT",
+  "Detailed service information": "Informations détaillées sur les services",
+  "Details": "Détails",
+  "Detect GPUs in host": "Détecter les GPU dans l'hôte",
+  "Detect controller/NVMe BDF": "Détecter le contrôleur/NVMe BDF",
+  "Detected": "Détecté",
+  "Detected AMD CPU": "Processeur AMD détecté",
+  "Detected Coral hardware:": "Matériel Coral détecté :",
+  "Detected GPU(s):": "GPU(s) détecté(s) :",
+  "Detected Intel CPU": "Processeur Intel détecté",
+  "Detected Proxmox VE": "Proxmox VE détecté",
+  "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Proxmox VE 8.x détecté - Installation de Ceph Squid pour Debian",
+  "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Proxmox VE 9.x détecté - Installation de Ceph Squid pour Debian Trixie",
+  "Detected RAM:": "RAM détectée :",
+  "Detected a mounted directory from host. Setting up shared group...": "Détection d'un répertoire monté depuis l'hôte. Configuration d'un groupe partagé...",
+  "Detected backups — newest first:": "Sauvegardes détectées – les plus récentes en premier :",
+  "Detected broken gasket-dkms package state:": "État du paquet joint-dkms cassé détecté :",
+  "Detected existing Samba user:": "Utilisateur Samba existant détecté :",
+  "Detected filesystem:": "Système de fichiers détecté :",
+  "Detected nftables - using nftables ban action": "Nftables détectés - utilisation de l'action d'interdiction de nftables",
+  "Detected paths in this backup:": "Chemins détectés dans cette sauvegarde :",
+  "Detected power state": "État d'alimentation détecté",
+  "Detected reset method": "Méthode de réinitialisation détectée",
+  "Detected risk factor": "Facteur de risque détecté",
+  "Detected subtype": "Sous-type détecté",
+  "Detected:": "Détecté :",
+  "Detecting AMD CPU and applying fixes if necessary...": "Détection du processeur AMD et application de correctifs si nécessaire...",
+  "Detecting PCI storage controllers and NVMe devices...": "Détection des contrôleurs de stockage PCI et des périphériques NVMe...",
+  "Detecting available disks...": "Détection des disques disponibles...",
+  "Detecting container OS...": "Détection du système d'exploitation du conteneur...",
+  "Detecting if this is an OVH server and installing OVH RTM if necessary...": "Détecter s'il s'agit d'un serveur OVH et installer OVH RTM si nécessaire...",
+  "Detecting previous optimizations...": "Détection des optimisations précédentes...",
+  "Detecting virtualization and installing  guest agent...": "Détection de la virtualisation et installation de l'agent invité...",
+  "Development Tools": "Outils de développement",
+  "Device In Use": "Appareil en cours d'utilisation",
+  "Device added": "Appareil ajouté",
+  "Device already present in target VM — existing hostpci entry reused": "Périphérique déjà présent dans la VM cible — entrée hostpci existante réutilisée",
+  "Device assignments will be written now and become active after reboot.": "Les affectations de périphériques seront écrites maintenant et deviendront actives après le redémarrage.",
+  "Device hostname": "Nom d'hôte de l'appareil",
+  "Device path mismatch. Format cancelled.": "Incohérence du chemin du périphérique. Format annulé.",
+  "Device:": "Appareil:",
+  "Devices to add to VM": "Appareils à ajouter à la VM",
+  "Diff: current system vs backup (--- system  +++ backup)": "Diff : système actuel vs sauvegarde (--- système +++ sauvegarde)",
+  "Different host. Backup from:": "Hôte différent. Sauvegarde depuis :",
+  "Direct conversion completed for container": "Conversion directe terminée pour le conteneur",
+  "Directory Exists": "Le répertoire existe",
+  "Directory Not Empty": "Répertoire non vide",
+  "Directory Not Found": "Répertoire introuvable",
+  "Directory already exists. Continue with permission setup?": "Le répertoire existe déjà. Continuer la configuration des autorisations ?",
+  "Directory configured for sharedfiles group access on:": "Répertoire configuré pour l'accès du groupe de fichiers partagés sur :",
+  "Directory configured with sharedfiles group ownership": "Répertoire configuré avec la propriété du groupe sharedfiles",
+  "Directory created successfully.": "Répertoire créé avec succès.",
+  "Directory created successfully:": "Répertoire créé avec succès :",
+  "Directory created:": "Répertoire créé :",
+  "Directory does not exist and was not created.": "Le répertoire n'existe pas et n'a pas été créé.",
+  "Directory does not exist:": "Le répertoire n'existe pas :",
+  "Directory error": "Erreur d'annuaire",
+  "Directory not found": "Répertoire introuvable",
+  "Directory storage added successfully to Proxmox!": "Stockage d'annuaire ajouté avec succès à Proxmox !",
+  "Directory successfully.": "Répertoire avec succès.",
+  "Directory:": "Annuaire:",
+  "Disable NIC Offloading (Intel e1000e)": "Désactiver le déchargement de la carte réseau (Intel e1000e)",
+  "Disable autostart on conflicting VM": "Désactiver le démarrage automatique sur la VM en conflit",
+  "Disable autostart on one VM to avoid startup conflicts.": "Désactivez le démarrage automatique sur une VM pour éviter les conflits de démarrage.",
+  "Disable kernel audit messages (optional but recommended):": "Désactivez les messages d'audit du noyau (facultatif mais recommandé) :",
+  "Disable onboot on affected VM(s)/CT(s)": "Désactiver le démarrage sur les VM/CT concernés",
+  "Disable portmapper/rpcbind": "Désactiver portmapper/rpcbind",
+  "Disabled": "Désactivé",
+  "Disabling High Availability services...": "Désactivation des services haute disponibilité...",
+  "Disabling ZFS autotrim applied by ProxMenux...": "Désactivation du découpage automatique ZFS appliqué par ProxMenux...",
+  "Disabling and removing NetworkManager...": "Désactivation et suppression de NetworkManager...",
+  "Disabling and stopping rpcbind service...": "Désactivation et arrêt du service rpcbind...",
+  "Disabling non-free firmware warnings...": "Désactivation des avertissements du firmware non libre...",
+  "Disabling portmapper/rpcbind for security...": "Désactivation de portmapper/rpcbind pour la sécurité...",
+  "Discover targets on portal:": "Découvrez les cibles sur le portail :",
+  "Discovering iSCSI targets...": "Découverte des cibles iSCSI...",
+  "Discovery successful": "Découverte réussie",
+  "Disk": "Disque",
+  "Disk Already Assigned": "Disque déjà attribué",
+  "Disk In Use": "Disque en cours d'utilisation",
+  "Disk In Use by Running VM": "Disque utilisé par l'exécution de la VM",
+  "Disk Manager": "Gestionnaire de disque",
+  "Disk Reference Conflict": "Conflit de référence de disque",
+  "Disk Setup": "Configuration du disque",
+  "Disk added as": "Disque ajouté en tant que",
+  "Disk already has": "Le disque a déjà",
+  "Disk and Storage Manager - Manual CLI Guide": "Gestionnaire de disques et de stockage - Guide CLI manuel",
+  "Disk appears empty. It will be formatted.": "Le disque semble vide. Il sera formaté.",
+  "Disk assigned at": "Disque attribué à",
+  "Disk attached as:": "Disque attaché en tant que :",
+  "Disk configured as": "Disque configuré comme",
+  "Disk conversion failed for": "La conversion du disque a échoué pour",
+  "Disk file not found:": "Fichier disque introuvable :",
+  "Disk formatted as": "Disque formaté comme",
+  "Disk formatted successfully.": "Disque formaté avec succès.",
+  "Disk image        — VM disk images": "Image disque — Images de disque de VM",
+  "Disk interface is required to continue VM creation.": "L'interface disque est requise pour poursuivre la création de VM.",
+  "Disk interface selected:": "Interface disque sélectionnée :",
+  "Disk interface selection cancelled.": "Sélection de l'interface disque annulée.",
+  "Disk is part of a host ZFS pool": "Le disque fait partie d'un pool ZFS hôte",
+  "Disk is part of host LVM": "Le disque fait partie du LVM hôte",
+  "Disk is ready for VM passthrough.": "Le disque est prêt pour le relais de la VM.",
+  "Disk is ready to be added to Proxmox storage.": "Le disque est prêt à être ajouté au stockage Proxmox.",
+  "Disk metadata cleaned.": "Métadonnées du disque nettoyées.",
+  "Disk mounted at": "Disque monté sur",
+  "Disk path resolved via pvesm:": "Chemin du disque résolu via pvesm :",
+  "Disk path:": "Chemin du disque :",
+  "Disk safety revalidation failed.": "La revalidation de la sécurité du disque a échoué.",
+  "Disk safety validation passed.": "Validation de la sécurité du disque réussie.",
+  "Disk unmounted from": "Disque démonté de",
+  "Disk verified and accessible inside CT at": "Disque vérifié et accessible à l'intérieur de CT à",
+  "Disk:": "Disque:",
+  "Disks exported:": "Disques exportés :",
+  "Disks to export:": "Disques à exporter :",
+  "Disks to import:": "Disques à importer :",
+  "Disks to process:": "Disques à traiter :",
+  "Disks:": "Disques :",
+  "Display  :": "Afficher  :",
+  "Display logical volumes (LVM)": "Afficher les volumes logiques (LVM)",
+  "Display physical volumes (LVM)": "Afficher les volumes physiques (LVM)",
+  "Display system summary in ASCII format": "Afficher le résumé du système au format ASCII",
+  "Display volume groups (LVM)": "Afficher les groupes de volumes (LVM)",
+  "Do not run the upgrade from the Web UI virtual console (it will disconnect)": "N'exécutez pas la mise à niveau à partir de la console virtuelle Web UI (elle se déconnectera)",
+  "Do not start the VM until the system has been rebooted.": "Ne démarrez pas la VM tant que le système n'a pas été redémarré.",
+  "Do you want ProxMenux to stop it now?": "Voulez-vous que ProxMenux l'arrête maintenant ?",
+  "Do you want to activate ProxMenux Monitor?": "Voulez-vous activer ProxMenux Monitor ?",
+  "Do you want to apply the optional NVIDIA patch to remove some GPU limitations?": "Souhaitez-vous appliquer le correctif NVIDIA facultatif pour supprimer certaines limitations du GPU ?",
+  "Do you want to apply these optimizations now?": "Voulez-vous appliquer ces optimisations maintenant ?",
+  "Do you want to configure GPU passthrough for this VM now?": "Voulez-vous configurer le relais GPU pour cette VM maintenant ?",
+  "Do you want to continue anyway?": "Voulez-vous quand même continuer ?",
+  "Do you want to continue with the conversion now, or exit to create a backup first?": "Voulez-vous poursuivre la conversion maintenant ou quitter pour créer d'abord une sauvegarde ?",
+  "Do you want to continue?": "Voulez-vous continuer ?",
+  "Do you want to convert it to a privileged container now?": "Voulez-vous le convertir en conteneur privilégié maintenant ?",
+  "Do you want to create it now?": "Voulez-vous le créer maintenant ?",
+  "Do you want to create it?": "Voulez-vous le créer?",
+  "Do you want to deactivate ProxMenux Monitor?": "Voulez-vous désactiver ProxMenux Monitor ?",
+  "Do you want to disable and remove it now?": "Voulez-vous le désactiver et le supprimer maintenant ?",
+  "Do you want to enable IOMMU now?": "Voulez-vous activer IOMMU maintenant ?",
+  "Do you want to enable the serial port": "Voulez-vous activer le port série",
+  "Do you want to encrypt this backup?": "Voulez-vous chiffrer cette sauvegarde ?",
+  "Do you want to install Log2RAM anyway to reduce log write load?": "Voulez-vous quand même installer Log2RAM pour réduire la charge d’écriture du journal ?",
+  "Do you want to make this mount permanent?": "Voulez-vous rendre ce montage permanent ?",
+  "Do you want to open Switch GPU Mode now?": "Voulez-vous ouvrir le mode Switch GPU maintenant ?",
+  "Do you want to proceed and run the Proxmox System Update?": "Voulez-vous continuer et exécuter la mise à jour du système Proxmox ?",
+  "Do you want to proceed with the system update?": "Voulez-vous procéder à la mise à jour du système ?",
+  "Do you want to proceed?": "Voulez-vous continuer ?",
+  "Do you want to reboot now?": "Voulez-vous redémarrer maintenant ?",
+  "Do you want to restart the network service now to apply changes?": "Voulez-vous redémarrer le service réseau maintenant pour appliquer les modifications ?",
+  "Do you want to restart the network service to apply changes?": "Voulez-vous redémarrer le service réseau pour appliquer les modifications ?",
+  "Do you want to run the network script from": "Voulez-vous exécuter le script réseau à partir de",
+  "Do you want to run the post-installation script from": "Voulez-vous exécuter le script de post-installation à partir de",
+  "Do you want to run the script now?": "Voulez-vous exécuter le script maintenant ?",
+  "Do you want to schedule selected paths for next boot now?": "Voulez-vous planifier les chemins sélectionnés pour le prochain démarrage maintenant ?",
+  "Do you want to start the converted unprivileged container": "Voulez-vous démarrer le conteneur converti sans privilèges",
+  "Do you want to start the privileged container": "Voulez-vous démarrer le conteneur privilégié",
+  "Do you want to try different credentials or authentication method?": "Voulez-vous essayer différentes informations d’identification ou méthodes d’authentification ?",
+  "Do you want to unmount it first?": "Voulez-vous d'abord le démonter ?",
+  "Do you want to update now?": "Voulez-vous mettre à jour maintenant ?",
+  "Do you want to update the NVIDIA userspace libraries inside these containers to match the host?": "Souhaitez-vous mettre à jour les bibliothèques d'espace utilisateur NVIDIA à l'intérieur de ces conteneurs pour qu'elles correspondent à l'hôte ?",
+  "Do you want to update the existing export?": "Voulez-vous mettre à jour l’export existant ?",
+  "Do you want to update the existing share?": "Voulez-vous mettre à jour le partage existant ?",
+  "Do you want to view the selected backup before restoring?": "Voulez-vous afficher la sauvegarde sélectionnée avant de la restaurer ?",
+  "Download failed for all attempted URLs": "Le téléchargement a échoué pour toutes les tentatives d'URL",
+  "Download keyfile": "Télécharger le fichier clé",
+  "Download latest VirtIO ISO automatically": "Téléchargez automatiquement la dernière version ISO de VirtIO",
+  "Downloaded amdgpu_top": "Téléchargé amdgpu_top",
+  "Downloading": "Téléchargement",
+  "Downloading Helper-Scripts logo...": "Téléchargement du logo Helper-Scripts...",
+  "Downloading Home-Labs-Club logo...": "Téléchargement du logo Home-Labs-Club...",
+  "Downloading JC Channel logo...": "Téléchargement du logo de JC Channel...",
+  "Downloading ProxMenux logo...": "Téléchargement du logo ProxMenux...",
+  "Downloading Proxmology logo...": "Téléchargement du logo Proxmology...",
+  "Downloading UUP converter...": "Téléchargement du convertisseur UUP...",
+  "Downloading amdgpu_top": "Téléchargement de amdgpu_top",
+  "Downloading official installer...": "Téléchargement du programme d'installation officiel...",
+  "Downloading pre-existing encrypted backups from this host will fail unless you kept a copy of the current key.": "Le téléchargement de sauvegardes chiffrées préexistantes à partir de cet hôte échouera à moins que vous ne conserviez une copie de la clé actuelle.",
+  "Downloading the latest Fastfetch release...": "Téléchargement de la dernière version de Fastfetch...",
+  "Driver blacklist entries removed": "Entrées de la liste noire des pilotes supprimées",
+  "Driver blacklist removed for": "Liste noire des pilotes supprimée pour",
+  "Driver installed successfully. Press Enter to continue...": "Pilote installé avec succès. Appuyez sur Entrée pour continuer...",
+  "Drivers  :": "Pilotes :",
+  "Drivers compiled and installed via DKMS.": "Pilotes compilés et installés via DKMS.",
+  "Dumping AMD GPU ROM BIOS via sysfs...": "Vidage du BIOS ROM GPU AMD via sysfs...",
+  "Duplicate IP addresses found": "Adresses IP en double trouvées",
+  "Duplicate parameters cleaned": "Paramètres en double nettoyés",
+  "Duration": "Durée",
+  "Duration:": "Durée:",
+  "EFI disk created and configured on": "Disque EFI créé et configuré sur",
+  "EFI storage selection cancelled.": "Sélection de stockage EFI annulée.",
+  "EFI storage selection failed or was cancelled. VM creation aborted.": "La sélection du stockage EFI a échoué ou a été annulée. Création de VM abandonnée.",
+  "EMERGENCY PROXMOX SYSTEM REPAIR": "RÉPARATION D'URGENCE DU SYSTÈME PROXMOX",
+  "ENABLED for restore": "ACTIVÉ pour la restauration",
+  "EXISTS": "EXISTE",
+  "Each LUN will appear as a block device assignable to VMs.": "Chaque LUN apparaîtra comme un périphérique bloc attribuable aux machines virtuelles.",
+  "Edge TPU runtime installed.": "Le runtime Edge TPU est installé.",
+  "Edit raw CT configuration file": "Modifier le fichier de configuration CT brut",
+  "Edit raw VM configuration file": "Modifier le fichier de configuration brut de la VM",
+  "Edit the VM machine type to q35 and try again.": "Modifiez le type de machine virtuelle en q35 et réessayez.",
+  "Emergency Proxmox System Repair": "Réparation d'urgence du système Proxmox",
+  "Emergency recovery:": "Récupération d'urgence :",
+  "Empty": "Vide",
+  "Enable": "Activer",
+  "Enable / disable job timer": "Activer/désactiver le minuteur de travail",
+  "Enable High Availability services": "Activer les services de haute disponibilité",
+  "Enable IOMMU in GRUB or ZFS boot": "Activer IOMMU au démarrage GRUB ou ZFS",
+  "Enable IOMMU support if not enabled": "Activer la prise en charge IOMMU si elle n'est pas activée",
+  "Enable IOMMU, reboot the host, and try again.": "Activez IOMMU, redémarrez l'hôte et réessayez.",
+  "Enable Remote Desktop (RDP) before disabling the virtual display.": "Activez le Bureau à distance (RDP) avant de désactiver l'affichage virtuel.",
+  "Enable SSD emulation for this disk?": "Activer l'émulation SSD pour ce disque ?",
+  "Enable TCP BBR/Fast Open control": "Activer le contrôle TCP BBR/Fast Open",
+  "Enable VFIO IOMMU support": "Activer la prise en charge de VFIO IOMMU",
+  "Enable ZFS autotrim (SSD/NVMe pools)": "Activer le réglage automatique ZFS (pools SSD/NVMe)",
+  "Enable auto-sync if /var/log exceeds 90% of its size?": "Activer la synchronisation automatique si /var/log dépasse 90 % de sa taille ?",
+  "Enable fast reboots": "Activer les redémarrages rapides",
+  "Enable restart on kernel panic": "Activer le redémarrage en cas de panique du noyau",
+  "Enable/Disable job": "Activer/Désactiver le travail",
+  "Enabled": "Activé",
+  "Enabled (device pending — load apex module or reboot)": "Activé (périphérique en attente – charger le module apex ou redémarrer)",
+  "Enabled (repokey)": "Activé (repokey)",
+  "Enabled and detected": "Activé et détecté",
+  "Enabled and ready": "Activé et prêt",
+  "Enabled but not connected": "Activé mais non connecté",
+  "Enabled memory compaction proactiveness": "Activation de la proactivité du compactage de la mémoire",
+  "Enabling Google TCP BBR congestion control...": "Activation du contrôle de congestion Google TCP BBR...",
+  "Enabling High Availability (HA) services...": "Activation des services haute disponibilité (HA)...",
+  "Enabling IOMMU": "Activation d'IOMMU",
+  "Enabling IOMMU and configuring VFIO for PCI passthrough...": "Activation d'IOMMU et configuration de VFIO pour le relais PCI...",
+  "Enabling TCP Fast Open...": "Activation de l'ouverture rapide TCP...",
+  "Enabling pigz in vzdump configuration...": "Activation de pigz dans la configuration de vzdump...",
+  "Encrypt this Borg repository?": "Chiffrer ce référentiel Borg ?",
+  "Encryption": "Cryptage",
+  "Encryption key": "Clé de cryptage",
+  "Encryption key creation failed": "La création de la clé de chiffrement a échoué",
+  "Encryption:": "Cryptage :",
+  "English": "Anglais",
+  "Ensure there are no errors and that proxmox-ve candidate shows 9.x": "Assurez-vous qu'il n'y a pas d'erreurs et que le candidat proxmox-ve affiche 9.x",
+  "Ensuring apex group and udev rules...": "Assurer les règles du groupe apex et de l'udev...",
+  "Ensuring ceph.sources (enterprise, Trixie) is present...": "S'assurer que ceph.sources (entreprise, Trixie) est présent...",
+  "Ensuring ceph.sources (no-subscription, Trixie) is present...": "S'assurer que ceph.sources (sans abonnement, Trixie) est présent...",
+  "Ensuring proxmox.sources (PVE 9, no-subscription, deb822) is present...": "S'assurer que proxmox.sources (PVE 9, sans abonnement, deb822) est présent...",
+  "Ensuring pve-enterprise.sources (PVE 9, deb822) is present...": "S'assurer que pve-enterprise.sources (PVE 9, deb822) est présent...",
+  "Enter": "Entrer",
+  "Enter CT ID:": "Entrez l'ID CT :",
+  "Enter MSR register (e.g. 0x10):": "Entrez le registre MSR (par exemple 0x10) :",
+  "Enter NFS export path (e.g., /mnt/shared):": "Entrez le chemin d'exportation NFS (par exemple, /mnt/shared) :",
+  "Enter NFS server IP or hostname:": "Saisissez l'adresse IP ou le nom d'hôte du serveur NFS :",
+  "Enter NVMe device (e.g., nvme0):": "Entrez le périphérique NVMe (par exemple, nvme0) :",
+  "Enter PCI BDF (e.g. 0000:01:00.0):": "Entrez PCI BDF (par exemple 0000:01:00.0) :",
+  "Enter PCI BDF (e.g. 0000:04:00.0):": "Entrez PCI BDF (par exemple 0000:04:00.0) :",
+  "Enter Path": "Entrez le chemin",
+  "Enter Samba server IP:": "Entrez l'adresse IP du serveur Samba :",
+  "Enter Samba share name:": "Entrez le nom du partage Samba :",
+  "Enter Tailscale Auth Key": "Entrez la clé d'authentification Tailscale",
+  "Enter VM ID:": "Saisissez l'ID de la VM :",
+  "Enter VM/CT ID:": "Saisissez l'ID de VM/CT :",
+  "Enter ZFS pool name for the selected disk:": "Entrez le nom du pool ZFS pour le disque sélectionné :",
+  "Enter a name for the mount point (used as /mnt/<name>):": "Entrez un nom pour le point de montage (utilisé comme /mnt/<name>) :",
+  "Enter a name for the new virtual machine:": "Entrez un nom pour la nouvelle machine virtuelle :",
+  "Enter a number, or write or paste a command:": "Entrez un nombre, ou écrivez ou collez une commande :",
+  "Enter backup file (.zst):": "Entrez le fichier de sauvegarde (.zst) :",
+  "Enter backup path (.tar.zst):": "Entrez le chemin de sauvegarde (.tar.zst) :",
+  "Enter backup path (.vma.zst):": "Entrez le chemin de sauvegarde (.vma.zst) :",
+  "Enter base folder for temporary files and converter (default:": "Entrez le dossier de base pour les fichiers temporaires et le convertisseur (par défaut :",
+  "Enter boot target (e.g. scsi0, sata0, ide0):": "Entrez la cible de démarrage (par exemple scsi0, sata0, ide0) :",
+  "Enter content types (comma-separated):": "Saisissez les types de contenu (séparés par des virgules) :",
+  "Enter custom CIFS mount options (open uid/gid/file_mode strongly recommended for LXC bind-mounts):": "Entrez les options de montage CIFS personnalisées (open uid/gid/file_mode fortement recommandé pour les montages de liaison LXC) :",
+  "Enter custom NFS mount options:": "Entrez les options de montage NFS personnalisées :",
+  "Enter custom NFS options:": "Entrez les options NFS personnalisées :",
+  "Enter custom Samba configuration for this share:": "Entrez la configuration Samba personnalisée pour ce partage :",
+  "Enter custom mount options:": "Entrez les options de montage personnalisées :",
+  "Enter custom path": "Entrez un chemin personnalisé",
+  "Enter custom pathr": "Entrez le chemin personnalisé",
+  "Enter destination directory for exported file(s):": "Entrez le répertoire de destination du ou des fichiers exportés :",
+  "Enter destination path for ISO file": "Entrez le chemin de destination du fichier ISO",
+  "Enter destination path:": "Entrez le chemin de destination :",
+  "Enter device (e.g., sda or nvme0):": "Saisissez le périphérique (par exemple, sda ou nvme0) :",
+  "Enter directory containing OVA/OVF files:": "Entrez le répertoire contenant les fichiers OVA/OVF :",
+  "Enter directory path:": "Entrez le chemin du répertoire :",
+  "Enter disk image path:": "Entrez le chemin de l'image disque :",
+  "Enter disk or partition path (prefer /dev/disk/by-id/...):": "Entrez le chemin du disque ou de la partition (préférez /dev/disk/by-id/...) :",
+  "Enter domain name:": "Entrez le nom de domaine :",
+  "Enter domain:": "Entrez le domaine :",
+  "Enter filesystem (ext4/xfs/btrfs):": "Entrez le système de fichiers (ext4/xfs/btrfs) :",
+  "Enter folder name for /mnt:": "Entrez le nom du dossier pour /mnt :",
+  "Enter full disk path as shown above (starting with /dev/disk/by-id/xxx...):": "Entrez le chemin complet du disque comme indiqué ci-dessus (en commençant par /dev/disk/by-id/xxx...) :",
+  "Enter full path for mount point:": "Entrez le chemin complet du point de montage :",
+  "Enter full path to the disk image (e.g., /var/lib/vz/images/xyz.img):": "Entrez le chemin complet de l'image disque (par exemple, /var/lib/vz/images/xyz.img) :",
+  "Enter full path to the input image (e.g., /var/lib/vz/images/disk.vmdk):": "Entrez le chemin complet de l'image d'entrée (par exemple, /var/lib/vz/images/disk.vmdk) :",
+  "Enter full path:": "Entrez le chemin complet :",
+  "Enter host IP (e.g., 192.168.0.100):": "Saisissez l'adresse IP de l'hôte (par exemple, 192.168.0.100) :",
+  "Enter host or IP:": "Entrez l'hôte ou l'adresse IP :",
+  "Enter hostpci slot (e.g. 0):": "Entrez l'emplacement hostpci (par exemple 0) :",
+  "Enter hostpci slot number (e.g. 0):": "Entrez le numéro d'emplacement hostpci (par exemple 0) :",
+  "Enter iSCSI target portal IP or hostname:": "Entrez l'adresse IP ou le nom d'hôte du portail cible iSCSI :",
+  "Enter image full path:": "Entrez le chemin complet de l'image :",
+  "Enter imported disk reference (e.g. local-lvm:vm-100-disk-0):": "Entrez la référence du disque importé (par exemple local-lvm:vm-100-disk-0) :",
+  "Enter interface (sata/scsi/virtio/ide):": "Entrez l'interface (sata/scsi/virtio/ide) :",
+  "Enter interface name (e.g. eth0):": "Entrez le nom de l'interface (par exemple eth0) :",
+  "Enter mount path on host:": "Entrez le chemin de montage sur l'hôte :",
+  "Enter mount point in CT (e.g. /mnt/data):": "Entrez le point de montage dans CT (par exemple /mnt/data) :",
+  "Enter mp slot number (e.g. 0):": "Entrez le numéro d'emplacement MP (par exemple 0) :",
+  "Enter name for the imported VM:": "Saisissez le nom de la VM importée :",
+  "Enter networks to advertise (comma-separated CIDR):": "Saisissez les réseaux sur lesquels faire de la publicité (CIDR séparés par des virgules) :",
+  "Enter new folder name:": "Entrez le nouveau nom du dossier :",
+  "Enter new group name:": "Entrez le nouveau nom du groupe :",
+  "Enter partition path (e.g. /dev/sdX1):": "Entrez le chemin de la partition (par exemple /dev/sdX1) :",
+  "Enter password for": "Entrez le mot de passe pour",
+  "Enter password:": "Entrez le mot de passe :",
+  "Enter path manually": "Saisir le chemin manuellement",
+  "Enter path to analyze:": "Entrez le chemin à analyser :",
+  "Enter path:": "Entrez le chemin :",
+  "Enter pool name to clear errors:": "Entrez le nom du pool pour effacer les erreurs :",
+  "Enter pool name to export:": "Saisissez le nom du pool à exporter :",
+  "Enter pool name to import:": "Saisissez le nom du pool à importer :",
+  "Enter pool name:": "Entrez le nom du pool :",
+  "Enter pool/dataset name:": "Entrez le nom du pool/ensemble de données :",
+  "Enter pool/dataset to destroy:": "Entrez le pool/ensemble de données à détruire :",
+  "Enter pool/dataset to mount:": "Entrez le pool/ensemble de données à monter :",
+  "Enter search term (leave empty to show all scripts):": "Saisissez le terme de recherche (laissez vide pour afficher tous les scripts) :",
+  "Enter server IP": "Entrez l'adresse IP du serveur",
+  "Enter server IP/hostname manually": "Entrez manuellement l'adresse IP/le nom d'hôte du serveur",
+  "Enter server IP:": "Entrez l'adresse IP du serveur :",
+  "Enter slot number (e.g. 0):": "Entrez le numéro d'emplacement (par exemple 0) :",
+  "Enter storage ID for Proxmox:": "Entrez l'ID de stockage pour Proxmox :",
+  "Enter storage ID:": "Saisissez l'ID de stockage :",
+  "Enter storage name:": "Entrez le nom du stockage :",
+  "Enter subnet (e.g., 192.168.0.0/24):": "Entrez le sous-réseau (par exemple, 192.168.0.0/24) :",
+  "Enter target disk (e.g. /dev/sdX):": "Entrez le disque cible (par exemple /dev/sdX) :",
+  "Enter target storage name (e.g., local-lvm):": "Entrez le nom du stockage cible (par exemple, local-lvm) :",
+  "Enter target storage:": "Entrez le stockage cible :",
+  "Enter the BORG REPOKEY passphrase for target:": "saisissez la phrase secrète BORG REPOKEY pour la cible :",
+  "Enter the Samba username:": "Entrez le nom d'utilisateur Samba :",
+  "Enter the VMID for the new VM:": "Saisissez le VMID de la nouvelle VM :",
+  "Enter the container terminal:": "Entrez dans le terminal à conteneurs :",
+  "Enter the full path to the directory containing disk images:": "Entrez le chemin complet du répertoire contenant les images disque :",
+  "Enter the full path to the host directory:": "Entrez le chemin complet du répertoire hôte :",
+  "Enter the full path to the host folder:": "Entrez le chemin complet du dossier hôte :",
+  "Enter the full path to the output image (e.g., /var/lib/vz/images/output.qcow2):": "Entrez le chemin complet vers l'image de sortie (par exemple, /var/lib/vz/images/output.qcow2) :",
+  "Enter the host mount path:": "Entrez le chemin de montage de l'hôte :",
+  "Enter the iperf3 server IP or hostname:": "Entrez l'adresse IP ou le nom d'hôte du serveur iperf3 :",
+  "Enter the maximum size (in MB) to allocate for /var/log in RAM (e.g. 128, 256, 512):": "Entrez la taille maximale (en Mo) à allouer pour /var/log dans la RAM (par exemple 128, 256, 512) :",
+  "Enter the mount point for the NFS export (e.g., /mnt/mynfs):": "Entrez le point de montage pour l'exportation NFS (par exemple, /mnt/mynfs) :",
+  "Enter the mount point for the shared folder (e.g., /mnt/myshare):": "Entrez le point de montage du dossier partagé (par exemple, /mnt/myshare) :",
+  "Enter the mount point inside the CT for": "Entrez le point de montage à l'intérieur du CT pour",
+  "Enter the number or type the interface name:": "Entrez le numéro ou tapez le nom de l'interface :",
+  "Enter the password for Samba user:": "Entrez le mot de passe de l'utilisateur Samba :",
+  "Enter the recovery passphrase set when the keyfile was created:": "Saisissez la phrase secrète de récupération définie lors de la création du fichier de clés :",
+  "Enter username for Samba server:": "Entrez le nom d'utilisateur pour le serveur Samba :",
+  "Enter username:": "Entrez le nom d'utilisateur :",
+  "Enterprise Proxmox Ceph repository disabled": "Référentiel Enterprise Proxmox Ceph désactivé",
+  "Enterprise Proxmox repository disabled": "Référentiel Enterprise Proxmox désactivé",
+  "Enterprise repositories restored": "Référentiels d'entreprise restaurés",
+  "Enterprise repository present": "Référentiel d'entreprise présent",
+  "Enterprise repository returned 401 Unauthorized (no valid subscription). Switch to the no-subscription repository and retry?": "Le référentiel d'entreprise a renvoyé 401 non autorisé (pas d'abonnement valide). Passer au référentiel sans abonnement et réessayer ?",
+  "Enterprise repository unauthorized and fallback declined by user": "Dépôt d'entreprise non autorisé et solution de secours refusée par l'utilisateur",
+  "Entropy generation optimization removed": "Optimisation de la génération d'entropie supprimée",
+  "Equivalent manual flow of disk_host.sh: partition, format, mount, persist, register in Proxmox.": "Flux manuel équivalent de disk_host.sh : partitionner, formater, monter, persister, s'inscrire dans Proxmox.",
+  "Equivalent manual flow of iscsi_host.sh.": "Flux manuel équivalent de iscsi_host.sh.",
+  "Equivalent manual flow used by Local Shared Manager.": "Flux manuel équivalent utilisé par Local Shared Manager.",
+  "Error": "Erreur",
+  "Error applying patch. Backups preserved at": "Erreur lors de l'application du correctif. Sauvegardes conservées à",
+  "Error details:": "Détails de l'erreur :",
+  "Error installing": "Erreur d'installation",
+  "Error installing build dependencies. Check": "Erreur lors de l'installation des dépendances de build. Vérifier",
+  "Error:": "Erreur:",
+  "Error: Cannot create directory": "Erreur : Impossible de créer le répertoire",
+  "Error: Failed to download the script.": "Erreur : échec du téléchargement du script.",
+  "Error: No script data found for slug:": "Erreur : Aucune donnée de script trouvée pour le slug :",
+  "Error: No write permissions in directory": "Erreur : aucune autorisation d'écriture dans le répertoire",
+  "Essential Proxmox packages installed": "Packages Proxmox essentiels installés",
+  "Estimated required free space:": "Espace libre requis estimé :",
+  "Every 12 hours": "Toutes les 12 heures",
+  "Every 3 hours": "Toutes les 3 heures",
+  "Every 6 hours": "Toutes les 6 heures",
+  "Every hour": "Toutes les heures",
+  "Every path in this backup is kernel-tied: the restore applies these paths automatically via the safe-subset filter and re-merges the operator's tuning.": "Chaque chemin de cette sauvegarde est lié au noyau : la restauration applique automatiquement ces chemins via le filtre de sous-ensemble sécurisé et fusionne à nouveau le réglage de l'opérateur.",
+  "Everything restorable in this backup will be restored": "Tout ce qui peut être restauré dans cette sauvegarde sera restauré",
+  "Example output: rootfs: local-lvm:vm-114-disk-0,size=8G": "Exemple de sortie : rootfs : local-lvm:vm-114-disk-0,size=8G",
+  "Example target: /dev/sdb": "Exemple de cible : /dev/sdb",
+  "Example: /dev/pve/vm-114-disk-0": "Exemple : /dev/pve/vm-114-disk-0",
+  "Example: /rpool/data/subvol-114-disk-0": "Exemple : /rpool/data/subvol-114-disk-0",
+  "Example: MOUNT_PATH=\"/rpool/data/subvol-114-disk-0\"": "Exemple : MOUNT_PATH=\"/rpool/data/subvol-114-disk-0\"",
+  "Example: cp /etc/pve/lxc/110.conf /etc/pve/lxc/110.conf.bak": "Exemple : cp /etc/pve/lxc/110.conf /etc/pve/lxc/110.conf.bak",
+  "Example: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak": "Exemple : cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak",
+  "Example: daily or Mon..Fri 03:00": "Exemple : tous les jours ou du lundi au vendredi à 03h00",
+  "Example: mkdir -p /tmp/lxc_convert_114": "Exemple : mkdir -p /tmp/lxc_convert_114",
+  "Example: pct config 110 | grep unprivileged": "Exemple : configuration PCT 110 | grep sans privilège",
+  "Example: pct stop 110": "Exemple : PCT stop 110",
+  "Example: pct stop 114": "Exemple : PCT arrêt 114",
+  "Example: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup": "Exemple : pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup",
+  "Example: pvesm path local-lvm:vm-114-disk-0": "Exemple : chemin pvesm local-lvm:vm-114-disk-0",
+  "Example: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf": "Exemple : sed -i '/^unprivileged : 1/d' /etc/pve/lxc/110.conf",
+  "Examples:": "Exemples :",
+  "Execute destructive rollback?": "Exécuter une restauration destructrice ?",
+  "Executing destructive rollback (operator confirmed) ...": "Exécution d'une restauration destructrice (opérateur confirmé)...",
+  "Executing:": "Exécution :",
+  "Existing Groups": "Groupes existants",
+  "Existing file, re-downloading...": "Fichier existant, retéléchargement...",
+  "Existing filesystem:": "Système de fichiers existant :",
+  "Existing hostpci entries detected — they will be reused": "Entrées hostpci existantes détectées : elles seront réutilisées",
+  "Existing key is at:": "La clé existante se trouve à :",
+  "Existing recovery envelopes already on PBS stay intact — they still recover the old key with its original passphrase.": "Les enveloppes de récupération existantes déjà sur PBS restent intactes : elles récupèrent toujours l'ancienne clé avec sa phrase secrète d'origine.",
+  "Exit": "Sortie",
+  "Exit and repair manually": "Quitter et réparer manuellement",
+  "Exit the container terminal:": "Sortez du terminal à conteneurs :",
+  "Exit: Stop to create backup manually": "Quitter : arrêter pour créer une sauvegarde manuellement",
+  "Exiting for manual repair...": "Sortie pour réparation manuelle...",
+  "Expected /tmp/gasket-driver/src not found. The clone seems incomplete or uses an unknown layout.": "/tmp/gasket-driver/src attendu introuvable. Le clone semble incomplet ou utilise une mise en page inconnue.",
+  "Expected Makefile not found in /tmp/gasket-driver/src. Source tree is incomplete.": "Makefile attendu introuvable dans /tmp/gasket-driver/src. L'arborescence source est incomplète.",
+  "Expected path:": "Chemin attendu :",
+  "Expected: rootfs/ directory, or /etc /var /root at archive root.": "Attendu : répertoire rootfs/ ou /etc /var /root à la racine de l'archive.",
+  "Export Format": "Format d'exportation",
+  "Export Options": "Options d'exportation",
+  "Export Path": "Chemin d'exportation",
+  "Export Summary": "Résumé de l'exportation",
+  "Export VM to OVA or OVF": "Exporter la VM vers OVA ou OVF",
+  "Export a ZFS pool": "Exporter un pool ZFS",
+  "Export added successfully.": "Exportation ajoutée avec succès.",
+  "Export backup data to file": "Exporter les données de sauvegarde vers un fichier",
+  "Export completed. The running system has not been modified.": "Exportation terminée. Le système en cours d'exécution n'a pas été modifié.",
+  "Export completed:": "Exportation terminée :",
+  "Export deleted and NFS service restarted.": "Exportation supprimée et service NFS redémarré.",
+  "Export error log": "Exporter le journal des erreurs",
+  "Export exists:": "L'export existe :",
+  "Export failed.": "L'exportation a échoué.",
+  "Export list test": "Test de liste d'exportation",
+  "Export list:": "Liste d'exportation :",
+  "Export mode:": "Mode d'exportation :",
+  "Export not found on server:": "Export introuvable sur le serveur :",
+  "Export path:": "Chemin d'exportation :",
+  "Export permissions allow access": "Les autorisations d'exportation autorisent l'accès",
+  "Export to file (no system changes)": "Exporter vers un fichier (aucune modification du système)",
+  "Export updated successfully.": "Exportation mise à jour avec succès.",
+  "Export:": "Exporter:",
+  "Exporting ZFS pool...": "Exportation du pool ZFS...",
+  "Exports cleared.": "Exportations autorisées.",
+  "Exports:": "Exportations:",
+  "Extended Filesystem 4 (recommended)": "Système de fichiers étendu 4 (recommandé)",
+  "External disk for backup": "Disque externe pour la sauvegarde",
+  "Extracting NVIDIA installer on host...": "Extraction du programme d'installation NVIDIA sur l'hôte...",
+  "Extracting OVA archive...": "Extraction de l'archive OVA...",
+  "Extracting archive...": "Extraction des archives...",
+  "Extracting data from Borg...": "Extraction des données de Borg...",
+  "Extracting data from PBS...": "Extraction de données de PBS...",
+  "Extraction completed.": "Extraction terminée.",
+  "Extraction failed.": "L'extraction a échoué.",
+  "Extraction failed. Check log:": "L'extraction a échoué. Journal de vérification :",
+  "Extraction successful": "Extraction réussie",
+  "FAILED": "ÉCHOUÉ",
+  "FINAL CONFIRMATION — DATA WILL BE ERASED": "CONFIRMATION FINALE — LES DONNÉES SERONT EFFACÉES",
+  "Fail2Ban - Intrusion Prevention": "Fail2Ban - Prévention des intrusions",
+  "Fail2Ban Management": "Gestion Fail2Ban",
+  "Fail2Ban has been removed": "Fail2Ban a été supprimé",
+  "Fail2Ban installation and configuration completed successfully!": "L'installation et la configuration de Fail2Ban se sont terminées avec succès !",
+  "Fail2Ban installed successfully": "Fail2Ban installé avec succès",
+  "Fail2Ban is NOT running!": "Fail2Ban ne fonctionne PAS !",
+  "Fail2Ban is currently installed.": "Fail2Ban est actuellement installé.",
+  "Fail2Ban is not installed on this system.": "Fail2Ban n'est pas installé sur ce système.",
+  "Fail2Ban is running correctly": "Fail2Ban fonctionne correctement",
+  "Failed": "Échoué",
+  "Failed to access log2ram directory": "Échec de l'accès au répertoire log2ram",
+  "Failed to access share with provided credentials.": "Échec de l'accès au partage avec les informations d'identification fournies.",
+  "Failed to access:": "Échec de l'accès :",
+  "Failed to add CIFS storage to Proxmox.": "Échec de l'ajout du stockage CIFS à Proxmox.",
+  "Failed to add GPU audio function": "Échec de l'ajout de la fonction audio GPU",
+  "Failed to add GPU to target VM": "Échec de l'ajout du GPU à la VM cible",
+  "Failed to add IOMMU group device": "Échec de l'ajout du périphérique du groupe IOMMU",
+  "Failed to add NFS storage to Proxmox.": "Échec de l'ajout du stockage NFS à Proxmox.",
+  "Failed to add bind mount:": "Échec de l'ajout du montage de liaison :",
+  "Failed to add iSCSI storage to Proxmox.": "Échec de l'ajout du stockage iSCSI à Proxmox.",
+  "Failed to add storage to Proxmox.": "Échec de l'ajout de stockage à Proxmox.",
+  "Failed to assign Controller/NVMe": "Échec de l'attribution du contrôleur/NVMe",
+  "Failed to assign virtual disk": "Échec de l'attribution du disque virtuel",
+  "Failed to clone Lynis from GitHub": "Échec du clonage de Lynis depuis GitHub",
+  "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "Échec du clonage du référentiel log2ram. Vérifiez /tmp/log2ram_install.log",
+  "Failed to configure EFI disk": "Échec de la configuration du disque EFI",
+  "Failed to configure IOMMU automatically.": "Échec de la configuration automatique d'IOMMU.",
+  "Failed to configure Proxmox repositories": "Échec de la configuration des référentiels Proxmox",
+  "Failed to configure TPM device in VM": "Échec de la configuration du périphérique TPM dans la VM",
+  "Failed to configure repositories.": "Échec de la configuration des référentiels.",
+  "Failed to configure repositories. Installation aborted.": "Échec de la configuration des référentiels. Installation interrompue.",
+  "Failed to connect to": "Échec de la connexion à",
+  "Failed to connect to server.": "Échec de la connexion au serveur.",
+  "Failed to copy sources into": "Échec de la copie des sources dans",
+  "Failed to create EFI disk": "Échec de la création du disque EFI",
+  "Failed to create OVA archive.": "Échec de la création de l'archive OVA.",
+  "Failed to create TPM state disk": "Échec de la création du disque d'état TPM",
+  "Failed to create VM": "Échec de la création de la VM",
+  "Failed to create base VM. Check VM ID and host configuration.": "Échec de la création de la VM de base. Vérifiez l'ID de la VM et la configuration de l'hôte.",
+  "Failed to create directory on host:": "Échec de la création du répertoire sur l'hôte :",
+  "Failed to create directory:": "Échec de la création du répertoire :",
+  "Failed to create disk": "Échec de la création du disque",
+  "Failed to create encryption key. Backup cancelled — fix the underlying issue and retry.": "Échec de la création de la clé de cryptage.Sauvegarde annulée : corrigez le problème sous-jacent et réessayez.",
+  "Failed to create group:": "Échec de la création du groupe :",
+  "Failed to create mount point.": "Échec de la création du point de montage.",
+  "Failed to create mount point:": "Échec de la création du point de montage :",
+  "Failed to create partition table": "Échec de la création de la table de partition",
+  "Failed to create partition table on disk": "Échec de la création de la table de partition sur le disque",
+  "Failed to create partition.": "Échec de la création de la partition.",
+  "Failed to create temporary directory:": "Échec de la création du répertoire temporaire :",
+  "Failed to create/update ZFS ARC configuration file": "Échec de la création/mise à jour du fichier de configuration ZFS ARC",
+  "Failed to destroy LXC:": "Échec de la destruction de LXC :",
+  "Failed to destroy VM:": "Échec de la destruction de la VM :",
+  "Failed to detect RAM size. Using default value of 16GB for ZFS ARC optimization.": "Échec de la détection de la taille de la RAM. Utilisation de la valeur par défaut de 16 Go pour l'optimisation ZFS ARC.",
+  "Failed to detect installed NVIDIA driver version.": "Échec de la détection de la version du pilote NVIDIA installé.",
+  "Failed to detect partition on disk": "Échec de la détection de la partition sur le disque",
+  "Failed to determine timezone from IP address - keeping current timezone settings": "Échec de la détermination du fuseau horaire à partir de l'adresse IP - conservation des paramètres de fuseau horaire actuels",
+  "Failed to disable Start on boot for LXC": "Échec de la désactivation du démarrage au démarrage pour LXC",
+  "Failed to disable Start on boot for VM": "Échec de la désactivation du démarrage au démarrage pour la VM",
+  "Failed to disable ZFS autotrim for pool:": "Échec de la désactivation du découpage automatique ZFS pour le pool :",
+  "Failed to download Borg.": "Échec du téléchargement de Borg.",
+  "Failed to download Figurine": "Échec du téléchargement de la figurine",
+  "Failed to download Helper-Scripts logo": "Échec du téléchargement du logo Helper-Scripts",
+  "Failed to download Home-Lab-Club logo": "Échec du téléchargement du logo Home-Lab-Club",
+  "Failed to download ISO image": "Échec du téléchargement de l'image ISO",
+  "Failed to download JC Channel logo": "Échec du téléchargement du logo JC Channel",
+  "Failed to download NVIDIA installer": "Échec du téléchargement du programme d'installation de NVIDIA",
+  "Failed to download ProxMenux logo": "Échec du téléchargement du logo ProxMenux",
+  "Failed to download Proxmology logo": "Échec du téléchargement du logo Proxmology",
+  "Failed to download VirtIO driver ISO.": "Échec du téléchargement de l'ISO du pilote VirtIO.",
+  "Failed to download amdgpu_top": "Échec du téléchargement de amdgpu_top",
+  "Failed to edit /etc/fstab — remove the line manually.": "Échec de la modification de /etc/fstab — supprimez la ligne manuellement.",
+  "Failed to enable ZFS autotrim for pool:": "Échec de l'activation du découpage automatique ZFS pour le pool :",
+  "Failed to enable automatic time synchronization": "Échec de l'activation de la synchronisation automatique de l'heure",
+  "Failed to extract OVA file:": "Échec de l'extraction du fichier OVA :",
+  "Failed to extract package": "Échec de l'extraction du package",
+  "Failed to fetch the Google Coral GPG key. Check": "Échec de la récupération de la clé GPG Google Coral. Vérifier",
+  "Failed to format disk as": "Échec du formatage du disque en tant que",
+  "Failed to format partition": "Échec du formatage de la partition",
+  "Failed to format the partition.": "Échec du formatage de la partition.",
+  "Failed to get .deb download URL": "Échec de l'obtention de l'URL de téléchargement .deb",
+  "Failed to get latest version from GitHub": "Impossible d'obtenir la dernière version de GitHub",
+  "Failed to get release information from GitHub": "Impossible d'obtenir les informations de version de GitHub",
+  "Failed to get shares": "Impossible d'obtenir des partages",
+  "Failed to get shares from": "Échec de l'obtention des partages de",
+  "Failed to import": "Échec de l'importation",
+  "Failed to initialize Borg repository at:": "Échec de l'initialisation du référentiel Borg à :",
+  "Failed to install Coral TPU driver inside the container.": "Échec de l'installation du pilote Coral TPU à l'intérieur du conteneur.",
+  "Failed to install Fail2Ban": "Échec de l'installation de Fail2Ban",
+  "Failed to install Fastfetch.": "Échec de l'installation de Fastfetch.",
+  "Failed to install NFS client packages.": "Échec de l'installation des packages clients NFS.",
+  "Failed to install OVH RTM": "Échec de l'installation d'OVH RTM",
+  "Failed to install OpenVSwitch": "Échec de l'installation d'OpenVSwitch",
+  "Failed to install Samba client packages.": "Échec de l'installation des packages clients Samba.",
+  "Failed to install amdgpu_top": "Échec de l'installation de amdgpu_top",
+  "Failed to install dependencies": "Échec de l'installation des dépendances",
+  "Failed to install gawk": "Échec de l'installation de Gawk",
+  "Failed to install intel-gpu-tools": "Échec de l'installation des outils Intel-Gpu",
+  "Failed to install libedgetpu1-std. Check": "Échec de l'installation de libedgetpu1-std. Vérifier",
+  "Failed to install pigz": "Échec de l'installation de pigz",
+  "Failed to install zfs-auto-snapshot": "Échec de l'installation de zfs-auto-snapshot",
+  "Failed to mount CIFS share on host.": "Échec du montage du partage CIFS sur l'hôte.",
+  "Failed to mount NFS share on host.": "Échec du montage du partage NFS sur l'hôte.",
+  "Failed to mount NFS share.": "Échec du montage du partage NFS.",
+  "Failed to mount Samba share.": "Échec du montage du partage Samba.",
+  "Failed to mount container filesystem.": "Échec du montage du système de fichiers du conteneur.",
+  "Failed to mount disk": "Échec du montage du disque",
+  "Failed to obtain public IP address - keeping current timezone settings": "Échec de l'obtention de l'adresse IP publique - conservation des paramètres de fuseau horaire actuels",
+  "Failed to refresh boot configuration": "Échec de l'actualisation de la configuration de démarrage",
+  "Failed to refresh proxmox-boot-tool": "Échec de l'actualisation de proxmox-boot-tool",
+  "Failed to reinstall Proxmox packages": "Échec de la réinstallation des packages Proxmox",
+  "Failed to reinstall packages": "Échec de la réinstallation des packages",
+  "Failed to remove gateway.": "Échec de la suppression de la passerelle.",
+  "Failed to remove mount point": "Échec de la suppression du point de montage",
+  "Failed to remove storage from Proxmox.": "Échec de la suppression du stockage de Proxmox.",
+  "Failed to remove storage.": "Échec de la suppression du stockage.",
+  "Failed to resolve group GID for": "Échec de la résolution du GID du groupe pour",
+  "Failed to restart": "Échec du redémarrage",
+  "Failed to restart container — restart manually": "Échec du redémarrage du conteneur : redémarrez manuellement",
+  "Failed to restart gateway.": "Échec du redémarrage de la passerelle.",
+  "Failed to restart network service": "Échec du redémarrage du service réseau",
+  "Failed to restart — restart manually to activate mount": "Échec du redémarrage : redémarrez manuellement pour activer le montage",
+  "Failed to restore subscription banner completely": "Échec de la restauration complète de la bannière d'abonnement",
+  "Failed to retrieve Fastfetch download URL.": "Échec de la récupération de l'URL de téléchargement Fastfetch.",
+  "Failed to run log2ram installer. Check /tmp/log2ram_install.log": "Échec de l'exécution du programme d'installation de log2ram. Vérifiez /tmp/log2ram_install.log",
+  "Failed to set VM description": "Échec de la définition de la description de la VM",
+  "Failed to set timezone - keeping current settings": "Échec de la définition du fuseau horaire - conservation des paramètres actuels",
+  "Failed to start CT": "Échec du démarrage de CT",
+  "Failed to start container — start manually and check the mount": "Échec du démarrage du conteneur : démarrez manuellement et vérifiez le montage",
+  "Failed to start gateway.": "Échec du démarrage de la passerelle.",
+  "Failed to start long self-test on": "Échec du démarrage d'un long autotest sur",
+  "Failed to start self-test on": "Échec du démarrage de l'autotest sur",
+  "Failed to start the CT.": "Échec du démarrage du CT.",
+  "Failed to start the container.": "Échec du démarrage du conteneur.",
+  "Failed to stop gateway.": "Échec de l'arrêt de la passerelle.",
+  "Failed to stop the container.": "Échec de l'arrêt du conteneur.",
+  "Failed to uninstall amdgpu_top": "Échec de la désinstallation de amdgpu_top",
+  "Failed to uninstall intel-gpu-tools": "Échec de la désinstallation d'Intel-Gpu-Tools",
+  "Failed to update GRUB": "Échec de la mise à jour de GRUB",
+  "Failed to update GRUB configuration": "Échec de la mise à jour de la configuration GRUB",
+  "Failed to update Lynis": "Échec de la mise à jour de Lynis",
+  "Failed to update amdgpu_top": "Échec de la mise à jour d'amdgpu_top",
+  "Failed to update auth.json — restoring backup.": "Échec de la mise à jour d'auth.json — restauration de la sauvegarde.",
+  "Failed to update cluster certificates (might not be in a cluster)": "Échec de la mise à jour des certificats de cluster (il se peut qu'il ne se trouve pas dans un cluster)",
+  "Failed to update intel-gpu-tools": "Échec de la mise à jour des outils Intel-Gpu",
+  "Failed to update package list.": "Échec de la mise à jour de la liste des packages.",
+  "Failed to update package lists": "Échec de la mise à jour des listes de packages",
+  "Failed to write": "Échec de l'écriture",
+  "Failed transitions from D3cold to D0": "Échec des transitions de D3cold à D0",
+  "Failed. See log:": "Échoué. Voir le journal :",
+  "Falling back to manual paste mode.": "Revenir au mode de collage manuel.",
+  "Fastfetch Logo Selection": "Sélection de logos Fastfetch",
+  "Fastfetch configuration updated": "Configuration Fastfetch mise à jour",
+  "Fastfetch download URL retrieved successfully.": "URL de téléchargement Fastfetch récupérée avec succès.",
+  "Fastfetch installation and configuration completed": "Installation et configuration de Fastfetch terminées",
+  "Fastfetch installed successfully": "Fastfetch installé avec succès",
+  "Fastfetch is not installed correctly.": "Fastfetch n'est pas installé correctement.",
+  "Fastfetch is not installed.": "Fastfetch n'est pas installé.",
+  "Fastfetch is not installed. Run: apt install fastfetch": "Fastfetch n'est pas installé. Exécuter : apt install fastfetch",
+  "Fastfetch now displays: System optimised by: ProxMenux": "Fastfetch affiche désormais : Système optimisé par : ProxMenux",
+  "Fastfetch removed from system": "Fastfetch supprimé du système",
+  "Fastfetch will start automatically in the console": "Fastfetch démarrera automatiquement dans la console",
+  "Figurine installation and configuration completed successfully.": "Installation et configuration de la figurine terminées avec succès.",
+  "Figurine is not installed.": "La figurine n'est pas installée.",
+  "Figurine removed from system": "Figurine retirée du système",
+  "File:": "Déposer:",
+  "Filesystem": "Système de fichiers",
+  "Filesystem Tools Required": "Outils de système de fichiers requis",
+  "Filesystem:": "Système de fichiers :",
+  "Final Confirmation": "Confirmation finale",
+  "Final confirmation": "Confirmation finale",
+  "Final storage health/status check": "Vérification finale de l’état/de l’état du stockage",
+  "Find your device using https://finds.synology.com": "Trouvez votre appareil en utilisant https://finds.synology.com",
+  "Fingerprint:": "Empreinte digitale :",
+  "Firewall allows port": "Le pare-feu autorise le port",
+  "Firewall settings": "Paramètres du pare-feu",
+  "Firmware :": "Micrologiciel :",
+  "First complete DSM setup and verify Web UI/SSH access.": "Terminez d’abord la configuration de DSM et vérifiez l’accès à l’interface utilisateur Web/SSH.",
+  "First complete ZimaOS setup and verify remote access (web/SSH).": "Terminez d’abord la configuration de ZimaOS et vérifiez l’accès à distance (web/SSH).",
+  "First install the GPU drivers inside the guest and verify remote access (RDP/SSH).": "Installez d'abord les pilotes GPU à l'intérieur de l'invité et vérifiez l'accès à distance (RDP/SSH).",
+  "Fix CIFS Permissions": "Corriger les autorisations CIFS",
+  "Fix Ceph version:": "Correction de la version de Ceph :",
+  "Fix NFS Access for Unprivileged LXC": "Correction de l'accès NFS pour LXC non privilégié",
+  "Fix disk space:": "Corriger l'espace disque :",
+  "Fix kernel version:": "Correction de la version du noyau :",
+  "Fix network connectivity": "Réparer la connectivité réseau",
+  "Fix network:": "Réseau fixe :",
+  "Fix package conflicts:": "Résoudre les conflits de packages :",
+  "Fix repositories:": "Corriger les référentiels :",
+  "Fix repository configuration": "Correction de la configuration du référentiel",
+  "Fix systemd-boot meta-package conflict": "Correction du conflit de méta-paquet systemd-boot",
+  "Fix systemd-boot:": "Correction du démarrage système :",
+  "Fix: on the host, run": "Correctif : sur l'hôte, exécutez",
+  "Fixing GPG key issues...": "Résolution des problèmes clés de GPG...",
+  "Folder Name": "Nom du dossier",
+  "Folders in /mnt": "Dossiers dans /mnt",
+  "Follow post-restore progress live from ProxMenux Monitor → Backups tab after the reboot.": "suivez la progression post-restauration en direct depuis ProxMenux Monitor → onglet Sauvegardes après le redémarrage.",
+  "For LVM - Create mount directory and mount:": "Pour LVM - Créez le répertoire de montage et montez :",
+  "For ZFS, storage ID must start with a letter and use only letters, numbers, dot, dash, underscore or colon.": "Pour ZFS, l'ID de stockage doit commencer par une lettre et utiliser uniquement des lettres, des chiffres, des points, des tirets, des traits de soulignement ou des deux-points.",
+  "For ZFS/BTRFS - Set the mount path:": "Pour ZFS/BTRFS : définissez le chemin de montage :",
+  "For a consistent export, the VM should be stopped.": "Pour une exportation cohérente, la VM doit être arrêtée.",
+  "For any question, issue or bug report, please use the official repository": "Pour toute question, problème ou rapport de bug, veuillez utiliser le référentiel officiel",
+  "For dedicated GPUs, FLR is required by this policy to reduce VM": "Pour les GPU dédiés, FLR est requis par cette stratégie pour réduire les VM",
+  "For example: pct enter 101": "Par exemple : PCT, entrez 101",
+  "For guest shares add: --options guest": "Pour les partages invités, ajoutez : --options invité",
+  "For security reasons, the system cannot format it.": "Pour des raisons de sécurité, le système ne peut pas le formater.",
+  "For unprivileged containers, use instead:": "Pour les conteneurs non privilégiés, utilisez plutôt :",
+  "For your safety, a backup of the current configuration will be created automatically before restoring.": "Pour votre sécurité, une sauvegarde de la configuration actuelle sera créée automatiquement avant la restauration.",
+  "Force APT to use IPv4": "Forcer APT à utiliser IPv4",
+  "Force NFSv3:": "Forcer NFSv3 :",
+  "Force NFSv4:": "Forcer NFSv4 :",
+  "Force stop VM now?": "Forcer l'arrêt de la VM maintenant ?",
+  "Force stop a container. Use the correct <ctid>": "Forcer l'arrêt d'un conteneur. Utilisez le bon <ctid>",
+  "Force stop a virtual machine. Use the correct <vmid>": "Forcer l'arrêt d'une machine virtuelle. Utilisez le bon <vmid>",
+  "Forcing removal...": "Forcer la suppression...",
+  "Format / Wipe Physical Disk (Safe)": "Formater/effacer le disque physique (sûr)",
+  "Format Mode": "Mode Formatage",
+  "Format USB disk?": "Formater le disque USB ?",
+  "Format disk (ERASE all data)": "Formater le disque (EFFACER toutes les données)",
+  "Format failed": "Échec du formatage",
+  "Format filesystem": "Formater le système de fichiers",
+  "Format partition:": "Formater une partition :",
+  "Format — erase and create new filesystem": "Formater - effacer et créer un nouveau système de fichiers",
+  "Format:": "Format:",
+  "Format: ERASE all data and create new filesystem": "Format : EFFACER toutes les données et créer un nouveau système de fichiers",
+  "Formatted and mounted": "Formaté et monté",
+  "Formatting": "Formatage",
+  "Formatting as": "Formatage comme",
+  "Formatting partition": "Formatage d'une partition",
+  "Found": "Trouvé",
+  "Found guest-accessible shares:": "Partages trouvés accessibles aux invités :",
+  "Free public Proxmox repository enabled": "Dépôt public Proxmox gratuit activé",
+  "Free space OK:": "Espace libre OK :",
+  "Free up disk space": "Libérer de l'espace disque",
+  "Free:": "Gratuit:",
+  "French": "Français",
+  "Full SMART Report": "Rapport SMART complet",
+  "Full SMART info and attributes": "Informations et attributs SMART complets",
+  "Full format       — new GPT partition + filesystem": "Format complet – nouvelle partition GPT + système de fichiers",
+  "Full format — new GPT partition + filesystem": "Format complet – nouvelle partition GPT + système de fichiers",
+  "Full format: clean + new GPT partition + filesystem": "Format complet : nettoyage + nouvelle partition GPT + système de fichiers",
+  "Full log:": "Journal complet :",
+  "Full report           — complete SMART data (scrollable)": "Rapport complet – données SMART complètes (défilement)",
+  "Full system upgrade, including dependencies": "Mise à niveau complète du système, y compris les dépendances",
+  "Function Level Reset (FLR) not available": "Réinitialisation du niveau de fonction (FLR) non disponible",
+  "GID already in use:": "GID déjà utilisé :",
+  "GID in CT": "GID en CT",
+  "GPU": "GPU",
+  "GPU -> VM Mode Detected": "GPU -> Mode VM détecté",
+  "GPU Already Added": "GPU déjà ajouté",
+  "GPU Already Assigned to Another VM": "GPU déjà attribué à une autre VM",
+  "GPU Already Assigned to This VM": "GPU déjà attribué à cette VM",
+  "GPU Busy in Running VM": "GPU occupé lors de l'exécution de la VM",
+  "GPU Not Available for Reliable VM Passthrough": "GPU non disponible pour un relais fiable de VM",
+  "GPU Not Compatible with VM Passthrough": "GPU non compatible avec VM Passthrough",
+  "GPU Passthrough Commands": "Commandes de passage GPU",
+  "GPU Passthrough Not Configured": "Passthrough GPU non configuré",
+  "GPU Passthrough to VM": "Passthrough GPU vers la VM",
+  "GPU Passthrough to VM (from LXC)": "Passthrough GPU vers VM (depuis LXC)",
+  "GPU Passthrough to VM (reassign from LXC and another VM)": "GPU Passthrough vers la VM (réaffectation depuis LXC et une autre VM)",
+  "GPU Passthrough to VM (reassign from another VM)": "Passthrough GPU vers VM (réaffectation depuis une autre VM)",
+  "GPU ROM dump to /usr/share/kvm/": "Vidage de la ROM GPU vers /usr/share/kvm/",
+  "GPU ROM dumped to": "ROM GPU vidée vers",
+  "GPU ROM extracted from ACPI VFCT table to": "ROM GPU extraite de la table ACPI VFCT vers",
+  "GPU Switch Mode": "Mode de changement de GPU",
+  "GPU Switch Mode Blocked": "Mode de commutation GPU bloqué",
+  "GPU Used in LXC Containers": "GPU utilisé dans les conteneurs LXC",
+  "GPU access removed from LXC": "Accès GPU supprimé de LXC",
+  "GPU added": "GPU ajouté",
+  "GPU already present in target VM — existing hostpci entry reused": "GPU déjà présent dans la VM cible – entrée hostpci existante réutilisée",
+  "GPU audio added": "Audio GPU ajouté",
+  "GPU audio already present in target VM — existing hostpci entry reused": "Audio GPU déjà présent dans la VM cible – entrée hostpci existante réutilisée",
+  "GPU driver blacklisted": "Pilote GPU sur liste noire",
+  "GPU guard hook will block concurrent start when another VM is already using this GPU": "Le crochet de protection du GPU bloquera le démarrage simultané lorsqu'une autre VM utilise déjà ce GPU",
+  "GPU host driver blacklisted in /etc/modprobe.d/blacklist.conf": "Pilote hôte GPU sur liste noire dans /etc/modprobe.d/blacklist.conf",
+  "GPU in VM Passthrough Mode": "GPU en mode VM Passthrough",
+  "GPU kept in source VM config": "GPU conservé dans la configuration de la VM source",
+  "GPU not found with slot": "GPU introuvable avec le slot",
+  "GPU passthrough assistant not found. You can run it later from Hardware Graphics.": "Assistant de relais GPU introuvable. Vous pouvez l'exécuter plus tard à partir de Hardware Graphics.",
+  "GPU passthrough changes require a host reboot.": "Les modifications du relais GPU nécessitent un redémarrage de l’hôte.",
+  "GPU passthrough configuration will continue now and will become effective after host reboot.": "La configuration du relais GPU continuera maintenant et deviendra effective après le redémarrage de l'hôte.",
+  "GPU passthrough configured for LXC": "Passthrough GPU configuré pour LXC",
+  "GPU passthrough configured for VM": "Passthrough GPU configuré pour la VM",
+  "GPU passthrough to VMs requires IOMMU to be enabled in the kernel.": "Le relais GPU vers les machines virtuelles nécessite que IOMMU soit activé dans le noyau.",
+  "GPU passthrough was not applied.": "Le relais GPU n’a pas été appliqué.",
+  "GPU passthrough was skipped (no compatible GPU detected).": "Le relais GPU a été ignoré (aucun GPU compatible détecté).",
+  "GPU removed from VM": "GPU supprimé de la VM",
+  "GPU removed from VM config": "GPU supprimé de la configuration de la VM",
+  "GPU switch complete: LXC mode prepared.": "Changement GPU terminé : mode LXC préparé.",
+  "GPU switch complete: VM mode prepared.": "Changement de GPU terminé : mode VM préparé.",
+  "GPU switch mode completed. No reboot required.": "Mode de changement de GPU terminé. Aucun redémarrage requis.",
+  "GPU will be removed from source VM config": "Le GPU sera supprimé de la configuration de la VM source",
+  "GPU will remain configured in source VM": "Le GPU restera configuré dans la VM source",
+  "GPU/TPU - Manual CLI Guide": "GPU/TPU - Guide CLI manuel",
+  "GPU/TPU Passthrough Commands": "Commandes de passage GPU/TPU",
+  "GPUs and Coral-TPU Menu": "Menu GPU et Coral-TPU",
+  "GRUB config file not found; skipping GRUB changes": "Fichier de configuration GRUB introuvable ; ignorer les modifications GRUB",
+  "GRUB configuration updated": "Configuration GRUB mise à jour",
+  "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT introuvable dans la configuration GRUB",
+  "GUI mode (if available)": "Mode GUI (si disponible)",
+  "Gateway is not installed.": "La passerelle n'est pas installée.",
+  "Gateway removed.": "Passerelle supprimée.",
+  "Gateway restarted.": "La passerelle a redémarré.",
+  "Gateway started.": "La passerelle a démarré.",
+  "Gateway stopped.": "La passerelle s'est arrêtée.",
+  "Gathering container privilege information...": "Collecte d'informations sur les privilèges du conteneur...",
+  "Generate a new key and authorize it on the server automatically (recommended)": "générer une nouvelle clé et l'autoriser automatiquement sur le serveur (recommandé)",
+  "Generate a new key, show me the line to paste manually": "Générez une nouvelle clé, montrez-moi la ligne à coller manuellement",
+  "Generate a new keyfile": "générer un nouveau fichier de clés",
+  "Generating OVF descriptor...": "Génération du descripteur OVF...",
+  "Generating dkms.conf...": "Génération de dkms.conf...",
+  "Generating manifest...": "Génération du manifeste...",
+  "Generating missing locale:": "Génération des paramètres régionaux manquants :",
+  "German": "Allemand",
+  "Get a list of all your containers:": "Obtenez une liste de tous vos conteneurs :",
+  "Get the actual disk path:": "Obtenez le chemin d'accès réel au disque :",
+  "Get the container's storage information:": "Obtenez les informations de stockage du conteneur :",
+  "Git installed": "Git installé",
+  "Global settings and SSH jail configured": "Paramètres globaux et prison SSH configurés",
+  "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "Accédez à \"Gérer les chemins personnalisés\" et supprimez votre entrée personnalisée qui inclut la destination",
+  "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "Google fournit uniquement un référentiel officiel libedgetpu APT pour Debian/Ubuntu. Le relais matériel est déjà écrit dans",
+  "Graceful shutdown timed out.": "L'arrêt progressif a expiré.",
+  "Group": "Groupe",
+  "Group 'sharedfiles' already exists inside the CT": "Le groupe « fichiers partagés » existe déjà dans le CT",
+  "Group GID:": "GID du groupe :",
+  "Group created:": "Groupe créé :",
+  "Group name cannot be empty.": "Le nom du groupe ne peut pas être vide.",
+  "Group:": "Groupe:",
+  "Groups": "Groupes",
+  "Groups:": "Groupes:",
+  "Guest Access Denied": "Accès invité refusé",
+  "Guest Access Error": "Erreur d'accès invité",
+  "Guest Access Failed": "Échec de l'accès invité",
+  "Guest Access Validation Results:": "Résultats de la validation de l'accès invité :",
+  "Guest Agent configuration applied": "Configuration de l'agent invité appliquée",
+  "Guest access (no authentication)": "Accès invité (pas d'authentification)",
+  "Guest access confirmed for share:": "Accès invité confirmé pour le partage :",
+  "Guest access denied for share:": "Accès invité refusé pour le partage :",
+  "Guest access failed.": "L'accès invité a échoué.",
+  "Guest access is not allowed on this server.": "L'accès invité n'est pas autorisé sur ce serveur.",
+  "Guest access test:": "Test d'accès invité :",
+  "Guest access validated successfully!": "Accès invité validé avec succès !",
+  "Guest access works for listing, but no shares are available.": "L'accès invité fonctionne pour l'inscription, mais aucun partage n'est disponible.",
+  "Guest accessible share": "Partage accessible aux invités",
+  "Guest accessible:": "Accessible aux invités :",
+  "Guest agent detection completed": "Détection de l'agent invité terminée",
+  "Guest agent installation process completed": "Processus d'installation de l'agent invité terminé",
+  "Guest agent packages removed": "Packages d'agent invité supprimés",
+  "Guest configs restored:": "Configurations invité restaurées :",
+  "Guest share listing successful": "Liste de partage d'invités réussie",
+  "Guided Cleanup Available": "Nettoyage guidé disponible",
+  "Guided Repair Available": "Réparation guidée disponible",
+  "HA groups will be migrated to HA rules automatically": "Les groupes HA seront automatiquement migrés vers les règles HA.",
+  "HA services disabled (configs preserved)": "Services HA désactivés (configurations préservées)",
+  "Hardening SSH: setting MaxAuthTries to 3...": "Renforcement de SSH : définition de MaxAuthTries sur 3...",
+  "Hardware": "Matériel",
+  "Hardware compatibility — these items will be skipped to keep the boot safe:": "Compatibilité matérielle – ces éléments seront ignorés pour assurer la sécurité du démarrage :",
+  "Hardware passthrough is already configured — the Coral device is visible inside the container as /dev/apex_0 (M.2) and/or /dev/bus/usb (USB).": "Le relais matériel est déjà configuré — le périphérique Coral est visible à l'intérieur du conteneur sous le nom /dev/apex_0 (M.2) et/ou /dev/bus/usb (USB).",
+  "Hardware: GPUs and Coral-TPU": "Matériel : GPU et Coral-TPU",
+  "Have valid backups of all VMs and containers": "Avoir des sauvegardes valides de toutes les VM et conteneurs",
+  "Help & Info (commands)": "Aide et informations (commandes)",
+  "Help & Information": "Aide et informations",
+  "Help and Info": "Aide et informations",
+  "Help and Info Commands": "Commandes d'aide et d'informations",
+  "Helper-Scripts logo applied": "Logo Helper-Scripts appliqué",
+  "Hidden for safety": "Caché pour plus de sécurité",
+  "Hidden:": "Caché:",
+  "High Availability services have been enabled successfully": "Les services haute disponibilité ont été activés avec succès",
+  "High Availability setup completed": "Configuration de la haute disponibilité terminée",
+  "High risk confirmation": "Confirmation de risque élevé",
+  "High-Risk GPU Power State": "État d'alimentation du GPU à haut risque",
+  "Home-Lab-Club logo applied": "Logo Home-Lab-Club appliqué",
+  "Host": "Hôte",
+  "Host Backup  →  Borg": "Sauvegarde de l'hôte → Borg",
+  "Host Backup  →  Local archive": "Sauvegarde de l'hôte → Archive locale",
+  "Host Backup  →  PBS": "Sauvegarde de l'hôte → PBS",
+  "Host Backup & Restore": "Sauvegarde et restauration de l'hôte",
+  "Host Config Backup": "Sauvegarde de la configuration de l'hôte",
+  "Host Config Backup / Restore": "Sauvegarde/restauration de la configuration de l'hôte",
+  "Host Config Restore": "Restauration de la configuration de l'hôte",
+  "Host Directory": "Répertoire des hôtes",
+  "Host Directory to LXC Mount Point": "Répertoire hôte vers le point de montage LXC",
+  "Host Directory:": "Répertoire des hôtes :",
+  "Host GPU binding changed — reboot required.": "La liaison du GPU hôte a été modifiée : redémarrage requis.",
+  "Host GPU detected": "GPU hôte détecté",
+  "Host GPU is already bound to vfio-pci. Host reconfiguration/reboot should not be required for this VM-to-VM reassignment.": "Le GPU hôte est déjà lié à vfio-pci. La reconfiguration/redémarrage de l'hôte ne devrait pas être requis pour cette réaffectation de VM à VM.",
+  "Host IP": "IP de l'hôte",
+  "Host Mount Path": "Chemin de montage de l'hôte",
+  "Host NFS/Samba as Proxmox Storage (pvesm)": "Hébergez NFS/Samba en tant que stockage Proxmox (pvesm)",
+  "Host Path": "Chemin d'accès de l'hôte",
+  "Host Path:": "Chemin d'accès de l'hôte :",
+  "Host Storage (NFS / Samba via Proxmox)": "Stockage hôte (NFS / Samba via Proxmox)",
+  "Host VFIO config was already up to date — no reboot needed.": "La configuration de l'hôte VFIO était déjà à jour – aucun redémarrage n'était nécessaire.",
+  "Host VFIO configuration already up to date": "Configuration hôte VFIO déjà à jour",
+  "Host VFIO configuration changed (initramfs updated). Reboot required before starting the VM.": "La configuration de l'hôte VFIO a été modifiée (initramfs mis à jour). Redémarrage requis avant de démarrer la VM.",
+  "Host VFIO configuration changed — reboot required before starting the VM.": "La configuration de l'hôte VFIO a été modifiée : redémarrage requis avant de démarrer la VM.",
+  "Host already in VFIO mode — skipping host reconfiguration for VM reassignment": "Hôte déjà en mode VFIO : ignorer la reconfiguration de l'hôte pour la réaffectation de la VM",
+  "Host backup attached to PVE job": "Sauvegarde de l'hôte attachée au travail PVE",
+  "Host directory access for unprivileged containers has been prepared above": "L'accès au répertoire hôte pour les conteneurs non privilégiés a été préparé ci-dessus",
+  "Host directory permissions updated — unprivileged containers can now access it": "Autorisations du répertoire hôte mises à jour : les conteneurs non privilégiés peuvent désormais y accéder",
+  "Host directory:": "Répertoire hôte :",
+  "Host fstab CIFS Mounts:": "Hôte des montages fstab CIFS :",
+  "Host fstab CIFS mounts (not registered with pvesm):": "Hôte des montages fstab CIFS (non enregistrés auprès de pvesm) :",
+  "Host fstab CIFS mounts:": "Hôte des montages fstab CIFS :",
+  "Host fstab Mount:": "Montage fstab de l'hôte :",
+  "Host fstab NFS Mounts:": "Hôte des montages NFS fstab :",
+  "Host fstab NFS mounts (not registered with pvesm):": "Hôte des montages fstab NFS (non enregistrés auprès de pvesm) :",
+  "Host fstab NFS mounts:": "Hôte des montages fstab NFS :",
+  "Host fstab mounts (not registered as Proxmox storage):": "Montages fstab de l'hôte (non enregistrés comme stockage Proxmox) :",
+  "Host identity (hostname, hosts)": "Identité de l'hôte (nom d'hôte, hôtes)",
+  "Host permissions applied (o+rwx + default ACL) — unprivileged LXCs can read/write through bind-mounts": "Autorisations d'hôte appliquées (o+rwx + ACL par défaut) — les LXC non privilégiés peuvent lire/écrire via les montages de liaison",
+  "Host write access confirmed.": "Accès en écriture de l'hôte confirmé.",
+  "Hostname": "Nom d'hôte",
+  "Hot changes applied. No reboot needed for these paths.": "Modifications à chaud appliquées. Aucun redémarrage n'est nécessaire pour ces chemins.",
+  "How do you want to add it?": "Comment veux-tu l’ajouter ?",
+  "How do you want to authenticate this backup target?": "Comment souhaitez-vous authentifier cette cible de sauvegarde ?",
+  "How do you want to select the": "Comment voulez-vous sélectionner le",
+  "How do you want to select the HOST folder to mount?": "Comment souhaitez-vous sélectionner le dossier HOST à ​​monter ?",
+  "How do you want to select the NFS server?": "Comment voulez-vous sélectionner le serveur NFS ?",
+  "How do you want to select the Samba server?": "Comment voulez-vous sélectionner le serveur Samba ?",
+  "How do you want to select the folder to export?": "Comment voulez-vous sélectionner le dossier à exporter ?",
+  "How do you want to select the folder to share?": "Comment voulez-vous sélectionner le dossier à partager ?",
+  "How to Access an LXC Terminal": "Comment accéder à un terminal LXC",
+  "How to Access an LXC Terminal from Proxmox Host": "Comment accéder à un terminal LXC depuis l'hôte Proxmox",
+  "How to schedule": "Comment planifier",
+  "I have read this": "j'ai lu ceci",
+  "I/O priority configured": "Priorité E/S configurée",
+  "ID already in use. Please choose another.": "ID déjà utilisé. Veuillez en choisir un autre.",
+  "IMPORTANT": "IMPORTANT",
+  "IMPORTANT NOTES:": "REMARQUES IMPORTANTES :",
+  "IMPORTANT PREREQUISITES:": "PRÉREQUIS IMPORTANTS :",
+  "IMPORTANT — Save this passphrase": "IMPORTANT – Enregistrez cette phrase secrète",
+  "IOMMU Group": "Groupe IOMMU",
+  "IOMMU Group Error": "Erreur du groupe IOMMU",
+  "IOMMU Group Pending": "Groupe IOMMU en attente",
+  "IOMMU Pending Reboot": "IOMMU en attente de redémarrage",
+  "IOMMU Required": "IOMMU requis",
+  "IOMMU already configured in /etc/kernel/cmdline": "IOMMU déjà configuré dans /etc/kernel/cmdline",
+  "IOMMU already configured in GRUB": "IOMMU déjà configuré dans GRUB",
+  "IOMMU already configured in kernel parameters": "IOMMU déjà configuré dans les paramètres du noyau",
+  "IOMMU already enabled in GRUB configuration": "IOMMU déjà activé dans la configuration GRUB",
+  "IOMMU and VFIO setup completed": "Configuration IOMMU et VFIO terminée",
+  "IOMMU configured successfully.": "IOMMU configuré avec succès.",
+  "IOMMU configured. GPU passthrough setup will continue now and will be effective after reboot.": "IOMMU configuré. La configuration du passthrough GPU se poursuivra maintenant et sera effective après le redémarrage.",
+  "IOMMU enabled in GRUB configuration": "IOMMU activé dans la configuration GRUB",
+  "IOMMU groups are not available yet because reboot is pending.": "Les groupes IOMMU ne sont pas encore disponibles car le redémarrage est en attente.",
+  "IOMMU has been enabled on this system.": "IOMMU a été activé sur ce système.",
+  "IOMMU has been enabled on this system. A reboot is required to apply the changes. Reboot now?": "IOMMU a été activé sur ce système. Un redémarrage est nécessaire pour appliquer les modifications. Redémarrer maintenant ?",
+  "IOMMU has been enabled — a system reboot is required": "IOMMU a été activé – un redémarrage du système est requis",
+  "IOMMU interrupt remapping configured": "Remappage d'interruption IOMMU configuré",
+  "IOMMU is already active on this system": "IOMMU est déjà actif sur ce système",
+  "IOMMU is already configured for next boot, but it is not active yet.": "IOMMU est déjà configuré pour le prochain démarrage, mais il n'est pas encore actif.",
+  "IOMMU is enabled on the system": "IOMMU est activé sur le système",
+  "IOMMU is not active on this host.": "IOMMU n'est pas actif sur cet hôte.",
+  "IOMMU is not active on this system.": "IOMMU n'est pas actif sur ce système.",
+  "IOMMU is not active. Skipping Controller + NVMe assignment.": "IOMMU n’est pas actif. Ignorer l'affectation Contrôleur + NVMe.",
+  "IOMMU kernel parameters configured": "Paramètres du noyau IOMMU configurés",
+  "IOMMU parameters added to /etc/kernel/cmdline": "Paramètres IOMMU ajoutés à /etc/kernel/cmdline",
+  "IOMMU parameters added to GRUB": "Paramètres IOMMU ajoutés à GRUB",
+  "IOMMU parameters removed from /etc/kernel/cmdline": "Paramètres IOMMU supprimés de /etc/kernel/cmdline",
+  "IOMMU parameters removed from GRUB": "Paramètres IOMMU supprimés de GRUB",
+  "IOMMU was configured during this wizard and a reboot is pending.": "IOMMU a été configuré lors de cet assistant et un redémarrage est en attente.",
+  "IOMMU/VFIO configuration reverted": "Configuration IOMMU/VFIO inversée",
+  "IP": "IP",
+  "IP or hostname of the PVE node hosting the Borg server LXC:": "IP ou nom d'hôte du nœud PVE hébergeant le serveur Borg LXC :",
+  "ISO": "OIN",
+  "ISO created successfully:": "ISO créé avec succès :",
+  "ISO image         — installation images": "Image ISO – images d'installation",
+  "ISO image downloaded": "Image ISO téléchargée",
+  "ISO not found to mount on device": "ISO introuvable à monter sur l'appareil",
+  "Identical:": "Identique:",
+  "Identify candidate disk (never use system disk):": "Identifiez le disque candidat (n'utilisez jamais le disque système) :",
+  "Identify persistent disk paths": "Identifier les chemins de disque persistants",
+  "If 'proxmox-ve' removal warning:": "Si l'avertissement de suppression de « proxmox-ve » :",
+  "If Code 43 error appears, KVM hiding is already configured.": "Si l'erreur Code 43 apparaît, le masquage KVM est déjà configuré.",
+  "If GUI does not load:": "Si l'interface graphique ne se charge pas :",
+  "If ZFS errors occur:": "Si des erreurs ZFS se produisent :",
+  "If booting in EFI mode with root on LVM: install GRUB for EFI": "Si vous démarrez en mode EFI avec root sur LVM : installez GRUB pour EFI",
+  "If config issues occur:": "Si des problèmes de configuration surviennent :",
+  "If container won't start:": "Si le conteneur ne démarre pas :",
+  "If imported from ESXi: install qemu-guest-agent inside the guest OS": "En cas d'importation depuis ESXi : installez qemu-guest-agent dans le système d'exploitation invité",
+  "If it still fails, the NFS server export options must be changed on the server.": "Si l'échec persiste, les options d'exportation du serveur NFS doivent être modifiées sur le serveur.",
+  "If it warns about 'systemd-boot' meta-package, remove it:": "S'il vous avertit du méta-paquet 'systemd-boot', supprimez-le :",
+  "If mount fails (LVM):": "Si le montage échoue (LVM) :",
+  "If needed again, re-add GPU to LXC from GPUs and Coral-TPU Menu → Add GPU to LXC.": "Si nécessaire à nouveau, ajoutez à nouveau le GPU à LXC à partir du menu GPU et Coral-TPU → Ajouter un GPU à LXC.",
+  "If network does not work:": "Si le réseau ne fonctionne pas :",
+  "If not 19.x, upgrade Ceph (Reef→Squid) first per the official guide:": "Si ce n'est pas 19.x, mettez d'abord à niveau Ceph (Reef → Squid) selon le guide officiel :",
+  "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.": "Si les notifications sont activées (Telegram/Discord/ntfy/...), vous recevrez un message « Restauration de l'hôte terminée » lorsque toutes les tâches en arrière-plan seront terminées.",
+  "If passthrough fails on Windows: install RadeonResetBugFix.": "Si le relais échoue sous Windows : installez RadeonResetBugFix.",
+  "If path not accessible (ZFS/BTRFS):": "Si chemin non accessible (ZFS/BTRFS) :",
+  "If pvesm path returned a DEVICE (LVM):": "Si le chemin pvesm a renvoyé un DEVICE (LVM) :",
+  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Si le chemin pvesm renvoie un RÉPERTOIRE (ZFS/BTRFS) :",
+  "If repositories error:": "Si erreur de référentiels :",
+  "If the host freezes, remove hostpci entries from": "Si l'hôte se bloque, supprimez les entrées hostpci de",
+  "If this happens, you can restore the backup from the 'Subscription Banner Removal' option in 'Uninstall optimizations'.": "Si cela se produit, vous pouvez restaurer la sauvegarde à partir de l'option « Suppression de la bannière d'abonnement » dans « Désinstaller les optimisations ».",
+  "If this node runs hyper-converged Ceph: ensure Ceph is 19.x (Squid) BEFORE upgrading PVE.": "Si ce nœud exécute Ceph hyper-convergé : assurez-vous que Ceph est 19.x (Squid) AVANT de mettre à niveau PVE.",
+  "If upgrade fails:": "Si la mise à niveau échoue :",
+  "If you are sure you want to use it, please remove the": "Si vous êtes sûr de vouloir l'utiliser, veuillez supprimer le",
+  "If you choose No, install": "Si vous choisissez Non, installez",
+  "If you continue, some adjustments may be duplicated or conflict with those already made by xshok.": "Si vous continuez, certains ajustements peuvent être dupliqués ou entrer en conflit avec ceux déjà effectués par xshok.",
+  "If you lose connectivity, you can restore from backup using the console.": "Si vous perdez la connectivité, vous pouvez restaurer à partir d'une sauvegarde à l'aide de la console.",
+  "If you lose or reinstall this host without a copy of the passphrase somewhere else (password manager, offline note, another host, USB stick...), every encrypted archive in this Borg repository becomes UNRECOVERABLE.": "Si vous perdez ou réinstallez cet hôte sans copie de la phrase secrète ailleurs (gestionnaire de mots de passe, note hors ligne, un autre hôte, clé USB...), chaque archive cryptée dans ce référentiel Borg devient IRRÉCUPÉRABLE.",
+  "If you want HDMI/analog audio inside the VM, select the audio controller(s) to pass through along with the GPU.": "Si vous souhaitez que l'audio HDMI/analogique soit intégré à la VM, sélectionnez le(s) contrôleur(s) audio à transmettre avec le GPU.",
+  "If you want to use a physical monitor on the passthrough GPU:": "Si vous souhaitez utiliser un moniteur physique sur le GPU passthrough :",
+  "If your DHCP has a static reservation for the old MAC, update it.": "Si votre DHCP a une réservation statique pour l'ancien MAC, mettez-la à jour.",
+  "Image Source Directory": "Répertoire des sources d'images",
+  "Image directory:": "Répertoire d'images :",
+  "Image file not found:": "Fichier image introuvable :",
+  "Image imported:": "Image importée :",
+  "Images to import:": "Images à importer :",
+  "Import            — disk image imports": "Importer – importations d'images disque",
+  "Import Disk Image to VM": "Importer l'image disque vers la VM",
+  "Import Disk to LXC": "Importer un disque vers LXC",
+  "Import Disk to VM": "Importer le disque vers la VM",
+  "Import Disks Selected:": "Importer les disques sélectionnés :",
+  "Import PBS keyfile": "Importer le fichier de clés PBS",
+  "Import Summary": "Résumé de l'importation",
+  "Import VM from OVA or OVF": "Importer une VM depuis OVA ou OVF",
+  "Import a ZFS pool": "Importer un pool ZFS",
+  "Import a keyfile from an absolute path (replaces the current one)": "importer un fichier de clés à partir d'un chemin absolu (remplace l'actuel)",
+  "Import disk assigned": "Disque d'importation attribué",
+  "Import disk image to VM": "Importer l'image disque sur la VM",
+  "Import disks": "Importer des disques",
+  "Import encryption keyfile": "Importer un fichier de clés de chiffrement",
+  "Import failed": "échec de l'importation",
+  "Import failed for:": "Échec de l'importation pour :",
+  "Important: both VMs cannot be running at the same time with the same GPU.": "Important : les deux VM ne peuvent pas fonctionner en même temps avec le même GPU.",
+  "Important: some GPUs may still fail in passthrough and can affect host stability or overall performance depending on hardware/firmware quality.": "Important : certains GPU peuvent toujours échouer en mode relais et affecter la stabilité de l'hôte ou les performances globales en fonction de la qualité du matériel/micrologiciel.",
+  "Importing": "Importation",
+  "Importing disk": "Importer un disque",
+  "Importing:": "Importation :",
+  "Improve log rotation and limit log size to save space and extend disk life": "Améliorez la rotation des journaux et limitez leur taille pour économiser de l'espace et prolonger la durée de vie du disque.",
+  "In the loader interface, follow the instructions to select your Synology model": "Dans l'interface du chargeur, suivez les instructions pour sélectionner votre modèle Synology",
+  "In use": "Utilisé",
+  "In use by VM/LXC config": "Utilisé par la configuration VM/LXC",
+  "In use by running VM/LXC — stop it first": "En cours d'utilisation en exécutant VM/LXC — arrêtez-le d'abord",
+  "Inaccessible device during VM startup": "Périphérique inaccessible lors du démarrage de la VM",
+  "Inactive": "Inactif",
+  "Inactive (entry in fstab, not currently mounted)": "Inactif (entrée dans fstab, non monté actuellement)",
+  "Includes /etc/network (may drop SSH immediately)": "Inclut /etc/network (peut supprimer SSH immédiatement)",
+  "Includes /etc/zfs": "Inclut /etc/zfs",
+  "Includes cluster data (/etc/pve, /var/lib/pve-cluster)": "Inclut les données du cluster (/etc/pve, /var/lib/pve-cluster)",
+  "Incompatible GPU for VM Passthrough": "GPU incompatible pour VM Passthrough",
+  "Incompatible Machine Type": "Type de machine incompatible",
+  "Incompatible Reset Capability for AMD dGPU": "Capacité de réinitialisation incompatible pour AMD dGPU",
+  "Incompatible Reset Capability for Intel GPU": "Capacité de réinitialisation incompatible pour le GPU Intel",
+  "Incompatible Reset Capability for Intel dGPU": "Capacité de réinitialisation incompatible pour Intel dGPU",
+  "Incompatible archive": "Archives incompatibles",
+  "Increase container RAM temporarily to": "Augmentez temporairement la RAM du conteneur pour",
+  "Increase file and process limits for advanced workloads": "Augmentez les limites de fichiers et de processus pour les charges de travail avancées",
+  "Increase various system limits": "Augmenter diverses limites du système",
+  "Increase vzdump backup speed": "Augmenter la vitesse de sauvegarde de vzdump",
+  "Increasing maximum file system open files...": "Augmentation du nombre maximal de fichiers ouverts dans le système de fichiers...",
+  "Increasing various system limits...": "Augmentation de diverses limites du système...",
+  "Inherited retention:": "Rétention héritée :",
+  "Inherited schedule:": "Horaire hérité :",
+  "Initializing Borg repository if needed...": "Initialisation du référentiel Borg si nécessaire...",
+  "Initiator IQN is authorised on the target": "L'IQN initiateur est autorisé sur la cible",
+  "Initiator IQN:": "IQN initiateur :",
+  "Inspect disks before any action": "Inspecter les disques avant toute action",
+  "Inspect host device nodes": "Inspecter les nœuds du périphérique hôte",
+  "Inspect passthrough/kernel events": "Inspecter les événements de relais/noyau",
+  "Inspect storage config block:": "Inspectez le bloc de configuration du stockage :",
+  "Inspection commands run directly. Template commands [T] require parameter substitution.": "Les commandes d'inspection s'exécutent directement. Les commandes de modèle [T] nécessitent une substitution de paramètres.",
+  "Install": "Installer",
+  "Install ALL utilities": "Installez TOUS les utilitaires",
+  "Install AMD GPU drivers inside the guest.": "Installez les pilotes GPU AMD dans l'invité.",
+  "Install CIFS client packages inside CT:": "Installez les packages clients CIFS dans CT :",
+  "Install Coral TPU in LXC": "Installer Coral TPU dans LXC",
+  "Install Fail2Ban": "Installer Fail2Ban",
+  "Install Figurine": "Installer la figurine",
+  "Install Intel Graphics Driver inside the guest.": "Installez le pilote graphique Intel dans l'invité.",
+  "Install Lynis": "Installer Lynis",
+  "Install NFS client packages inside CT:": "Installez les packages clients NFS dans CT :",
+  "Install NVIDIA Drivers on Host": "Installer les pilotes NVIDIA sur l'hôte",
+  "Install NVIDIA drivers from nvidia.com inside the guest.": "Installez les pilotes NVIDIA depuis nvidia.com dans l'invité.",
+  "Install NVIDIA proprietary drivers": "Installer les pilotes propriétaires NVIDIA",
+  "Install OVH Real Time Monitoring": "Installer la surveillance en temps réel d'OVH",
+  "Install Open vSwitch": "Installer Open vSwitch",
+  "Install Samba inside CT:": "Installez Samba dans CT :",
+  "Install ZFS auto-snapshot": "Installer l'instantané automatique ZFS",
+  "Install analysis tools": "Installer des outils d'analyse",
+  "Install and configure": "Installer et configurer",
+  "Install and configure Fastfetch": "Installer et configurer Fastfetch",
+  "Install and configure Log2RAM": "Installer et configurer Log2RAM",
+  "Install and start iSCSI initiator:": "Installez et démarrez l'initiateur iSCSI :",
+  "Install basic utilities": "Installer les utilitaires de base",
+  "Install common system utilities": "Installer les utilitaires système courants",
+  "Install compression tools": "Installer les outils de compression",
+  "Install development tools": "Installer les outils de développement",
+  "Install maintainer's version (Y)": "Installer la version du responsable (Y)",
+  "Install manually and retry: apt-get install -y exfatprogs": "Installez manuellement et réessayez : apt-get install -y exfatprogs",
+  "Install manually with:": "Installez manuellement avec :",
+  "Install network tools": "Installer les outils réseau",
+  "Install podman or docker to continue.": "Installez podman ou docker pour continuer.",
+  "Install relevant guest agent": "installer l'agent invité approprié",
+  "Install server packages inside CT:": "Installez les packages de serveur dans CT :",
+  "Install terminal multiplexers": "Installer des multiplexeurs de terminaux",
+  "Install the Edge TPU runtime (libedgetpu1-std)": "Installez le runtime Edge TPU (libedgetpu1-std)",
+  "Install with Cloud-Init script": "Installer avec le script Cloud-Init",
+  "Install with ISO from UUP Dump": "Installer avec ISO à partir de UUP Dump",
+  "Install with personal ISO": "Installer avec une ISO personnelle",
+  "Install with traditional method": "Installer avec la méthode traditionnelle",
+  "Install with: apt-get install open-iscsi": "Installer avec : apt-get install open-iscsi",
+  "Install/Update Coral TPU on Host": "Installer/mettre à jour Coral TPU sur l'hôte",
+  "Install/Update NVIDIA Drivers (Host + LXC)": "Installer/mettre à jour les pilotes NVIDIA (hôte + LXC)",
+  "Installation Complete": "Installation terminée",
+  "Installation completed.": "Installation terminée.",
+  "Installation completed. Please reboot the server manually as soon as possible.": "Installation terminée. Veuillez redémarrer le serveur manuellement dès que possible.",
+  "Installation completed. Press Enter to continue...": "Installation terminée. Appuyez sur Entrée pour continuer...",
+  "Installation failed": "L'installation a échoué",
+  "Installation finished but drivers are not loaded. A reboot may be required.": "Installation terminée mais les pilotes ne sont pas chargés. Un redémarrage peut être nécessaire.",
+  "Installation log:": "Journal d'installation :",
+  "Installation summary": "Résumé de l'installation",
+  "Installed": "Installé",
+  "Installed at:": "Installé à :",
+  "Installed components:": "Composants installés :",
+  "Installed:": "Installé:",
+  "Installer already downloaded and verified.": "Installateur déjà téléchargé et vérifié.",
+  "Installer copied to container.": "Programme d'installation copié dans le conteneur.",
+  "Installer downloaded.": "Installateur téléchargé.",
+  "Installer finished with errors.": "Le programme d'installation s'est terminé avec des erreurs.",
+  "Installer not found:": "Installateur introuvable :",
+  "Installing": "Installation",
+  "Installing AMD mesa drivers in container...": "Installation des pilotes AMD mesa dans un conteneur...",
+  "Installing Ceph packages...": "Installation des packages Ceph...",
+  "Installing Ceph support...": "Installation du support Ceph...",
+  "Installing Coral TPU driver inside the container...": "Installation du pilote Coral TPU à l'intérieur du conteneur...",
+  "Installing Edge TPU runtime (libedgetpu1-std)...": "Installation du runtime Edge TPU (libedgetpu1-std)...",
+  "Installing Fail2Ban...": "Installation de Fail2Ban...",
+  "Installing Git as a prerequisite...": "Installer Git comme prérequis...",
+  "Installing Intel VA-API drivers in container...": "Installation des pilotes Intel VA-API dans le conteneur...",
+  "Installing Log2RAM from GitHub...": "Installation de Log2RAM depuis GitHub...",
+  "Installing Log2RAM from source...": "Installation de Log2RAM à partir des sources...",
+  "Installing NFS Client in LXC": "Installation du client NFS dans LXC",
+  "Installing NFS client packages...": "Installation des packages clients NFS...",
+  "Installing NFS client tools...": "Installation des outils clients NFS...",
+  "Installing NFS server packages inside the CT...": "Installation des packages de serveur NFS dans le CT...",
+  "Installing NVIDIA drivers in container. This may take several minutes...": "Installation des pilotes NVIDIA dans un conteneur. Cela peut prendre plusieurs minutes...",
+  "Installing NVIDIA udev rules and persistence service...": "Installation des règles NVIDIA udev et du service de persistance...",
+  "Installing NVIDIA utils (Alpine)...": "Installation des utilitaires NVIDIA (Alpine)...",
+  "Installing NVIDIA utils (Arch)...": "Installation des utilitaires NVIDIA (Arch)...",
+  "Installing OVH RTM (Real Time Monitoring)...": "Installation d'OVH RTM (Real Time Monitoring)...",
+  "Installing OpenVSwitch for virtual internal network...": "Installation d'OpenVSwitch pour le réseau interne virtuel...",
+  "Installing OpenVSwitch packages...": "Installation des packages OpenVSwitch...",
+  "Installing Samba Client": "Installation du client Samba",
+  "Installing Samba Client in LXC": "Installation du client Samba dans LXC",
+  "Installing Samba client tools...": "Installation des outils clients Samba...",
+  "Installing Samba server packages inside the CT...": "Installation des packages du serveur Samba dans le CT...",
+  "Installing Samba/CIFS client packages...": "Installation des packages clients Samba/CIFS...",
+  "Installing amdgpu_top...": "Installation d'amdgpu_top...",
+  "Installing and configuring Fail2Ban to protect Proxmox web interface and SSH...": "Installation et configuration de Fail2Ban pour protéger l'interface Web de Proxmox et SSH...",
+  "Installing and configuring Fastfetch...": "Installation et configuration de Fastfetch...",
+  "Installing and configuring Figurine...": "Installation et configuration de Figurine...",
+  "Installing and configuring ZFS auto-snapshot...": "Installation et configuration de l'instantané automatique ZFS...",
+  "Installing build dependencies...": "Installation des dépendances de build...",
+  "Installing dependency:": "Installation de la dépendance :",
+  "Installing essential Proxmox packages...": "Installation des packages Proxmox essentiels...",
+  "Installing gawk (required for OVF parsing)...": "Installation de gawk (requis pour l'analyse OVF)...",
+  "Installing group": "Groupe d'installation",
+  "Installing host drivers while the GPU is assigned to a VM could break passthrough and destabilize the system.": "L'installation de pilotes hôtes alors que le GPU est attribué à une VM pourrait interrompre le relais et déstabiliser le système.",
+  "Installing iSCSI initiator tools...": "Installation des outils d'initiateur iSCSI...",
+  "Installing intel-gpu-tools...": "Installation des outils Intel-Gpu...",
+  "Installing kexec-tools...": "Installation des outils kexec...",
+  "Installing latest Lynis security scan tool...": "Installation du dernier outil d'analyse de sécurité Lynis...",
+  "Installing packages...": "Installation des packages...",
+  "Installing pigz...": "Installation de pigz...",
+  "Installing required dependencies...": "Installation des dépendances requises...",
+  "Installing required package: git": "Installation du package requis : git",
+  "Installing required tools...": "Installation des outils requis...",
+  "Installing selected utilities": "Installation des utilitaires sélectionnés",
+  "Installing system utilities...": "Installation des utilitaires système...",
+  "Installing zfs-auto-snapshot package...": "Installation du package zfs-auto-snapshot...",
+  "Installs essential packages if missing": "Installe les packages essentiels s'ils sont manquants",
+  "Insufficient Disk Space": "Espace disque insuffisant",
+  "Insufficient disk space. Skipping LXC": "Espace disque insuffisant. Sauter LXC",
+  "Insufficient memory. NVIDIA install aborted.": "Mémoire insuffisante. Installation NVIDIA abandonnée.",
+  "Insufficient memory. Skipping LXC": "Mémoire insuffisante. Sauter LXC",
+  "Insufficient space:": "Espace insuffisant :",
+  "Integrity check failed on": "La vérification de l'intégrité a échoué",
+  "Intel CPU detected": "Processeur Intel détecté",
+  "Intel GPU Tools installation completed!": "Installation des outils GPU Intel terminée !",
+  "Intel GPU(s) detected:": "GPU Intel détecté(s) :",
+  "Intel VA-API drivers installed.": "Pilotes Intel VA-API installés.",
+  "Intel iGPU passthrough configured.": "Passthrough Intel iGPU configuré.",
+  "Interactive (guided, prompts visible)": "Interactif (guidé, invites visibles)",
+  "Interactive process viewer (press q to exit)": "Visionneuse de processus interactive (appuyez sur q pour quitter)",
+  "Interface": "Interface",
+  "Interface MTU": "MTU de l'interface",
+  "Interface Names (persistent)": "noms d'interface (persistants)",
+  "Interface Type": "Type d'interface",
+  "Interface names will return to default systemd behavior.": "Les noms d’interface reviendront au comportement systemd par défaut.",
+  "Interface type:": "Type d'interface :",
+  "Interfaces configured": "Interfaces configurées",
+  "Interfaces defined with 'auto' but no 'iface' block": "Interfaces définies avec 'auto' mais pas de bloc 'iface'",
+  "Interfaces to Remove": "Interfaces à supprimer",
+  "Internal error: NVIDIA installer path is empty or file not found.": "Erreur interne : le chemin du programme d'installation NVIDIA est vide ou le fichier est introuvable.",
+  "Internal error: missing arguments in pmx_prepare_host_shared_dir": "Erreur interne : arguments manquants dans pmx_prepare_host_shared_dir",
+  "Invalid 'proxmox-ve' candidate (not 9.x or none). Please verify your repository configuration and network, then retry.": "Candidat 'proxmox-ve' invalide (pas 9.x ou aucun). Veuillez vérifier la configuration et le réseau de votre référentiel, puis réessayez.",
+  "Invalid ID": "Pièce d'identité invalide",
+  "Invalid Option": "Option invalide",
+  "Invalid Path": "Chemin invalide",
+  "Invalid VMID": "IDVM invalide",
+  "Invalid ZFS pool name.": "Nom du pool ZFS non valide.",
+  "Invalid group name. Use letters, digits, underscore or hyphen, and start with a letter or underscore.": "Nom de groupe invalide. Utilisez des lettres, des chiffres, un trait de soulignement ou un trait d'union et commencez par une lettre ou un trait de soulignement.",
+  "Invalid input": "Entrée invalide",
+  "Invalid name": "Nom invalide",
+  "Invalid name. Use only letters, numbers, hyphens and underscores.": "Nom invalide. Utilisez uniquement des lettres, des chiffres, des traits d'union et des traits de soulignement.",
+  "Invalid option": "Option invalide",
+  "Invalid option, please try again.": "Option non valide, veuillez réessayer.",
+  "Invalid option. Skipping.": "Option invalide. Saut.",
+  "Invalid parameters for bind mount": "Paramètres non valides pour le montage de liaison",
+  "Invalid selection": "Sélection invalide",
+  "Invalid size. Please enter a number in MB (e.g., 128, 256, 512).": "Taille invalide. Veuillez saisir un nombre en Mo (par exemple, 128, 256, 512).",
+  "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "ID de stockage invalide. Utilisez uniquement des lettres, des chiffres, des traits d'union et des traits de soulignement.",
+  "Invalid username or password.": "Nom d'utilisateur ou mot de passe invalide.",
+  "Issue": "Problème",
+  "Issues found": "Problèmes trouvés",
+  "Issues were found. Would you like to use the Guided Cleanup Assistant?": "Des problèmes ont été trouvés. Souhaitez-vous utiliser l'assistant de nettoyage guidé ?",
+  "Issues were found. Would you like to use the Guided Repair Assistant?": "Des problèmes ont été trouvés. Souhaitez-vous utiliser l'assistant de réparation guidé ?",
+  "It appears that you have already executed the xshok-proxmox post-install script on this system.": "Il semble que vous ayez déjà exécuté le script de post-installation xshok-proxmox sur ce système.",
+  "It is recommended to create a backup before continuing.": "Il est recommandé de créer une sauvegarde avant de continuer.",
+  "It is strongly recommended to create a backup of your container before proceeding with the conversion.": "Il est fortement recommandé de créer une sauvegarde de votre conteneur avant de procéder à la conversion.",
+  "It will be installed from the official GitHub repository.": "Il sera installé à partir du référentiel officiel GitHub.",
+  "Italian": "italien",
+  "JC Channel logo applied": "Logo JC Channel appliqué",
+  "JSON output for scripts": "Sortie JSON pour les scripts",
+  "Job ID (letters, numbers, - _)": "ID de travail (lettres, chiffres, - _)",
+  "Job ID:": "Identifiant du travail :",
+  "Job deleted:": "Tâche supprimée :",
+  "Job disabled:": "Emploi désactivé :",
+  "Job enabled:": "Tâche activée :",
+  "Job selection returned empty id — aborting.": "La sélection de tâches a renvoyé un identifiant vide – abandon.",
+  "Journald configuration adjusted to": "Configuration du journal ajustée à",
+  "Journald configuration is already optimized": "La configuration de Journald est déjà optimisée",
+  "Journald configuration updated and service restarted": "Configuration journald mise à jour et service redémarré",
+  "Journald optimization completed": "Optimisation du journal terminée",
+  "Journald optimized - Max size: 64M": "Journal optimisé - Taille max : 64M",
+  "KDF:": "KDF :",
+  "KVM MSR options added to /etc/modprobe.d/kvm.conf": "Options KVM MSR ajoutées à /etc/modprobe.d/kvm.conf",
+  "KVM MSR options ensured in /etc/modprobe.d/kvm.conf": "Options KVM MSR assurées dans /etc/modprobe.d/kvm.conf",
+  "KVM MSR options not present, nothing to revert": "Options KVM MSR non présentes, rien à annuler",
+  "Keep GPU in LXC config (disable Start on boot)": "Conserver le GPU dans la configuration LXC (désactiver le démarrage au démarrage)",
+  "Keep GPU in LXC config + disable Start on boot": "Conserver le GPU dans la configuration LXC + désactiver le démarrage au démarrage",
+  "Keep GPU in VM config (disable Start on boot)": "Conserver le GPU dans la configuration de la VM (désactiver le démarrage au démarrage)",
+  "Keep GPU in source VM config (disable Start on boot if enabled)": "Conserver le GPU dans la configuration de la VM source (désactiver le démarrage au démarrage si activé)",
+  "Keep GPU in source VM config + disable Start on boot if enabled": "Conserver le GPU dans la configuration de la VM source + désactiver le démarrage au démarrage si activé",
+  "Keep current version (N)": "Conserver la version actuelle (N)",
+  "Keep current version (N) if modified": "Conserver la version actuelle (N) si modifiée",
+  "Keep in source VM(s) + disable onboot + add to target VM": "Conserver dans la ou les VM sources + désactiver le démarrage + ajouter à la VM cible",
+  "Keeping GPU in source VM config": "Conserver le GPU dans la configuration de la VM source",
+  "Kept sharedfiles group (has regular users assigned).": "Groupe de fichiers partagés conservé (des utilisateurs réguliers sont attribués).",
+  "Kernel and architecture info": "Informations sur le noyau et l'architecture",
+  "Kernel headers and build tools verified.": "En-têtes du noyau et outils de build vérifiés.",
+  "Kernel max Key limit configured": "Limite de clé maximale du noyau configurée",
+  "Kernel panic behavior configuration completed": "Configuration du comportement de panique du noyau terminée",
+  "Kernel panic configuration removed": "Configuration de panique du noyau supprimée",
+  "Kernel panic configuration updated and applied": "Configuration de panique du noyau mise à jour et appliquée",
+  "Kernel, modules and boot config": "Noyau, modules et configuration de démarrage",
+  "Kernel/boot-tied files (boot config, /etc/systemd/system, initramfs config, apt sources, ZFS state, ...) are NOT copied verbatim to keep the target's boot safe. The operator's own tuning inside them (IOMMU cmdline, VFIO IDs, custom quirks, GRUB timeout, ...) is merged into the target's fresh copies automatically via kernel-agnostic merge.": "les fichiers liés au noyau/au démarrage (configuration de démarrage, /etc/systemd/system, configuration initramfs, sources apt, état ZFS, ...) ne sont PAS copiés textuellement pour assurer la sécurité du démarrage de la cible.Les propres réglages de l'opérateur à l'intérieur (ligne de commande IOMMU, ID VFIO, bizarreries personnalisées, délai d'attente GRUB, ...) sont automatiquement fusionnés dans les nouvelles copies de la cible via une fusion indépendante du noyau.",
+  "Keyfile copied": "fichier clé copié",
+  "Keyfile copied to:": "fichier clé copié dans :",
+  "Keyfile passphrase": "Phrase secrète du fichier clé",
+  "Keyfile passphrase stored:": "Phrase secrète du fichier clé stockée :",
+  "Keyfile recovered": "Fichier clé récupéré",
+  "Keyfile recovered successfully.": "Le fichier clé a été récupéré avec succès.",
+  "Keyfile recovery available": "Récupération de fichier clé disponible",
+  "Keyfile recovery — pick source host": "Récupération du fichier de clés – choisissez l'hôte source",
+  "Keyfile removed.": "fichier clé supprimé.",
+  "Keyrings method failed; trying apt-key fallback": "La méthode des porte-clés a échoué ; essayer la solution de secours apt-key",
+  "LUNs appear as block devices assignable to VMs": "Les LUN apparaissent sous forme de périphériques de bloc attribuables aux machines virtuelles",
+  "LVM PV headers check completed": "Vérification des en-têtes PV LVM terminée",
+  "LVM physical volume detected": "Volume physique LVM détecté",
+  "LVM tools not available, skipping LVM check": "Outils LVM non disponibles, ignorer la vérification LVM",
+  "LVM:": "LVM :",
+  "LXC Conflict Policy": "Politique de conflit LXC",
+  "LXC Container Privilege Status": "Statut de privilège du conteneur LXC",
+  "LXC Conversion Manual Guides": "Guides manuels de conversion LXC",
+  "LXC Management": "Gestion LXC",
+  "LXC Mount Manager": "Gestionnaire de montage LXC",
+  "LXC Privileged to Unprivileged conversion": "Conversion LXC privilégié en non privilégié",
+  "LXC Unprivileged to Privileged conversion": "Conversion LXC non privilégiée en privilégiée",
+  "LXC already stopped": "LXC déjà arrêté",
+  "LXC containers with NVIDIA passthrough:": "Conteneurs LXC avec relais NVIDIA :",
+  "LXC conversion from privileged to unprivileged completed successfully!": "La conversion LXC de privilégié à non privilégié s'est terminée avec succès !",
+  "LXC conversion from unprivileged to privileged completed successfully!": "Conversion LXC de non privilégié à privilégié terminée avec succès !",
+  "LXC removed:": "LXC supprimé :",
+  "LXC stopped": "LXC arrêté",
+  "LXC update skipped by user.": "Mise à jour LXC ignorée par l'utilisateur.",
+  "LXCs to destroy:": "LXC à détruire :",
+  "Label:": "Étiquette:",
+  "Language Change": "Changement de langue",
+  "Language changed to": "La langue a été modifiée en",
+  "Last 50 kernel log lines": "50 dernières lignes de journal du noyau",
+  "Last run:": "Dernière exécution :",
+  "Last system boot time": "Heure du dernier démarrage du système",
+  "Latest available": "Dernier disponible",
+  "Latest version:": "Dernière version :",
+  "Launching GPU passthrough assistant for VM": "Lancement de l'assistant de passthrough GPU pour VM",
+  "Legacy PVE 8 .list files commented or not present": "Fichiers .list hérités PVE 8 commentés ou non présents",
+  "Legacy ceph.list commented or not present": "Ceph.list hérité commenté ou non présent",
+  "Legacy network tools (e.g., ifconfig)": "Outils réseau hérités (par exemple, ifconfig)",
+  "Legend:": "Légende:",
+  "Let's review your current network configuration.": "Passons en revue votre configuration réseau actuelle.",
+  "Likely cause: host directory permissions deny the container's mapped UID.": "Cause probable : les autorisations du répertoire hôte refusent l'UID mappé du conteneur.",
+  "Limiting size and optimizing journald": "Limiter la taille et optimiser journald",
+  "Limiting size and optimizing journald...": "Limiter la taille et optimiser le journal...",
+  "Line to paste (single line, including \"command=...\" prefix):": "Ligne à coller (une seule ligne, incluant le préfixe \"command=...\") :",
+  "Linux Installation Options": "Options d'installation Linux",
+  "Linux/Mac path:": "Chemin Linux/Mac :",
+  "List Available Disks": "Liste des disques disponibles",
+  "List IOMMU group mapping": "Répertorier le mappage de groupe IOMMU",
+  "List NVMe devices": "Répertorier les appareils NVMe",
+  "List SMART-capable devices": "Répertorier les appareils compatibles SMART",
+  "List VM/CT IDs to operate on": "Répertorier les ID de VM/CT sur lesquels opérer",
+  "List ZFS datasets and snapshots": "Répertorier les ensembles de données et les instantanés ZFS",
+  "List all LXC containers": "Répertorier tous les conteneurs LXC",
+  "List all ZFS pools": "Répertorier tous les pools ZFS",
+  "List all containers to identify the privileged one:": "Lister tous les conteneurs pour identifier celui privilégié :",
+  "List all containers to identify the unprivileged one:": "Répertoriez tous les conteneurs pour identifier celui qui n'est pas privilégié :",
+  "List all virtual machines": "Lister toutes les machines virtuelles",
+  "List backups in a specific storage": "Répertorier les sauvegardes dans un stockage spécifique",
+  "List block devices and partitions": "Liste des périphériques de blocage et des partitions",
+  "List configured storages:": "Répertoriez les stockages configurés :",
+  "List containers:": "Répertorier les conteneurs :",
+  "List content of specific storage": "Répertorier le contenu d'un stockage spécifique",
+  "List disk persistent identifiers": "Répertorier les identifiants persistants du disque",
+  "List disks with detailed info": "Répertorier les disques avec des informations détaillées",
+  "List importable ZFS pools": "Répertorier les pools ZFS importables",
+  "List local backups": "Répertorier les sauvegardes locales",
+  "List storages valid for image import": "Répertorier les stockages valides pour l'importation d'images",
+  "Listening Ports": "Ports d'écoute",
+  "Listening on:": "En écoute sur :",
+  "Listening ports:": "Ports d'écoute :",
+  "Listing relevant CT users and their mapped UID/GID on host...": "Liste des utilisateurs CT concernés et de leur UID/GID mappé sur l'hôte...",
+  "Loading modules...": "Chargement des modules...",
+  "Local Disk Manager - Proxmox Host": "Gestionnaire de disque local - Hôte Proxmox",
+  "Local Disk Storages": "Stockages sur disque local",
+  "Local Shared Directory on Host": "Répertoire partagé local sur l'hôte",
+  "Local archive targets (paths + USB mount/unmount)": "cibles d'archives locales (chemins + montage/démontage USB)",
+  "Local backup error log": "Journal des erreurs de sauvegarde locale",
+  "Local backup failed.": "La sauvegarde locale a échoué.",
+  "Local directory  (single-machine — only use if it is a SEPARATE disk)": "Répertoire local (machine unique — à utiliser uniquement s'il s'agit d'un disque SÉPARÉ)",
+  "Local keyfile is missing but a recovery copy was found in PBS.": "Le fichier de clé local est manquant mais une copie de récupération a été trouvée dans PBS.",
+  "Local network only (192.168.0.0/16)": "Réseau local uniquement (192.168.0.0/16)",
+  "Local restore error log": "Journal des erreurs de restauration locale",
+  "Locale generated": "Paramètres régionaux générés",
+  "Location:": "Emplacement:",
+  "Log": "Enregistrer",
+  "Log file": "Fichier journal",
+  "Log2RAM already registered — updating to latest configuration": "Log2RAM déjà enregistré - mise à jour vers la dernière configuration",
+  "Log2RAM installation and configuration completed successfully.": "L'installation et la configuration de Log2RAM se sont terminées avec succès.",
+  "Log2RAM installation cancelled by user": "Installation de Log2RAM annulée par l'utilisateur",
+  "Log2RAM installation verification failed. Check /tmp/log2ram_install.log": "La vérification de l'installation de Log2RAM a échoué. Vérifiez /tmp/log2ram_install.log",
+  "Log2RAM installed successfully": "Log2RAM installé avec succès",
+  "Log2RAM size set to:": "Taille de Log2RAM définie sur :",
+  "Log2RAM write scheduled every": "Écriture Log2RAM programmée tous les",
+  "Log:": "Enregistrer:",
+  "Logged-in users": "Utilisateurs connectés",
+  "Logrotate optimization completed": "Optimisation de la rotation terminée",
+  "Logrotate service restarted successfully": "Le service Logrotate a redémarré avec succès",
+  "Long Test — Background": "Test long — Contexte",
+  "Long self-test started on": "Un autotest long a démarré le",
+  "Long test             — full scan, runs in background if closed": "Test long : analyse complète, s'exécute en arrière-plan si fermé",
+  "Look for containers with 'unprivileged: 1' in their config": "Recherchez les conteneurs avec « non privilégié : 1 » dans leur configuration.",
+  "Look for containers without 'unprivileged: 1' in their config": "Recherchez les conteneurs sans « non privilégié : 1 » dans leur configuration",
+  "Lookup domain registration info": "Rechercher des informations d'enregistrement de domaine",
+  "Low Container Memory": "Mémoire de conteneur faible",
+  "Low free space warning": "Avertissement d'espace libre faible",
+  "Low-power CPU platform": "Plateforme CPU basse consommation",
+  "Lynis - Security Audit": "Lynis - Audit de sécurité",
+  "Lynis Management": "Gestion Lynis",
+  "Lynis command not found": "Commande Lynis introuvable",
+  "Lynis has been removed": "Lynis a été supprimé",
+  "Lynis installation could not be verified": "L'installation de Lynis n'a pas pu être vérifiée",
+  "Lynis installed successfully from GitHub": "Lynis installé avec succès depuis GitHub",
+  "Lynis is a security auditing tool that performs comprehensive system scans including:": "Lynis est un outil d'audit de sécurité qui effectue des analyses complètes du système, notamment :",
+  "Lynis is currently installed.": "Lynis est actuellement installé.",
+  "Lynis is not installed on this system.": "Lynis n'est pas installé sur ce système.",
+  "Lynis is not installed. Run: apt install lynis": "Lynis n'est pas installé. Exécuter : apt installer lynis",
+  "Lynis is ready to use": "Lynis est prêt à l'emploi",
+  "Lynis updated to version:": "Lynis mis à jour vers la version :",
+  "Lynis version:": "Version Lynis :",
+  "Lynis was not installed from Git. Reinstalling...": "Lynis n'a pas été installé depuis Git. Réinstallation...",
+  "M.2 / PCIe devices:": "Appareils M.2/PCIe :",
+  "MAC Address": "Adresse MAC",
+  "MACHINE TYPE": "TYPE DE MACHINE",
+  "MOTD configuration updated successfully": "Configuration MOTD mise à jour avec succès",
+  "Machine Type": "Type de machine",
+  "Machine type: q35": "Type de machine : q35",
+  "Machine: q35": "Appareil : q35",
+  "Major version differs:": "La version majeure diffère :",
+  "Make sure IOMMU is properly enabled and the system has been rebooted after activation.": "Assurez-vous que IOMMU est correctement activé et que le système a été redémarré après l'activation.",
+  "Make sure there are no critical services running as they will be interrupted. Ensure your server can be safely rebooted.": "Assurez-vous qu'aucun service critique n'est en cours d'exécution car ils seront interrompus. Assurez-vous que votre serveur peut être redémarré en toute sécurité.",
+  "Make sure you have SSH or Web UI access before rebooting.": "Assurez-vous que vous disposez d'un accès SSH ou Web UI avant de redémarrer.",
+  "Makefile missing in": "Makefile manquant dans",
+  "Malformed repository entries cleaned": "Entrées de référentiel malformées nettoyées",
+  "Manage PBS encryption keyfile": "Gérer le fichier de clés de chiffrement PBS",
+  "Manage Secure Gateway": "Gérer la passerelle sécurisée",
+  "Manage and inspect VM disk images": "Gérer et inspecter les images de disque de VM",
+  "Manage custom backup paths": "Gérer les chemins de sauvegarde personnalisés",
+  "Manage custom paths (add / remove your folders)": "Gérer les chemins personnalisés (ajouter/supprimer vos dossiers)",
+  "Manage local backup target": "Gérer la cible de sauvegarde locale",
+  "Manual CLI Guide (Disk and Storage Manager)": "Guide CLI manuel (Gestionnaire de disques et de stockage)",
+  "Manual CLI Guide (GPU/TPU)": "Guide CLI manuel (GPU/TPU)",
+  "Manual Guide: Convert LXC Privileged to Unprivileged": "Guide manuel : Convertir LXC privilégié en non privilégié",
+  "Manual Guide: Convert LXC Unprivileged to Privileged": "Guide manuel : Convertir LXC non privilégié en privilégié",
+  "Manual Path Entry": "Entrée manuelle du chemin",
+  "Manual backup of a VM or CT": "Sauvegarde manuelle d'une VM ou d'un CT",
+  "Manual command template (copy/paste):": "Modèle de commande manuelle (copier/coller) :",
+  "Manual destination path": "Chemin de destination manuel",
+  "Manual guide script not found": "Script de guide manuel introuvable",
+  "Manual install required inside CT": "Installation manuelle requise à l’intérieur du CT",
+  "Manual path entry": "Saisie manuelle du chemin",
+  "Manual steps recommended after import": "Étapes manuelles recommandées après l'importation",
+  "Manual upgrade guide step by step": "Guide de mise à niveau manuelle étape par étape",
+  "Mapped GID on host": "GID mappé sur l'hôte",
+  "Mapped UID on host": "UID mappé sur l'hôte",
+  "Max FD limit / ulimit configured": "Limite FD maximale / ulimit configurée",
+  "Max FS open files configuration created successfully": "Configuration des fichiers ouverts Max FS créée avec succès",
+  "Max user watches configured": "Nombre maximum de montres utilisateur configurées",
+  "Maximum auto-repair attempts reached (3). Please review the log and run any remaining commands manually.": "Nombre maximal de tentatives de réparation automatique atteint (3). Veuillez consulter le journal et exécuter manuellement les commandes restantes.",
+  "May need to restart terminal": "Il faudra peut-être redémarrer le terminal",
+  "Memory optimization completed.": "Optimisation de la mémoire terminée.",
+  "Memory optimizations removed": "Optimisations de mémoire supprimées",
+  "Memory restored.": "Mémoire restaurée.",
+  "Memory settings optimized successfully": "Paramètres de mémoire optimisés avec succès",
+  "Memory:": "Mémoire:",
+  "Method:": "Méthode:",
+  "Migrate VMs away from node being upgraded": "Migrer les VM hors du nœud en cours de mise à niveau",
+  "Migrate away any guests that must keep running": "Migrez tous les invités qui doivent continuer à fonctionner",
+  "Migrated legacy ProxMenux NVIDIA blacklist state — module will reload after reboot": "État de la liste noire ProxMenux NVIDIA héritée migrée : le module se rechargera après le redémarrage",
+  "Mirror URL not available for this script.": "URL miroir non disponible pour ce script.",
+  "Missing": "Manquant",
+  "Missing commands after installation:": "Commandes manquantes après l'installation :",
+  "Missing dependency": "Dépendance manquante",
+  "Missing on target:": "Manquant la cible :",
+  "Missing or invalid parameter": "Paramètre manquant ou invalide",
+  "Missing required parameter": "Paramètre obligatoire manquant",
+  "Mixed GPU Modes": "Modes GPU mixtes",
+  "Mixed current mode detected in selected GPU(s).": "Mode courant mixte détecté dans le(s) GPU sélectionné(s).",
+  "Mobile UI backup created": "Sauvegarde de l'interface utilisateur mobile créée",
+  "Mode": "Mode",
+  "Model": "Modèle",
+  "Modern resource monitor (press q to exit)": "Moniteur de ressources moderne (appuyez sur q pour quitter)",
+  "Modifying Fastfetch configuration...": "Modification de la configuration de Fastfetch...",
+  "Modules configuration updated.": "Configuration des modules mise à jour.",
+  "Modules loaded.": "Modules chargés.",
+  "Monitor Activated": "Moniteur activé",
+  "Monitor Deactivated": "Moniteur désactivé",
+  "Monitor URL": "Surveiller l'URL",
+  "Monitor disk I/O usage (press q to exit)": "Surveiller l'utilisation des E/S du disque (appuyez sur q pour quitter)",
+  "Monitor progress:": "Surveiller les progrès :",
+  "Monitoring": "Surveillance",
+  "Most common cause: the archive is corrupted (interrupted write, partial copy, or storage issue).": "Cause la plus courante : l'archive est corrompue (écriture interrompue, copie partielle ou problème de stockage).",
+  "Mount Added Successfully:": "Montage ajouté avec succès :",
+  "Mount CIFS share:": "Montez le partage CIFS :",
+  "Mount Configuration Summary:": "Résumé de la configuration du montage :",
+  "Mount Details:": "Détails du montage :",
+  "Mount Examples:": "Exemples de montage :",
+  "Mount Host Directory to LXC": "Monter le répertoire hôte sur LXC",
+  "Mount Host Directory to LXC Container": "Monter le répertoire hôte sur le conteneur LXC",
+  "Mount Information:": "Informations sur la monture :",
+  "Mount Method": "Méthode de montage",
+  "Mount NFS Client in LXC": "Monter le client NFS dans LXC",
+  "Mount NFS Share": "Monter le partage NFS",
+  "Mount NFS Share on Host": "Monter le partage NFS sur l'hôte",
+  "Mount NFS share:": "Monter le partage NFS :",
+  "Mount Name": "Nom de la monture",
+  "Mount Name:": "Nom de la monture :",
+  "Mount Options": "Options de montage",
+  "Mount Path": "Chemin de montage",
+  "Mount Path:": "Chemin de montage :",
+  "Mount Point": "Point de montage",
+  "Mount Point ID": "ID du point de montage",
+  "Mount Point Removal Summary:": "Résumé de la suppression du point de montage :",
+  "Mount Point:": "Point de montage :",
+  "Mount Samba Share": "Mont Samba Partager",
+  "Mount Samba Share on Host": "Partager Mount Samba sur l'hôte",
+  "Mount USB disk?": "Monter un disque USB ?",
+  "Mount a USB drive now": "Montez une clé USB maintenant",
+  "Mount all datasets": "Monter tous les ensembles de données",
+  "Mount already exists for this path in container": "Le support existe déjà pour ce chemin dans le conteneur",
+  "Mount and persist with UUID:": "Montez et conservez avec l'UUID :",
+  "Mount failed": "Le montage a échoué",
+  "Mount options:": "Options de montage :",
+  "Mount path must be an absolute path starting with /": "Le chemin de montage doit être un chemin absolu commençant par /",
+  "Mount path:": "Chemin de montage :",
+  "Mount point created": "Point de montage créé",
+  "Mount point created.": "Point de montage créé.",
+  "Mount point is visible but NOT writable from inside the container": "Le point de montage est visible mais NON accessible en écriture depuis l'intérieur du conteneur",
+  "Mount point is writable from inside the container": "Le point de montage est accessible en écriture depuis l'intérieur du conteneur",
+  "Mount point not visible inside the container yet": "Point de montage pas encore visible à l'intérieur du conteneur",
+  "Mount point ready:": "Point de montage prêt :",
+  "Mount point removed successfully": "Point de montage supprimé avec succès",
+  "Mount point:": "Point de montage :",
+  "Mount shares on HOST first": "Montez d'abord les partages sur HOST",
+  "Mount specific dataset": "Monter un ensemble de données spécifique",
+  "Mount status:": "Statut du montage :",
+  "Mount this device and use it as the backup destination?": "Monter cet appareil et l'utiliser comme destination de sauvegarde ?",
+  "Mount was busy — performed lazy unmount": "Mount était occupé – effectué un démontage paresseux",
+  "Mounted": "Monté",
+  "Mounted ISO on device": "ISO monté sur l'appareil",
+  "Mounted at": "Monté à",
+  "Mounted external disk": "Disque externe monté",
+  "Mounted external disk  (offline-safe, single-machine dedup)": "Disque externe monté (déduplication sécurisée hors ligne sur une seule machine)",
+  "Mounted filesystem detected": "Système de fichiers monté détecté",
+  "Mounting CIFS share...": "Montage du partage CIFS...",
+  "Mounting NFS share...": "Montage du partage NFS...",
+  "Mounting container filesystem": "Montage du système de fichiers du conteneur",
+  "Mounting disk...": "Disque de montage...",
+  "Mounting existing": "Montage existant",
+  "Mounting here will hide existing files until unmounted.": "Le montage ici masquera les fichiers existants jusqu'à leur démontage.",
+  "Move that copy offsite (USB, password manager, another host). Delete it from this path when done.": "déplacez cette copie hors site (USB, gestionnaire de mots de passe, un autre hôte).Supprimez-le de ce chemin une fois terminé.",
+  "Move to target VM (remove from source VM config)": "Déplacer vers la VM cible (supprimer de la configuration de la VM source)",
+  "Multiple recovery groups found in PBS. Pick the one that originally created the keyfile:": "Plusieurs groupes de récupération trouvés dans PBS. Choisissez celui qui a initialement créé le fichier de clés :",
+  "Multiple rootfs directories were found in this archive. Restore cannot continue automatically.": "Plusieurs répertoires rootfs ont été trouvés dans cette archive. La restauration ne peut pas continuer automatiquement.",
+  "NAS Systems": "Systèmes NAS",
+  "NETWORK CONFIGURATION ANALYSIS": "ANALYSE DE LA CONFIGURATION DU RÉSEAU",
+  "NFS Access Restricted": "Accès NFS restreint",
+  "NFS Client Error": "Erreur du client NFS",
+  "NFS Client Manager - CT": "Gestionnaire de clients NFS - CT",
+  "NFS Client Status in CT": "Statut du client NFS dans CT",
+  "NFS Client Tools: AVAILABLE": "Outils clients NFS : DISPONIBLES",
+  "NFS Client Tools: NOT AVAILABLE": "Outils clients NFS : NON DISPONIBLES",
+  "NFS Client in LXC (Privileged)": "Client NFS dans LXC (privilégié)",
+  "NFS Client in LXC (privileged)": "Client NFS dans LXC (privilégié)",
+  "NFS Client: INSTALLED": "Client NFS : INSTALLÉ",
+  "NFS Client: NOT INSTALLED": "Client NFS : NON INSTALLÉ",
+  "NFS Error": "Erreur NFS",
+  "NFS Host Manager - Proxmox Host": "Gestionnaire d'hôte NFS - Hôte Proxmox",
+  "NFS LXC Manager - CT": "Gestionnaire NFS LXC - CT",
+  "NFS Mounts on Host": "Montages NFS sur l'hôte",
+  "NFS Not Installed": "NFS non installé",
+  "NFS Port Error": "Erreur de port NFS",
+  "NFS Proxmox storages (pvesm):": "Stockages NFS Proxmox (pvesm) :",
+  "NFS Server": "Serveur NFS",
+  "NFS Server Selection": "Sélection du serveur NFS",
+  "NFS Server in LXC (Privileged)": "Serveur NFS dans LXC (privilégié)",
+  "NFS Server in LXC (privileged)": "Serveur NFS dans LXC (privilégié)",
+  "NFS Server: INSTALLED": "Serveur NFS : INSTALLÉ",
+  "NFS Server: NOT INSTALLED": "Serveur NFS : NON INSTALLÉ",
+  "NFS Service Status in CT": "État du service NFS dans CT",
+  "NFS Service: RUNNING": "Service NFS : EN EXÉCUTION",
+  "NFS Service: STOPPED": "Service NFS : ARRÊTÉ",
+  "NFS Version Configuration:": "Configuration des versions NFS :",
+  "NFS Version:": "Version NFS :",
+  "NFS Version: Auto-negotiation (NFSv3/NFSv4)": "Version NFS : négociation automatique (NFSv3/NFSv4)",
+  "NFS client installed successfully.": "Client NFS installé avec succès.",
+  "NFS client tools installed": "Outils clients NFS installés",
+  "NFS directory permissions set — containers should now be able to write": "Ensemble d'autorisations de répertoire NFS : les conteneurs devraient désormais pouvoir écrire",
+  "NFS export": "Exportation NFS",
+  "NFS export Selected": "Exportation NFS Sélectionné",
+  "NFS export created successfully!": "Exportation NFS créée avec succès !",
+  "NFS export:": "Exportation NFS :",
+  "NFS is recommended for VM disk image storage.": "NFS est recommandé pour le stockage d’images disque de VM.",
+  "NFS mounts in CT": "Montages NFS dans CT",
+  "NFS packages removed.": "Packages NFS supprimés.",
+  "NFS port (2049) is not accessible on": "Le port NFS (2049) n'est pas accessible sur",
+  "NFS port 2049": "Port NFS 2049",
+  "NFS server Selected": "Serveur NFS Sélectionné",
+  "NFS server installed successfully.": "Serveur NFS installé avec succès.",
+  "NFS server is already installed.": "Le serveur NFS est déjà installé.",
+  "NFS server is not installed in this CT.": "Le serveur NFS n'est pas installé dans ce CT.",
+  "NFS server is running": "Le serveur NFS est en cours d'exécution",
+  "NFS server:": "Serveur NFS :",
+  "NFS servers detected": "Serveurs NFS détectés",
+  "NFS service is enabled": "Le service NFS est activé",
+  "NFS services stopped and disabled.": "Services NFS arrêtés et désactivés.",
+  "NFS share mounted at:": "Partage NFS monté à :",
+  "NFS share mounted successfully!": "Partage NFS monté avec succès !",
+  "NFS share unmount completed.": "Démontage du partage NFS terminé.",
+  "NFS storage added successfully!": "Stockage NFS ajouté avec succès !",
+  "NFS storage adding in progress...": "Ajout du stockage NFS en cours...",
+  "NIC": "NIC",
+  "NIC changes detected — adjusted automatically": "modifications de la carte réseau détectées – ajustées automatiquement",
+  "NICs:": "Cartes réseau :",
+  "NOT FOUND": "NON TROUVÉ",
+  "NOTE: The host directory and its contents will remain unchanged.": "REMARQUE : Le répertoire hôte et son contenu resteront inchangés.",
+  "NVENC patch detected — list narrowed to versions supported by keylase/nvidia-patch.": "Correctif NVENC détecté — liste restreinte aux versions prises en charge par keylase/nvidia-patch.",
+  "NVIDIA Actions": "Actions NVIDIA",
+  "NVIDIA CPU hiding already configured": "Le masquage du processeur NVIDIA est déjà configuré",
+  "NVIDIA DKMS entries removed.": "NVIDIA DKMS entries removed.",
+  "NVIDIA Driver Uninstall": "Désinstallation du pilote NVIDIA",
+  "NVIDIA Driver Version": "Version du pilote NVIDIA",
+  "NVIDIA Drivers": "Pilotes NVIDIA",
+  "NVIDIA Drivers Not Found": "Pilotes NVIDIA introuvables",
+  "NVIDIA GPU Driver Installation": "Installation du pilote GPU NVIDIA",
+  "NVIDIA GPU passthrough configured.": "Passthrough GPU NVIDIA configuré.",
+  "NVIDIA KVM args configured (kvm=off, vendor_id spoof)": "Arguments NVIDIA KVM configurés (kvm=off, usurpation d'id_vendeur)",
+  "NVIDIA KVM hiding (cpu hidden=1)": "Masquage NVIDIA KVM (cpu caché = 1)",
+  "NVIDIA KVM hiding already configured": "Masquage NVIDIA KVM déjà configuré",
+  "NVIDIA Patch": "Correctif NVIDIA",
+  "NVIDIA driver": "Pilote NVIDIA",
+  "NVIDIA driver installed successfully.": "Pilote NVIDIA installé avec succès.",
+  "NVIDIA driver installed:": "Pilote NVIDIA installé :",
+  "NVIDIA driver verification in container:": "Vérification du pilote NVIDIA dans le conteneur :",
+  "NVIDIA drivers are not installed or not loaded on this host.": "Les pilotes NVIDIA ne sont pas installés ou ne sont pas chargés sur cet hôte.",
+  "NVIDIA host services already aligned for VFIO mode": "Services hôtes NVIDIA déjà alignés pour le mode VFIO",
+  "NVIDIA host services disabled for VFIO mode": "Services hôte NVIDIA désactivés pour le mode VFIO",
+  "NVIDIA host services/autoload already aligned for VFIO mode": "Services hôte NVIDIA/chargement automatique déjà alignés pour le mode VFIO",
+  "NVIDIA host services/autoload already aligned for native mode": "Services d'hôte NVIDIA/chargement automatique déjà alignés pour le mode natif",
+  "NVIDIA host services/autoload disabled for VFIO mode": "Services hôte NVIDIA/chargement automatique désactivés pour le mode VFIO",
+  "NVIDIA host services/autoload restored for native mode": "Services hôte NVIDIA/chargement automatique restaurés pour le mode natif",
+  "NVIDIA install incomplete. Check log:": "Installation NVIDIA incomplète. Journal de vérification :",
+  "NVIDIA installer downloaded successfully": "Le programme d'installation de NVIDIA a été téléchargé avec succès",
+  "NVIDIA installer extracted.": "Programme d'installation NVIDIA extrait.",
+  "NVIDIA installer not found at": "Le programme d'installation NVIDIA est introuvable sur",
+  "NVIDIA installer reported an error. Check /tmp/nvidia_install.log": "Le programme d'installation de NVIDIA a signalé une erreur. Vérifiez /tmp/nvidia_install.log",
+  "NVIDIA installer returned error": "Le programme d'installation de NVIDIA a renvoyé une erreur",
+  "NVIDIA kernel modules unloaded successfully.": "Les modules du noyau NVIDIA ont été déchargés avec succès.",
+  "NVIDIA libs require approximately 1.5GB of free space.": "Les bibliothèques NVIDIA nécessitent environ 1,5 Go d'espace libre.",
+  "NVIDIA patch applied - check README for supported versions.": "Patch NVIDIA appliqué - consultez le fichier README pour les versions prises en charge.",
+  "NVIDIA patch not applied.": "Patch NVIDIA non appliqué.",
+  "NVIDIA per-BDF VFIO binding configured": "Liaison NVIDIA par BDF VFIO configurée",
+  "NVIDIA services stopped and disabled.": "Services NVIDIA arrêtés et désactivés.",
+  "NVIDIA udev rules and persistence service installed.": "Règles NVIDIA udev et service de persistance installés.",
+  "NVIDIA uninstallation steps completed.": "Étapes de désinstallation de NVIDIA terminées.",
+  "NVIDIA uninstaller completed.": "Le programme de désinstallation NVIDIA est terminé.",
+  "NVIDIA update failed for LXC": "La mise à jour NVIDIA a échoué pour LXC",
+  "NVIDIA userspace libraries installed.": "Bibliothèques d'espace utilisateur NVIDIA installées.",
+  "NVMe Disk Detected": "Disque NVMe détecté",
+  "NVMe health status: PASSED": "État de santé NVMe : RÉUSSI",
+  "NVMe health status: WARNING (critical_warning =": "État de santé NVMe : AVERTISSEMENT (critical_warning =",
+  "NVMe skipped (to add as PCIe use 'Add Controller or NVMe PCIe to VM'):": "NVMe ignoré (pour ajouter en tant que PCIe, utilisez « Ajouter un contrôleur ou NVMe PCIe à la VM ») :",
+  "NVMe-specific SMART log": "Journal SMART spécifique à NVMe",
+  "Name for this target:": "Nom de cette cible :",
+  "Name:": "Nom:",
+  "Neither /etc/kernel/cmdline nor /etc/default/grub found.": "Ni /etc/kernel/cmdline ni /etc/default/grub n'ont été trouvés.",
+  "Nesting feature enabled": "Fonction d'imbrication activée",
+  "NetBIOS Service: RUNNING": "Service NetBIOS : EN EXÉCUTION",
+  "NetBIOS Service: STOPPED": "Service NetBIOS : ARRÊTÉ",
+  "NetBIOS port 139:": "Port NetBIOS 139 :",
+  "Network": "Réseau",
+  "Network  :": "Réseau  :",
+  "Network (interfaces, DNS)": "Réseau (interfaces, DNS)",
+  "Network Bridge": "Pont réseau",
+  "Network Commands": "Commandes réseau",
+  "Network Configuration": "Configuration réseau",
+  "Network Configuration Analysis": "Analyse de la configuration réseau",
+  "Network Configuration File": "Fichier de configuration réseau",
+  "Network Diagnostics": "Diagnostic réseau",
+  "Network Error": "Erreur réseau",
+  "Network Interface Setup": "Configuration de l'interface réseau",
+  "Network Interfaces": "Interfaces réseau",
+  "Network Management": "Gestion du réseau",
+  "Network Management - SAFE MODE": "Gestion du réseau - MODE SÉCURISÉ",
+  "Network Restart": "Redémarrage du réseau",
+  "Network Restart Failed": "Échec du redémarrage du réseau",
+  "Network Restarted": "Réseau redémarré",
+  "Network Tools": "Outils réseau",
+  "Network access:": "Accès au réseau :",
+  "Network configuration backed up": "Configuration réseau sauvegardée",
+  "Network configuration has been restored from backup.": "La configuration réseau a été restaurée à partir de la sauvegarde.",
+  "Network connection failed to": "La connexion réseau n'a pas réussi",
+  "Network connectivity": "Connectivité réseau",
+  "Network connectivity to": "Connectivité réseau à",
+  "Network interfaces added:": "Interfaces réseau ajoutées :",
+  "Network monitoring tool (iptraf-ng)": "Outil de surveillance du réseau (iptraf-ng)",
+  "Network optimization completed": "Optimisation du réseau terminée",
+  "Network optimizations removed": "Optimisations du réseau supprimées",
+  "Network service restarted successfully": "Le service réseau a redémarré avec succès",
+  "Network service restarted successfully.": "Le service réseau a redémarré avec succès.",
+  "Network share mounting (NFS/Samba) requires a PRIVILEGED container.": "Le montage de partage réseau (NFS/Samba) nécessite un conteneur PRIVILEGED.",
+  "Network throughput test (client/server)": "Test de débit réseau (client/serveur)",
+  "NetworkManager Detected": "Gestionnaire de réseau détecté",
+  "NetworkManager has been removed successfully": "NetworkManager a été supprimé avec succès",
+  "NetworkManager is running (may cause conflicts)": "NetworkManager est en cours d'exécution (peut provoquer des conflits)",
+  "NetworkManager is running, which may conflict with Proxmox.": "NetworkManager est en cours d'exécution, ce qui peut entrer en conflit avec Proxmox.",
+  "NetworkManager not running": "NetworkManager ne fonctionne pas",
+  "New Folder in /mnt": "Nouveau dossier dans /mnt",
+  "New Group": "Nouveau groupe",
+  "New Search": "Nouvelle recherche",
+  "New VM:": "Nouvelle VM :",
+  "New Virtual Machine": "Nouvelle machine virtuelle",
+  "New backup job": "Nouveau travail de sauvegarde",
+  "New backups on this host will be unencrypted until a new keyfile is set up.": "Les nouvelles sauvegardes sur cet hôte ne seront pas chiffrées jusqu'à ce qu'un nouveau fichier de clés soit configuré.",
+  "New mount options to apply:": "Nouvelles options de montage à appliquer :",
+  "New scheduled job (own timer + retention)": "Nouvelle tâche planifiée (propre minuterie + rétention)",
+  "New version available": "Nouvelle version disponible",
+  "New version:": "Nouvelle version :",
+  "Next Step Required": "Prochaine étape requise",
+  "Next Steps:": "Prochaines étapes :",
+  "Next step: stop that VM first, then run": "Étape suivante : arrêtez d'abord cette VM, puis exécutez",
+  "No": "Non",
+  "No .link files found in": "Aucun fichier .link trouvé dans",
+  "No .ova or .ovf files found in:": "Aucun fichier .ova ou .ovf trouvé dans :",
+  "No .ovf descriptor found inside OVA.": "Aucun descripteur .ovf trouvé dans OVA.",
+  "No .pxar archives were found in this backup:": "Aucune archive .pxar n'a été trouvée dans cette sauvegarde :",
+  "No AMD CPU detected. Skipping AMD fixes.": "Aucun processeur AMD détecté. Ignorer les correctifs AMD.",
+  "No AMD GPU detected on this system.": "Aucun GPU AMD détecté sur ce système.",
+  "No Available Exports": "Aucune exportation disponible",
+  "No Available Shares": "Aucune action disponible",
+  "No Backups": "Aucune sauvegarde",
+  "No CIFS Proxmox storage and no CIFS fstab mount found on this host.": "Aucun stockage CIFS Proxmox et aucun montage CIFS fstab trouvés sur cet hôte.",
+  "No CIFS Proxmox storage configured.": "Aucun stockage CIFS Proxmox configuré.",
+  "No CIFS Proxmox storages configured.": "Aucun stockage CIFS Proxmox configuré.",
+  "No CIFS mounts active.": "Aucun montage CIFS actif.",
+  "No CT was selected.": "Aucun CT n'a été sélectionné.",
+  "No CTs available in the system.": "Aucun TC disponible dans le système.",
+  "No Changes Needed": "Aucun changement nécessaire",
+  "No Cleanup Needed": "Aucun nettoyage nécessaire",
+  "No Controller/NVMe selected for now.": "Aucun contrôleur/NVMe sélectionné pour l'instant.",
+  "No Coral Detected": "Aucun corail détecté",
+  "No Coral TPU device was found on this host (neither PCIe/M.2 nor USB).": "Aucun périphérique Coral TPU n'a été trouvé sur cet hôte (ni PCIe/M.2 ni USB).",
+  "No Custom Logos Found": "Aucun logo personnalisé trouvé",
+  "No Disk Images Found": "Aucune image disque trouvée",
+  "No Disk Storage": "Pas de stockage sur disque",
+  "No Disks Available": "Aucun disque disponible",
+  "No Disks Found": "Aucun disque trouvé",
+  "No Exports": "Aucune exportation",
+  "No Exports Found": "Aucune exportation trouvée",
+  "No Folders": "Aucun dossier",
+  "No GPU Detected": "Aucun GPU détecté",
+  "No GPU selected.": "Aucun GPU sélectionné.",
+  "No GPU selected. Please select at least one GPU to continue.": "Aucun GPU sélectionné. Veuillez sélectionner au moins un GPU pour continuer.",
+  "No GPUs detected on this host.": "Aucun GPU détecté sur cet hôte.",
+  "No Guest Shares": "Aucun partage invité",
+  "No IP": "Pas d'adresse IP",
+  "No IP assigned": "Aucune adresse IP attribuée",
+  "No ISO file detected after UUP Dump process.": "Aucun fichier ISO détecté après le processus de vidage UUP.",
+  "No ISO images found in Proxmox ISO storages.": "Aucune image ISO trouvée dans les stockages ISO Proxmox.",
+  "No ISO selected.": "Aucun ISO sélectionné.",
+  "No ISO was generated.": "Aucun ISO n'a été généré.",
+  "No Images Found": "Aucune image trouvée",
+  "No Intel GPU detected on this system.": "Aucun GPU Intel détecté sur ce système.",
+  "No LXC containers available": "Aucun conteneur LXC disponible",
+  "No LXC containers found": "Aucun conteneur LXC trouvé",
+  "No LXC containers found on this system.": "Aucun conteneur LXC trouvé sur ce système.",
+  "No MAC": "Pas de MAC",
+  "No Method Selected": "Aucune méthode sélectionnée",
+  "No Mounts": "Aucune monture",
+  "No NFS Proxmox storage and no NFS fstab mount found on this host.": "Aucun stockage NFS Proxmox et aucun montage NFS fstab trouvés sur cet hôte.",
+  "No NFS Proxmox storage configured.": "Aucun stockage NFS Proxmox configuré.",
+  "No NFS Proxmox storages configured.": "Aucun stockage NFS Proxmox configuré.",
+  "No NFS mounts active.": "Aucun montage NFS actif.",
+  "No NFS mounts found.": "Aucun montage NFS trouvé.",
+  "No NFS ports found": "Aucun port NFS trouvé",
+  "No NFS servers configured to test.": "Aucun serveur NFS configuré pour tester.",
+  "No NFS servers found on the network.": "Aucun serveur NFS trouvé sur le réseau.",
+  "No NFS shares currently mounted.": "Aucun partage NFS actuellement monté.",
+  "No NVIDIA GPU detected on this system.": "Aucun GPU NVIDIA détecté sur ce système.",
+  "No NVIDIA GPU has been detected on this system. The installer will now exit.": "Aucun GPU NVIDIA n'a été détecté sur ce système. Le programme d'installation va maintenant se fermer.",
+  "No NVIDIA driver installed.": "Aucun pilote NVIDIA installé.",
+  "No PBS keyfile is installed on this host and no automatic recovery was possible.": "Aucun fichier de clé PBS n'est installé sur cet hôte et aucune récupération automatique n'a été possible.",
+  "No PVE vzdump job uses a": "Aucune tâche vzdump PVE n'utilise un",
+  "No PVs with old headers found.": "Aucun PV avec d'anciens en-têtes trouvé.",
+  "No ProxMenux ZFS autotrim state file found.": "Aucun fichier d'état de découpage automatique ProxMenux ZFS trouvé.",
+  "No ProxMenux host-backup archives were found in:": "Aucune archive de sauvegarde d'hôte ProxMenux n'a été trouvée dans :",
+  "No Recent Servers": "Aucun serveur récent",
+  "No Samba mounts found.": "Aucune monture Samba trouvée.",
+  "No Samba ports found": "Aucun port Samba trouvé",
+  "No Samba servers configured to test.": "Aucun serveur Samba configuré pour tester.",
+  "No Samba servers found on the network.": "Aucun serveur Samba trouvé sur le réseau.",
+  "No Samba shares currently mounted.": "Aucun partage Samba actuellement monté.",
+  "No Samba users found": "Aucun utilisateur Samba trouvé",
+  "No Selection": "Aucune sélection",
+  "No Servers Found": "Aucun serveur trouvé",
+  "No Shares": "Pas de partage",
+  "No Shares Available": "Aucune action disponible",
+  "No Shares Found": "Aucun partage trouvé",
+  "No Storage Found": "Aucun stockage trouvé",
+  "No USB drives detected. Enter the mountpoint path manually:": "Aucune clé USB détectée. Saisissez manuellement le chemin du point de montage :",
+  "No USB drives mounted by ProxMenux yet. Mount one first to use it as a target.": "Aucune clé USB montée par ProxMenux pour le moment.Montez-en un d’abord pour l’utiliser comme cible.",
+  "No UUP folder found.": "Aucun dossier UUP trouvé.",
+  "No VM was selected.": "Aucune VM n'a été sélectionnée.",
+  "No VMID defined. Cannot apply guest agent config.": "Aucun VMID défini. Impossible d'appliquer la configuration de l'agent invité.",
+  "No VMs Found": "Aucune VM trouvée",
+  "No VMs available in the system.": "Aucune machine virtuelle disponible dans le système.",
+  "No VMs available on this host.": "Aucune VM disponible sur cet hôte.",
+  "No VMs found": "Aucune VM trouvée",
+  "No Valid Servers": "Aucun serveur valide",
+  "No VirtIO ISO found. Please download one.": "Aucun ISO VirtIO trouvé. Veuillez en télécharger un.",
+  "No VirtIO ISO selected. Please choose again.": "Aucun ISO VirtIO sélectionné. Veuillez choisir à nouveau.",
+  "No Virtual Machines found on this system.": "Aucune machine virtuelle trouvée sur ce système.",
+  "No ZFS pools detected. Skipping ZFS autotrim.": "Aucun pool ZFS détecté. Ignorer le découpage automatique ZFS.",
+  "No accessible": "Non accessible",
+  "No accessible NFS servers found.": "Aucun serveur NFS accessible trouvé.",
+  "No accessible Samba servers found.": "Aucun serveur Samba accessible trouvé.",
+  "No accessible exports found.": "Aucune exportation accessible trouvée.",
+  "No accessible shares found.": "Aucun partage accessible trouvé.",
+  "No active exports or showmount not available": "Aucune exportation active ou showmount non disponible",
+  "No active session": "Aucune session active",
+  "No additional GPU can be added.": "Aucun GPU supplémentaire ne peut être ajouté.",
+  "No additional device needs to be added.": "Aucun appareil supplémentaire ne doit être ajouté.",
+  "No archives": "Pas d'archives",
+  "No archives found in this Borg repository.": "Aucune archive trouvée dans ce référentiel Borg.",
+  "No available Controllers/NVMe devices were found.": "Aucun contrôleur/périphérique NVMe disponible n'a été trouvé.",
+  "No available disks found.": "Aucun disque disponible trouvé.",
+  "No backup found, logrotate configuration not changed": "Aucune sauvegarde trouvée, la configuration de la rotation n'a pas été modifiée",
+  "No backups": "Aucune sauvegarde",
+  "No backups found": "Aucune sauvegarde trouvée",
+  "No bridge configuration issues found": "Aucun problème de configuration de pont trouvé",
+  "No bridges found in system": "Aucun pont trouvé dans le système",
+  "No changes are required for": "Aucune modification n'est requise pour",
+  "No changes are required.": "Aucune modification n’est requise.",
+  "No changes have been made to your system": "Aucune modification n'a été apportée à votre système",
+  "No changes will be made to the running system.": "Aucune modification ne sera apportée au système en cours d'exécution.",
+  "No compatible GPU detected for VM passthrough. Skipping GPU wizard option.": "Aucun GPU compatible détecté pour le relais de VM. Ignorer l'option de l'assistant GPU.",
+  "No compatible GPU was detected on this host.": "Aucun GPU compatible n'a été détecté sur cet hôte.",
+  "No compatible GPUs detected on this host.": "Aucun GPU compatible détecté sur cet hôte.",
+  "No compatible GPUs were detected on this host.": "Aucun GPU compatible n'a été détecté sur cet hôte.",
+  "No compatible PVE jobs": "Aucun travail PVE compatible",
+  "No compatible disk images found in:": "Aucune image disque compatible trouvée dans :",
+  "No compatible versions found for your kernel": "Aucune version compatible trouvée pour votre noyau",
+  "No configuration issues found": "Aucun problème de configuration trouvé",
+  "No container runtime available.": "Aucun environnement d'exécution de conteneur disponible.",
+  "No container selected. Exiting.": "Aucun conteneur sélectionné. Sortir.",
+  "No controller/NVMe selected.": "Aucun contrôleur/NVMe sélectionné.",
+  "No controllers remaining after conflict resolution.": "Il ne reste aucun contrôleur après la résolution du conflit.",
+  "No custom key (rely on default SSH config)": "Pas de clé personnalisée (comptez sur la configuration SSH par défaut)",
+  "No custom logos were found in /usr/local/share/fastfetch/logos/.\n\nPlease add a logo and try again.": "Aucun logo personnalisé n'a été trouvé dans /usr/local/share/fastfetch/logos/.\n\nVeuillez ajouter un logo et réessayer.",
+  "No desktop UI backup found, will reinstall packages": "Aucune sauvegarde de l'interface utilisateur du bureau trouvée, les packages seront réinstallés",
+  "No directories found in": "Aucun répertoire trouvé dans",
+  "No disk images found in /var/lib/vz/images/. Please add an image first.": "Aucune image disque trouvée dans /var/lib/vz/images/. Veuillez d'abord ajouter une image.",
+  "No disks available for this CT.": "Aucun disque disponible pour ce CT.",
+  "No disks available for this VM.": "Aucun disque disponible pour cette VM.",
+  "No disks were added.": "Aucun disque n'a été ajouté.",
+  "No disks were configured for processing.": "Aucun disque n'a été configuré pour le traitement.",
+  "No disks were selected.": "Aucun disque n'a été sélectionné.",
+  "No duplicate IP addresses": "Pas d'adresses IP en double",
+  "No duplicate repositories found": "Aucun référentiel en double trouvé",
+  "No eligible Controller/NVMe devices remain after SR-IOV filtering. Skipping.": "Il ne reste aucun périphérique contrôleur/NVMe éligible après le filtrage SR-IOV. Saut.",
+  "No eligible controllers remain after SR-IOV filtering.": "Il ne reste aucun contrôleur éligible après le filtrage SR-IOV.",
+  "No encryption key is stored on this host. Choose how to set one up:": "Aucune clé de cryptage n’est stockée sur cet hôte.Choisissez comment en configurer un :",
+  "No exportable VM disks were found (CD-ROM/cloud-init are excluded).": "Aucun disque de VM exportable n'a été trouvé (les CD-ROM/cloud-init sont exclus).",
+  "No exportable disks": "Aucun disque exportable",
+  "No exports configured.": "Aucune exportation configurée.",
+  "No exports file found.": "Aucun fichier d'exportation trouvé.",
+  "No exports found in /etc/exports.": "Aucune exportation trouvée dans /etc/exports.",
+  "No exports found on server": "Aucune exportation trouvée sur le serveur",
+  "No files found": "Aucun fichier trouvé",
+  "No folders found in /mnt.": "Aucun dossier trouvé dans /mnt.",
+  "No folders found in /mnt. Please create a new folder.": "Aucun dossier trouvé dans /mnt. Veuillez créer un nouveau dossier.",
+  "No folders found inside /mnt in the CT.": "Aucun dossier trouvé dans /mnt dans le CT.",
+  "No format-safe disks are available.": "Aucun disque au format sécurisé n'est disponible.",
+  "No group creation required — uses world-writable sticky bit permissions.": "Aucune création de groupe requise : utilise des autorisations de bit collant accessibles en écriture dans le monde entier.",
+  "No host VFIO reconfiguration expected": "Aucune reconfiguration VFIO hôte attendue",
+  "No host VFIO/native binding changes were required.": "Aucune modification de liaison VFIO/native de l’hôte n’a été requise.",
+  "No host backups were found in this PBS repository:": "Aucune sauvegarde d'hôte n'a été trouvée dans ce référentiel PBS :",
+  "No host reboot expected": "Aucun redémarrage de l'hôte n'est prévu",
+  "No host write access — server-side ACL or root_squash. Continuing anyway.": "Aucun accès en écriture sur l'hôte : ACL côté serveur ou root_squash. On continue quand même.",
+  "No host write access — server-side ACL. Continuing anyway.": "Aucun accès en écriture sur l'hôte – ACL côté serveur. On continue quand même.",
+  "No iSCSI Storage": "Pas de stockage iSCSI",
+  "No iSCSI storage configured in Proxmox.": "Aucun stockage iSCSI configuré dans Proxmox.",
+  "No iSCSI storage configured.": "Aucun stockage iSCSI configuré.",
+  "No iSCSI storage found in Proxmox.": "Aucun stockage iSCSI trouvé dans Proxmox.",
+  "No iSCSI targets found on portal": "Aucune cible iSCSI trouvée sur le portail",
+  "No import disks selected for now.": "Aucun disque d'importation sélectionné pour l'instant.",
+  "No importable disks available. System disks and protected disks are hidden.": "Aucun disque importable disponible. Les disques système et les disques protégés sont masqués.",
+  "No installation information available.": "Aucune information d'installation disponible.",
+  "No interface type was selected for the disks.": "Aucun type d'interface n'a été sélectionné pour les disques.",
+  "No jobs": "Aucun emploi",
+  "No language selected.": "Aucune langue sélectionnée.",
+  "No local disk storage configured.": "Aucun stockage sur disque local configuré.",
+  "No main sources.list present (skipped)": "Aucune liste de sources principale présente (ignorée)",
+  "No mount point was specified.": "Aucun point de montage n'a été spécifié.",
+  "No mount points found in any container": "Aucun point de montage trouvé dans aucun conteneur",
+  "No mount points found in container": "Aucun point de montage trouvé dans le conteneur",
+  "No network configuration backups found.": "Aucune sauvegarde de configuration réseau trouvée.",
+  "No network interfaces configured (besides loopback)": "Aucune interface réseau configurée (en dehors du bouclage)",
+  "No new Controller/NVMe entries were added.": "Aucune nouvelle entrée Contrôleur/NVMe n’a été ajoutée.",
+  "No optimizations detected to uninstall.": "Aucune optimisation détectée à désinstaller.",
+  "No partitions found on disk. Nothing was wiped.": "Aucune partition trouvée sur le disque. Rien n'a été effacé.",
+  "No password provided.": "Aucun mot de passe fourni.",
+  "No paths available": "Aucun chemin disponible",
+  "No paths selected. Select at least one path.": "Aucun chemin sélectionné. Sélectionnez au moins un chemin.",
+  "No pending paths to schedule for reboot.": "Aucun chemin en attente pour planifier le redémarrage.",
+  "No permanent NFS mounts configured.": "Aucun montage NFS permanent configuré.",
+  "No permanent Samba mounts configured.": "Aucun montage Samba permanent configuré.",
+  "No persistent path found for": "Aucun chemin persistant trouvé pour",
+  "No physical disks detected for SMART testing.": "Aucun disque physique détecté pour les tests SMART.",
+  "No physical interfaces found": "Aucune interface physique trouvée",
+  "No ports configured": "Aucun port configuré",
+  "No privileged containers available in Proxmox.": "Aucun conteneur privilégié disponible dans Proxmox.",
+  "No pve-enterprise.list present (skipped)": "Aucun pve-enterprise.list présent (ignoré)",
+  "No recent": "Pas de récent",
+  "No recent Samba servers found.": "Aucun serveur Samba récent trouvé.",
+  "No routing information found.": "Aucune information de routage trouvée.",
+  "No scheduled backup jobs configured.": "Aucune tâche de sauvegarde planifiée configurée.",
+  "No scheduled backup jobs found.": "Aucune tâche de sauvegarde planifiée trouvée.",
+  "No scripts found for:": "Aucun script trouvé pour :",
+  "No self-test history found for": "Aucun historique d'autotest trouvé pour",
+  "No self-test log available for": "Aucun journal d'autotest disponible pour",
+  "No server IP or hostname provided.": "Aucune adresse IP de serveur ou nom d'hôte fourni.",
+  "No shared mount detected. Applying standard local access.": "Aucun montage partagé détecté. Application d'un accès local standard.",
+  "No shares configured.": "Aucun partage configuré.",
+  "No shares found in smb.conf.": "Aucun partage trouvé dans smb.conf.",
+  "No shares found on server": "Aucun partage trouvé sur le serveur",
+  "No smb.conf file found.": "Aucun fichier smb.conf trouvé.",
+  "No specific LXC action selected": "Aucune action LXC spécifique sélectionnée",
+  "No specific VM action selected": "Aucune action de VM spécifique sélectionnée",
+  "No storage": "Pas de stockage",
+  "No storage volumes available for VM images.": "Aucun volume de stockage disponible pour les images de VM.",
+  "No storage volumes available for disk images.": "Aucun volume de stockage disponible pour les images disque.",
+  "No stored credentials found.": "Aucune information d'identification stockée trouvée.",
+  "No suitable disks found.": "Aucun disque approprié trouvé.",
+  "No sysfs ROM entry — trying ACPI VFCT table...": "Aucune entrée ROM sysfs - essayez la table ACPI VFCT...",
+  "No target configured.": "aucune cible configurée.",
+  "No test currently running": "Aucun test en cours d'exécution actuellement",
+  "No uninstaller found for:": "Aucun programme de désinstallation trouvé pour :",
+  "No unprivileged containers available in Proxmox.": "Aucun conteneur non privilégié disponible dans Proxmox.",
+  "No updates available — run a scan first or wait for the Monitor to refresh.": "Aucune mise à jour disponible : lancez d'abord une analyse ou attendez que le moniteur s'actualise.",
+  "No updates or failed to fetch templates": "Aucune mise à jour ou échec de récupération des modèles",
+  "No user groups found.": "Aucun groupe d'utilisateurs trouvé.",
+  "No user-created disk storage or fstab mount found.": "Aucun stockage sur disque créé par l'utilisateur ni aucun montage fstab trouvé.",
+  "No username provided.": "Aucun nom d'utilisateur fourni.",
+  "No utilities selected": "Aucun utilitaire sélectionné",
+  "No utilities were selected": "Aucun service public n'a été sélectionné",
+  "No valid containers found": "Aucun conteneur valide trouvé",
+  "No valid mount points found": "Aucun point de montage valide trouvé",
+  "No version in this branch is currently supported by keylase/nvidia-patch — the NVENC patch will not reapply after reinstall.": "Aucune version de cette branche n'est actuellement prise en charge par keylase/nvidia-patch — le correctif NVENC ne sera pas réappliqué après la réinstallation.",
+  "No virtual machines were found on this host.": "Aucune machine virtuelle n'a été trouvée sur cet hôte.",
+  "No write permissions on:": "Aucune autorisation en écriture sur :",
+  "No, keep local only": "Non, conserver uniquement les informations locales",
+  "No-subscription repository present": "Référentiel sans abonnement présent",
+  "No: the key stays only at": "Non : la clé reste uniquement à",
+  "Non-Debian container detected": "Conteneur non Debian détecté",
+  "Non-free firmware warnings disabled": "Avertissements du micrologiciel non libre désactivés",
+  "None": "Aucun",
+  "Normalizing stable monitor service...": "Normalisation du service de surveillance stable...",
+  "Not Mounted": "Non monté",
+  "Not all platforms support Controller/NVMe passthrough reliably.": "Toutes les plates-formes ne prennent pas en charge le relais Controller/NVMe de manière fiable.",
+  "Not an OVH server, skipping RTM installation": "Pas un serveur OVH, sautant l'installation RTM",
+  "Not currently mounted": "Non monté actuellement",
+  "Not currently mounted — skipping umount.": "Non monté actuellement – ​​ignorer umount.",
+  "Not found": "Pas trouvé",
+  "Not imported:": "Non importé :",
+  "Not mounted": "Non monté",
+  "Not portable:": "Non portable :",
+  "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "Non enregistré en tant que stockage Proxmox — utilisez « LXC Mount Manager » pour effectuer le montage en liaison",
+  "Note: A system reboot will be required after enabling IOMMU.": "Remarque : Un redémarrage du système sera requis après l'activation d'IOMMU.",
+  "Note: this only works if the NFS server does NOT use 'all_squash' for root.": "Remarque : cela ne fonctionne que si le serveur NFS n'utilise PAS « all_squash » pour root.",
+  "Notes": "Remarques",
+  "Nothing inside the container is modified": "Rien à l'intérieur du conteneur n'est modifié",
+  "Nothing selectable": "rien de sélectionnable",
+  "Nothing selected": "rien de sélectionné",
+  "Nothing to apply — none of the selected updates have a runnable function on disk.": "Rien à appliquer : aucune des mises à jour sélectionnées n'a de fonction exécutable sur le disque.",
+  "Nothing to remove": "Rien à supprimer",
+  "Nothing to restore": "Rien à restaurer",
+  "Nothing to schedule for reboot from selected paths.": "Rien à planifier pour le redémarrage à partir des chemins sélectionnés.",
+  "Nouveau module is loaded, attempting to unload...": "Le module Nouveau est chargé, tentative de déchargement...",
+  "Number of CPU cores (default: 2)": "Nombre de cœurs de processeur (par défaut : 2)",
+  "OCI containers require Proxmox VE 9.1 or later.": "Les conteneurs OCI nécessitent Proxmox VE 9.1 ou version ultérieure.",
+  "OK": "D'ACCORD",
+  "OR add new PVE 9 no-subscription repository:": "OU ajoutez un nouveau référentiel sans abonnement PVE 9 :",
+  "OS hint:": "Astuce du système d'exploitation :",
+  "OS release details": "Détails de la version du système d'exploitation",
+  "OS type  :": "Type de système d'exploitation :",
+  "OS type:": "Type de système d'exploitation :",
+  "OS:": "Système d'exploitation :",
+  "OVA (single portable file)": "OVA (fichier portable unique)",
+  "OVF (descriptor + VMDK files)": "OVF (descripteur + fichiers VMDK)",
+  "OVF parsed:": "OVF analysé :",
+  "OVH RTM installed successfully": "OVH RTM installé avec succès",
+  "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM supprimé (les artefacts de marionnettes peuvent nécessiter un nettoyage manuel)",
+  "OVH server detected": "Serveur OVH détecté",
+  "OVH server detection and RTM installation process completed": "Processus de détection du serveur OVH et d'installation de RTM terminé",
+  "Offer as exit node?": "Proposer comme nœud de sortie ?",
+  "Official Linux Distributions": "Distributions Linux officielles",
+  "Old debian.sources file removed to prevent duplication": "Ancien fichier debian.sources supprimé pour éviter la duplication",
+  "Old memory configuration detected. Replacing with balanced optimization...": "Ancienne configuration de mémoire détectée. Remplacement par une optimisation équilibrée...",
+  "Old time services removed successfully": "Les anciens services ont été supprimés avec succès",
+  "On a privileged CT the mount options carry the only permissions.": "Sur un CT privilégié, les options de montage portent les seules autorisations.",
+  "On some systems, when starting the VM the host may slow down for several minutes until it stabilizes, or freeze completely.": "Sur certains systèmes, lors du démarrage de la VM, l'hôte peut ralentir pendant plusieurs minutes jusqu'à ce qu'il se stabilise, ou se figer complètement.",
+  "On the Borg server, append the following line to:": "Sur le serveur Borg, ajoutez la ligne suivante à :",
+  "Once finished, re-run 'PVE 8 to 9 check' to verify that all issues are resolved \n    before executing the PVE 8 → PVE 9 upgrade.": "Une fois terminé, réexécutez la « vérification PVE 8 à 9 » pour vérifier que tous les problèmes sont résolus. \n    avant d'exécuter la mise à niveau PVE 8 → PVE 9.",
+  "Once finished, re-run the script 'PVE 8 to 9 check' to verify that all issues are resolved \n   before rebooting.": "Une fois terminé, réexécutez le script 'PVE 8 to 9 check' pour vérifier que tous les problèmes sont résolus. \n   avant de redémarrer.",
+  "Once finished, re-run the script 'PVE 8 to 9 check' to verify that all issues.": "Une fois terminé, réexécutez le script « PVE 8 to 9 check » pour vérifier que tous les problèmes sont résolus.",
+  "Once installed, open the VirtIO ISO and run the installer to complete driver setup.": "Une fois installé, ouvrez l'ISO VirtIO et exécutez le programme d'installation pour terminer la configuration du pilote.",
+  "One or more NVIDIA GPUs are currently configured for VM passthrough (vfio-pci):": "Un ou plusieurs GPU NVIDIA sont actuellement configurés pour le relais de VM (vfio-pci) :",
+  "Only convert to privileged if absolutely necessary for your use case.": "Ne convertissez en privilèges que si cela est absolument nécessaire pour votre cas d'utilisation.",
+  "Only fully free disks are shown (not system-used and not referenced by VM/LXC).": "Seuls les disques entièrement libres sont affichés (non utilisés par le système et non référencés par VM/LXC).",
+  "Only if using enterprise subscription": "Uniquement si vous utilisez un abonnement entreprise",
+  "Only if using no-subscription repository": "Uniquement si vous utilisez un référentiel sans abonnement",
+  "Only needed if you mounted the filesystem in step 6b": "Nécessaire uniquement si vous avez monté le système de fichiers à l'étape 6b",
+  "Only removes storage definition, not remote data.": "Supprime uniquement la définition de stockage, pas les données distantes.",
+  "Only run this if you used LVM (step 6b):": "Exécutez-le uniquement si vous avez utilisé LVM (étape 6b) :",
+  "Only the host backup hook is removed — PVE vzdump jobs targeting this storage stay intact.": "seul le hook de sauvegarde de l'hôte est supprimé – les tâches PVE vzdump ciblant ce stockage restent intactes.",
+  "Open": "Ouvrir",
+  "Open rwx + default inheritance for new files": "Ouvrir rwx + héritage par défaut pour les nouveaux fichiers",
+  "Open the VM console and wait for the installer to boot": "Ouvrez la console VM et attendez que le programme d'installation démarre",
+  "Open the VM console and wait for the loader to boot": "Ouvrez la console VM et attendez que le chargeur démarre",
+  "Open the dashboard from this host on port 8008 to create a new admin account.": "Ouvrez le tableau de bord de cet hôte sur le port 8008 pour créer un nouveau compte administrateur.",
+  "Open the dashboard to create a new admin account:": "Ouvrez le tableau de bord pour créer un nouveau compte administrateur :",
+  "OpenVSwitch installation could not be verified": "L'installation d'OpenVSwitch n'a pas pu être vérifiée",
+  "OpenVSwitch installed successfully": "OpenVSwitch installé avec succès",
+  "OpenVSwitch is ready to use": "OpenVSwitch est prêt à être utilisé",
+  "OpenVSwitch removed": "OpenVSwitch supprimé",
+  "Operation": "Opération",
+  "Operation cancelled by user": "Opération annulée par l'utilisateur",
+  "Operation cancelled by user to create backup.": "Opération annulée par l'utilisateur pour créer une sauvegarde.",
+  "Operation cancelled by user.": "Opération annulée par l'utilisateur.",
+  "Operation cancelled. Cannot continue with an unprivileged container.": "Opération annulée. Impossible de continuer avec un conteneur non privilégié.",
+  "Operation log": "Journal des opérations",
+  "Operator config re-applied via kernel-agnostic merge": "configuration de l'opérateur réappliquée via une fusion indépendante du noyau",
+  "Operator config that WILL be re-applied via kernel-agnostic merge": "configuration de l'opérateur qui SERA réappliquée via une fusion indépendante du noyau",
+  "Optimizations detected and ready to revert.": "Optimisations détectées et prêtes à être annulées.",
+  "Optimize": "Optimiser",
+  "Optimize Memory": "optimiser la mémoire",
+  "Optimize ZFS ARC size": "Optimiser la taille de ZFS ARC",
+  "Optimize journald": "Optimiser journald",
+  "Optimize logrotate": "Optimiser la rotation du log",
+  "Optimizing ZFS ARC size according to available memory...": "Optimisation de la taille de ZFS ARC en fonction de la mémoire disponible...",
+  "Optimizing logrotate configuration...": "Optimisation de la configuration de la rotation des logs...",
+  "Optimizing memory settings...": "Optimisation des paramètres de mémoire...",
+  "Optimizing network settings...": "Optimisation des paramètres réseau...",
+  "Optimizing vzdump backup speed...": "Optimisation de la vitesse de sauvegarde de vzdump...",
+  "Optional": "facultatif",
+  "Optional GPU Passthrough": "Passthrough GPU en option",
+  "Optional safety helper if you ever need to re-apply manually:": "Assistant de sécurité facultatif si jamais vous devez réappliquer manuellement :",
+  "Optional: Modernize repository sources:": "Facultatif : Modernisez les sources du référentiel :",
+  "Optional: apply default ACL so new files inherit permissions:": "Facultatif : appliquez l'ACL par défaut pour que les nouveaux fichiers héritent des autorisations :",
+  "Optional: register this path as Proxmox dir storage:": "Facultatif : enregistrez ce chemin en tant que stockage du répertoire Proxmox :",
+  "Optionally remove": "Supprimer éventuellement",
+  "Optionally update NVIDIA libs in LXC containers with passthrough": "Mettez éventuellement à jour les bibliothèques NVIDIA dans les conteneurs LXC avec passthrough",
+  "Options:": "Possibilités :",
+  "Or press CTRL + D": "Ou appuyez sur CTRL + D",
+  "Or re-run this script and accept the 'apply host permissions' prompt.": "Ou réexécutez ce script et acceptez l'invite « appliquer les autorisations de l'hôte ».",
+  "Or use ProxMenux update function": "Ou utilisez la fonction de mise à jour de ProxMenux",
+  "Or, if your terminal can't select text, copy it from:": "Ou, si votre terminal ne peut pas sélectionner de texte, copiez-le depuis :",
+  "Original ZFS ARC config restored from .bak": "Configuration ZFS ARC d'origine restaurée à partir de .bak",
+  "Original bashrc restored": "Bashrc d'origine restauré",
+  "Original logrotate configuration restored": "Configuration de rotation d'origine restaurée",
+  "Other Prebuilt Linux VMs": "Autres machines virtuelles Linux prédéfinies",
+  "Output archive:": "Archives de sortie :",
+  "Owner:": "Propriétaire:",
+  "Ownership set to root:sharedfiles with 2775 on:": "Propriété définie sur root:sharedfiles avec 2775 sur :",
+  "PAM limits configured": "Limites PAM configurées",
+  "PBS backup error log": "Journal des erreurs de sauvegarde PBS",
+  "PBS backup failed.": "La sauvegarde PBS a échoué.",
+  "PBS encryption keyfile (show / replace / remove)": "fichier de clé de chiffrement PBS (afficher/remplacer/supprimer)",
+  "PBS encryption keyfile — detailed info": "Fichier de clé de chiffrement PBS – informations détaillées",
+  "PBS extraction failed": "L'extraction PBS a échoué",
+  "PBS host or IP address:": "Hôte PBS ou adresse IP :",
+  "PBS upload": "Téléchargement PBS",
+  "PCI Address": "Adresse PCI",
+  "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "Passthrough PCI, état TPM, configuration cloud-init, hooks Proxmox",
+  "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "Passthrough PCI, état TPM, cloud-init, instantanés, hooks spécifiques à Proxmox",
+  "PCI reset method": "Méthode de réinitialisation PCI",
+  "PCIe GPU passthrough requires:": "Le relais GPU PCIe nécessite :",
+  "PCIe/M.2 gasket-dkms": "Joint PCIe/M.2-dkms",
+  "POSIX ACLs applied (access + default for inheritance).": "ACL POSIX appliquées (accès + valeur par défaut pour l'héritage).",
+  "PVE application manager updated": "Gestionnaire d'applications PVE mis à jour",
+  "PVE cache regenerated": "Cache PVE régénéré",
+  "PVE host (where the Borg LXC lives)": "hôte PVE (où vit le Borg LXC)",
+  "PVE host, VMID and password are all required for this mode.": "l'hôte PVE, le VMID et le mot de passe sont tous requis pour ce mode.",
+  "PVE9: udev rules reloaded — new interfaces will get correct names without reboot": "PVE9 : règles udev rechargées — les nouvelles interfaces obtiendront des noms corrects sans redémarrage",
+  "Package Updates Available": "Mises à jour du package disponibles",
+  "Package lists": "Listes de paquets",
+  "Package lists updated after GPG fix": "Listes de packages mises à jour après le correctif GPG",
+  "Package lists updated successfully": "Listes de packages mises à jour avec succès",
+  "Package update completed with warnings, continuing...": "Mise à jour du package terminée avec des avertissements, suite...",
+  "Package update had issues, checking details...": "La mise à jour du package a rencontré des problèmes, vérification des détails...",
+  "Package update still has issues, continuing anyway...": "La mise à jour du package a toujours des problèmes, elle continue quand même...",
+  "Packages from backup to install:": "Packages de la sauvegarde à installer :",
+  "Packages upgrade successfull": "Mise à jour des packages réussie",
+  "Packages upgraded": "Forfaits mis à niveau",
+  "Packages:": "Forfaits :",
+  "Packaging OVA file...": "Emballage du fichier OVA...",
+  "Packing installer archive...": "Archive du programme d'installation de l'emballage...",
+  "Parsing OVF descriptor...": "Analyse du descripteur OVF...",
+  "Partial VM removed": "VM partielle supprimée",
+  "Partition": "Partition",
+  "Partition created": "Partition créée",
+  "Partition created:": "Partition créée :",
+  "Partition table wiped": "Table de partition effacée",
+  "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "Phrase secrète utilisée pour déverrouiller le fichier de clés importé (laisser vide si le fichier de clés n'est pas chiffré / kdf=aucun) :",
+  "Passphrases do not match.": "Les phrases secrètes ne correspondent pas.",
+  "Passphrases do not match. Try again.": "Les phrases secrètes ne correspondent pas. Essayer à nouveau.",
+  "Passthrough may fail depending on hardware/firmware implementation.": "Le relais peut échouer en fonction de la mise en œuvre du matériel/micrologiciel.",
+  "Passthrough may still work without a ROM file.": "Passthrough peut toujours fonctionner sans fichier ROM.",
+  "Passthrough may work, but startup/restart reliability is not guaranteed.": "Le relais peut fonctionner, mais la fiabilité du démarrage/redémarrage n'est pas garantie.",
+  "Password": "Mot de passe",
+  "Password Mismatch": "Incompatibilité de mot de passe",
+  "Password cannot be empty.": "Le mot de passe ne peut pas être vide.",
+  "Password confirmation cannot be empty.": "La confirmation du mot de passe ne peut pas être vide.",
+  "Password confirmation is required.": "Une confirmation du mot de passe est requise.",
+  "Password for": "Mot de passe pour",
+  "Password for:": "Mot de passe pour :",
+  "Password is correct": "Le mot de passe est correct",
+  "Password or API token secret:": "Mot de passe ou secret du jeton API :",
+  "Password reset completed.": "Réinitialisation du mot de passe terminée.",
+  "Passwords do not match. Please try again.": "Les mots de passe ne correspondent pas. Veuillez réessayer.",
+  "Paste the UUP Dump URL here": "Collez l'URL de vidage UUP ici",
+  "Patching source for kernel compatibility...": "Source de correctifs pour la compatibilité du noyau...",
+  "Path does not exist.": "Le chemin n'existe pas.",
+  "Path must be absolute (start with /)": "Le chemin doit être absolu (commencer par /)",
+  "Path must be absolute (start with /).": "Le chemin doit être absolu (commencer par /).",
+  "Path not found": "Chemin introuvable",
+  "Path:": "Chemin:",
+  "Paths applied:": "Chemins appliqués :",
+  "Paths included in backup": "Chemins inclus dans la sauvegarde",
+  "Paths not found at backup time": "Chemins introuvables au moment de la sauvegarde",
+  "Paths skipped:": "Chemins ignorés :",
+  "Paths to back up:": "Chemins à sauvegarder :",
+  "Paths:": "Chemins :",
+  "Pending restore ID:": "ID de restauration en attente :",
+  "Pending restore dir:": "Répertoire de restauration en attente :",
+  "Pending restore prepared. A reboot is required to complete it.": "En attente de restauration préparée. Un redémarrage est nécessaire pour le terminer.",
+  "Pending restore prepared. It will run automatically at next boot.": "En attente de restauration préparée. Il s'exécutera automatiquement au prochain démarrage.",
+  "Pending restore script not found or not executable:": "Script de restauration en attente introuvable ou non exécutable :",
+  "Pending upgrades detected on a clustered node.\n\nTo proceed safely, update this node to the latest Proxmox VE 8.x before switching to Trixie/PVE 9.\n\nSelect Yes for AUTOMATIC upgrade (recommended), or No for MANUAL instructions.": "Mises à niveau en attente détectées sur un nœud en cluster.\n\nPour procéder en toute sécurité, mettez à jour ce nœud avec la dernière version de Proxmox VE 8.x avant de passer à Trixie/PVE 9.\n\nSélectionnez Oui pour la mise à niveau AUTOMATIQUE (recommandée) ou Non pour les instructions MANUELLES.",
+  "Pending upgrades detected on a clustered node. Perform AUTOMATIC upgrade now? (y = automatic, n = manual):": "Mises à niveau en attente détectées sur un nœud en cluster. Effectuer une mise à niveau AUTOMATIQUE maintenant ? (y = automatique, n = manuel) :",
+  "Per official known issues; ensures proper boot after upgrade": "Selon les problèmes officiels connus ; garantit un démarrage correct après la mise à niveau",
+  "Performance": "Performances",
+  "Performance optimized": "Performances optimisées",
+  "Performing complete package reinstallation...": "Réinstallation complète du package...",
+  "Performing packages upgrade...": "Effectuer la mise à niveau des packages...",
+  "Performing system cleanup...": "Effectuer un nettoyage du système...",
+  "Performs automatic cleanup after updating": "Effectue un nettoyage automatique après la mise à jour",
+  "Permanent Mount": "Montage permanent",
+  "Permanent Mounts (fstab):": "Montages permanents (fstab) :",
+  "Permanent:": "Permanent:",
+  "Permanently delete saved target:": "Supprimer définitivement la cible enregistrée :",
+  "Permanently delete this archive and its sidecar?": "Supprimer définitivement cette archive et son side-car ?",
+  "Permission error": "Erreur d'autorisation",
+  "Permissions:": "Autorisations :",
+  "Persist mount in CT /etc/fstab (optional):": "Conserver le montage dans CT /etc/fstab (facultatif) :",
+  "Persistent:": "Persistant:",
+  "Physical Function with": "Fonction physique avec",
+  "Physical interface": "Interface physique",
+  "Physical interfaces available": "Interfaces physiques disponibles",
+  "Pick PVE vzdump job": "Choisir le travail PVE vzdump",
+  "Pick USB target": "Choisir la cible USB",
+  "Pick Yes to destroy them now (before reboot). Pick No to keep the additive restore and clean up manually later.": "choisissez Oui pour les détruire maintenant (avant le redémarrage).Choisissez Non pour conserver la restauration additive et nettoyer manuellement plus tard.",
+  "Pick a USB disk:": "Choisissez un disque USB :",
+  "Pick a drive to unmount:": "Choisissez un lecteur à démonter :",
+  "Pick a mounted USB as target": "Choisissez une clé USB montée comme cible",
+  "Pick a target to remove:": "Choisissez une cible à supprimer :",
+  "Pick an SSH private key (auto-detected on this host):": "Choisissez une clé privée SSH (détectée automatiquement sur cet hôte) :",
+  "Pick an alternative way to authorize the new key:": "Choisissez une autre manière d'autoriser la nouvelle clé :",
+  "Please check network connectivity.": "Veuillez vérifier la connectivité réseau.",
+  "Please check permissions and try again.": "Veuillez vérifier les autorisations et réessayer.",
+  "Please check the installation.": "Veuillez vérifier l'installation.",
+  "Please check:": "Vérifiez s'il vous plaît:",
+  "Please choose another path.": "Veuillez choisir un autre chemin.",
+  "Please configure it manually and reboot.": "Veuillez le configurer manuellement et redémarrer.",
+  "Please expand the container disk and run this option again.": "Veuillez développer le disque du conteneur et réexécuter cette option.",
+  "Please install the NVIDIA drivers first using the option:": "Veuillez d'abord installer les pilotes NVIDIA en utilisant l'option :",
+  "Please mark at least one option, or press Cancel to exit.": "Veuillez cocher au moins une option ou appuyer sur Annuler pour quitter.",
+  "Please reboot manually and run the passthrough step again.": "Veuillez redémarrer manuellement et réexécuter l'étape de relais.",
+  "Please reboot manually to complete the switch.": "Veuillez redémarrer manuellement pour terminer le changement.",
+  "Please reboot the system manually to complete the GPU switch.": "Veuillez redémarrer le système manuellement pour terminer le changement de GPU.",
+  "Please reselect GPU(s) and choose only compatible devices for VM mode.": "Veuillez resélectionner le(s) GPU et choisir uniquement les appareils compatibles pour le mode VM.",
+  "Please resolve the problem(s) as described above, then re-run the upgrade script.": "Veuillez résoudre le(s) problème(s) comme décrit ci-dessus, puis réexécutez le script de mise à niveau.",
+  "Please select GPU(s) that are currently in the same mode and try again.": "Veuillez sélectionner le(s) GPU actuellement dans le même mode et réessayer.",
+  "Please select a valid option": "Veuillez sélectionner une option valide",
+  "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Veuillez utiliser une session SSH (Linux, macOS, Windows/PuTTY) ou une console physique pour effectuer la mise à niveau.",
+  "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "Le pool ne semble pas utiliser de périphériques SSD/NVMe prenant en charge la suppression. Ignorer le découpage automatique ZFS pour le pool :",
+  "Pool exists": "La piscine existe",
+  "Pool name matches but GUID differs (fresh ZFS install):": "le nom du pool correspond mais le GUID diffère (nouvelle installation de ZFS) :",
+  "Pool:": "Piscine:",
+  "Port": "Port",
+  "Port:": "Port:",
+  "Portal IP and port are correct": "L'adresse IP et le port du portail sont corrects",
+  "Portal is reachable": "Le portail est accessible",
+  "Portal:": "Portail:",
+  "Portuguese": "portugais",
+  "Post-Installation Options": "Options de post-installation",
+  "Post-Installation Scripts": "Scripts de post-installation",
+  "Postfix configuration": "Configuration de Postfix",
+  "Potential QEMU startup/assertion failures": "Échecs potentiels de démarrage/d’assertion de QEMU",
+  "Power state D3cold/D0 transitions may be inaccessible": "Les transitions de l'état d'alimentation D3cold/D0 peuvent être inaccessibles",
+  "Pre-check found": "Pré-vérification trouvée",
+  "Pre-configure destinations so you don't have to enter them every time you back up.": "Préconfigurez les destinations afin de ne pas avoir à les saisir à chaque sauvegarde.",
+  "Pre-existing gasket-dkms package removed.": "Le paquet joint-dkms préexistant a été supprimé.",
+  "Pre-restore backup:": "Sauvegarde avant restauration :",
+  "Pre-upgrade check FAILED: the simulation shows that 'proxmox-ve' would be REMOVED.\n    This indicates a repository or dependency issue and upgrading now could break your Proxmox installation.": "ÉCHEC de la vérification avant la mise à niveau : la simulation montre que « proxmox-ve » serait SUPPRIMÉ.\n    Cela indique un problème de référentiel ou de dépendance et une mise à niveau maintenant pourrait interrompre votre installation Proxmox.",
+  "Pre-upgrade simulation passed: 'proxmox-ve' will be kept or upgraded safely.": "Simulation de pré-mise à niveau réussie : « proxmox-ve » sera conservé ou mis à niveau en toute sécurité.",
+  "Preparing Log2RAM configuration": "Préparation de la configuration de Log2RAM",
+  "Preparing files for backup...": "Préparation des fichiers pour la sauvegarde...",
+  "Preparing host mount...": "Préparation du montage sur l'hôte...",
+  "Preparing pending restore (network-safe)": "Préparation de la restauration en attente (sécurisée sur le réseau)",
+  "Preparing staging area...": "Préparation de la zone de préparation...",
+  "Preserving logs to /var/log.hdd before unmounting...": "Conserver les journaux dans /var/log.hdd avant de démonter...",
+  "Press 'q' to exit": "Appuyez sur « q » pour quitter",
+  "Press Ctrl+C to stop the server and return to menu.": "Appuyez sur Ctrl+C pour arrêter le serveur et revenir au menu.",
+  "Press ENTER to continue...": "Appuyez sur ENTER pour continuer...",
+  "Press ENTER to return to the menu...": "Appuyez sur ENTER pour revenir au menu...",
+  "Press ENTER to return...": "Appuyez sur ENTER pour revenir...",
+  "Press Enter to close...": "appuyez sur Entrée pour fermer...",
+  "Press Enter to continue": "Appuyez sur Entrée pour continuer",
+  "Press Enter to continue...": "Appuyez sur Entrée pour continuer...",
+  "Press Enter to exit and repair": "Appuyez sur Entrée pour quitter et réparer",
+  "Press Enter to exit the script after reading instructions...": "Appuyez sur Entrée pour quitter le script après avoir lu les instructions...",
+  "Press Enter to exit...": "Appuyez sur Entrée pour quitter...",
+  "Press Enter to return": "Appuyez sur Entrée pour revenir",
+  "Press Enter to return to menu...": "Appuyez sur Entrée pour revenir au menu...",
+  "Press Enter to return to the main menu...": "Appuyez sur Entrée pour revenir au menu principal...",
+  "Press Enter to return...": "Appuyez sur Entrée pour revenir...",
+  "Press Enter when the line has been pasted on the server...": "Appuyez sur Entrée lorsque la ligne a été collée sur le serveur...",
+  "Press OK to see the preview, then confirm": "Appuyez sur OK pour voir l'aperçu, puis confirmez",
+  "Pretty uptime format": "Joli format de disponibilité",
+  "Preview Backup": "Aperçu de la sauvegarde",
+  "Preview Changes": "Aperçu des modifications",
+  "Preview changes (diff)": "Aperçu des modifications (diff)",
+  "Preview: changes that would be applied": "Aperçu : modifications qui seraient appliquées",
+  "Previous DKMS tree cleared.": "L’arborescence DKMS précédente a été effacée.",
+  "Previous installation cleaned": "Installation précédente nettoyée",
+  "Previous installation removed": "Installation précédente supprimée",
+  "Previous shutdowns": "Arrêts précédents",
+  "Privileged": "Privilégié",
+  "Privileged Container": "Conteneur privilégié",
+  "Privileged Container Required": "Conteneur privilégié requis",
+  "Privileged container": "Conteneur privilégié",
+  "Privileged container selected:": "Conteneur privilégié sélectionné :",
+  "Privileged container — UID-shift remapping skipped (not applicable)": "Conteneur privilégié – remappage UID-shift ignoré (non applicable)",
+  "Privileged container — direct root access": "Conteneur privilégié – accès root direct",
+  "Privileged container — host root maps directly, no permission changes needed": "Conteneur privilégié : hébergez directement les mappages racines, aucune modification d'autorisation n'est nécessaire",
+  "Privileged containers can access host devices directly": "Les conteneurs privilégiés peuvent accéder directement aux appareils hôtes",
+  "Privileged containers have full root access to the host system!": "Les conteneurs privilégiés ont un accès root complet au système hôte !",
+  "Privileged: Full host access (less secure)": "Privilégié : accès complet à l'hôte (moins sécurisé)",
+  "Proceed": "Procéder",
+  "Proceed with removal": "Procéder à la suppression",
+  "Proceed?": "Procéder?",
+  "Proceeding with Log2RAM setup on non-SSD disk as requested by user.": "Poursuite de la configuration de Log2RAM sur un disque non SSD comme demandé par l'utilisateur.",
+  "Process may take several minutes depending on container size": "Le processus peut prendre plusieurs minutes selon la taille du conteneur",
+  "Process may take several minutes for large containers": "Le processus peut prendre plusieurs minutes pour les grands conteneurs",
+  "Processes using NVIDIA:": "Processus utilisant NVIDIA :",
+  "Profile": "Profil",
+  "Profile:": "Profil :",
+  "Proposed Changes": "Modifications proposées",
+  "Provided by newer version — skipping": "fourni par une version plus récente – sauter",
+  "ProxMenux Information": "Informations sur ProxMenux",
+  "ProxMenux Monitor": "Moniteur ProxMenux",
+  "ProxMenux Monitor Service Verification": "Vérification du service de surveillance ProxMenux",
+  "ProxMenux Monitor authentication is not configured on this host — there is no password to reset.": "L'authentification ProxMenux Monitor n'est pas configurée sur cet hôte — il n'y a pas de mot de passe à réinitialiser.",
+  "ProxMenux Monitor filter configured": "Filtre du moniteur ProxMenux configuré",
+  "ProxMenux Monitor has been activated.": "Le moniteur ProxMenux a été activé.",
+  "ProxMenux Monitor has been deactivated.": "Le moniteur ProxMenux a été désactivé.",
+  "ProxMenux Monitor is not installed": "Le moniteur ProxMenux n'est pas installé",
+  "ProxMenux Monitor is not installed.": "Le moniteur ProxMenux n'est pas installé.",
+  "ProxMenux Monitor jail configured": "Prison ProxMenux Monitor configurée",
+  "ProxMenux Monitor protection": "Protection du moniteur ProxMenux",
+  "ProxMenux Monitor unit repaired and restarted": "Unité ProxMenux Monitor réparée et redémarrée",
+  "ProxMenux Monitor → Backups tab (live progress card with estimated time, logs, rollback delta)": "ProxMenux Monitor → Onglet Sauvegardes (carte de progression en direct avec durée estimée, journaux, delta de restauration)",
+  "ProxMenux can apply open permissions on this NFS directory from the host so the container can read and write:": "ProxMenux peut appliquer des autorisations d'ouverture sur ce répertoire NFS depuis l'hôte afin que le conteneur puisse lire et écrire :",
+  "ProxMenux can remount it with open permissions so any LXC can read and write.": "ProxMenux peut le remonter avec des autorisations ouvertes afin que n'importe quel LXC puisse lire et écrire.",
+  "ProxMenux cannot override NFS server-side permissions from the host.": "ProxMenux ne peut pas remplacer les autorisations côté serveur NFS de l'hôte.",
+  "ProxMenux customizations removed from bashrc": "Personnalisations de ProxMenux supprimées de bashrc",
+  "ProxMenux does not validate the contents; any keyfile your PBS accepts is accepted here.": "ProxMenux ne valide pas le contenu ;tout fichier clé accepté par votre PBS est accepté ici.",
+  "ProxMenux files:": "Fichiers ProxMenux :",
+  "ProxMenux logo applied": "Logo ProxMenux appliqué",
+  "ProxMenux only acts as a launcher — once the script starts, control leaves ProxMenux.": "ProxMenux agit uniquement comme un lanceur : une fois le script démarré, le contrôle quitte ProxMenux.",
+  "ProxMenux saved it locally at:": "ProxMenux l'a enregistré localement à :",
+  "Proxmology logo applied": "Logo Proxmologie appliqué",
+  "Proxmox 9 system update allready": "La mise à jour du système Proxmox 9 est déjà terminée",
+  "Proxmox APT repositories configured": "Dépôts Proxmox APT configurés",
+  "Proxmox Backup Server (PBS) destinations": "Destinations du serveur de sauvegarde Proxmox (PBS)",
+  "Proxmox CIFS Storage Status:": "État de stockage Proxmox CIFS :",
+  "Proxmox NFS Storage Status:": "Statut de stockage Proxmox NFS :",
+  "Proxmox System Update": "Mise à jour du système Proxmox",
+  "Proxmox Update": "Mise à jour Proxmox",
+  "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 system update completed successfully": "La mise à jour du système Proxmox VE 8 s'est terminée avec succès",
+  "Proxmox VE 8 to 9 Manual Upgrade Guide": "Guide de mise à niveau manuelle Proxmox VE 8 vers 9",
+  "Proxmox VE 9.x no-subscription repository created": "Création d'un référentiel sans abonnement Proxmox VE 9.x",
+  "Proxmox VE Helper Scripts": "Scripts d'assistance Proxmox VE",
+  "Proxmox VE configuration completed.": "Configuration de Proxmox VE terminée.",
+  "Proxmox auth logger service created and started": "Service d'enregistrement d'authentification Proxmox créé et démarré",
+  "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "Le référentiel d'entreprise Proxmox peut être manquant ou inaccessible. J'essaie de passer au sans abonnement...",
+  "Proxmox filter configured": "Filtre Proxmox configuré",
+  "Proxmox iSCSI Storage Status:": "État du stockage Proxmox iSCSI :",
+  "Proxmox jail configured": "Prison Proxmox configurée",
+  "Proxmox local storages:": "Stockages locaux Proxmox :",
+  "Proxmox repository OK (candidate is 9.x)": "Dépôt Proxmox OK (le candidat est 9.x)",
+  "Proxmox repository configuration completed": "Configuration du référentiel Proxmox terminée",
+  "Proxmox repository fixed (no-subscription, candidate is 9.x)": "Dépôt Proxmox corrigé (sans abonnement, le candidat est 9.x)",
+  "Proxmox status:": "Statut Proxmox :",
+  "Proxmox storages:": "Stockages Proxmox :",
+  "Proxmox system repair completed successfully!": "Réparation du système Proxmox terminée avec succès !",
+  "Proxmox system repair completed with some issues.": "Réparation du système Proxmox terminée avec quelques problèmes.",
+  "Proxmox system update": "Mise à jour du système Proxmox",
+  "Proxmox web interface protection": "Protection de l'interface Web Proxmox",
+  "Proxmox web interface: Datacenter > Storage > Add > Directory": "Interface web Proxmox : Datacenter > Stockage > Ajouter > Annuaire",
+  "Proxmox web interface: Datacenter > Storage > Add > NFS": "Interface web Proxmox : Datacenter > Stockage > Ajouter > NFS",
+  "Proxmox web interface: Datacenter > Storage > Add > SMB/CIFS": "Interface web Proxmox : Datacenter > Stockage > Ajouter > SMB/CIFS",
+  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Interface web Proxmox : Datacenter > Stockage > Ajouter > ZFS",
+  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Interface Web Proxmox : Datacenter > Stockage > Ajouter > iSCSI",
+  "Pulling latest changes from GitHub...": "Extraction des dernières modifications de GitHub...",
+  "Purging log2ram apt package...": "Purge du paquet log2ram apt...",
+  "Quick health check (PASSED / FAILED)": "Bilan de santé rapide (RÉUSSI / ÉCHEC)",
+  "Quick health status   — overall SMART result + key attributes": "État de santé rapide – résultat SMART global + attributs clés",
+  "RAID Detected": "RAID détecté",
+  "RAID member detected": "Membre RAID détecté",
+  "RAM Size": "Taille de la RAM",
+  "RAM and swap usage": "Utilisation de la RAM et du swap",
+  "REPAIR SUMMARY": "RÉSUMÉ DE LA RÉPARATION",
+  "REQUIREMENTS:": "EXIGENCES:",
+  "ROM dump not available — configuring without romfile.": "Dump ROM non disponible - configuration sans fichier rom.",
+  "ROM file used": "Fichier ROM utilisé",
+  "RPC Bind Service: RUNNING": "Service de liaison RPC : EN EXÉCUTION",
+  "RPC Bind Service: STOPPED": "Service de liaison RPC : ARRÊTÉ",
+  "RPC Bind Service: STOPPED - starting...": "Service de liaison RPC : ARRÊTÉ - démarrage...",
+  "Re-enter the BORG REPOKEY passphrase to confirm:": "saisissez à nouveau la phrase secrète BORG REPOKEY pour confirmer :",
+  "Re-running pre-check after repairs...": "Nouvelle vérification préalable après réparation...",
+  "Reachable": "Accessible",
+  "Read-Only": "Lecture seule",
+  "Read-Only access": "Accès en lecture seule",
+  "Read-Write (universal)": "Lecture-écriture (universel)",
+  "Read-Write access": "Accès en lecture-écriture",
+  "Read-only": "Lecture seule",
+  "Read-only access (or no write permissions).": "Accès en lecture seule (ou aucune autorisation en écriture).",
+  "Read-only mount": "Montage en lecture seule",
+  "Read/Write (default)": "Lecture/écriture (par défaut)",
+  "Read/write CPU model-specific registers": "Lecture/écriture de registres spécifiques au modèle de processeur",
+  "Readable user table (UID, shell, etc.)": "Table utilisateur lisible (UID, shell, etc.)",
+  "Reading NVMe SMART data...": "Lecture des données NVMe SMART...",
+  "Reading NVMe self-test log...": "Lecture du journal d'auto-test NVMe...",
+  "Reading SMART data...": "Lecture des données SMART...",
+  "Reading SMART self-test log...": "Lecture du journal d'autotest SMART...",
+  "Reading full SMART report...": "Lecture du rapport SMART complet...",
+  "Real-time bandwidth usage (press q to exit)": "Utilisation de la bande passante en temps réel (appuyez sur q pour quitter)",
+  "Real-time network monitoring (press q to exit)": "Surveillance du réseau en temps réel (appuyez sur q pour quitter)",
+  "Real-time network usage (iftop)": "Utilisation du réseau en temps réel (iftop)",
+  "Reason: Access denied": "Raison : Accès refusé",
+  "Reason: Authentication required": "Raison : Authentification requise",
+  "Reason: Permission denied": "Raison : Autorisation refusée",
+  "Reboot Recommended": "Redémarrage recommandé",
+  "Reboot Required": "Redémarrage requis",
+  "Reboot is required to apply the scheduled restore.": "Le redémarrage est requis pour appliquer la restauration planifiée.",
+  "Reboot is required to complete the pending restore.": "Le redémarrage est requis pour terminer la restauration en attente.",
+  "Reboot now?": "Redémarrer maintenant ?",
+  "Reboot pending — changes will take full effect after the next restart.": "Redémarrage en attente : les modifications prendront pleinement effet après le prochain redémarrage.",
+  "Reboot the VM to complete the driver installation.": "Redémarrez la VM pour terminer l'installation du pilote.",
+  "Reboot the system:": "Redémarrez le système :",
+  "Rebooting the system...": "Redémarrage du système...",
+  "Rebuilding initramfs to apply nouveau blacklist before installation...": "Reconstruire initramfs pour appliquer la nouvelle liste noire avant l'installation...",
+  "Recent": "Récent",
+  "Recent Samba Servers": "Serveurs Samba récents",
+  "Recent Samba server": "Serveur Samba récent",
+  "Recent logs:": "Journaux récents :",
+  "Recent test results:": "Résultats de tests récents :",
+  "Recommendation: reformat the disk to ext4 for a robust setup — see docs.": "Recommandation : reformatez le disque en ext4 pour une configuration robuste – voir la documentation.",
+  "Recommendation: start with Complete restore.": "Recommandation : commencez par Restauration complète.",
+  "Recommendation: use 'Export to file' for these paths and apply manually during a maintenance window.": "Recommandation : utilisez « Exporter vers un fichier » pour ces chemins et appliquez-le manuellement pendant une fenêtre de maintenance.",
+  "Recommended diagnostic commands": "Commandes de diagnostic recommandées",
+  "Recommended: Install the QEMU Guest Agent in the VM": "Recommandé : installer l'agent invité QEMU dans la VM",
+  "Recommended: run": "Recommandé : courir",
+  "Recommended: schedule these paths for next boot to avoid immediate SSH disconnection.": "Recommandé : planifiez ces chemins pour le prochain démarrage afin d'éviter une déconnexion SSH immédiate.",
+  "Recommended: use GPU -> LXC mode for these devices.": "Recommandé : utilisez le mode GPU -> LXC pour ces appareils.",
+  "Recommended: use GPU with LXC workloads instead of VM passthrough on this hardware.": "Recommandé : utilisez le GPU avec les charges de travail LXC au lieu du relais VM sur ce matériel.",
+  "Recover the keyfile using your recovery passphrase?": "Récupérer le fichier de clés à l'aide de votre phrase secrète de récupération ?",
+  "Recoverable:": "Récupérable :",
+  "Recovery blob upload failed — main backup is OK, but keyfile recovery from PBS will not be available for this backup.": "Échec du téléchargement du blob de récupération – la sauvegarde principale est OK, mais la récupération du fichier de clé à partir de PBS ne sera pas disponible pour cette sauvegarde.",
+  "Recovery blob:": "Blob de récupération :",
+  "Recovery failed": "La récupération a échoué",
+  "Recovery passphrase": "Phrase secrète de récupération",
+  "Recovery setup failed": "La configuration de la récupération a échoué",
+  "Refresh APT index and verify repositories:": "Actualisez l'index APT et vérifiez les référentiels :",
+  "Refresh your browser (Ctrl+Shift+R) to see changes": "Actualisez votre navigateur (Ctrl+Shift+R) pour voir les modifications",
+  "Refresh your browser to see changes (server restart may be required)": "Actualisez votre navigateur pour voir les modifications (un redémarrage du serveur peut être nécessaire)",
+  "Refreshing apt cache...": "Actualisation du cache apt...",
+  "Regenerating PVE package cache...": "Régénération du cache des packages PVE...",
+  "Regenerating boot artifacts for the merged kernel-agnostic changes...": "Régénération des artefacts de démarrage pour les modifications fusionnées indépendantes du noyau...",
+  "Regenerating certificates and restarting services...": "Régénération des certificats et redémarrage des services...",
+  "Register mount path in Proxmox:": "Enregistrez le chemin de montage dans Proxmox :",
+  "Registering disk as Proxmox storage...": "Enregistrement du disque en tant que stockage Proxmox...",
+  "Registering module with DKMS...": "Module d'enregistrement avec DKMS...",
+  "Reinstall / update Coral drivers": "Réinstaller/mettre à jour les pilotes Coral",
+  "Reinstall Fail2Ban": "Réinstaller Fail2Ban",
+  "Reinstall Lynis": "Réinstaller Lynis",
+  "Reinstall and reconfigure Fail2Ban": "Réinstaller et reconfigurer Fail2Ban",
+  "Reinstall/Update NVIDIA drivers": "Réinstaller/mettre à jour les pilotes NVIDIA",
+  "Reinstalled": "Réinstallé",
+  "Reinstalled Proxmox packages successfully": "Packages Proxmox réinstallés avec succès",
+  "Reinstalling core Proxmox packages...": "Réinstallation des packages Proxmox principaux...",
+  "Release Channel": "Canal de sortie",
+  "Release channel set to Beta.": "Canal de sortie défini sur Bêta.",
+  "Release channel set to Stable.": "Canal de sortie réglé sur Stable.",
+  "Release channel:": "Canal de sortie :",
+  "Reload Proxmox firewall rules": "Recharger les règles du pare-feu Proxmox",
+  "Reload network configuration (ifupdown2)": "Recharger la configuration réseau (ifupdown2)",
+  "Remapped Users:": "Utilisateurs remappés :",
+  "Remapped users:": "Utilisateurs remappés :",
+  "Reminder: You must install the QEMU Guest Agent inside the Windows VM": "Rappel : vous devez installer l'agent invité QEMU dans la VM Windows",
+  "Remote repository path:": "Chemin du référentiel distant :",
+  "Remote server via SSH  (recommended — off-host, dedup across machines)": "Serveur distant via SSH (recommandé – hors hôte, déduplication sur plusieurs machines)",
+  "Remounting CIFS share with open permissions...": "Remontage du partage CIFS avec des autorisations ouvertes...",
+  "Remove CIFS Mount": "Supprimer le support CIFS",
+  "Remove CIFS Mount (pvesm or fstab)": "Supprimer le support CIFS (pvesm ou fstab)",
+  "Remove CIFS Storage": "Supprimer le stockage CIFS",
+  "Remove CIFS fstab Mount": "Supprimer le montage CIFS fstab",
+  "Remove CIFS fstab mount:": "Supprimez le montage CIFS fstab :",
+  "Remove CIFS storage:": "Supprimez le stockage CIFS :",
+  "Remove Disk Storage": "Supprimer le stockage sur disque",
+  "Remove Disk from fstab": "Supprimer le disque de fstab",
+  "Remove FS labels  — partitions and data preserved": "Supprimer les étiquettes FS – partitions et données préservées",
+  "Remove FS labels — partitions and data preserved": "Supprimer les étiquettes FS – partitions et données préservées",
+  "Remove Fail2Ban": "Supprimer Fail2Ban",
+  "Remove GPU from LXC config (keep Start on boot)": "Supprimez le GPU de la configuration LXC (gardez Démarrer au démarrage)",
+  "Remove GPU from LXC config + keep Start on boot unchanged": "Supprimer le GPU de la configuration LXC + garder le démarrage au démarrage inchangé",
+  "Remove GPU from VM config (keep Start on boot)": "Supprimez le GPU de la configuration de la VM (conservez Démarrer au démarrage)",
+  "Remove GPU from source VM config (keep Start on boot)": "Supprimez le GPU de la configuration de la VM source (conservez Démarrer au démarrage)",
+  "Remove GPU from source VM config + keep Start on boot unchanged": "Supprimer le GPU de la configuration de la VM source + conserver le démarrage au démarrage inchangé",
+  "Remove LXC Mount Point": "Supprimer le point de montage LXC",
+  "Remove Lynis": "Supprimer Lynis",
+  "Remove Mount Point": "Supprimer le point de montage",
+  "Remove Mount Point Confirmation:": "Supprimer la confirmation du point de montage :",
+  "Remove NFS Mount": "Supprimer le support NFS",
+  "Remove NFS Mount (pvesm or fstab)": "Supprimer le support NFS (pvesm ou fstab)",
+  "Remove NFS Storage": "Supprimer le stockage NFS",
+  "Remove NFS fstab Mount": "Supprimer le montage NFS fstab",
+  "Remove NFS fstab mount:": "Supprimez le montage NFS fstab :",
+  "Remove NFS storage:": "Supprimez le stockage NFS :",
+  "Remove Proxmox CIFS storage:": "Supprimez le stockage Proxmox CIFS :",
+  "Remove Proxmox NFS storage:": "Supprimez le stockage Proxmox NFS :",
+  "Remove Proxmox iSCSI storage:": "Supprimez le stockage iSCSI Proxmox :",
+  "Remove Secure Gateway? State will be preserved.": "Supprimer la passerelle sécurisée ? L'État sera préservé.",
+  "Remove custom paths": "Supprimer les chemins personnalisés",
+  "Remove disk references from affected VM(s)/CT(s) config": "Supprimer les références de disque de la configuration des VM/CT concernées",
+  "Remove iSCSI Storage": "Supprimer le stockage iSCSI",
+  "Remove iSCSI storage definition:": "Supprimez la définition de stockage iSCSI :",
+  "Remove invalid port": "Supprimer le port invalide",
+  "Remove invalid port(s)": "Supprimer les ports invalides",
+  "Remove keyfile from this host": "Supprimer le fichier de clés de cet hôte",
+  "Remove mount point:": "Supprimer le point de montage :",
+  "Remove obsolete systemd-boot meta-package": "Supprimer le méta-paquet systemd-boot obsolète",
+  "Remove old repository files:": "Supprimez les anciens fichiers du référentiel :",
+  "Remove passthrough device from VM": "Supprimer le périphérique relais de la VM",
+  "Remove subscription banner": "Supprimer la bannière d'abonnement",
+  "Remove the unprivileged flag from configuration:": "Supprimez l'indicateur sans privilèges de la configuration :",
+  "Remove unused packages and their config": "Supprimer les packages inutilisés et leur configuration",
+  "Removed": "Supprimé",
+  "Removed KVM MSR options from configuration": "Options KVM MSR supprimées de la configuration",
+  "Removed Mount:": "Support supprimé :",
+  "Removed all .link files from": "Suppression de tous les fichiers .link de",
+  "Removed bwlimit/ionice tuning (no .bak found)": "Suppression du réglage bwlimit/ionice (aucun .bak trouvé)",
+  "Removed configurations for": "Configurations supprimées pour",
+  "Removed credentials file:": "Fichier d'informations d'identification supprimé :",
+  "Removed empty KVM configuration file": "Suppression du fichier de configuration KVM vide",
+  "Removed empty mount directory:": "Suppression du répertoire de montage vide :",
+  "Removed entry from /etc/fstab": "Entrée supprimée de /etc/fstab",
+  "Removed from /etc/fstab": "Supprimé de /etc/fstab",
+  "Removed from /etc/fstab.": "Supprimé de /etc/fstab.",
+  "Removed idle=nomwait from /etc/kernel/cmdline (ZFS)": "Suppression de ralenti = nomwait de /etc/kernel/cmdline (ZFS)",
+  "Removed idle=nomwait from GRUB configuration": "Suppression de ralenti = nomwait de la configuration GRUB",
+  "Removed remapped user:": "Utilisateur remappé supprimé :",
+  "Removed sharedfiles group.": "Groupe de fichiers partagés supprimé.",
+  "Removed:": "Supprimé:",
+  "Removing APT IPv4 configuration...": "Suppression de la configuration APT IPv4...",
+  "Removing Coral packages...": "Suppression des packages Coral...",
+  "Removing Fail2Ban...": "Suppression de Fail2Ban...",
+  "Removing GPU from VM": "Suppression du GPU de la VM",
+  "Removing Lynis...": "Suppression de Lynis...",
+  "Removing NVIDIA DKMS entries...": "Suppression des entrées NVIDIA DKMS...",
+  "Removing NVIDIA packages...": "Suppression des packages NVIDIA...",
+  "Removing OVH RTM...": "Suppression d'OVH RTM...",
+  "Removing OpenVSwitch...": "Suppression d'OpenVSwitch...",
+  "Removing VFIO ownership for selected GPU(s)...": "Suppression de la propriété VFIO pour les GPU sélectionnés...",
+  "Removing all .link files from": "Suppression de tous les fichiers .link de",
+  "Removing any pre-existing gasket-dkms package...": "Suppression de tout paquet joint-dkms préexistant...",
+  "Removing conflicting utilities...": "Suppression des utilitaires en conflit...",
+  "Removing entropy generation optimization...": "Suppression de l'optimisation de la génération d'entropie...",
+  "Removing filesystem signatures...": "Suppression des signatures du système de fichiers...",
+  "Removing from /etc/fstab...": "Suppression de /etc/fstab...",
+  "Removing gasket DKMS modules...": "Retrait du joint des modules DKMS...",
+  "Removing gateway...": "Suppression de la passerelle...",
+  "Removing guest agent...": "Suppression de l'agent invité...",
+  "Removing invalid configurations...": "Suppression des configurations invalides...",
+  "Removing invalid existing file...": "Suppression du fichier existant invalide...",
+  "Removing kernel panic configuration...": "Suppression de la configuration de panique du noyau...",
+  "Removing memory optimizations...": "Suppression des optimisations de mémoire...",
+  "Removing mount point": "Suppression du point de montage",
+  "Removing network optimizations...": "Suppression des optimisations de réseau...",
+  "Removing no longer required packages and purging old cached updates...": "Suppression des packages qui ne sont plus nécessaires et purge des anciennes mises à jour mises en cache...",
+  "Removing partial VM": "Suppression d'une VM partielle",
+  "Removing previous DKMS source tree...": "Suppression de l'arborescence source DKMS précédente...",
+  "Removing previous Lynis installation...": "Suppression de l'installation précédente de Lynis...",
+  "Removing remapped users...": "Suppression des utilisateurs remappés...",
+  "Removing storage from Proxmox...": "Suppression du stockage de Proxmox...",
+  "Removing system limits optimizations...": "La suppression des optimisations des limites du système...",
+  "Removing zfs-auto-snapshot...": "Suppression de zfs-auto-snapshot...",
+  "Renamed": "Renommé",
+  "Renamed NIC:": "Carte réseau renommée :",
+  "Repair Complete": "Réparation terminée",
+  "Repair Options:": "Options de réparation :",
+  "Repairs and optimizes repositories": "Répare et optimise les référentiels",
+  "Replace": "Remplacer",
+  "Replace <container-id> with the actual ID.": "Remplacez <container-id> par l'ID réel.",
+  "Replace <container-id> with your actual container ID": "Remplacez <container-id> par votre ID de conteneur réel",
+  "Replace <storage-identifier> with the value from step 4": "Remplacez <storage-identifier> par la valeur de l'étape 4",
+  "Replace invalid port(s)": "Remplacer les ports invalides",
+  "Replace it?": "Le remplacer ?",
+  "Replace paths with your actual values from step 5": "Remplacez les chemins par vos valeurs réelles de l'étape 5",
+  "Replace with your actual path from step 5": "Remplacez par votre chemin réel de l'étape 5",
+  "Replacing gzip with pigz wrapper...": "Remplacement de gzip par le wrapper pigz...",
+  "Repositories switched to no-subscription": "Les référentiels sont passés au sans abonnement",
+  "Repository ready.": "Référentiel prêt.",
+  "Repository:": "Dépôt:",
+  "Require reboot": "Nécessite un redémarrage",
+  "Required command not found:": "Commande requise introuvable :",
+  "Required if using a VirtIO or SCSI disk.": "Requis si vous utilisez un disque VirtIO ou SCSI.",
+  "Required install helpers not available.": "Les aides à l'installation requises ne sont pas disponibles.",
+  "Requires acl package. Skip if setfacl is not available.": "Nécessite le package acl. Ignorer si setfacl n'est pas disponible.",
+  "Requires authentication": "Nécessite une authentification",
+  "Reset Capability Blocked": "Capacité de réinitialisation bloquée",
+  "Reset Capability Warning": "Avertissement de capacité de réinitialisation",
+  "Reset Monitor Password": "Réinitialiser le mot de passe du moniteur",
+  "Reset ProxMenux Monitor Password": "Réinitialiser le mot de passe du moniteur ProxMenux",
+  "Reset current storage selection": "Réinitialiser la sélection de stockage actuelle",
+  "Resetting time synchronization...": "Réinitialisation de la synchronisation de l'heure...",
+  "Residual Bookworm entries commented where applicable": "Entrées résiduelles de Bookworm commentées le cas échéant",
+  "Resolve package conflicts": "Résoudre les conflits de packages",
+  "Restart Network": "Redémarrer le réseau",
+  "Restart Network Service": "Redémarrer le service réseau",
+  "Restart Web UI proxy": "Redémarrer le proxy de l'interface utilisateur Web",
+  "Restart and enable Samba:": "Redémarrez et activez Samba :",
+  "Restart container to activate mount?": "Redémarrer le conteneur pour activer le montage ?",
+  "Restarting ProxMenux Monitor service...": "Redémarrage du service ProxMenux Monitor...",
+  "Restarting Proxmox services...": "Redémarrage des services Proxmox...",
+  "Restarting container...": "Redémarrage du conteneur...",
+  "Restarting gateway...": "Redémarrage de la passerelle...",
+  "Restarting network service...": "Redémarrage du service réseau...",
+  "Restarting the server...": "Redémarrage du serveur...",
+  "Restore Backup": "Restaurer la sauvegarde",
+  "Restore Network Backup": "Restaurer la sauvegarde réseau",
+  "Restore a CT from backup": "Restaurer un CT à partir d'une sauvegarde",
+  "Restore a VM from backup": "Restaurer une VM à partir d'une sauvegarde",
+  "Restore actions": "Actions de restauration",
+  "Restore applied:": "Restauration appliquée :",
+  "Restore can now proceed.": "La restauration peut maintenant avoir lieu.",
+  "Restore failed": "La restauration a échoué",
+  "Restore from Borg  →  staging": "Restaurer depuis Borg → mise en scène",
+  "Restore from Borg repository": "Restaurer à partir du référentiel Borg",
+  "Restore from PBS  →  staging": "Restauration à partir de PBS → mise en scène",
+  "Restore from Proxmox Backup Server (PBS)": "Restauration à partir du serveur de sauvegarde Proxmox (PBS)",
+  "Restore from local archive  (.tar.gz / .tar.zst)": "Restaurer à partir d'une archive locale (.tar.gz / .tar.zst)",
+  "Restore from local archive  →  staging": "Restaurer à partir d'une archive locale → mise en scène",
+  "Restore host configuration": "Restaurer la configuration de l'hôte",
+  "Restore it ONLY if the target host has the same pools and disks as the source. Otherwise Proxmox may try to import non-existent pools at next boot.": "Restaurez-le UNIQUEMENT si l'hôte cible possède les mêmes pools et disques que la source. Sinon, Proxmox pourrait essayer d'importer des pools inexistants au prochain démarrage.",
+  "Restore plan": "Plan de restauration",
+  "Restore plan summary": "Résumé du plan de restauration",
+  "Restore source location": "Restaurer l'emplacement source",
+  "Restored config is on disk; reboot the host to apply.": "La configuration restaurée est sur le disque ; redémarrez l'hôte pour appliquer.",
+  "Restored original /bin/gzip": "Original restauré /bin/gzip",
+  "Restored original /etc/vzdump.conf from .bak": "/etc/vzdump.conf d'origine restauré à partir de .bak",
+  "Restoring APT language downloads...": "Restauration des téléchargements de langue APT...",
+  "Restoring container memory to": "Restauration de la mémoire du conteneur sur",
+  "Restoring default journald configuration...": "Restauration de la configuration journald par défaut...",
+  "Restoring enterprise repositories...": "Restauration des référentiels d'entreprise...",
+  "Restoring guest configs (LXC + QEMU)...": "Restauration des configurations invité (LXC + QEMU)...",
+  "Restoring original bashrc...": "Restauration du bashrc d'origine...",
+  "Restoring original logrotate configuration...": "Restauration de la configuration originale de la rotation des logs...",
+  "Restoring subscription banner...": "Restauration de la bannière d'abonnement...",
+  "Results will be saved automatically to:": "Les résultats seront automatiquement enregistrés dans :",
+  "Results will be saved to:": "Les résultats seront enregistrés dans :",
+  "Retention": "Rétention",
+  "Return": "Retour",
+  "Return to Main Menu": "Retour au menu principal",
+  "Return to Share Menu": "Revenir au menu Partager",
+  "Return to main menu": "Retour au menu principal",
+  "Reused the encryption key from the PVE storage entry.": "réutilisation de la clé de cryptage de l'entrée de stockage PVE.",
+  "Reverting AMD (Ryzen/EPYC) fixes...": "Annulation des correctifs AMD (Ryzen/EPYC)...",
+  "Reverting IOMMU/VFIO configuration...": "Rétablissement de la configuration IOMMU/VFIO...",
+  "Reverting TCP BBR + Fast Open...": "Rétablissement de TCP BBR + ouverture rapide...",
+  "Reverting ZFS ARC tuning...": "Annulation du réglage ZFS ARC...",
+  "Reverting pigz wrapper...": "Rétablissement du wrapper pigz...",
+  "Reverting vzdump speed tuning...": "Annulation du réglage de la vitesse de vzdump...",
+  "Review passthrough config files": "Examiner les fichiers de configuration relais",
+  "Review what will be removed": "Vérifiez ce qui sera supprimé",
+  "Rollback: nothing to remove (host matches backup)": "Rollback : rien à supprimer (l'hôte correspond à la sauvegarde)",
+  "Root SSH keys/config": "Clés/configuration SSH racine",
+  "Root inside container = root on host system": "Racine à l'intérieur du conteneur = racine sur le système hôte",
+  "Root shell/profile config": "Configuration du shell/profil racine",
+  "Root user on the PVE host (default 'root'):": "Utilisateur root sur l'hôte PVE ('root' par défaut) :",
+  "Rotate the recovery passphrase": "Faites pivoter la phrase secrète de récupération",
+  "Routing Information": "Informations d'acheminement",
+  "Routing Table": "Table de routage",
+  "Run 'Mount NFS Share' to install NFS client automatically.": "Exécutez « Monter le partage NFS » pour installer automatiquement le client NFS.",
+  "Run 'Mount Samba Share' to install CIFS client automatically.": "Exécutez « Mount Samba Share » pour installer automatiquement le client CIFS.",
+  "Run PVE 8 to 9": "Exécutez le PVE 8 à 9",
+  "Run PVE 8 to 9 check": "Exécutez la vérification PVE 8 à 9",
+  "Run \\\"Install NVIDIA Drivers on Host\\\" first so the installer is cached.": "Exécutez d'abord \\\"Installer les pilotes NVIDIA sur l'hôte\\\" pour que le programme d'installation soit mis en cache.",
+  "Run a full security audit": "Exécutez un audit de sécurité complet",
+  "Run a job now": "Exécutez un travail maintenant",
+  "Run as server or client? [s/c]:": "Exécuter en tant que serveur ou client ? [s/c] :",
+  "Run checklist again to verify upgrade:": "Exécutez à nouveau la liste de contrôle pour vérifier la mise à niveau :",
+  "Run from console, or SSH inside tmux/screen": "Exécuté depuis la console ou SSH dans tmux/screen",
+  "Run job now": "Exécuter le travail maintenant",
+  "Run mode selected: Automatic": "Mode d'exécution sélectionné : Automatique",
+  "Run mode selected: Automatic/Unattended": "Mode d'exécution sélectionné : Automatique/Sans surveillance",
+  "Run mode selected: Interactive": "Mode d'exécution sélectionné : Interactif",
+  "Run mode: Unattended": "Mode d'exécution : sans surveillance",
+  "Run security audit now": "Exécutez un audit de sécurité maintenant",
+  "Run the following inside the VM:": "Exécutez la commande suivante dans la VM :",
+  "Run upgrade checklist script:": "Exécutez le script de liste de contrôle de mise à niveau :",
+  "Running": "En cours d'exécution",
+  "Running Lynis security audit...": "Exécution de l'audit de sécurité Lynis...",
+  "Running NVIDIA installer in container. This may take several minutes...": "Exécution du programme d'installation NVIDIA dans le conteneur. Cela peut prendre plusieurs minutes...",
+  "Running NVIDIA uninstaller...": "Exécution du programme de désinstallation NVIDIA...",
+  "Running VM detected": "VM en cours d'exécution détectée",
+  "Running backup job:": "Exécution d'une tâche de sauvegarde :",
+  "Running containers detected": "Conteneurs en cours d'exécution détectés",
+  "Running pre-upgrade simulation to verify 'proxmox-ve' will remain installed...": "Exécution d'une simulation de pré-mise à niveau pour vérifier que « proxmox-ve » restera installé...",
+  "SATA   (standard - high compatibility)": "SATA (standard - haute compatibilité)",
+  "SCSI   (recommended for Linux and Windows)": "SCSI (recommandé pour Linux et Windows)",
+  "SCSI   (recommended for Linux)": "SCSI (recommandé pour Linux)",
+  "SECURITY CONSIDERATIONS:": "CONSIDÉRATIONS DE SÉCURITÉ :",
+  "SECURITY WARNING:": "AVERTISSEMENT DE SÉCURITÉ :",
+  "SMART Action": "Action INTELLIGENTE",
+  "SMART Disk Health & Test": "Santé et test du disque SMART",
+  "SMART health status: PASSED": "État de santé SMART : RÉUSSI",
+  "SMB Client Error": "Erreur du client PME",
+  "SMB Client Tools: AVAILABLE": "Outils clients PME : DISPONIBLES",
+  "SMB Client Tools: NOT AVAILABLE": "Outils clients PME : NON DISPONIBLE",
+  "SMB Error": "Erreur PME",
+  "SMB port 445:": "Port SMB 445 :",
+  "SMB ports:": "Ports PME :",
+  "SR-IOV Configuration Detected": "Configuration SR-IOV détectée",
+  "SSD Emulation": "Émulation SSD",
+  "SSH access (host + root)": "Accès SSH (hôte + root)",
+  "SSH auth logger service created and started": "Service d'enregistrement d'authentification SSH créé et démarré",
+  "SSH hardening: MaxAuthTries set to 3 (Lynis recommendation)": "Renforcement SSH : MaxAuthTries défini sur 3 (recommandation Lynis)",
+  "SSH host or IP:": "Hôte SSH ou IP :",
+  "SSH key strategy": "Stratégie clé SSH",
+  "SSH login failed": "Échec de la connexion SSH",
+  "SSH network risk": "Risque réseau SSH",
+  "SSH password auth refused on server": "authentification par mot de passe SSH refusée sur le serveur",
+  "SSH protection (aggressive mode)": "Protection SSH (mode agressif)",
+  "STEP 6: Choose commands based on your storage type": "ÉTAPE 6 : Choisissez les commandes en fonction de votre type de stockage",
+  "STEP 9: Cleanup (LVM only)": "ÉTAPE 9 : Nettoyage (LVM uniquement)",
+  "STORAGE TYPE IDENTIFICATION:": "IDENTIFICATION DU TYPE DE STOCKAGE :",
+  "SUGGESTION FOR": "SUGGESTION POUR",
+  "Safe design: no automatic ACL/ownership mutation on host or CT.": "Conception sécurisée : pas de mutation automatique d’ACL/propriété sur l’hôte ou le CT.",
+  "Safe to apply now": "Postuler en toute sécurité maintenant",
+  "Safety Backup": "Sauvegarde de sécurité",
+  "Safety backup created": "Sauvegarde de sécurité créée",
+  "Safety check failed: selected disk is now used by host/system.": "Échec du contrôle de sécurité : le disque sélectionné est désormais utilisé par l'hôte/le système.",
+  "Safety check failed: selected disk is referenced by a VM/LXC config.": "Échec du contrôle de sécurité : le disque sélectionné est référencé par une configuration VM/LXC.",
+  "Samba Client Manager - CT": "Gestionnaire de clients Samba - CT",
+  "Samba Client in LXC (Privileged)": "Client Samba dans LXC (privilégié)",
+  "Samba Client in LXC (privileged)": "Client Samba dans LXC (privilégié)",
+  "Samba Credentials": "Informations d'identification Samba",
+  "Samba Host Manager - Proxmox Host": "Gestionnaire d'hébergement Samba - Hôte Proxmox",
+  "Samba LXC Manager": "Gestionnaire Samba LXC",
+  "Samba Manager - CT": "Gestionnaire Samba - CT",
+  "Samba Not Installed": "Samba non installé",
+  "Samba Password": "Mot de passe Samba",
+  "Samba Server": "Serveur Samba",
+  "Samba Server Selection": "Sélection du serveur Samba",
+  "Samba Server in LXC (Privileged)": "Serveur Samba dans LXC (privilégié)",
+  "Samba Server in LXC (privileged)": "Serveur Samba dans LXC (privilégié)",
+  "Samba Server: INSTALLED": "Serveur Samba : INSTALLÉ",
+  "Samba Server: NOT INSTALLED": "Serveur Samba : NON INSTALLÉ",
+  "Samba Service Status in CT": "Statut du service Samba dans CT",
+  "Samba Service: RUNNING": "Service Samba : EN COURS",
+  "Samba Service: STOPPED": "Service Samba : ARRÊTÉ",
+  "Samba User": "Utilisateur Samba",
+  "Samba Username": "Nom d'utilisateur Samba",
+  "Samba client tools installed": "Outils clients Samba installés",
+  "Samba configuration backed up.": "Configuration Samba sauvegardée.",
+  "Samba group kept (has users assigned).": "Groupe Samba conservé (des utilisateurs sont attribués).",
+  "Samba group removed.": "Groupe Samba supprimé.",
+  "Samba packages removed.": "Paquets Samba supprimés.",
+  "Samba server has been completely uninstalled!": "Le serveur Samba a été complètement désinstallé !",
+  "Samba server installed successfully.": "Serveur Samba installé avec succès.",
+  "Samba server is already installed.": "Le serveur Samba est déjà installé.",
+  "Samba server is not installed in this CT.": "Le serveur Samba n'est pas installé dans ce CT.",
+  "Samba server is running": "Le serveur Samba est en cours d'exécution",
+  "Samba servers detected": "Serveurs Samba détectés",
+  "Samba services stopped and disabled.": "Les services Samba arrêtés et désactivés.",
+  "Samba share": "Partager Samba",
+  "Samba share created successfully!": "Partage Samba créé avec succès !",
+  "Samba share mounted successfully!": "Partage Samba monté avec succès !",
+  "Samba share unmount successfully. Reboot LXC required to take effect.": "Le partage Samba a été démonté avec succès. Redémarrez LXC requis pour prendre effet.",
+  "Samba users removed.": "Utilisateurs Samba supprimés.",
+  "Samba users:": "Utilisateurs de Samba :",
+  "Samba/CIFS Client Status in CT": "Statut du client Samba/CIFS dans CT",
+  "Samba/CIFS client installed successfully.": "Client Samba/CIFS installé avec succès.",
+  "Samba/CIFS mounts in CT": "Montages Samba/CIFS dans CT",
+  "Samba/NFS clients will likely receive 'permission denied'. Review the steps above.": "Les clients Samba/NFS recevront probablement une « autorisation refusée ». Passez en revue les étapes ci-dessus.",
+  "Same Version Detected": "Même version détectée",
+  "Same host:": "Même hébergeur :",
+  "Same major series:": "Même grande série :",
+  "Same major.minor:": "Même majeur.mineur :",
+  "Sanitizing NVIDIA host services for VFIO mode...": "Désinfection des services hôtes NVIDIA pour le mode VFIO...",
+  "Save the passphrase somewhere safe NOW, before continuing.": "Enregistrez la phrase secrète dans un endroit sûr MAINTENANT, avant de continuer.",
+  "Save this Borg target so you don't need to enter the details again?": "Enregistrer cette cible Borg pour ne pas avoir à saisir à nouveau les détails ?",
+  "Scan storage for new content": "Analyser le stockage pour trouver du nouveau contenu",
+  "Scanning available physical disks...": "Analyse des disques physiques disponibles...",
+  "Scanning network for NFS servers...": "Réseau d'analyse pour les serveurs NFS...",
+  "Scanning network for Samba servers...": "Réseau de numérisation pour les serveurs Samba...",
+  "Schedule": "Calendrier",
+  "Schedule:": "Calendrier:",
+  "Scheduled backup job created": "Tâche de sauvegarde planifiée créée",
+  "Scheduled backup jobs": "Travaux de sauvegarde planifiés",
+  "Scheduled backups and retention policies": "Sauvegardes planifiées et politiques de conservation",
+  "Scheduled tasks (cron)": "Tâches planifiées (cron)",
+  "Scheduler script not found:": "Script du planificateur introuvable :",
+  "Script Information": "Informations sur le script",
+  "Script not found:": "Script introuvable :",
+  "Scripts in": "Scripts dans",
+  "Search Results for:": "Résultats de recherche pour :",
+  "Search/Filter Scripts": "Scripts de recherche/filtrage",
+  "Secure Disk Formatter": "Formateur de disque sécurisé",
+  "Secure Gateway (Tailscale VPN)": "Passerelle sécurisée (VPN Tailscale)",
+  "Secure Gateway deployed successfully!": "Secure Gateway déployé avec succès !",
+  "Secure Gateway is already installed.": "Secure Gateway est déjà installé.",
+  "Security": "Sécurité",
+  "Security Updates": "Mises à jour de sécurité",
+  "Security Warning — read before applying": "Avertissement de sécurité – à lire avant de postuler",
+  "See": "Voir",
+  "See /tmp/proxmenux-mount.log for details.": "Voir /tmp/proxmenux-mount.log pour plus de détails.",
+  "Select": "Sélectionner",
+  "Select Borg target": "Sélectionnez la cible Borg",
+  "Select CPU model": "Sélectionnez le modèle de processeur",
+  "Select CT": "Sélectionnez CT",
+  "Select CT for destination disk": "Sélectionnez CT pour le disque de destination",
+  "Select Disk": "Sélectionnez le disque",
+  "Select Disk Images": "Sélectionnez des images disque",
+  "Select Disk Interface": "Sélectionnez l'interface du disque",
+  "Select Disks": "Sélectionnez les disques",
+  "Select Existing Folder": "Sélectionner un dossier existant",
+  "Select Filesystem": "Sélectionnez le système de fichiers",
+  "Select Folder": "Sélectionner un dossier",
+  "Select GPU for VM Passthrough": "Sélectionnez le GPU pour le relais de la VM",
+  "Select GPU(s)": "Sélectionnez des GPU",
+  "Select Host Directory": "Sélectionnez le répertoire hôte",
+  "Select Host Folder": "Sélectionnez le dossier hôte",
+  "Select LXC Container": "Sélectionnez le conteneur LXC",
+  "Select Mount Point": "Sélectionnez le point de montage",
+  "Select Mount Point to Remove": "Sélectionnez le point de montage à supprimer",
+  "Select NFS Export": "Sélectionnez Exportation NFS",
+  "Select NFS Server": "Sélectionnez le serveur NFS",
+  "Select OVA/OVF file": "Sélectionnez le fichier OVA/OVF",
+  "Select PBS repository": "Sélectionnez le référentiel PBS",
+  "Select Privileged Container": "Sélectionnez un conteneur privilégié",
+  "Select SSH private key": "Sélectionnez la clé privée SSH",
+  "Select SSH private key file": "Sélectionnez le fichier de clé privée SSH",
+  "Select Samba Server": "Sélectionnez le serveur Samba",
+  "Select Samba Share": "Sélectionnez Partager Samba",
+  "Select Shared Directory Location": "Sélectionnez l'emplacement du répertoire partagé",
+  "Select Storage": "Sélectionnez le stockage",
+  "Select Storage Volume": "Sélectionnez le volume de stockage",
+  "Select System Type": "Sélectionnez le type de système",
+  "Select Unprivileged Container": "Sélectionnez un conteneur non privilégié",
+  "Select VM": "Sélectionnez une machine virtuelle",
+  "Select VM to export:": "Sélectionnez la VM à exporter :",
+  "Select Virtual Machine": "Sélectionnez une machine virtuelle",
+  "Select a Custom Logo": "Sélectionnez un logo personnalisé",
+  "Select a VirtIO ISO to use:": "Sélectionnez un ISO VirtIO à utiliser :",
+  "Select a category of useful commands:": "Sélectionnez une catégorie de commandes utiles :",
+  "Select a category or search for scripts:": "Sélectionnez une catégorie ou recherchez des scripts :",
+  "Select a custom ISO to use:": "Sélectionnez un ISO personnalisé à utiliser :",
+  "Select a job:": "Sélectionnez un emploi :",
+  "Select a network management option:": "Sélectionnez une option de gestion de réseau :",
+  "Select a new language for the menu:": "Sélectionnez une nouvelle langue pour le menu :",
+  "Select a post-installation script:": "Sélectionnez un script de post-installation :",
+  "Select a pre-configured Linux VM script to execute:": "Sélectionnez un script de machine virtuelle Linux préconfiguré à exécuter :",
+  "Select a script or action:": "Sélectionnez un script ou une action :",
+  "Select a share to delete:": "Sélectionnez un partage à supprimer :",
+  "Select access mode": "Sélectionnez le mode d'accès",
+  "Select an existing group": "Sélectionnez un groupe existant",
+  "Select an existing group:": "Sélectionnez un groupe existant :",
+  "Select an export to delete:": "Sélectionnez une exportation à supprimer :",
+  "Select an option": "Sélectionnez une option",
+  "Select an option:": "Sélectionnez une option :",
+  "Select another source path and try again.": "Sélectionnez un autre chemin source et réessayez.",
+  "Select archive": "Sélectionner les archives",
+  "Select archive to restore": "Sélectionnez l'archive à restaurer",
+  "Select at least one path to continue.": "sélectionnez au moins un chemin pour continuer.",
+  "Select authentication mode:": "Sélectionnez le mode d'authentification :",
+  "Select authentication type:": "Sélectionnez le type d'authentification :",
+  "Select available Controllers/NVMe to add:": "Sélectionnez les contrôleurs/NVMe disponibles à ajouter :",
+  "Select backup archive": "Sélectionnez l'archive de sauvegarde",
+  "Select backup archive to restore": "Sélectionnez l'archive de sauvegarde à restaurer",
+  "Select backup backend:": "Sélectionnez le backend de sauvegarde :",
+  "Select backup method and profile:": "Sélectionnez la méthode de sauvegarde et le profil :",
+  "Select backup profile:": "Sélectionnez le profil de sauvegarde :",
+  "Select backup to restore": "Sélectionnez la sauvegarde à restaurer",
+  "Select backup to restore:": "Sélectionnez la sauvegarde à restaurer :",
+  "Select bridge for network interface(s):": "Sélectionnez le pont pour les interfaces réseau :",
+  "Select container:": "Sélectionnez le conteneur :",
+  "Select content types for this storage:": "Sélectionnez les types de contenu pour ce stockage :",
+  "Select conversion guide:": "Sélectionnez le guide de conversion :",
+  "Select conversion option:": "Sélectionnez l'option de conversion :",
+  "Select destination": "Sélectionnez une destination",
+  "Select disk interface type:": "Sélectionnez le type d'interface de disque :",
+  "Select driver version": "Sélectionnez la version du pilote",
+  "Select export format:": "Sélectionnez le format d'exportation :",
+  "Select export permissions:": "Sélectionnez les autorisations d'exportation :",
+  "Select from /mnt directories": "Sélectionnez dans les répertoires /mnt",
+  "Select from existing folders in /mnt": "Sélectionnez parmi les dossiers existants dans /mnt",
+  "Select from folders inside /mnt": "Sélectionnez parmi les dossiers dans /mnt",
+  "Select from recent servers": "Sélectionnez parmi les serveurs récents",
+  "Select help topic:": "Sélectionnez la rubrique d'aide :",
+  "Select how to provide VirtIO drivers": "Sélectionnez comment fournir les pilotes VirtIO",
+  "Select iSCSI Target": "Sélectionnez la cible iSCSI",
+  "Select local archive format:": "Sélectionnez le format d'archive locale :",
+  "Select machine type": "Sélectionnez le type de machine",
+  "Select mount configuration:": "Sélectionnez la configuration de montage :",
+  "Select mount options. Open uid/gid/file_mode are always applied so unprivileged LXC bind-mounts can write:": "Sélectionnez les options de montage. Les uid/gid/file_mode ouverts sont toujours appliqués afin que les montages de liaison LXC non privilégiés puissent écrire :",
+  "Select mount options:": "Sélectionnez les options de montage :",
+  "Select mount point to remove from container": "Sélectionnez le point de montage à supprimer du conteneur",
+  "Select mount point to unmount:": "Sélectionnez le point de montage à démonter :",
+  "Select network access level:": "Sélectionnez le niveau d'accès au réseau :",
+  "Select one of the ready-to-run Linux VMs:": "Sélectionnez l'une des VM Linux prêtes à fonctionner :",
+  "Select one or more GPU(s) to switch mode:": "Sélectionnez un ou plusieurs GPU pour changer de mode :",
+  "Select one or more disk images to import:": "Sélectionnez une ou plusieurs images disque à importer :",
+  "Select operation:": "Sélectionnez l'opération :",
+  "Select optimizations to uninstall:": "Sélectionnez les optimisations à désinstaller :",
+  "Select option": "Sélectionnez une option",
+  "Select option [1-2] (default: 2):": "Sélectionnez l'option [1-2] (par défaut : 2) :",
+  "Select option [1-3] (default: 3):": "Sélectionnez l'option [1-3] (par défaut : 3) :",
+  "Select repository destination:": "Sélectionnez la destination du référentiel :",
+  "Select restore source:": "Sélectionnez la source de restauration :",
+  "Select run mode": "Sélectionnez le mode d'exécution",
+  "Select share permissions:": "Sélectionnez les autorisations de partage :",
+  "Select storage for imported disk(s):": "Sélectionnez le stockage pour les disques importés :",
+  "Select storage to remove:": "Sélectionnez le stockage à supprimer :",
+  "Select target IQN:": "Sélectionnez l'IQN cible :",
+  "Select target mode for selected GPU(s):": "Sélectionnez le mode cible pour les GPU sélectionnés :",
+  "Select the CT to manage NFS/Samba client:": "Sélectionnez le CT pour gérer le client NFS/Samba :",
+  "Select the CT to which you want to add disks:": "Sélectionnez le CT auquel vous souhaitez ajouter des disques :",
+  "Select the GPU to pass through to the VM:": "Sélectionnez le GPU à transmettre à la VM :",
+  "Select the GPU(s) to add to LXC": "Sélectionnez le(s) GPU à ajouter à LXC",
+  "Select the LXC container:": "Sélectionnez le conteneur LXC :",
+  "Select the Linux distribution to install:": "Sélectionnez la distribution Linux à installer :",
+  "Select the NAS system to install:": "Sélectionnez le système NAS à installer :",
+  "Select the NVIDIA driver version to install:": "Sélectionnez la version du pilote NVIDIA à installer :",
+  "Select the VM to add the GPU to:": "Sélectionnez la VM à laquelle ajouter le GPU :",
+  "Select the VM to which you want to add disks:": "Sélectionnez la VM à laquelle vous souhaitez ajouter des disques :",
+  "Select the VM where you want to import the disk image:": "Sélectionnez la VM sur laquelle vous souhaitez importer l'image disque :",
+  "Select the bus type for the disks:": "Sélectionnez le type de bus pour les disques :",
+  "Select the directory containing disk images:": "Sélectionnez le répertoire contenant les images disque :",
+  "Select the directory to bind to container:": "Sélectionnez le répertoire à lier au conteneur :",
+  "Select the disk to add as Proxmox storage:": "Sélectionnez le disque à ajouter comme stockage Proxmox :",
+  "Select the disk to test or inspect:": "Sélectionnez le disque à tester ou à inspecter :",
+  "Select the disk you want to format:": "Sélectionnez le disque que vous souhaitez formater :",
+  "Select the disks you want to add:": "Sélectionnez les disques que vous souhaitez ajouter :",
+  "Select the disks you want to import (use spacebar to toggle):": "Sélectionnez les disques que vous souhaitez importer (utilisez la barre d'espace pour basculer) :",
+  "Select the entry to remove. [pvesm] entries are removed from Proxmox storage; [fstab] entries are unmounted and removed from /etc/fstab.": "Sélectionnez l'entrée à supprimer. Les entrées [pvesm] sont supprimées du stockage Proxmox ; Les entrées [fstab] sont démontées et supprimées de /etc/fstab.",
+  "Select the entry to remove. [pvesm] entries are removed from Proxmox storage; [fstab] entries are unmounted, removed from /etc/fstab and have their credentials file deleted.": "Sélectionnez l'entrée à supprimer. Les entrées [pvesm] sont supprimées du stockage Proxmox ; Les entrées [fstab] sont démontées, supprimées de /etc/fstab et leur fichier d'informations d'identification est supprimé.",
+  "Select the file to import:": "Sélectionnez le fichier à importer :",
+  "Select the filesystem for": "Sélectionnez le système de fichiers pour",
+  "Select the folder to mount:": "Sélectionnez le dossier à monter :",
+  "Select the interface type for all disks:": "Sélectionnez le type d'interface pour tous les disques :",
+  "Select the interface type for:": "Sélectionnez le type d'interface pour :",
+  "Select the mounted USB to use as backup target:": "Sélectionnez la clé USB montée à utiliser comme cible de sauvegarde :",
+  "Select the optimizations to update. Each one re-runs its post-install function and registers the new version.": "Sélectionnez les optimisations à mettre à jour. Chacun réexécute sa fonction post-installation et enregistre la nouvelle version.",
+  "Select the parent job to attach to:": "sélectionnez la tâche parent à attacher :",
+  "Select the paths to restore (one per backup entry):": "Sélectionnez les chemins à restaurer (un par entrée de sauvegarde) :",
+  "Select the privileged LXC container to convert:": "Sélectionnez le conteneur LXC privilégié à convertir :",
+  "Select the storage volume for disk import:": "Sélectionnez le volume de stockage pour l'importation de disque :",
+  "Select the sync interval (in hours):": "Sélectionnez l'intervalle de synchronisation (en heures) :",
+  "Select the target VM for PCI passthrough:": "Sélectionnez la VM cible pour le relais PCI :",
+  "Select the type of Linux installation:": "Sélectionnez le type d'installation Linux :",
+  "Select the type of Windows installation:": "Sélectionnez le type d'installation de Windows :",
+  "Select the unprivileged LXC container to convert:": "Sélectionnez le conteneur LXC non privilégié à convertir :",
+  "Select utilities to install": "Sélectionnez les utilitaires à installer",
+  "Select what to do with this disk:": "Sélectionnez quoi faire avec ce disque :",
+  "Select where to export VM files (OVA/OVF + temporary workspace):": "Sélectionnez où exporter les fichiers VM (OVA/OVF + espace de travail temporaire) :",
+  "Selected GPU function": "Fonction GPU sélectionnée",
+  "Selected GPU(s)": "GPU sélectionnés",
+  "Selected GPU(s):": "GPU sélectionnés :",
+  "Selected LXC action": "Action LXC sélectionnée",
+  "Selected VM": "VM sélectionnée",
+  "Selected VM action": "Action de VM sélectionnée",
+  "Selected container": "Conteneur sélectionné",
+  "Selected controller/NVMe is already assigned to other VM(s):": "Le contrôleur/NVMe sélectionné est déjà attribué à d’autres VM :",
+  "Selected device is already assigned to other VM(s):": "Le périphérique sélectionné est déjà attribué à d'autres VM :",
+  "Selected devices": "Appareils sélectionnés",
+  "Selected optimizations have been uninstalled.": "Les optimisations sélectionnées ont été désinstallées.",
+  "Selected paths produced no entries to apply.": "les chemins sélectionnés n'ont produit aucune entrée à appliquer.",
+  "Selected utilities installation completed": "Installation des utilitaires sélectionnés terminée",
+  "Sending backup to Borg repository...": "Envoi de la sauvegarde au référentiel Borg...",
+  "Sending backup to PBS...": "Envoi de sauvegarde vers PBS...",
+  "Server": "Serveur",
+  "Server (listen for incoming tests on TCP 5201)": "Serveur (écouter les tests entrants sur TCP 5201)",
+  "Server IP/hostname is correct": "L'adresse IP/le nom d'hôte du serveur est correct",
+  "Server IP:": "IP du serveur :",
+  "Server is accessible:": "Le serveur est accessible :",
+  "Server is online": "Le serveur est en ligne",
+  "Server is running": "Le serveur est en cours d'exécution",
+  "Server response:": "Réponse du serveur :",
+  "Server stopped. Press Enter to return to menu...": "Le serveur s'est arrêté. Appuyez sur Entrée pour revenir au menu...",
+  "Server will listen on TCP port 5201.": "Le serveur écoutera sur le port TCP 5201.",
+  "Server:": "Serveur:",
+  "Servers": "Serveurs",
+  "Service Status": "Statut du service",
+  "Service is active and running": "Le service est actif et en cours d'exécution",
+  "Service is inactive": "Le service est inactif",
+  "Service restarted.": "Service redémarré.",
+  "Service restarts:": "Le service redémarre :",
+  "Service stopped.": "Service arrêté.",
+  "Services failed": "Les services ont échoué",
+  "Services restarted": "Services redémarrés",
+  "Services:": "Services:",
+  "Set Display > Graphic card (VGA, SPICE or VirtIO) to match the guest": "Réglez Affichage > Carte graphique (VGA, SPICE ou VirtIO) pour correspondre à l'invité",
+  "Set Hostname": "Définir le nom d'hôte",
+  "Set Interface MTU Size (leave blank for default)": "Définir la taille MTU de l'interface (laisser vide par défaut)",
+  "Set MAC Address (leave empty for automatic)": "Définir l'adresse MAC (laisser vide pour automatique)",
+  "Set MTU (leave empty for default)": "Définir MTU (laisser vide par défaut)",
+  "Set VLAN (leave empty for none)": "Définir le VLAN (laisser vide pour aucun)",
+  "Set VM boot order": "Définir l'ordre de démarrage de la VM",
+  "Set Virtual Machine ID": "Définir l'ID de la machine virtuelle",
+  "Set a Bridge": "Définir un pont",
+  "Set a MAC Address": "Définir une adresse MAC",
+  "Set a Vlan(leave blank for default)": "Définir un Vlan (laisser vide par défaut)",
+  "Set network bridge (default: vmbr0)": "Définir le pont réseau (par défaut : vmbr0)",
+  "Set ownership and permissions:": "Définir la propriété et les autorisations :",
+  "Set this disk as the primary boot disk?": "Définir ce disque comme disque de démarrage principal ?",
+  "Set up custom MOTD banner": "Configurer une bannière MOTD personnalisée",
+  "Set up the apex group and udev rules": "Configurer le groupe apex et les règles udev",
+  "Set up time synchronization and entropy generation": "Configurer la synchronisation temporelle et la génération d'entropie",
+  "Setting APT language configuration...": "Définition de la configuration du langage APT...",
+  "Setting VM description": "Définition de la description de la VM",
+  "Setting boot order...": "Définition de l'ordre de démarrage...",
+  "Setting directory ownership and permissions...": "Définition de la propriété et des autorisations du répertoire...",
+  "Setting sharedfiles group with UID remapping...": "Définition du groupe de fichiers partagés avec remappage UID...",
+  "Setting systemd ulimits...": "Définition des ulimits système...",
+  "Setting ulimit for the shell user...": "Définition de ulimit pour l'utilisateur du shell...",
+  "Setting up persistent network interfaces": "Configuration d'interfaces réseau persistantes",
+  "Setting up persistent network interfaces successfully.": "Configuration réussie des interfaces réseau persistantes.",
+  "Setting up the Google Coral APT repository...": "Configuration du référentiel Google Coral APT...",
+  "Settings": "Paramètres",
+  "Settings post-install Proxmox": "Paramètres post-installation de Proxmox",
+  "Setup Persistent Network Names": "configurer des noms de réseau persistants",
+  "Share Access Error": "Erreur d'accès au partage",
+  "Share Name": "Partager le nom",
+  "Share Options": "Options de partage",
+  "Share added successfully.": "Partage ajouté avec succès.",
+  "Share deleted and Samba service restarted.": "Partage supprimé et service Samba redémarré.",
+  "Share exists:": "Le partage existe :",
+  "Share name:": "Nom du partage :",
+  "Share not found on server:": "Partage introuvable sur le serveur :",
+  "Share path:": "Chemin de partage :",
+  "Share updated successfully.": "Partage mis à jour avec succès.",
+  "Share:": "Partager:",
+  "Shared Directory Ready:": "Répertoire partagé prêt :",
+  "Shared Group": "Groupe partagé",
+  "Shared group: CONFIGURED": "Groupe partagé : CONFIGURÉ",
+  "Shared group: sharedfiles (GID:": "Groupe partagé : fichiers partagés (GID :",
+  "Sharedfiles group already exists (GID: 101000)": "Le groupe Sharedfiles existe déjà (GID : 101000)",
+  "Shares found:": "Partages trouvés :",
+  "Shell user ulimit set": "Ensemble ulimit utilisateur Shell",
+  "Short self-test started on": "Court autotest démarré le",
+  "Short test            — ~2 minutes, basic surface check": "Test court — ~ 2 minutes, vérification de base de la surface",
+  "Should show 'unprivileged: 0' or no unprivileged line": "Doit afficher « non privilégié : 0 » ou aucune ligne non privilégiée",
+  "Should show 'unprivileged: 1'": "Doit afficher « non privilégié : 1 »",
+  "Should show 'unprivileged: 1' if it's unprivileged": "Doit afficher « non privilégié : 1 » s'il n'est pas privilégié",
+  "Should show fewer or no issues": "Devrait montrer moins ou pas de problèmes",
+  "Should show pve-manager/9.x.x": "Devrait afficher pve-manager/9.x.x",
+  "Show All Scripts": "Afficher tous les scripts",
+  "Show CT users in table format": "Afficher les utilisateurs CT sous forme de tableau",
+  "Show Container Privilege Status": "Afficher l'état des privilèges du conteneur",
+  "Show DNS resolution status": "Afficher l'état de la résolution DNS",
+  "Show Ethernet device info": "Afficher les informations sur le périphérique Ethernet",
+  "Show GPU frequency": "Afficher la fréquence du GPU",
+  "Show GPU kernel driver in use": "Afficher le pilote du noyau GPU utilisé",
+  "Show GPU time": "Afficher l'heure du GPU",
+  "Show Monitor Service Status": "Afficher l'état du service de surveillance",
+  "Show Network Config File": "Afficher le fichier de configuration réseau",
+  "Show Proxmox storage configuration": "Afficher la configuration du stockage Proxmox",
+  "Show Proxmox version": "Afficher la version de Proxmox",
+  "Show Routing Table": "Afficher la table de routage",
+  "Show UUID and filesystem type of block devices": "Afficher l'UUID et le type de système de fichiers des périphériques de bloc",
+  "Show VM configuration. Use the correct <vmid>": "Afficher la configuration de la VM. Utilisez le bon <vmid>",
+  "Show Version Information": "Afficher les informations sur la version",
+  "Show ZFS pool status": "Afficher l'état du pool ZFS",
+  "Show active firewall rules (iptables)": "Afficher les règles de pare-feu actives (iptables)",
+  "Show all active mounts from the kernel": "Afficher tous les montages actifs du noyau",
+  "Show available Proxmox upgrades": "Afficher les mises à niveau Proxmox disponibles",
+  "Show configured network bridges": "Afficher les ponts réseau configurés",
+  "Show container configuration. Use the correct <ctid>": "Afficher la configuration du conteneur. Utilisez le bon <ctid>",
+  "Show detailed keyfile info": "Afficher les informations détaillées sur le fichier de clés",
+  "Show disk usage by mount point": "Afficher l'utilisation du disque par point de montage",
+  "Show jobs and last run status": "Afficher les tâches et l'état de la dernière exécution",
+  "Show listening ports (TCP/UDP)": "Afficher les ports d'écoute (TCP/UDP)",
+  "Show manual repair commands": "Afficher les commandes de réparation manuelle",
+  "Show me the line to paste manually on the server": "Montre-moi la ligne à coller manuellement sur le serveur",
+  "Show mounted storage devices": "Afficher les périphériques de stockage montés",
+  "Show network interfaces and IPs": "Afficher les interfaces réseau et les adresses IP",
+  "Show nftables rules": "Afficher les règles nftables",
+  "Show raw network configuration": "Afficher la configuration réseau brute",
+  "Show routing table": "Afficher la table de routage",
+  "Show size of a directory": "Afficher la taille d'un répertoire",
+  "Show standard exclude patterns": "Afficher les modèles d'exclusion standard",
+  "Show status of all storage pools": "Afficher l'état de tous les pools de stockage",
+  "Show traffic statistics per interface": "Afficher les statistiques de trafic par interface",
+  "Show vzdump backup configuration": "Afficher la configuration de sauvegarde vzdump",
+  "Shows status and type (nfs/cifs/dir/iscsi...).": "Affiche l'état et le type (nfs/cifs/dir/iscsi...).",
+  "Shutdown timeout": "Délai d'arrêt",
+  "Signatures removed. Partition table preserved.": "Signatures supprimées. Table de partition conservée.",
+  "Single GPU Warning": "Avertissement sur un seul GPU",
+  "Single target found — selected automatically:": "Cible unique trouvée — sélectionnée automatiquement :",
+  "Size": "Taille",
+  "Size:": "Taille:",
+  "Skip downloading additional languages": "ignorer le téléchargement de langues supplémentaires",
+  "Skip this device": "Ignorer cet appareil",
+  "Skip this step for ZFS/BTRFS": "Ignorer cette étape pour ZFS/BTRFS",
+  "Skip this step if using no-subscription repository": "Ignorez cette étape si vous utilisez un référentiel sans abonnement",
+  "Skip — I will add it as PCIe device": "Ignorer — Je vais l'ajouter en tant que périphérique PCIe",
+  "Skip — leave as-is": "Sauter — laisser tel quel",
+  "Skipped device": "Appareil ignoré",
+  "Skipped to protect target system (would cascade-remove packages)": "Ignoré pour protéger le système cible (supprimerait les packages en cascade)",
+  "Skipped, not in apt cache:": "Ignoré, pas dans le cache apt :",
+  "Skipping LXC": "Sauter LXC",
+  "Skipping SR-IOV device": "Ignorer le périphérique SR-IOV",
+  "Skipping installation.": "Sauter l'installation.",
+  "Skipping manual patches — feranick fork already supports this kernel.": "Ignorer les correctifs manuels — feranick fork prend déjà en charge ce noyau.",
+  "Smart restore plan — hardware compatibility check": "Plan de restauration intelligent – vérification de la compatibilité matérielle",
+  "Snippets          — hook scripts / config": "Extraits - scripts de hook / configuration",
+  "SoC-integrated GPU: tight coupling with other SoC components": "GPU intégré au SoC : couplage étroit avec d'autres composants du SoC",
+  "Some changes require a reboot to take effect. Do you want to restart now?": "Certaines modifications nécessitent un redémarrage pour prendre effet. Voulez-vous redémarrer maintenant ?",
+  "Some essential Proxmox packages may not have been installed": "Certains packages Proxmox essentiels n'ont peut-être pas été installés",
+  "Some log2ram files may still exist. Manual cleanup may be required.": "Certains fichiers log2ram peuvent encore exister. Un nettoyage manuel peut être nécessaire.",
+  "Some old time services could not be removed (not installed)": "Certains anciens services n'ont pas pu être supprimés (non installés)",
+  "Some operations failed — review messages above. Press Enter to continue...": "Certaines opérations ont échoué : consultez les messages ci-dessus. Appuyez sur Entrée pour continuer...",
+  "Some repairs failed. Please fix manually and re-run the script.": "Certaines réparations ont échoué. Veuillez corriger manuellement et réexécuter le script.",
+  "Some repositories are not available, continuing with available ones...": "Certains référentiels ne sont pas disponibles, continuons avec ceux disponibles...",
+  "Some selected GPUs are already configured in this container.": "Certains GPU sélectionnés sont déjà configurés dans ce conteneur.",
+  "Some signatures could not be removed (see warnings above).": "Certaines signatures n'ont pas pu être supprimées (voir les avertissements ci-dessus).",
+  "Something is already mounted at": "Quelque chose est déjà monté sur",
+  "Something is already mounted at:": "Quelque chose est déjà monté sur :",
+  "Source": "Source",
+  "Source VM": "VM source",
+  "Source patched successfully.": "Source corrigée avec succès.",
+  "Source:": "Source:",
+  "Sources copied to": "Sources copiées vers",
+  "Spanish": "Espagnol",
+  "Specific host (enter IP)": "Hôte spécifique (entrez IP)",
+  "Specific subnet (enter manually)": "Sous-réseau spécifique (saisir manuellement)",
+  "Stable (main branch)": "Stable (branche principale)",
+  "Stable monitor service normalized.": "Service de surveillance stable normalisé.",
+  "Staging directory:": "Répertoire intermédiaire :",
+  "Staging ready.": "Mise en scène prête.",
+  "Staging source:": "Source intermédiaire :",
+  "Standard NAS   (backup, iso, vztmpl)": "NAS standard (sauvegarde, iso, vztmpl)",
+  "Start VM": "Démarrer la machine virtuelle",
+  "Start VM after creation": "Démarrer la VM après la création",
+  "Start VM after creation?": "Démarrer la VM après la création ?",
+  "Start a container. Use the correct <ctid>": "Démarrez un conteneur. Utilisez le bon <ctid>",
+  "Start a virtual machine. Use the correct <vmid>": "Démarrez une machine virtuelle. Utilisez le bon <vmid>",
+  "Start long self-test (hours)": "Démarrer un autotest long (heures)",
+  "Start long test now?": "Commencer un long test maintenant ?",
+  "Start on boot already disabled for VM": "Démarrer au démarrage déjà désactivé pour la VM",
+  "Start on boot disabled for LXC": "Démarrage au démarrage désactivé pour LXC",
+  "Start on boot disabled for VM": "Démarrage au démarrage désactivé pour la VM",
+  "Start on boot enabled": "Démarrage au démarrage activé",
+  "Start on boot enabled (onboot=1)": "Démarrage au démarrage activé (onboot=1)",
+  "Start on boot will be disabled on source VM only if currently enabled": "Le démarrage au démarrage sera désactivé sur la VM source uniquement s'il est actuellement activé",
+  "Start scrub for a ZFS pool": "Démarrer le nettoyage pour un pool ZFS",
+  "Start short self-test (~2 min)": "Démarrer un court autotest (~ 2 min)",
+  "Start terminal multiplexer (recommended):": "Démarrez le multiplexeur de terminal (recommandé) :",
+  "Start the VM": "Démarrer la VM",
+  "Start the VM to begin Windows installation from the mounted ISO.": "Démarrez la VM pour commencer l'installation de Windows à partir de l'ISO montée.",
+  "Start the converted container:": "Démarrez le conteneur converti :",
+  "Start the main system upgrade:": "Démarrez la mise à niveau principale du système :",
+  "Start uploading to PBS — sets a recovery passphrase": "Commencer le téléchargement sur PBS – définit une phrase secrète de récupération",
+  "Starting Borg backup...": "Démarrage de la sauvegarde Borg...",
+  "Starting CT": "Démarrage du CT",
+  "Starting LXC Privileged to Unprivileged conversion process...": "Démarrage du processus de conversion LXC privilégié en non privilégié...",
+  "Starting LXC Unprivileged to Privileged conversion process...": "Démarrage du processus de conversion LXC non privilégié en privilégié...",
+  "Starting NVIDIA installer. This may take several minutes...": "Démarrage du programme d'installation NVIDIA. Cela peut prendre plusieurs minutes...",
+  "Starting NVMe long self-test...": "Démarrage de l'autotest long NVMe...",
+  "Starting NVMe short self-test...": "Démarrage du court autotest NVMe...",
+  "Starting ProxMenux update...": "Démarrage de la mise à jour de ProxMenux...",
+  "Starting Proxmox storage integration...": "Démarrage de l'intégration du stockage Proxmox...",
+  "Starting Proxmox system repair...": "Démarrage de la réparation du système Proxmox...",
+  "Starting SMART long self-test...": "Démarrage de l'autotest long SMART...",
+  "Starting SMART short self-test...": "Démarrage du court autotest SMART...",
+  "Starting container": "Conteneur de démarrage",
+  "Starting container...": "Démarrage du conteneur...",
+  "Starting direct conversion of container": "Démarrage de la conversion directe du conteneur",
+  "Starting gateway...": "Démarrage de la passerelle...",
+  "Starting installation...": "Démarrage de l'installation...",
+  "Starting installer...": "Démarrage du programme d'installation...",
+  "Starting privileged container...": "Démarrage du conteneur privilégié...",
+  "Starting rpcbind service...": "Démarrage du service rpcbind...",
+  "Starting unprivileged container...": "Démarrage du conteneur sans privilèges...",
+  "Status": "Statut",
+  "Status:": "Statut:",
+  "Step": "Étape",
+  "Step 2: Testing actual share access with guest...": "Étape 2 : Test de l'accès réel au partage avec l'invité...",
+  "Steps that will run:": "Étapes qui s'exécuteront :",
+  "Still has issues": "A encore des problèmes",
+  "Stop it first and run this option again.": "Arrêtez-le d'abord et réexécutez cette option.",
+  "Stop the CT, unmount the disk on the HOST, and remount with:": "Arrêtez le CT, démontez le disque sur le HOST et remontez avec :",
+  "Stop the VM/CT before formatting this disk.": "Arrêtez la VM/CT avant de formater ce disque.",
+  "Stop the container if it's running:": "Arrêtez le conteneur s'il est en cours d'exécution :",
+  "Stop them first and run this script again.": "Arrêtez-les d'abord et exécutez à nouveau ce script.",
+  "Stop uploading to PBS": "Arrêter de télécharger sur PBS",
+  "Stop uploading?": "Arrêter le téléchargement ?",
+  "Stopped": "Arrêté",
+  "Stopped and disabled": "Arrêté et désactivé",
+  "Stopping Coral kernel modules...": "Arrêt des modules du noyau Coral...",
+  "Stopping LXC": "Arrêter LXC",
+  "Stopping NFS services...": "Arrêt des services NFS...",
+  "Stopping ProxMenux Monitor service...": "Arrêt du service ProxMenux Monitor...",
+  "Stopping Samba services...": "Arrêt des services Samba...",
+  "Stopping VM": "Arrêt de la VM",
+  "Stopping and disabling NVIDIA services...": "Arrêt et désactivation des services NVIDIA...",
+  "Stopping container": "Arrêt du conteneur",
+  "Stopping gateway...": "Arrêt de la passerelle...",
+  "Stopping the container before applying configuration...": "Arrêt du conteneur avant d'appliquer la configuration...",
+  "Stopping the container before conversion...": "Arrêt du conteneur avant la conversion...",
+  "Storage": "Stockage",
+  "Storage & Share Manager": "Gestionnaire de stockage et de partage",
+  "Storage Added:": "Stockage ajouté :",
+  "Storage Exists": "Le stockage existe",
+  "Storage ID": "ID de stockage",
+  "Storage ID already exists. Do you want to remove and recreate it?": "L'ID de stockage existe déjà. Voulez-vous le supprimer et le recréer ?",
+  "Storage ID already exists:": "L'ID de stockage existe déjà :",
+  "Storage ID is available": "L'ID de stockage est disponible",
+  "Storage ID:": "ID de stockage :",
+  "Storage and Disks Commands": "Commandes de stockage et de disques",
+  "Storage controller: VirtIO SCSI": "Contrôleur de stockage : VirtIO SCSI",
+  "Storage disk identifier:": "Identifiant du disque de stockage :",
+  "Storage is now available in Proxmox web interface under Datacenter > Storage": "Le stockage est désormais disponible dans l'interface Web Proxmox sous Datacenter > Stockage",
+  "Storage plan selection cancelled.": "Sélection du plan de stockage annulée.",
+  "Storage plan selection failed or cancelled": "La sélection du plan de stockage a échoué ou a été annulée",
+  "Storage:": "Stockage:",
+  "Stored Credentials:": "Identifiants stockés :",
+  "Stored credentials:": "Identifiants stockés :",
+  "Subnet": "Sous-réseau",
+  "Subscription banner removed successfully": "La bannière d'abonnement a été supprimée avec succès",
+  "Subscription banner restored successfully (desktop and mobile)": "Bannière d'abonnement restaurée avec succès (ordinateur et mobile)",
+  "Success": "Succès",
+  "Successful": "Réussi",
+  "Supported formats: .img, .qcow2, .vmdk, .raw": "Formats pris en charge : .img, .qcow2, .vmdk, .raw",
+  "Swap partition detected": "Partition d'échange détectée",
+  "Swappiness configuration created successfully": "Configuration Swapiness créée avec succès",
+  "Switch GPU Mode  (VM <-> LXC)": "Changer de mode GPU (VM <-> LXC)",
+  "Switch Script Not Found": "Script de commutation introuvable",
+  "Switch to GPU -> LXC (native driver mode)": "Passer au GPU -> LXC (mode pilote natif)",
+  "Switch to GPU -> VM (VFIO passthrough mode)": "Passer au GPU -> VM (mode passthrough VFIO)",
+  "Switches to the free no-subscription repository": "Passe au référentiel gratuit sans abonnement",
+  "Switching to GPU -> LXC mode removes VFIO exclusivity.": "Le passage au mode GPU -> LXC supprime l'exclusivité VFIO.",
+  "Switching to GPU -> VM mode requires exclusive VFIO binding.": "Le passage au mode GPU -> VM nécessite une liaison VFIO exclusive.",
+  "Synchronize time automatically": "Synchroniser l'heure automatiquement",
+  "System": "Système",
+  "System CLI Tools": "Outils CLI système",
+  "System Disk Size (GB)": "Taille du disque système (Go)",
+  "System Update Information": "Informations sur la mise à jour du système",
+  "System Utilities Installer": "Installateur des utilitaires système",
+  "System disk is SSD or M.2. Proceeding with Log2RAM setup.": "Le disque système est SSD ou M.2. Poursuite de la configuration de Log2RAM.",
+  "System errors and logs": "Erreurs système et journaux",
+  "System group apex already exists.": "Le sommet du groupe système existe déjà.",
+  "System group apex created.": "Sommet du groupe système créé.",
+  "System hardening scoring (0-100)": "Notation du durcissement du système (0-100)",
+  "System hostname and kernel info": "Nom d'hôte du système et informations sur le noyau",
+  "System is already up to date": "Le système est déjà à jour",
+  "System is already up to date. No update needed.": "Le système est déjà à jour. Aucune mise à jour nécessaire.",
+  "System limits increase completed.": "Augmentation des limites du système terminée.",
+  "System limits optimizations removed": "Optimisations des limites du système supprimées",
+  "System must be updated to latest PVE 8.4+ before starting": "Le système doit être mis à jour avec la dernière version PVE 8.4+ avant de démarrer",
+  "System reboot required": "Redémarrage du système requis",
+  "System upgrade completed": "Mise à niveau du système terminée",
+  "System uptime": "Disponibilité du système",
+  "Systemd ulimits set": "Ensemble de limites ulimites Systemd",
+  "TCP BBR configuration created successfully": "Configuration TCP BBR créée avec succès",
+  "TCP Fast Open configuration created successfully": "Configuration TCP Fast Open créée avec succès",
+  "TCP optimizations configuration completed": "Configuration des optimisations TCP terminée",
+  "TCP optimizations reverted (defaults restored on next reboot)": "Optimisations TCP annulées (valeurs par défaut restaurées au prochain redémarrage)",
+  "TCP port 5201 is reachable (firewall on server)": "Le port TCP 5201 est accessible (pare-feu sur le serveur)",
+  "TPM device added to VM": "Périphérique TPM ajouté à la VM",
+  "TPM storage selection failed or was cancelled. VM creation aborted.": "La sélection du stockage TPM a échoué ou a été annulée. Création de VM abandonnée.",
+  "TROUBLESHOOTING:": "DÉPANNAGE :",
+  "TUI mode": "Mode TUI",
+  "TUI mode (requires root)": "Mode TUI (nécessite root)",
+  "Target IQN:": "IQN cible :",
+  "Target VM": "VM cible",
+  "Target VM validated": "VM cible validée",
+  "Target channel:": "Canal cible :",
+  "Target disk": "Disque cible",
+  "Target host runs": "L'hôte cible s'exécute",
+  "Target mode": "Mode cible",
+  "Target server:": "Serveur cible :",
+  "Target:": "Cible:",
+  "Temporary working directory (if present):": "Répertoire de travail temporaire (si présent) :",
+  "Terminal Multiplexers": "Multiplexeurs de terminaux",
+  "Terminal multiplexer (Ctrl+b then d to detach, or type exit)": "Multiplexeur de terminal (Ctrl+b puis d pour détacher, ou taper exit)",
+  "Test Connectivity": "Tester la connectivité",
+  "Test NFS Connectivity": "Tester la connectivité NFS",
+  "Test Samba Connectivity": "Tester la connectivité Samba",
+  "Test iSCSI Connectivity": "Tester la connectivité iSCSI",
+  "Test in progress:": "Test en cours :",
+  "Test runs on the drive hardware — safe to close this terminal.": "Tests effectués sur le matériel du lecteur – fermer ce terminal en toute sécurité.",
+  "Test share visibility:": "Testez la visibilité des partages :",
+  "Test typically completes in ~2 minutes.": "Le test se termine généralement en environ 2 minutes.",
+  "Testing": "Essai",
+  "Testing NFS connection...": "Test de la connexion NFS...",
+  "Testing comprehensive guest access to server": "Test de l'accès invité complet au serveur",
+  "Testing connectivity to portal...": "Test de la connectivité au portail...",
+  "Testing network connectivity...": "Test de la connectivité réseau...",
+  "Thank you for using ProxMenux. Goodbye!": "Merci d'utiliser ProxMenux. Au revoir!",
+  "That VM is currently stopped, so the GPU can be reassigned now.": "Cette VM est actuellement arrêtée, le GPU peut donc être réaffecté maintenant.",
+  "That doesn't look like an SSH private key. Pick the private key file (no .pub extension, parseable by ssh-keygen).": "Cela ne ressemble pas à une clé privée SSH.Choisissez le fichier de clé privée (pas d'extension .pub, analysable par ssh-keygen).",
+  "The GPU has been moved out of VM": "Le GPU a été déplacé hors de la VM",
+  "The GPU is being detached from VM": "Le GPU est détaché de la VM",
+  "The NVIDIA installer needs at least": "Le programme d'installation de NVIDIA a besoin d'au moins",
+  "The URL does not contain the required parameters (id, pack, edition).": "L'URL ne contient pas les paramètres requis (id, pack, édition).",
+  "The VM also has these audio devices assigned via PCI passthrough — typically added together with the GPU. Remove them too?": "La VM dispose également de ces périphériques audio attribués via un relais PCI, généralement ajoutés avec le GPU. Les supprimer aussi ?",
+  "The VM guest will have exclusive access to the GPU.": "L'invité de la VM aura un accès exclusif au GPU.",
+  "The VM is powered on. Turn it off before adding disks.": "La VM est sous tension. Éteignez-le avant d'ajouter des disques.",
+  "The VM/LXC will lose access to this disk after formatting.": "La VM/LXC perdra l'accès à ce disque après le formatage.",
+  "The archive could not be extracted.": "L'archive n'a pas pu être extraite.",
+  "The archive destination directory is INSIDE one of the paths you are about to back up. Writing the archive there would copy the backup into itself — producing a corrupted archive, or growing without limit until the disk fills up.": "Le répertoire de destination de l'archive se trouve À L'INTÉRIEUR de l'un des chemins que vous êtes sur le point de sauvegarder. Écrire l'archive là-bas copierait la sauvegarde sur elle-même, produisant une archive corrompue ou s'agrandissant sans limite jusqu'à ce que le disque se remplisse.",
+  "The backup metadata was compared against this host. The following items will be SKIPPED to keep the boot safe:": "les métadonnées de sauvegarde ont été comparées à cet hôte.Les éléments suivants seront SAUTÉS pour assurer la sécurité du démarrage :",
+  "The backup was taken on a different PVE or kernel major.minor. These paths will be SKIPPED to keep the boot safe:": "La sauvegarde a été effectuée sur un autre PVE ou noyau major.minor.Ces chemins seront SAUTÉS pour assurer la sécurité du démarrage :",
+  "The compatibility check raised failures that may break the system after restore.": "La vérification de compatibilité a généré des échecs susceptibles de casser le système après la restauration.",
+  "The container is currently stopped. Do you want to start it now to install the package?": "Le conteneur est actuellement arrêté. Voulez-vous le démarrer maintenant pour installer le package ?",
+  "The container should now start as privileged": "Le conteneur devrait maintenant démarrer en tant que privilégié",
+  "The container should now start as unprivileged": "Le conteneur devrait maintenant démarrer sans privilèges",
+  "The current driver will be completely uninstalled before installing the new version. Continue?": "Le pilote actuel sera complètement désinstallé avant d'installer la nouvelle version. Continuer?",
+  "The directory does not exist in the CT.": "Le répertoire n'existe pas dans le CT.",
+  "The disk": "Le disque",
+  "The file does not exist, is empty or is not readable.": "Le fichier n'existe pas, est vide ou n'est pas lisible.",
+  "The filesystem": "Le système de fichiers",
+  "The following LXC containers have NVIDIA passthrough configured:": "Les conteneurs LXC suivants ont configuré le relais NVIDIA :",
+  "The following backup paths are kernel-tied and are excluded from the picker to keep the target's boot safe. The operator's own tuning inside these paths (IOMMU cmdline, VFIO IDs, custom quirks) is merged back automatically via kernel-agnostic merge:": "Les chemins de sauvegarde suivants sont liés au noyau et sont exclus du sélecteur pour assurer la sécurité du démarrage de la cible.Les propres réglages de l'opérateur à l'intérieur de ces chemins (ligne de commande IOMMU, ID VFIO, bizarreries personnalisées) sont automatiquement fusionnés via une fusion indépendante du noyau :",
+  "The following changes will be applied": "Les modifications suivantes seront appliquées",
+  "The following devices were excluded because they are part of an SR-IOV configuration:": "Les appareils suivants ont été exclus car ils font partie d'une configuration SR-IOV :",
+  "The following devices were excluded from Controller/NVMe passthrough because they are part of an SR-IOV configuration:": "Les périphériques suivants ont été exclus du relais Controller/NVMe car ils font partie d'une configuration SR-IOV :",
+  "The following entries exist on the host but were NOT in the backup. To make the host EXACTLY match the backup state, they must be removed:": "Les entrées suivantes existent sur l'hôte mais n'étaient PAS dans la sauvegarde.Pour que l'hôte corresponde EXACTEMENT à l'état de la sauvegarde, ils doivent être supprimés :",
+  "The following selected GPU(s) are currently in GPU -> VM mode (vfio-pci):": "Les GPU sélectionnés suivants sont actuellement en mode GPU -> VM (vfio-pci) :",
+  "The following selected device(s) are Physical Functions with active Virtual Functions:": "Les appareils sélectionnés suivants sont des fonctions physiques avec des fonctions virtuelles actives :",
+  "The following selected device(s) are SR-IOV Virtual Functions (VFs):": "Les périphériques sélectionnés suivants sont des fonctions virtuelles (VF) SR-IOV :",
+  "The fstab entry will still be removed; reboot or manual umount needed.": "L'entrée fstab sera toujours supprimée ; redémarrage ou démontage manuel nécessaire.",
+  "The gateway should appear in your Tailscale admin console shortly.": "La passerelle devrait bientôt apparaître dans votre console d'administration Tailscale.",
+  "The host directory may not be accessible from an unprivileged container.": "Le répertoire hôte peut ne pas être accessible à partir d'un conteneur non privilégié.",
+  "The installation requires a server restart to apply changes. Do you want to restart now?": "L'installation nécessite un redémarrage du serveur pour appliquer les modifications. Voulez-vous redémarrer maintenant ?",
+  "The installation/changes require a server restart to apply correctly. Do you want to reboot now?": "L'installation/les modifications nécessitent un redémarrage du serveur pour s'appliquer correctement. Voulez-vous redémarrer maintenant ?",
+  "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "L'enveloppe locale est supprimée et les futures sauvegardes ne téléchargent rien.Les enveloppes téléchargées déjà sur PBS restent intactes et restent récupérables avec leur phrase secrète d'origine.",
+  "The long test runs directly on the disk hardware.": "Le test long s'exécute directement sur le matériel du disque.",
+  "The new SSH key was installed and is now authorized on the server.\nKey file:": "La nouvelle clé SSH a été installée et est désormais autorisée sur le serveur.\nFichier clé :",
+  "The new SSH key was pushed to the LXC via 'pct exec' on": "La nouvelle clé SSH a été transmise au LXC via 'pct exec' sur",
+  "The next visit to the dashboard will show the initial setup wizard.": "La prochaine visite sur le tableau de bord affichera l'assistant de configuration initiale.",
+  "The passwords do not match. Please try again.": "Les mots de passe ne correspondent pas. Veuillez réessayer.",
+  "The preselected VMID does not exist on this host:": "Le VMID présélectionné n'existe pas sur cet hôte :",
+  "The same GPU cannot be used by two VMs at the same time.": "Le même GPU ne peut pas être utilisé par deux VM en même temps.",
+  "The script clones the osx-proxmox.com repository and once the setup is complete, the server will automatically reboot.": "Le script clone le référentiel osx-proxmox.com et une fois la configuration terminée, le serveur redémarrera automatiquement.",
+  "The script will continue to restore VM passthrough mode on the host and reuse existing hostpci entries.": "Le script continuera à restaurer le mode passthrough de la VM sur l'hôte et à réutiliser les entrées hostpci existantes.",
+  "The script will preconfigure the selected GPU now and finalize hardware binding after reboot.": "Le script va préconfigurer le GPU sélectionné maintenant et finaliser la liaison matérielle après le redémarrage.",
+  "The selected AMD GPU does not report FLR reset support": "Le GPU AMD sélectionné ne signale pas la prise en charge de la réinitialisation FLR",
+  "The selected AMD GPU is currently in power state D3cold": "Le GPU AMD sélectionné est actuellement en état d'alimentation D3cold",
+  "The selected GPU configuration already exists in this container.": "La configuration GPU sélectionnée existe déjà dans ce conteneur.",
+  "The selected GPU has no dedicated .1 audio sibling function.": "Le GPU sélectionné n’a pas de fonction de frère audio .1 dédiée.",
+  "The selected GPU is already assigned to another VM that is currently running:": "Le GPU sélectionné est déjà attribué à une autre VM en cours d'exécution :",
+  "The selected GPU is already assigned to this VM, but the host is not currently using vfio-pci for this device.": "Le GPU sélectionné est déjà attribué à cette VM, mais l'hôte n'utilise pas actuellement vfio-pci pour cet appareil.",
+  "The selected GPU is already assigned to this VM.": "Le GPU sélectionné est déjà attribué à cette VM.",
+  "The selected GPU is already configured for passthrough to:": "Le GPU sélectionné est déjà configuré pour le relais vers :",
+  "The selected GPU is already present in this VM. Select another GPU to continue:": "Le GPU sélectionné est déjà présent dans cette VM. Sélectionnez un autre GPU pour continuer :",
+  "The selected GPU is currently used by the following LXC container(s):": "Le GPU sélectionné est actuellement utilisé par le(s) conteneur(s) LXC suivants :",
+  "The selected GPU(s) are configured in these VM(s)": "Le(s) GPU sélectionné(s) sont configurés dans ces VM",
+  "The selected GPU(s) are configured in these VM(s):": "Les GPU sélectionnés sont configurés dans ces VM :",
+  "The selected GPU(s) are used in these LXC container(s)": "Le(s) GPU sélectionné(s) sont utilisés dans ce(s) conteneur(s) LXC",
+  "The selected GPU(s) are used in these LXC container(s):": "Le(s) GPU sélectionné(s) sont utilisés dans ces conteneurs LXC :",
+  "The selected Intel GPU belongs to Apollo Lake generation and is blocked by policy for VM passthrough due to host instability risk.": "Le GPU Intel sélectionné appartient à la génération Apollo Lake et est bloqué par la stratégie de relais de VM en raison du risque d'instabilité de l'hôte.",
+  "The selected Intel GPU does not expose a PCI reset interface": "Le GPU Intel sélectionné n'expose pas d'interface de réinitialisation PCI",
+  "The selected Intel GPU has non-FLR reset support and unknown subtype": "Le GPU Intel sélectionné prend en charge la réinitialisation non FLR et sous-type inconnu",
+  "The selected Intel GPU is currently in power state D3cold": "Le GPU Intel sélectionné est actuellement en état d'alimentation D3cold",
+  "The selected VM": "La VM sélectionnée",
+  "The selected VM is running.": "La VM sélectionnée est en cours d'exécution.",
+  "The selected base folder does not exist and could not be created:": "Le dossier de base sélectionné n'existe pas et n'a pas pu être créé :",
+  "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "Le conteneur sélectionné n'est pas privilégié. Un conteneur privilégié est requis pour le relais direct du périphérique.",
+  "The selected device": "L'appareil sélectionné",
+  "The selected directory does not exist:": "Le répertoire sélectionné n'existe pas :",
+  "The selected disk has an active swap partition. Aborting.": "Le disque sélectionné possède une partition d'échange active. Avorter.",
+  "The selected disk is currently used by a RUNNING VM or CT. Stop it before formatting.": "Le disque sélectionné est actuellement utilisé par une VM ou CT en cours d'exécution. Arrêtez-le avant le formatage.",
+  "The selected disk is now part of the system ZFS pool. Aborting.": "Le disque sélectionné fait désormais partie du pool ZFS système. Avorter.",
+  "The selected disk now contains a system-critical mount. Aborting.": "Le disque sélectionné contient désormais un montage critique pour le système. Avorter.",
+  "The selected path does not exist on this host:": "Le chemin sélectionné n'existe pas sur cet hôte :",
+  "The selected path is not a valid directory:": "Le chemin sélectionné n'est pas un répertoire valide :",
+  "The server connected you as guest instead of the specified user.": "Le serveur vous a connecté en tant qu'invité au lieu de l'utilisateur spécifié.",
+  "The server may not have accessible shares.": "Le serveur n'a peut-être pas de partages accessibles.",
+  "The server may require authentication for actual share access.": "Le serveur peut exiger une authentification pour l'accès réel au partage.",
+  "The server refused password authentication for": "Le serveur a refusé l'authentification par mot de passe pour",
+  "The server rejected": "Le serveur a rejeté",
+  "The share already exists in smb.conf:": "Le partage existe déjà dans smb.conf :",
+  "The source VM also has these audio devices, likely added together with the GPU. Remove them too?": "La VM source possède également ces périphériques audio, probablement ajoutés au GPU. Les supprimer aussi ?",
+  "The specified directory does not exist:": "Le répertoire spécifié n'existe pas :",
+  "The storage has been removed and the disk unmounted.": "Le stockage a été supprimé et le disque démonté.",
+  "The test will continue even if you close this terminal.": "Le test continuera même si vous fermez ce terminal.",
+  "Then bind-mount to container": "Puis liez le montage au conteneur",
+  "Then change the VM display to none (vga: none) when the guest is stable.": "Modifiez ensuite l'affichage de la VM sur aucun (vga : aucun) lorsque l'invité est stable.",
+  "Then change the VM display to none (vga: none) when the system is stable.": "Modifiez ensuite l'affichage de la VM sur aucun (vga : aucun) lorsque le système est stable.",
+  "Then run this option again:": "Ensuite, réexécutez cette option :",
+  "Then update /etc/fstab on the host with the same options.": "Mettez ensuite à jour /etc/fstab sur l'hôte avec les mêmes options.",
+  "These are the changes that will be made": "Ce sont les changements qui seront apportés",
+  "These interface configurations will be removed": "Ces configurations d'interface seront supprimées",
+  "These paths will not be restored live and will be extracted for manual recovery.": "Ces chemins ne seront pas restaurés en direct et seront extraits pour une récupération manuelle.",
+  "This CIFS share is mounted with restrictive permissions.": "Ce partage CIFS est monté avec des autorisations restrictives.",
+  "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Ce GPU est considéré comme incompatible avec le relais GPU vers une VM dans ProxMenux.",
+  "This NFS share is fully restricted — even the host root cannot write to it.": "Ce partage NFS est entièrement restreint : même la racine de l'hôte ne peut pas y écrire.",
+  "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Cette VM nécessite des étapes d'installation supplémentaires. Consultez le guide d'installation à l'adresse :\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
+  "This action will:": "Cette action va :",
+  "This archive does not contain a recognized backup layout.": "Cette archive ne contient pas de présentation de sauvegarde reconnue.",
+  "This backup does not contain any restorable paths.": "Cette sauvegarde ne contient aucun chemin restaurable.",
+  "This backup includes /etc/zfs/zpool.cache (host-specific ZFS state).": "Cette sauvegarde inclut /etc/zfs/zpool.cache (état ZFS spécifique à l'hôte).",
+  "This backup is encrypted.": "Cette sauvegarde est cryptée.",
+  "This backup was taken on kernel": "Cette sauvegarde a été effectuée sur le noyau",
+  "This container does not have apt-get. NFS client installation only supports Debian/Ubuntu containers.": "Ce conteneur n'a pas apt-get. L'installation du client NFS prend uniquement en charge les conteneurs Debian/Ubuntu.",
+  "This container does not have apt-get. Samba client installation only supports Debian/Ubuntu containers.": "Ce conteneur n'a pas apt-get. L'installation du client Samba prend uniquement en charge les conteneurs Debian/Ubuntu.",
+  "This container has no GPU configured. Coral TPU works best alongside hardware video decoding (Quick Sync, VA-API, NVENC) for apps like Frigate.": "Ce conteneur n'a aucun GPU configuré. Coral TPU fonctionne mieux avec le décodage vidéo matériel (Quick Sync, VA-API, NVENC) pour des applications comme Frigate.",
+  "This converts all directory UIDs/GIDs by adding 100000": "Ceci convertit tous les UID/GID du répertoire en ajoutant 100 000",
+  "This converts all file UIDs/GIDs by adding 100000": "Ceci convertit tous les UID/GID de fichiers en ajoutant 100 000",
+  "This creates a backup in case you need to revert changes": "Cela crée une sauvegarde au cas où vous auriez besoin d'annuler les modifications",
+  "This erases existing metadata.": "Cela efface les métadonnées existantes.",
+  "This explicitly marks the container as privileged": "Cela marque explicitement le conteneur comme privilégié",
+  "This guarantees that device nodes are available before applying LXC GPU config.": "Cela garantit que les nœuds de périphérique sont disponibles avant d'appliquer la configuration GPU LXC.",
+  "This installation will:": "Cette installation va :",
+  "This installer will:": "Ce programme d'installation va :",
+  "This interface is configured but doesn't exist physically": "Cette interface est configurée mais n'existe pas physiquement",
+  "This is IRREVERSIBLE.": "C’est IRRÉVERSIBLE.",
+  "This is a destructive action": "Il s’agit d’une action destructrice",
+  "This is a simple configuration change": "Il s'agit d'un simple changement de configuration",
+  "This is an external community script maintained by": "Il s'agit d'un script de communauté externe maintenu par",
+  "This is an external script that creates a macOS VM in Proxmox VE in just a few steps, whether you are using AMD or Intel hardware.": "Il s'agit d'un script externe qui crée une VM macOS dans Proxmox VE en quelques étapes seulement, que vous utilisiez du matériel AMD ou Intel.",
+  "This is unexpected since credentials were validated.": "C'est inattendu puisque les informations d'identification ont été validées.",
+  "This marks the container as unprivileged": "Cela marque le conteneur comme non privilégié",
+  "This may be normal for a fresh installation": "Cela peut être normal pour une nouvelle installation",
+  "This may take a few seconds...": "Cela peut prendre quelques secondes...",
+  "This may take several minutes...": "Cela peut prendre plusieurs minutes...",
+  "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "Cela signifie que Proxmox gère le cycle de vie du montage de manière native (aucun /etc/fstab manuel n'est nécessaire pour les stockages hôtes NFS/CIFS).",
+  "This means the credentials are incorrect.": "Cela signifie que les informations d'identification sont incorrectes.",
+  "This might indicate network connectivity issues.": "Cela peut indiquer des problèmes de connectivité réseau.",
+  "This operation may take several minutes and requires internet connectivity.": "Cette opération peut prendre plusieurs minutes et nécessite une connexion Internet.",
+  "This passphrase is the ONLY way to access encrypted Borg backups.": "Cette phrase secrète est le SEUL moyen d'accéder aux sauvegardes Borg cryptées.",
+  "This path is already used as a mount point in this container.": "Ce chemin est déjà utilisé comme point de montage dans ce conteneur.",
+  "This path is not a registered mount point. Use it anyway?": "Ce chemin n'est pas un point de montage enregistré. L'utiliser quand même ?",
+  "This process changes file ownership inside the container": "Ce processus modifie la propriété du fichier à l'intérieur du conteneur",
+  "This release channel is already active.": "Ce canal de publication est déjà actif.",
+  "This removes the 'unprivileged: 1' line from the config": "Cela supprime la ligne « non privilégié : 1 » de la configuration.",
+  "This removes the storage from Proxmox. The iSCSI target is not affected.": "Cela supprime le stockage de Proxmox. La cible iSCSI n'est pas affectée.",
+  "This replaces the currently installed keyfile.": "cela remplace le fichier de clés actuellement installé.",
+  "This returns available IQNs.": "Cela renvoie les IQN disponibles.",
+  "This script cannot be executed from the Proxmox web terminal.": "Ce script ne peut pas être exécuté depuis le terminal web Proxmox.",
+  "This script must be run as root.": "Ce script doit être exécuté en tant que root.",
+  "This script must be run on a Proxmox host.": "Ce script doit être exécuté sur un hôte Proxmox.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Ce script appliquera les optimisations et ajustements avancés suivants à votre serveur Proxmox VE",
+  "This script will update your Proxmox VE system with advanced options:": "Ce script mettra à jour votre système Proxmox VE avec des options avancées :",
+  "This shows the storage type and disk identifier": "Ceci montre le type de stockage et l'identifiant du disque",
+  "This state has a high probability of VM startup/reset failures.": "Cet état présente une forte probabilité d’échecs de démarrage/réinitialisation de la VM.",
+  "This state indicates a high risk of passthrough failure due to": "Cet état indique un risque élevé d'échec du relais en raison de",
+  "This tool is designed for systems with AMD GPUs.": "Cet outil est conçu pour les systèmes équipés de GPU AMD.",
+  "This tool is designed for systems with Intel GPUs.": "Cet outil est conçu pour les systèmes équipés de GPU Intel.",
+  "This will RESET the ProxMenux Monitor login credentials on this host:": "Cela réinitialisera les informations de connexion de ProxMenux Monitor sur cet hôte :",
+  "This will add the mount to /etc/fstab so it persists after reboot.": "Cela ajoutera le montage à /etc/fstab afin qu'il persiste après le redémarrage.",
+  "This will completely remove Fail2Ban and its configuration. Continue?": "Cela supprimera complètement Fail2Ban et sa configuration. Continuer?",
+  "This will completely remove Lynis from the system. Continue?": "Cela supprimera complètement Lynis du système. Continuer?",
+  "This will create a new VM": "Cela créera une nouvelle VM",
+  "This will deploy a Tailscale VPN gateway for secure remote access.": "Cela permettra de déployer une passerelle VPN Tailscale pour un accès à distance sécurisé.",
+  "This will install and configure Fail2Ban with:": "Cela installera et configurera Fail2Ban avec :",
+  "This will install the Beta version from the develop branch and enable beta update checks.\n\nBeta builds may contain bugs or incomplete features.\n\nContinue?": "Cela installera la version bêta à partir de la branche de développement et permettra les vérifications de mise à jour bêta.\n\nLes versions bêta peuvent contenir des bugs ou des fonctionnalités incomplètes.\n\nContinuer?",
+  "This will launch the GPU assistant after VM creation and may require a host reboot.": "Cela lancera l'assistant GPU après la création de la VM et peut nécessiter un redémarrage de l'hôte.",
+  "This will reinstall and reconfigure Fail2Ban with the default ProxMenux settings. Continue?": "Cela réinstallera et reconfigurera Fail2Ban avec les paramètres ProxMenux par défaut. Continuer?",
+  "This will reinstall core Proxmox packages and regenerate certificates": "Cela réinstallera les packages Proxmox principaux et régénérera les certificats.",
+  "This will reinstall the Stable version from the main branch and disable beta update checks.\n\nContinue?": "Cela réinstallera la version stable à partir de la branche principale et désactivera les vérifications de mise à jour bêta.\n\nContinuer?",
+  "This will remove NVIDIA drivers and related configuration. Do you want to continue?": "Cela supprimera les pilotes NVIDIA et la configuration associée. Voulez-vous continuer ?",
+  "This will remove and reinstall Lynis from the latest GitHub source. Continue?": "Cela supprimera et réinstallera Lynis de la dernière source GitHub. Continuer?",
+  "This will remove the Coral TPU drivers (gasket DKMS + libedgetpu) and related configuration. Any LXC container with apex passthrough will lose access to /dev/apex_* after reboot. Continue?": "Cela supprimera les pilotes Coral TPU (joint DKMS + libedgetpu) et la configuration associée. Tout conteneur LXC avec relais apex perdra l'accès à /dev/apex_* après le redémarrage. Continuer?",
+  "This will remove the mount from /etc/fstab and delete credentials if present.": "Cela supprimera le montage de /etc/fstab et supprimera les informations d'identification si elles sont présentes.",
+  "This will remove the mount from /etc/fstab.": "Cela supprimera le montage de /etc/fstab.",
+  "This will restart the network service and may cause a brief disconnection. Continue?": "Cela redémarrera le service réseau et pourrait provoquer une brève déconnexion. Continuer?",
+  "This will take time. Answer prompts carefully - see notes below.": "Cela prendra du temps. Répondez attentivement aux invites - voir les notes ci-dessous.",
+  "This will upgrade this node to Proxmox VE 9 on Debian Trixie.": "Cela mettra à niveau ce nœud vers Proxmox VE 9 sur Debian Trixie.",
+  "Tick the paths to include in this backup. Press \"Add custom path\" to add a folder or file of your own to the list.": "Cochez les chemins à inclure dans cette sauvegarde. Appuyez sur \"Ajouter un chemin personnalisé\" pour ajouter votre propre dossier ou fichier à la liste.",
+  "Tick the paths to remove (they will not be deleted from disk — only from this list):": "Cochez les chemins à supprimer (ils ne seront pas supprimés du disque — uniquement à partir de cette liste) :",
+  "Time settings configured - Timezone:": "Paramètres horaires configurés - Fuseau horaire :",
+  "Time synchronization reset to UTC": "Synchronisation de l'heure réinitialisée sur UTC",
+  "Tip: Also mount the VirtIO ISO for drivers and guest agent installer": "Astuce : Montez également l'ISO VirtIO pour les pilotes et le programme d'installation de l'agent invité.",
+  "Tip: You can install the QEMU Guest Agent inside the VM with:": "Astuce : Vous pouvez installer l'agent invité QEMU dans la VM avec :",
+  "Tip: zfs set acltype=posixacl xattr=sa <pool>/<dataset> enables full ACL support.": "Astuce : zfs set acltype=posixacl xattr=sa <pool>/<dataset> active la prise en charge complète des ACL.",
+  "To allow LXC write access, change the NFS export on the server to include:": "Pour autoriser l'accès en écriture LXC, modifiez l'exportation NFS sur le serveur pour inclure :",
+  "To assign VFs to VMs or LXCs, edit the configuration manually via the Proxmox web interface. The Physical Function will remain bound to the native driver.": "Pour attribuer des VF aux VM ou LXC, modifiez la configuration manuellement via l'interface Web Proxmox. La fonction physique restera liée au pilote natif.",
+  "To continue with Add GPU to LXC, first switch the host to GPU -> LXC mode and reboot.": "Pour continuer avec Ajouter un GPU à LXC, commencez par basculer l'hôte en mode GPU -> LXC et redémarrez.",
+  "To copy any of these files verbatim, restore this backup on a host with the same kernel major.minor.": "Pour copier textuellement l'un de ces fichiers, restaurez cette sauvegarde sur un hôte avec le même noyau major.minor.",
+  "To exit iftop, press q": "Pour quitter iftop, appuyez sur q",
+  "To exit iptraf-ng, press x": "Pour quitter iptraf-ng, appuyez sur x",
+  "To fix this, do ONE of the following:": "Pour résoudre ce problème, effectuez l'une des opérations suivantes :",
+  "To install host drivers, first remove the GPU from VM passthrough configuration and reboot.": "Pour installer les pilotes hôtes, supprimez d’abord le GPU de la configuration passthrough de la VM et redémarrez.",
+  "To install the monitor, reinstall ProxMenux with the latest version": "Pour installer le moniteur, réinstallez ProxMenux avec la dernière version",
+  "To pass SR-IOV Virtual Functions to a VM, edit the VM configuration manually via the Proxmox web interface.": "Pour transmettre les fonctions virtuelles SR-IOV à une VM, modifiez la configuration de la VM manuellement via l'interface Web Proxmox.",
+  "To pass SR-IOV Virtual Functions to a container, edit the LXC configuration manually via the Proxmox web interface. The Physical Function will remain bound to the native driver.": "Pour transmettre les fonctions virtuelles SR-IOV à un conteneur, modifiez la configuration LXC manuellement via l'interface Web Proxmox. La fonction physique restera liée au pilote natif.",
+  "To remove partial VM:": "Pour supprimer une VM partielle :",
+  "To restore": "Pour restaurer",
+  "To revert changes:": "Pour annuler les modifications :",
+  "To start the VM:": "Pour démarrer la VM :",
+  "To stop:": "Pour arrêter :",
+  "To use Coral from a regular app, install the libedgetpu runtime via the usual method for your distro (community package or build from source). The simplest path is to run an app container that bundles the runtime — e.g. the Frigate Docker image — passing the device through with": "Pour utiliser Coral à partir d'une application standard, installez le runtime libedgetpu via la méthode habituelle de votre distribution (package communautaire ou build à partir des sources). Le chemin le plus simple consiste à exécuter un conteneur d'application qui regroupe le runtime, par exemple. l'image Frigate Docker - en faisant passer l'appareil avec",
+  "To use GPU passthrough, please create a new VM configured with:": "Pour utiliser le relais GPU, veuillez créer une nouvelle VM configurée avec :",
+  "To use a custom Fastfetch logo, place your ASCII logo file in:\n\n/usr/local/share/fastfetch/logos/\n\nThe file should not exceed 35 lines to fit properly in the terminal.\n\nPress OK to continue and select your logo.": "Pour utiliser un logo Fastfetch personnalisé, placez votre fichier de logo ASCII dans :\n\n/usr/local/share/fastfetch/logos/\n\nLe fichier ne doit pas dépasser 35 lignes pour s'insérer correctement dans le terminal.\n\nAppuyez sur OK pour continuer et sélectionnez votre logo.",
+  "To use the GPU again in LXC, run Add GPU to LXC from GPUs and Coral-TPU Menu": "Pour utiliser à nouveau le GPU dans LXC, exécutez Ajouter un GPU à LXC à partir des GPU et du menu Coral-TPU",
+  "To use the VM without issues, the host must be restarted before starting it.": "Pour utiliser la VM sans problème, l'hôte doit être redémarré avant de le démarrer.",
+  "To use this share from an LXC, bind-mount it via:": "Pour utiliser ce partage à partir d'un LXC, montez-le via :",
+  "Tool exit code:": "Code de sortie de l'outil :",
+  "Tool output:": "Sortie de l'outil :",
+  "Top memory processes in CT": "Principaux processus de mémoire en CT",
+  "Total": "Total",
+  "Total members:": "Nombre total de membres :",
+  "Total routes": "Total des itinéraires",
+  "Total size:": "Taille totale :",
+  "Translation files:": "Fichiers de traduction :",
+  "Tried pvesm path and manual detection methods": "Chemin pvesm essayé et méthodes de détection manuelle",
+  "Try Again": "Essayer à nouveau",
+  "Try a different search term.": "Essayez un autre terme de recherche.",
+  "Try accessing": "Essayez d'accéder",
+  "Try another archive": "Essayez une autre archive",
+  "Try automatic repair of detected issues": "Essayez la réparation automatique des problèmes détectés",
+  "Two-factor authentication and backup codes will be removed.": "L'authentification à deux facteurs et les codes de sauvegarde seront supprimés.",
+  "Type": "Taper",
+  "Type the device path EXACTLY to confirm formatting:": "Tapez EXACTEMENT le chemin du périphérique pour confirmer le formatage :",
+  "Type the full disk path to confirm": "Tapez le chemin complet du disque pour confirmer",
+  "Type:": "Taper:",
+  "Type: attached to PVE storage": "Type : attaché au stockage PVE",
+  "Typed value does not match selected disk. Operation cancelled.": "La valeur saisie ne correspond pas au disque sélectionné. Opération annulée.",
+  "UID in CT": "UID dans CT",
+  "UPGRADE PROMPTS - RECOMMENDED ANSWERS:": "INVITES DE MISE À NIVEAU – RÉPONSES RECOMMANDÉES :",
+  "USB Accelerators:": "Accélérateurs USB :",
+  "USB disk target": "cible du disque USB",
+  "USB drives mounted now:": "Clés USB montées maintenant :",
+  "USB libedgetpu1": "Libedgetpu1 USB",
+  "UUP Dump script not found.": "Script de vidage UUP introuvable.",
+  "UUp Dump ISO creator Custom": "UUp Dump Créateur ISO Personnalisé",
+  "Udev rules for Coral USB devices added and rules reloaded.": "Règles Udev pour les périphériques USB Coral ajoutées et règles rechargées.",
+  "Udev rules for Coral USB devices already exist.": "Les règles Udev pour les périphériques Coral USB existent déjà.",
+  "Udev rules for Coral USB devices appended and rules reloaded.": "Règles Udev pour les périphériques USB Coral ajoutées et règles rechargées.",
+  "Umbrel OS installer script by Helper Scripts\n\nVisit the GitHub repo to learn more, contribute, or support the project:\n\nhttps://community-scripts.github.io/ProxmoxVE/scripts?id=umbrel-os-vm": "Script d'installation du système d'exploitation Umbrel par Helper Scripts\n\nVisitez le dépôt GitHub pour en savoir plus, contribuer ou soutenir le projet :\n\nhttps://community-scripts.github.io/ProxmoxVE/scripts?id=umbrel-os-vm",
+  "Unable to detect Proxmox version.": "Impossible de détecter la version de Proxmox.",
+  "Understand the security implications of privileged containers": "Comprendre les implications de sécurité des conteneurs privilégiés",
+  "Uninstall Coral drivers and configuration": "Désinstaller les pilotes et la configuration Coral",
+  "Uninstall Fail2Ban": "Désinstaller Fail2Ban",
+  "Uninstall Lynis": "Désinstaller Lynis",
+  "Uninstall NFS Server": "Désinstaller le serveur NFS",
+  "Uninstall NVIDIA drivers and configuration": "Désinstaller les pilotes et la configuration NVIDIA",
+  "Uninstall Optimizations": "Désinstaller les optimisations",
+  "Uninstall ProxMenux": "Désinstaller ProxMenux",
+  "Uninstall Samba Server": "Désinstaller le serveur Samba",
+  "Uninstall optimizations": "Désinstaller les optimisations",
+  "Uninstallation Summary:": "Résumé de la désinstallation :",
+  "Uninstallation completed. Press Enter to continue...": "Désinstallation terminée. Appuyez sur Entrée pour continuer...",
+  "Uninstalling Ceph...": "Désinstallation de Ceph...",
+  "Uninstalling Fastfetch...": "Désinstallation de Fastfetch...",
+  "Uninstalling Figurine...": "Désinstallation de Figurine...",
+  "Uninstalling amdgpu_top...": "Désinstallation d'amdgpu_top...",
+  "Uninstalling current NVIDIA driver before installing new version": "Désinstallation du pilote NVIDIA actuel avant d'installer la nouvelle version",
+  "Uninstalling intel-gpu-tools...": "Désinstallation des outils Intel-Gpu...",
+  "Uninstalling kexec-tools and removing custom service...": "Désinstallation de kexec-tools et suppression du service personnalisé...",
+  "Uninstalling log2ram (all versions)...": "Désinstallation de log2ram (toutes les versions)...",
+  "Universal Group Configuration:": "Configuration du groupe universel :",
+  "Universal Group:": "Groupe Universel :",
+  "Universal NFS server has been completely uninstalled!": "Le serveur Universal NFS a été complètement désinstallé !",
+  "Universal compatibility: ENABLED": "Compatibilité universelle : ACTIVÉE",
+  "Universal group: NOT CONFIGURED": "Groupe universel : NON CONFIGURÉ",
+  "Universal sharedfiles group configured with": "Groupe de fichiers partagés universels configuré avec",
+  "Unknown": "Inconnu",
+  "Unknown CPU type. IOMMU might not be properly enabled.": "Type de processeur inconnu. IOMMU n'est peut-être pas correctement activé.",
+  "Unknown CPU vendor. Cannot determine IOMMU parameter.": "Fournisseur de processeur inconnu. Impossible de déterminer le paramètre IOMMU.",
+  "Unknown GPU": "GPU inconnu",
+  "Unknown model": "Modèle inconnu",
+  "Unknown size": "Taille inconnue",
+  "Unknown storage controller": "Contrôleur de stockage inconnu",
+  "Unmount NFS Share": "Démonter le partage NFS",
+  "Unmount Samba Share": "Démonter le partage Samba",
+  "Unmount USB drive": "Démonter la clé USB",
+  "Unmount a USB drive": "Démonter une clé USB",
+  "Unmount and cleanup (LVM only):": "Démontage et nettoyage (LVM uniquement) :",
+  "Unmount failed": "Échec du démontage",
+  "Unmount it before proceeding. The script will verify this at execution.": "Démontez-le avant de continuer. Le script le vérifiera lors de l'exécution.",
+  "Unmounted": "Non monté",
+  "Unmounted successfully": "Démonté avec succès",
+  "Unmounted:": "Démonté :",
+  "Unmounting": "Démontage",
+  "Unmounting disk...": "Démontage du disque...",
+  "Unprivileged": "Sans privilège",
+  "Unprivileged Container Access": "Accès aux conteneurs sans privilèges",
+  "Unprivileged container": "Conteneur non privilégié",
+  "Unprivileged container selected:": "Conteneur non privilégié sélectionné :",
+  "Unprivileged container — UID offset:": "Conteneur non privilégié – décalage UID :",
+  "Unprivileged containers map their UIDs to high host UIDs (e.g. 100000+), which appear as 'others' on the host filesystem.": "Les conteneurs non privilégiés mappent leurs UID sur des UID d'hôte élevés (par exemple 100 000+), qui apparaissent comme « autres » sur le système de fichiers hôte.",
+  "Unprivileged: Limited access (more secure)": "Non privilégié : accès limité (plus sécurisé)",
+  "Unreachable": "Injoignable",
+  "Unsupported Terminal": "Terminal non pris en charge",
+  "Unsupported format. Only .ova and .ovf files are supported.": "Format non pris en charge. Seuls les fichiers .ova et .ovf sont pris en charge.",
+  "Unsupported output format:": "Format de sortie non pris en charge :",
+  "Update Available": "mise à jour disponible",
+  "Update Ceph repository (Only if using Ceph):": "Mettre à jour le référentiel Ceph (uniquement si vous utilisez Ceph) :",
+  "Update Debian repositories to Trixie:": "Mettez à jour les dépôts Debian vers Trixie :",
+  "Update Export": "Mettre à jour l'exportation",
+  "Update Lynis to latest version": "Mettre à jour Lynis vers la dernière version",
+  "Update NVIDIA in LXC Containers": "Mettre à jour NVIDIA dans les conteneurs LXC",
+  "Update PVE enterprise repository (Only if using enterprise):": "Mettre à jour le référentiel d'entreprise PVE (uniquement si vous utilisez l'entreprise) :",
+  "Update Proxmox VE Appliance Manager": "Mettre à jour le gestionnaire d'appliances Proxmox VE",
+  "Update Proxmox package lists": "Mettre à jour les listes de packages Proxmox",
+  "Update Share": "Mettre à jour le partage",
+  "Update Status": "Statut de la mise à jour",
+  "Update and upgrade all system packages": "Mettre à jour et mettre à niveau tous les packages système",
+  "Update and upgrade system": "Système de mise à jour et de mise à niveau",
+  "Update cancelled by user": "Mise à jour annulée par l'utilisateur",
+  "Update completed. Press Enter to continue...": "Mise à jour terminée. Appuyez sur Entrée pour continuer...",
+  "Update kernel to compatible version": "Mettre à jour le noyau vers une version compatible",
+  "Update package index:": "Index du package de mise à jour :",
+  "Update system to latest PVE 8.4+ (if not done already):": "Mettre à jour le système vers la dernière version PVE 8.4+ (si ce n'est déjà fait) :",
+  "Updated": "Mis à jour",
+  "Updated sharedfiles group to GID: 101000": "Groupe de fichiers partagés mis à jour vers GID : 101000",
+  "Updates all Proxmox and Debian packages": "Met à jour tous les packages Proxmox et Debian",
+  "Updates and Packages Commands": "Commandes de mises à jour et de packages",
+  "Updates file is empty or unreadable.": "Le fichier de mises à jour est vide ou illisible.",
+  "Updating APT package lists...": "Mise à jour des listes de packages APT...",
+  "Updating Debian Bookworm → Trixie in sources.list...": "Mise à jour de Debian Bookworm → Trixie dans sources.list...",
+  "Updating Figurine binary...": "Mise à jour du binaire Figurine...",
+  "Updating Lynis to the latest version...": "Mise à jour de Lynis vers la dernière version...",
+  "Updating PVE application manager...": "Mise à jour du gestionnaire d'applications PVE...",
+  "Updating amdgpu_top...": "Mise à jour d'amdgpu_top...",
+  "Updating cluster certificates...": "Mise à jour des certificats de cluster...",
+  "Updating initramfs (this may take a minute)...": "Mise à jour d'initramfs (cela peut prendre une minute)...",
+  "Updating initramfs for all kernels...": "Mise à jour d'initramfs pour tous les noyaux...",
+  "Updating initramfs, GRUB, and EFI boot, patience...": "Mise à jour d'initramfs, GRUB et boot EFI, patience...",
+  "Updating journald to store info-level messages...": "Mise à jour de journald pour stocker les messages au niveau des informations...",
+  "Updating kernel panic configuration...": "Mise à jour de la configuration de panique du noyau...",
+  "Updating package lists...": "Mise à jour des listes de packages...",
+  "Updating pve-enterprise.list (if present) to Trixie...": "Mise à jour de pve-enterprise.list (si présent) vers Trixie...",
+  "Updating release channel configuration...": "Mise à jour de la configuration du canal de version...",
+  "Upgrade Ceph to compatible version": "Mettre à niveau Ceph vers une version compatible",
+  "Upgrade PVE 8 to PVE 9": "Mettre à niveau le PVE 8 vers le PVE 9",
+  "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Assistant de mise à niveau : Proxmox VE 8 → 9 (Trixie)",
+  "Upgrade canceled by user": "Mise à niveau annulée par l'utilisateur",
+  "Upgrade one node at a time": "Mettre à niveau un nœud à la fois",
+  "Upgrade to Proxmox VE 9": "Mise à niveau vers Proxmox VE 9",
+  "Upgrading NVIDIA utils (Arch)...": "Mise à niveau des utilitaires NVIDIA (Arch)...",
+  "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "Télécharger une copie cryptée de la clé sur PBS afin de pouvoir la récupérer sur un hôte réinstallé avec juste une phrase secrète ?",
+  "Upload key to PBS?": "Télécharger la clé sur PBS ?",
+  "Upload to PBS disabled.": "Téléchargement vers PBS désactivé.",
+  "Upload to PBS enabled. The envelope is uploaded on every encrypted backup.": "Téléchargement vers PBS activé.L'enveloppe est téléchargée sur chaque sauvegarde cryptée.",
+  "Upload to PBS is currently: no. Pick an action:": "Le téléchargement sur PBS est actuellement : non.Choisissez une action :",
+  "Upload to PBS is currently: yes. Pick an action:": "Le téléchargement sur PBS est actuellement : oui.Choisissez une action :",
+  "Upload to PBS: enable, disable or rotate the recovery passphrase": "Télécharger sur PBS : activer, désactiver ou alterner la phrase secrète de récupération",
+  "Uptime and who is logged in": "Disponibilité et qui est connecté",
+  "Use \"Check test progress\" to see results.": "Utilisez « Vérifier la progression du test » pour voir les résultats.",
+  "Use 'Export to file' to save it and inspect manually.": "Utilisez « Exporter vers un fichier » pour l'enregistrer et l'inspecter manuellement.",
+  "Use 'pct restore' / 'qmrestore' to recover their disks from your VM backups.": "Utilisez « PCT Restore » / « qmrestore » pour récupérer leurs disques à partir des sauvegardes de votre VM.",
+  "Use Custom backup and uncheck the conflicting path from the list": "Utilisez la sauvegarde personnalisée et décochez le chemin en conflit dans la liste",
+  "Use Default Settings?": "Utiliser les paramètres par défaut ?",
+  "Use Download first if you want to save a copy of the current key. Continue?": "utilisez d'abord Télécharger si vous souhaitez enregistrer une copie de la clé actuelle.Continuer?",
+  "Use SPACE to select, ENTER to confirm": "Utilisez ESPACE pour sélectionner, ENTRÉE pour confirmer",
+  "Use SPACE to select/deselect, ENTER to confirm": "Utilisez ESPACE pour sélectionner/désélectionner, ENTER pour confirmer",
+  "Use SSH or terminal access (SSH recommended)": "Utilisez SSH ou l'accès au terminal (SSH recommandé)",
+  "Use a USB disk": "Utiliser un disque USB",
+  "Use a custom path": "utiliser un chemin personnalisé",
+  "Use a privileged LXC for NFS server/client workflows.": "Utilisez un LXC privilégié pour les workflows serveur/client NFS.",
+  "Use a privileged LXC for Samba client/server workflows.": "Utilisez un LXC privilégié pour les workflows client/serveur Samba.",
+  "Use an existing SSH private key file on this host": "Utiliser un fichier de clé privée SSH existant sur cet hôte",
+  "Use an existing keyfile": "utiliser un fichier de clés existant",
+  "Use as-is — keep data and filesystem": "Utiliser tel quel – conserver les données et le système de fichiers",
+  "Use content types according to your use case.": "Utilisez les types de contenu en fonction de votre cas d'utilisation.",
+  "Use default": "utiliser la valeur par défaut",
+  "Use default (Yes)": "Utiliser la valeur par défaut (Oui)",
+  "Use default group:": "Utiliser le groupe par défaut :",
+  "Use enterprise URL if you have subscription.": "Utilisez l'URL d'entreprise si vous disposez d'un abonnement.",
+  "Use existing VirtIO ISO from storage": "Utiliser l'ISO VirtIO existant à partir du stockage",
+  "Use existing filesystem": "Utiliser le système de fichiers existant",
+  "Use existing: mount without formatting": "Utiliser existant : monter sans formatage",
+  "Use images only if the directory is on suitable storage.": "Utilisez des images uniquement si le répertoire se trouve sur un stockage approprié.",
+  "Use mp1/mp2/... for extra mount points.": "Utilisez mp1/mp2/... pour des points de montage supplémentaires.",
+  "Use only when unprivileged containers cannot meet your needs": "À utiliser uniquement lorsque les conteneurs non privilégiés ne peuvent pas répondre à vos besoins",
+  "Use option 1 to add a local disk (as Proxmox storage and/or as a host mount).": "Utilisez l'option 1 pour ajouter un disque local (comme stockage Proxmox et/ou comme montage hôte).",
+  "Use option 1 to add an iSCSI target as Proxmox storage.": "Utilisez l'option 1 pour ajouter une cible iSCSI comme stockage Proxmox.",
+  "Use pigz for faster gzip compression": "Utilisez pigz pour une compression gzip plus rapide",
+  "Use the Guided Cleanup option to fix issues safely": "Utilisez l'option de nettoyage guidé pour résoudre les problèmes en toute sécurité",
+  "Use the Guided Repair option to fix issues safely": "Utilisez l'option de réparation guidée pour résoudre les problèmes en toute sécurité",
+  "Use these commands on your Proxmox host to access an LXC container's terminal:": "Utilisez ces commandes sur votre hôte Proxmox pour accéder au terminal d'un conteneur LXC :",
+  "Use tmux or screen to avoid interruptions": "Utilisez tmux ou screen pour éviter les interruptions",
+  "Use:": "Utiliser:",
+  "Useful System Commands": "Commandes système utiles",
+  "Useful to verify options/content after script execution.": "Utile pour vérifier les options/contenus après l'exécution du script.",
+  "User": "Utilisateur",
+  "User account exists on server": "Le compte utilisateur existe sur le serveur",
+  "User activity and uptime": "Activité des utilisateurs et disponibilité",
+  "User chose not to remove NetworkManager": "L'utilisateur a choisi de ne pas supprimer NetworkManager",
+  "User chose to exit for manual backup creation.": "L'utilisateur a choisi de quitter pour la création manuelle d'une sauvegarde.",
+  "Username": "Nom d'utilisateur",
+  "Username (e.g. root@pam or user@pbs!token):": "Nom d'utilisateur (par exemple root@pam ou user@pbs!token) :",
+  "Username and password": "Nom d'utilisateur et mot de passe",
+  "Username and password will be cleared.": "Le nom d'utilisateur et le mot de passe seront effacés.",
+  "Username cannot be empty.": "Le nom d'utilisateur ne peut pas être vide.",
+  "Username is correct": "Le nom d'utilisateur est correct",
+  "Username on the Borg server that runs \"borg serve\" (typically \"borg\"). This is NOT the admin/root user of the server — that one is asked later only if you choose \"Generate a new key and authorize it\".": "nom d'utilisateur sur le serveur Borg qui exécute \"borg serve\" (généralement \"borg\").Il ne s'agit PAS de l'administrateur/utilisateur root du serveur — celui-ci n'est demandé plus tard que si vous choisissez \"Générer une nouvelle clé et l'autoriser\".",
+  "Username:": "Nom d'utilisateur:",
+  "Users:": "Utilisateurs :",
+  "Using UUID is recommended over /dev/sdX.": "L'utilisation de l'UUID est recommandée plutôt que /dev/sdX.",
+  "Using advanced configuration": "Utilisation de la configuration avancée",
+  "Using default Proxmox logo...": "Utilisation du logo Proxmox par défaut...",
+  "Using existing encryption key:": "Utilisation de la clé de chiffrement existante :",
+  "Utilities Installation Menu": "Menu d'installation des utilitaires",
+  "Utilities Menu": "Menu Utilitaires",
+  "Utilities Verification": "Vérification des utilitaires",
+  "Utilities and Tools": "Utilitaires et outils",
+  "Utilities installation completed": "Installation des utilitaires terminée",
+  "VFIO device IDs removed from /etc/modprobe.d/vfio.conf": "ID de périphérique VFIO supprimés de /etc/modprobe.d/vfio.conf",
+  "VFIO modules configured in /etc/modules": "Modules VFIO configurés dans /etc/modules",
+  "VFIO modules configured.": "Modules VFIO configurés.",
+  "VFIO modules in /etc/modules": "Modules VFIO dans /etc/modules",
+  "VFIO modules removed from /etc/modules": "Modules VFIO supprimés de /etc/modules",
+  "VFIO orphans cleared and initramfs rebuilt — next boot will free the GPU.": "les orphelins VFIO effacés et initramfs reconstruits — le prochain démarrage libérera le GPU.",
+  "VFIO orphans cleared but initramfs rebuild failed; check /var/log/proxmenux logs.": "les orphelins VFIO ont été effacés mais la reconstruction d'initramfs a échoué ;vérifiez les journaux /var/log/proxmenux.",
+  "VLAN": "VLAN",
+  "VM": "Machine virtuelle",
+  "VM Conflict Policy": "Politique de conflit de VM",
+  "VM ID": "ID de machine virtuelle",
+  "VM ID:": "ID de machine virtuelle :",
+  "VM Must Be Stopped": "La VM doit être arrêtée",
+  "VM Name": "Nom de la machine virtuelle",
+  "VM Storage     (images, backup)": "Stockage VM (images, sauvegarde)",
+  "VM and CT Management Commands": "Commandes de gestion VM et CT",
+  "VM creation cancelled before disk planning.": "Création de VM annulée avant la planification du disque.",
+  "VM creation cancelled by user.": "Création de VM annulée par l'utilisateur.",
+  "VM creation completed": "Création de VM terminée",
+  "VM creation completed with GPU passthrough configured.": "Création de VM terminée avec le relais GPU configuré.",
+  "VM creation completed. GPU passthrough was not applied.": "Création de la VM terminée. Le relais GPU n’a pas été appliqué.",
+  "VM creation completed. GPU passthrough was skipped (no compatible GPU detected).": "Création de la VM terminée. Le relais GPU a été ignoré (aucun GPU compatible détecté).",
+  "VM creation failed or was cancelled during storage setup.": "La création de la VM a échoué ou a été annulée lors de la configuration du stockage.",
+  "VM description configured": "Description de la VM configurée",
+  "VM imported successfully": "VM importée avec succès",
+  "VM is running": "La VM est en cours d'exécution",
+  "VM is still running. Export cancelled.": "La VM est toujours en cours d'exécution. Exportation annulée.",
+  "VM passthrough configuration failed. Review the log and VM config.": "La configuration du relais de la VM a échoué. Consultez le journal et la configuration de la VM.",
+  "VM passthrough requires exclusive VFIO binding of the GPU.": "Le relais de VM nécessite une liaison VFIO exclusive du GPU.",
+  "VM removed:": "VM supprimée :",
+  "VM selected:": "VM sélectionnée :",
+  "VM shell created:": "Shell de VM créé :",
+  "VM started": "VM démarrée",
+  "VM stopped": "VM arrêtée",
+  "VM:": "Machine virtuelle :",
+  "VMID in use": "VMID en cours d'utilisation",
+  "VMID must be a number.": "VMID doit être un nombre.",
+  "VMID of the Borg server LXC on": "VMID du serveur Borg LXC sur",
+  "VMs to destroy:": "VM à détruire :",
+  "VMs, LXCs, network, /etc/pve, users, cron, packages, drivers, ProxMenux state, etc.": "machines virtuelles, LXC, réseau, /etc/pve, utilisateurs, cron, packages, pilotes, état ProxMenux, etc.",
+  "Valid backups for all VMs/CTs": "Sauvegardes valides pour toutes les VM/CT",
+  "Validating Proxmox 9 repositories (checking 'proxmox-ve' candidate)...": "Validation des référentiels Proxmox 9 (vérification du candidat 'proxmox-ve')...",
+  "Validating credentials with server": "Validation des informations d'identification avec le serveur",
+  "Validating disk safety...": "Validation de la sécurité du disque...",
+  "Verbose pool status": "État du pool détaillé",
+  "Verification": "Vérification",
+  "Verify IOMMU group for PCI device": "Vérifier le groupe IOMMU pour le périphérique PCI",
+  "Verify Options > OS Type — currently set to:": "Vérifiez les options > Type de système d'exploitation – actuellement défini sur :",
+  "Verify PVE version (must be 8.4.1 or newer):": "Vérifiez la version PVE (doit être 8.4.1 ou plus récente) :",
+  "Verify active exports:": "Vérifiez les exportations actives :",
+  "Verify bridge assignment and NIC model — change to VirtIO if guest drivers are available": "Vérifiez l'affectation du pont et le modèle de carte réseau – passez à VirtIO si des pilotes invités sont disponibles",
+  "Verify iSCSI sessions and storage status:": "Vérifiez les sessions iSCSI et l'état du stockage :",
+  "Verify inside container:": "Vérifiez à l'intérieur du conteneur :",
+  "Verify installations": "Vérifier les installations",
+  "Verify mount:": "Vérifiez le montage :",
+  "Verify the conversion:": "Vérifiez la conversion :",
+  "Verify the credentials. Switching to manual paste mode so you can finish the setup without re-typing the password.": "Vérifiez les informations d’identification.Passage en mode collage manuel pour pouvoir terminer la configuration sans retaper le mot de passe.",
+  "Verifying Ceph installation...": "Vérification de l'installation de Ceph...",
+  "Verifying Ceph packages availability...": "Vérification de la disponibilité des packages Ceph...",
+  "Verifying all utilities status": "Vérification de l'état de tous les utilitaires",
+  "Verifying disk accessibility in CT": "Vérification de l'accessibilité du disque dans CT",
+  "Version": "Version",
+  "Version Change Detected": "Changement de version détecté",
+  "Version info not available": "Informations sur la version non disponibles",
+  "Version:": "Version:",
+  "Version: Auto-negotiation (NFSv3/NFSv4)": "Version : Auto-négociation (NFSv3/NFSv4)",
+  "Versions shown are compatible with your kernel. Latest available is recommended in most cases.": "Les versions affichées sont compatibles avec votre noyau. La dernière version disponible est recommandée dans la plupart des cas.",
+  "View CIFS Mounts (pvesm + fstab)": "Afficher les montages CIFS (pvesm + fstab)",
+  "View Current Exports": "Afficher les exportations actuelles",
+  "View Current Mounts": "Afficher les montures actuelles",
+  "View Current Shares": "Afficher les partages actuels",
+  "View Disk Storages": "Afficher les stockages sur disque",
+  "View Mount Points": "Afficher les points de montage",
+  "View NFS Mounts (pvesm + fstab)": "Afficher les montages NFS (pvesm + fstab)",
+  "View backup metadata": "Afficher les métadonnées de sauvegarde",
+  "View current paths": "afficher les chemins actuels",
+  "View existing folders in /mnt": "Afficher les dossiers existants dans /mnt",
+  "View iSCSI Storages": "Afficher les stockages iSCSI",
+  "View raw CT configuration file": "Afficher le fichier de configuration CT brut",
+  "View raw VM configuration file": "Afficher le fichier de configuration brut de la VM",
+  "View restore plan": "Afficher le plan de restauration",
+  "View self-test log": "Afficher le journal d'autotest",
+  "VirtIO (advanced - high performance)": "VirtIO (avancé - hautes performances)",
+  "VirtIO ISO not found after selection.": "VirtIO ISO introuvable après sélection.",
+  "VirtIO ISO selection cancelled.": "Sélection ISO VirtIO annulée.",
+  "VirtIO driver ISO downloaded successfully.": "Le pilote ISO VirtIO a été téléchargé avec succès.",
+  "Virtual Disks Created:": "Disques virtuels créés :",
+  "Virtual Function": "Fonction virtuelle",
+  "Virtual Function (parent PF:": "Fonction virtuelle (PF parent :",
+  "Virtual Machine ID": "ID de machine virtuelle",
+  "Virtual disk": "Disque virtuel",
+  "Virtual disks": "Disques virtuels",
+  "Virtual display already set to": "Affichage virtuel déjà réglé sur",
+  "Virtual display changed from": "L'affichage virtuel est passé de",
+  "Virtual display normalized to vga: std (compatibility)": "Affichage virtuel normalisé en VGA : std (compatibilité)",
+  "Virtual display set to": "Affichage virtuel réglé sur",
+  "Virtual interface (normal)": "Interface virtuelle (normale)",
+  "Virtualization": "Virtualisation",
+  "Visit https://osx-proxmox.com for more information.": "Visitez https://osx-proxmox.com pour plus d'informations.",
+  "Visit the website to discover more scripts, stay updated with the latest updates, and support the project:": "Visitez le site Web pour découvrir plus de scripts, rester informé des dernières mises à jour et soutenir le projet :",
+  "Visit the website to discover more scripts, stay updated with the latest updates, and support the project:\n\nhttps://community-scripts.github.io/ProxmoxVE": "Visitez le site Web pour découvrir plus de scripts, rester informé des dernières mises à jour et soutenir le projet :\n\nhttps://community-scripts.github.io/ProxmoxVE",
+  "Vulnerability detection": "Détection de vulnérabilité",
+  "WARNING": "AVERTISSEMENT",
+  "WARNING — This backup contains paths that are risky to restore on a running system:": "AVERTISSEMENT — Cette sauvegarde contient des chemins dont la restauration est risquée sur un système en cours d'exécution :",
+  "WARNING — You selected risky paths for live restore:": "AVERTISSEMENT — Vous avez sélectionné des chemins risqués pour la restauration en direct :",
+  "WARNING: All data on selected disk will be ERASED if formatted.": "AVERTISSEMENT : toutes les données sur le disque sélectionné seront EFFACÉES si elles sont formatées.",
+  "WARNING: The NFS server is not affected. The mount directory contents are NOT deleted (data stays on the server).": "AVERTISSEMENT : Le serveur NFS n'est pas affecté. Le contenu du répertoire de montage n'est PAS supprimé (les données restent sur le serveur).",
+  "WARNING: The Samba server is not affected. The mount directory contents are NOT deleted.": "ATTENTION : Le serveur Samba n'est pas affecté. Le contenu du répertoire de montage n'est PAS supprimé.",
+  "WARNING: The selected directory is not empty!": "ATTENTION : Le répertoire sélectionné n'est pas vide !",
+  "WARNING: This disk has a mounted partition.": "AVERTISSEMENT : ce disque possède une partition montée.",
+  "WARNING: This disk is also assigned to:": "AVERTISSEMENT : ce disque est également affecté à :",
+  "WARNING: This disk is referenced in a stopped VM/LXC config.": "AVERTISSEMENT : ce disque est référencé dans une configuration VM/LXC arrêtée.",
+  "WARNING: This is a single GPU system": "AVERTISSEMENT : il s'agit d'un système à GPU unique",
+  "WARNING: This may cause a brief disconnection.": "AVERTISSEMENT : Cela peut provoquer une brève déconnexion.",
+  "WARNING: This removes the storage from Proxmox. The NFS server is not affected.": "AVERTISSEMENT : cela supprime le stockage de Proxmox. Le serveur NFS n'est pas affecté.",
+  "WARNING: This removes the storage from Proxmox. The Samba server is not affected.": "AVERTISSEMENT : cela supprime le stockage de Proxmox. Le serveur Samba n'est pas affecté.",
+  "WARNING: This will ERASE all data on this disk.": "AVERTISSEMENT : cela effacera toutes les données de ce disque.",
+  "WARNING: This will FORMAT the disk": "AVERTISSEMENT : cela FORMATERA le disque",
+  "WARNING: This will completely remove NFS server from the CT.": "AVERTISSEMENT : cela supprimera complètement le serveur NFS du CT.",
+  "WARNING: This will completely remove Samba server from the CT.": "AVERTISSEMENT : cela supprimera complètement le serveur Samba du CT.",
+  "WARNING: You are about to remove this Proxmox storage:": "AVERTISSEMENT : Vous êtes sur le point de supprimer ce stockage Proxmox :",
+  "WARNING: You are about to remove this disk mount:": "AVERTISSEMENT : vous êtes sur le point de supprimer ce support de disque :",
+  "WARNING: this will ERASE EVERYTHING on the disk.": "ATTENTION : cela effacera TOUT ce qui se trouve sur le disque.",
+  "WILL BE PERMANENTLY ERASED.": "SERA définitivement effacé.",
+  "Wait for each node to complete before starting next": "Attendez que chaque nœud soit terminé avant de commencer le suivant",
+  "Warning": "Avertissement",
+  "Warning: Auth key should start with 'tskey-'": "Attention : la clé d'authentification doit commencer par \"tskey-\"",
+  "Warning: Disk Images on CIFS": "Avertissement : Images disque sur CIFS",
+  "Warning: Limited PCI Reset Support": "Avertissement : prise en charge limitée de la réinitialisation PCI",
+  "Warning: both VMs have autostart enabled (onboot=1).": "Attention : les deux machines virtuelles ont le démarrage automatique activé (onboot=1).",
+  "Warnings": "Avertissements",
+  "Website": "Site web",
+  "What do you want to do?": "Qu'est-ce que vous voulez faire?",
+  "What would you like to do?": "Qu'aimeriez-vous faire ?",
+  "When asked to select a disk, click Load Driver and load the VirtIO drivers.": "Lorsqu'on vous demande de sélectionner un disque, cliquez sur Charger le pilote et chargez les pilotes VirtIO.",
+  "When this GPU is passed through to a VM, the Proxmox host will lose all video output on the physical monitor.": "Lorsque ce GPU est transmis à une VM, l'hôte Proxmox perdra toute la sortie vidéo sur le moniteur physique.",
+  "Where are the backup archives stored?": "Où sont stockées les archives de sauvegarde ?",
+  "Where do you want the host folder?": "Où voulez-vous le dossier hôte ?",
+  "Where do you want to mount inside container?": "Où souhaitez-vous monter à l’intérieur du conteneur ?",
+  "Where do you want to mount the NFS export?": "Où souhaitez-vous monter l’export NFS ?",
+  "Where do you want to mount the Samba share?": "Où souhaitez-vous monter le partage Samba ?",
+  "Where is the OVA/OVF file located?": "Où se trouve le fichier OVA/OVF ?",
+  "Where to mount inside container?": "Où monter à l’intérieur du conteneur ?",
+  "While the server allows guest listing, no shares are actually accessible without authentication.": "Bien que le serveur autorise la liste des invités, aucun partage n'est réellement accessible sans authentification.",
+  "Will be configured now": "Sera configuré maintenant",
+  "Windows Installation Options": "Options d'installation de Windows",
+  "Windows path:": "Chemin Windows :",
+  "Wipe all          — erase partitions + metadata": "Effacer tout – effacer les partitions + les métadonnées",
+  "Wipe all — remove partitions + metadata": "Effacer tout – supprimer les partitions + les métadonnées",
+  "Wipe old signatures and partition table (DESTRUCTIVE):": "Effacez les anciennes signatures et la table de partition (DESTRUCTIVE) :",
+  "Wiping existing partition table...": "Effacement de la table de partition existante...",
+  "Wiping partitions and metadata...": "Effacement des partitions et des métadonnées...",
+  "Wired NICs in backup missing on target:": "Cartes réseau filaires dans la sauvegarde manquantes sur la cible :",
+  "With warnings": "Avec des avertissements",
+  "Without Function Level Reset (FLR), passthrough is not considered reliable": "Sans réinitialisation du niveau de fonction (FLR), le relais n'est pas considéré comme fiable",
+  "Without a usable reset path, passthrough reliability is poor and VM": "Sans chemin de réinitialisation utilisable, la fiabilité du relais est médiocre et la VM",
+  "Working directory:": "Répertoire de travail :",
+  "Works with LVM, ZFS, and BTRFS storage types": "Fonctionne avec les types de stockage LVM, ZFS et BTRFS",
+  "Would you like to continue in passthrough-only mode? The libedgetpu APT install will be skipped, the Coral device will still be visible inside the container (e.g. /dev/apex_0), and you can install the runtime yourself or use an app container that bundles it (e.g. the Frigate Docker image).": "Souhaitez-vous continuer en mode passthrough uniquement ? L'installation de libedgetpu APT sera ignorée, le périphérique Coral sera toujours visible à l'intérieur du conteneur (par exemple /dev/apex_0) et vous pourrez installer le runtime vous-même ou utiliser un conteneur d'application qui le regroupe (par exemple l'image Frigate Docker).",
+  "Would you like to see the current": "Souhaitez-vous voir le courant",
+  "Write access confirmed for user:": "Accès en écriture confirmé pour l'utilisateur :",
+  "Write access confirmed.": "Accès en écriture confirmé.",
+  "Write access test FAILED for user:": "ÉCHEC du test d'accès en écriture pour l'utilisateur :",
+  "Write access verified for user:": "Accès en écriture vérifié pour l'utilisateur :",
+  "Wrong passphrase": "Mauvaise phrase secrète",
+  "Yes": "Oui",
+  "Yes, upload": "Oui, télécharger",
+  "Yes: set a recovery passphrase now; the encrypted key envelope is uploaded with every backup.": "Oui : définissez une phrase secrète de récupération maintenant ;l'enveloppe de clé cryptée est téléchargée à chaque sauvegarde.",
+  "You are connected via SSH and selected network-related restore paths.": "Vous êtes connecté via SSH et les chemins de restauration sélectionnés liés au réseau.",
+  "You can add it manually through:": "Vous pouvez l'ajouter manuellement via :",
+  "You can add servers manually.": "Vous pouvez ajouter des serveurs manuellement.",
+  "You can enter the export path manually.": "Vous pouvez saisir le chemin d'exportation manuellement.",
+  "You can enter the share name manually.": "Vous pouvez saisir le nom de partage manuellement.",
+  "You can now monitor your AMD GPU using:": "Vous pouvez désormais surveiller votre GPU AMD en utilisant :",
+  "You can now monitor your Intel GPU using:": "Vous pouvez désormais surveiller votre GPU Intel en utilisant :",
+  "You can now select Controller/NVMe devices in Storage Plan.": "Vous pouvez désormais sélectionner les périphériques Controller/NVMe dans le plan de stockage.",
+  "You can reboot later manually with: reboot": "Vous pouvez redémarrer manuellement plus tard avec : reboot",
+  "You can reboot later manually.": "Vous pouvez redémarrer manuellement plus tard.",
+  "You can restore it anytime with": "Vous pouvez le restaurer à tout moment avec",
+  "You can restore the backup with": "Vous pouvez restaurer la sauvegarde avec",
+  "You can run a security audit with:": "Vous pouvez exécuter un audit de sécurité avec :",
+  "You can still install amdgpu_top if needed.": "Vous pouvez toujours installer amdgpu_top si nécessaire.",
+  "You can still install intel-gpu-tools if needed.": "Vous pouvez toujours installer Intel-Gpu-Tools si nécessaire.",
+  "You can still mount this share for READ-ONLY access.": "Vous pouvez toujours monter ce partage pour un accès en LECTURE SEULE.",
+  "You can use the following credentials to login to the Nextcloud vm:": "Vous pouvez utiliser les informations d'identification suivantes pour vous connecter à la machine virtuelle Nextcloud :",
+  "You haven't added any custom paths yet.": "Vous n'avez pas encore ajouté de chemins personnalisés.",
+  "You may need to run 'pveceph install' manually": "Vous devrez peut-être exécuter 'pveceph install' manuellement",
+  "You must select a logo to continue.": "Vous devez sélectionner un logo pour continuer.",
+  "You must select at least one mount method to continue.": "Vous devez sélectionner au moins une méthode de montage pour continuer.",
+  "You need to use username and password authentication.": "Vous devez utiliser l'authentification par nom d'utilisateur et mot de passe.",
+  "You selected 'Disk image' content on a CIFS/SMB storage.": "Vous avez sélectionné le contenu « Image disque » sur un stockage CIFS/SMB.",
+  "You should now be able to access the Proxmox web interface.": "Vous devriez maintenant pouvoir accéder à l'interface Web de Proxmox.",
+  "You will need a Tailscale auth key from: https://login.tailscale.com/admin/settings/keys": "Vous aurez besoin d'une clé d'authentification Tailscale provenant de : https://login.tailscale.com/admin/settings/keys",
+  "ZFS ARC config removed (kernel defaults will apply on reboot)": "Configuration ZFS ARC supprimée (les valeurs par défaut du noyau s'appliqueront au redémarrage)",
+  "ZFS ARC configuration file created/updated successfully": "Fichier de configuration ZFS ARC créé/mis à jour avec succès",
+  "ZFS ARC configuration is up to date": "La configuration de ZFS ARC est à jour",
+  "ZFS ARC optimization completed": "Optimisation ZFS ARC terminée",
+  "ZFS Management Commands": "Commandes de gestion ZFS",
+  "ZFS Pool Name": "Nom du pool ZFS",
+  "ZFS auto-snapshot installation and configuration completed": "Installation et configuration de l'instantané automatique ZFS terminées",
+  "ZFS autotrim already enabled for pool:": "Le découpage automatique ZFS est déjà activé pour le pool :",
+  "ZFS autotrim disabled for pool:": "Découpage automatique ZFS désactivé pour le pool :",
+  "ZFS autotrim enabled for pool:": "Découpage automatique ZFS activé pour le pool :",
+  "ZFS autotrim is not supported for pool:": "Le découpage automatique ZFS n'est pas pris en charge pour le pool :",
+  "ZFS autotrim setup completed": "Configuration du découpage automatique ZFS terminée",
+  "ZFS command history": "Historique des commandes ZFS",
+  "ZFS configuration": "Configuration ZFS",
+  "ZFS member detected": "Membre ZFS détecté",
+  "ZFS not detected. Nothing to disable.": "ZFS non détecté. Rien à désactiver.",
+  "ZFS not detected. Skipping ZFS ARC optimization.": "ZFS non détecté. Ignorer l'optimisation ZFS ARC.",
+  "ZFS not detected. Skipping ZFS autotrim.": "ZFS non détecté. Ignorer le découpage automatique ZFS.",
+  "ZFS pool": "Pool ZFS",
+  "ZFS pool created": "Pool ZFS créé",
+  "ZFS pool created and mounted at": "Pool ZFS créé et monté à",
+  "ZFS pool exported:": "Pool ZFS exporté :",
+  "ZFS pool is not available after creation:": "Le pool ZFS n'est pas disponible après la création :",
+  "ZFS pool not found:": "Pool ZFS introuvable :",
+  "ZFS pool:": "Pool ZFS :",
+  "ZFS storage added successfully to Proxmox!": "Stockage ZFS ajouté avec succès à Proxmox !",
+  "ZFS tools not found. Install zfsutils-linux and retry.": "Outils ZFS introuvables. Installez zfsutils-linux et réessayez.",
+  "ZFS:": "ZFS :",
+  "Zero all data     — partition table preserved, data wiped": "Zéro toutes les données : table de partition préservée, données effacées",
+  "Zero all data — partition table preserved": "Zéro toutes les données - table de partition préservée",
+  "Zeroing partition": "Remise à zéro de la partition",
+  "active VF(s)": "FV active(s)",
+  "active VFs": "VF actives",
+  "active Virtual Functions. Changing its driver binding would destroy every VF.": "Fonctions virtuelles actives. Changer la liaison de son pilote détruirait chaque VF.",
+  "after copy; source tree is incomplete.": "après copie ; l'arborescence des sources est incomplète.",
+  "after update.": "après mise à jour.",
+  "all_squash,anonuid=65534,anongid=65534": "all_squash,anonuid=65534,anongid=65534",
+  "amdgpu_top installed successfully": "amdgpu_top installé avec succès",
+  "amdgpu_top is already installed:": "amdgpu_top est déjà installé :",
+  "amdgpu_top is not installed": "amdgpu_top n'est pas installé",
+  "amdgpu_top is up to date": "amdgpu_top est à jour",
+  "amdgpu_top uninstalled successfully": "amdgpu_top désinstallé avec succès",
+  "amdgpu_top updated to": "amdgpu_top mis à jour vers",
+  "and": "et",
+  "and could not be unmounted — disk may be busy.": "et n'a pas pu être démonté — le disque est peut-être occupé.",
+  "and upgrade the system (disables the enterprise repo)": "et mettre à niveau le système (désactive le dépôt d'entreprise)",
+  "apex device node not found yet; a reboot may be required.": "le nœud du périphérique apex n'a pas encore été trouvé ; un redémarrage peut être nécessaire.",
+  "apex group and udev rules are in place.": "Les règles du groupe apex et de l'udev sont en place.",
+  "apex group removed.": "groupe apex supprimé.",
+  "apex group still has members; left in place:": "le groupe faîtier compte toujours des membres ; laissé en place :",
+  "apex kernel module not loaded on host. Run \"Install Coral on Host\" first or the container will not see /dev/apex_0.": "Le module du noyau apex n'est pas chargé sur l'hôte. Exécutez d'abord \"Installer Coral sur l'hôte\" ou le conteneur ne verra pas /dev/apex_0.",
+  "appears to be part of a": "semble faire partie d'un",
+  "applying minimal banner patch": "application d'un patch de bannière minimal",
+  "apt cache refreshed.": "cache apt actualisé.",
+  "apt-get exited": "apt-sortir",
+  "apt-get update returned warnings. Continuing anyway; check": "apt-get update a renvoyé des avertissements. On continue quand même ; vérifier",
+  "as": "comme",
+  "automatically. Install it manually inside the container.": "automatiquement. Installez-le manuellement à l'intérieur du conteneur.",
+  "automatically. Reboot LXC to fully release.": "automatiquement. Redémarrez LXC pour le libérer complètement.",
+  "available for LXC bind-mounts via 'LXC Mount Manager'": "disponible pour les montages liés LXC via 'LXC Mount Manager'",
+  "available in this same GPU and TPU menu.": "disponible dans ce même menu GPU et TPU.",
+  "backup at /etc/fstab.proxmenux.bak": "sauvegarde sur /etc/fstab.proxmenux.bak",
+  "ban": "interdire",
+  "blocking issue(s).": "problème(s) bloquant(s).",
+  "btrfs — Proxmox dir storage (snapshots, compression)": "btrfs — Stockage du répertoire Proxmox (instantanés, compression)",
+  "btrfs — snapshots and compression": "btrfs — instantanés et compression",
+  "but it does not match the one used to create the backup. Replace it with the correct keyfile from the source host and retry.": "mais il ne correspond pas à celui utilisé pour créer la sauvegarde.Remplacez-le par le fichier de clés correct de l'hôte source et réessayez.",
+  "bytes": "octets",
+  "can write to": "peut écrire à",
+  "chmod 1777 + setfacl o::rwx (applied on the NFS share from this host)": "chmod 1777 + setfacl o::rwx (appliqué sur le partage NFS de cet hôte)",
+  "chmod failed — NFS server may be restricting changes from root": "chmod a échoué — Le serveur NFS restreint peut-être les modifications depuis la racine",
+  "chown/chmod failed — likely unprivileged CT against host bind mount. Falling back to ACL.": "chown/chmod a échoué - CT probablement non privilégié contre le montage de liaison de l'hôte. Revenir à ACL.",
+  "content:": "contenu:",
+  "custom path(s) saved.": "chemin(s) personnalisé(s) enregistré(s).",
+  "default": "défaut",
+  "delete the credentials file (if any)": "supprimer le fichier d'informations d'identification (le cas échéant)",
+  "delete the matching line from /etc/fstab": "supprimez la ligne correspondante de /etc/fstab",
+  "descriptor + VMDK files": "descripteur + fichiers VMDK",
+  "device(s) added to VM": "périphérique(s) ajouté(s) à la VM",
+  "devices": "appareils",
+  "did not become ready. Skipping.": "n'est pas devenu prêt. Saut.",
+  "disk(s) added to CT": "disque(s) ajouté(s) à CT",
+  "disk(s) added to VM": "disque(s) ajouté(s) à la VM",
+  "dkms.conf generated.": "dkms.conf généré.",
+  "does not exist on this host. Path not added.": "n'existe pas sur cet hôte. Chemin non ajouté.",
+  "does not exist. Exiting.": "n'existe pas. Sortir.",
+  "driver:": "conducteur:",
+  "exFAT (portable: Windows/Linux/macOS)": "exFAT (portable : Windows/Linux/macOS)",
+  "exFAT tools installed successfully.": "Outils exFAT installés avec succès.",
+  "ext4  — Proxmox dir storage (recommended)": "ext4 — Stockage du répertoire Proxmox (recommandé)",
+  "ext4  — recommended, most compatible": "ext4 — recommandé, le plus compatible",
+  "fail2ban-client could not communicate with the server": "fail2ban-client n'a pas pu communiquer avec le serveur",
+  "fail2ban-client successfully communicated with the server": "fail2ban-client a communiqué avec succès avec le serveur",
+  "failed:": "échoué:",
+  "feranick fork unreachable. Falling back to google/gasket-driver...": "fourchette de Feranick inaccessible. Revenir à google/gasket-driver...",
+  "feranick/gasket-driver cloned (actively maintained, kernel 6.12+ ready).": "feranick/gasket-driver cloné (maintenu activement, noyau 6.12+ prêt).",
+  "file?": "déposer?",
+  "files": "fichiers",
+  "files/folders": "fichiers/dossiers",
+  "filesystem. Skipping format.": "système de fichiers. Sauter le format.",
+  "filesystem...": "système de fichiers...",
+  "for better performance and stability": "pour de meilleures performances et stabilité",
+  "for next boot (needs reboot to take effect)": "pour le prochain démarrage (nécessite un redémarrage pour prendre effet)",
+  "for this policy and may fail after first use or on subsequent VM starts.": "pour cette stratégie et peut échouer après la première utilisation ou lors des démarrages ultérieurs de la VM.",
+  "formatted as": "formaté comme",
+  "found": "trouvé",
+  "from Proxmox web interface (you will be asked)": "depuis l'interface web de Proxmox (il vous sera demandé)",
+  "from container": "du conteneur",
+  "from the GPUs and Coral-TPU menu first, then run this option again.": "à partir du menu GPU et Coral-TPU, puis réexécutez cette option.",
+  "fstab entry exists": "l'entrée fstab existe",
+  "fstab line:": "ligne fstab :",
+  "fstab references UUIDs/devices not present on this host:": "fstab fait référence aux UUID/périphériques non présents sur cet hôte :",
+  "gasket DKMS entries removed.": "les entrées du joint DKMS ont été supprimées.",
+  "gawk installed": "bouche bée installé",
+  "google/gasket-driver cloned (fallback — will apply local patches).": "google/gasket-driver cloné (repli – appliquera les correctifs locaux).",
+  "gpg not found; trying apt-key fallback": "gpg introuvable ; essayer la solution de secours apt-key",
+  "gzip replaced with pigz wrapper successfully": "gzip remplacé avec succès par le wrapper pigz",
+  "has": "a",
+  "has a different MAC than the backup — update any DHCP static reservation": "a un MAC différent de celui de la sauvegarde – mettre à jour toute réservation statique DHCP",
+  "has a new MAC": "a un nouveau MAC",
+  "has only": "n'a que",
+  "host fstab only (not registered as Proxmox storage)": "hôte fstab uniquement (non enregistré comme stockage Proxmox)",
+  "hostpci entries for all IOMMU group devices": "entrées hostpci pour tous les périphériques du groupe IOMMU",
+  "hostpci entries for selected GPU functions (full IOMMU group will be enforced after reboot)": "Entrées hostpci pour les fonctions GPU sélectionnées (le groupe IOMMU complet sera appliqué après le redémarrage)",
+  "hour(s)": "heures)",
+  "iSCSI Content Type": "Type de contenu iSCSI",
+  "iSCSI Daemon (iscsid): RUNNING": "Démon iSCSI (iscsid) : EN COURS D'EXÉCUTION",
+  "iSCSI Daemon (iscsid): STOPPED": "Démon iSCSI (iscsid) : ARRÊTÉ",
+  "iSCSI Host Manager - Proxmox Host": "Gestionnaire d'hôtes iSCSI - Hôte Proxmox",
+  "iSCSI Initiator: AVAILABLE": "Initiateur iSCSI : DISPONIBLE",
+  "iSCSI Initiator: NOT INSTALLED": "Initiateur iSCSI : NON INSTALLÉ",
+  "iSCSI Portal": "Portail iSCSI",
+  "iSCSI Storages in Proxmox": "Stockages iSCSI dans Proxmox",
+  "iSCSI Storages:": "Stockages iSCSI :",
+  "iSCSI discovery failed": "La découverte iSCSI a échoué",
+  "iSCSI port": "Port iSCSI",
+  "iSCSI service is running on the target": "Le service iSCSI est en cours d'exécution sur la cible",
+  "iSCSI storage added successfully to Proxmox!": "Stockage iSCSI ajouté avec succès à Proxmox !",
+  "iSCSI storage provides raw block devices for VM disk images.": "Le stockage iSCSI fournit des périphériques de bloc bruts pour les images disque de VM.",
+  "iSCSI tools installed": "Outils iSCSI installés",
+  "iftop usage": "utilisation de l'iftop",
+  "imported:": "importé:",
+  "in CT": "en CT",
+  "initramfs updated": "initramfs mis à jour",
+  "initramfs updated.": "initramfs mis à jour.",
+  "installed but command not immediately available": "installé mais la commande n'est pas immédiatement disponible",
+  "installed correctly and available": "installé correctement et disponible",
+  "installed in CT": "installé en CT",
+  "installed inside CT": "installé à l'intérieur du CT",
+  "installed successfully.": "installé avec succès.",
+  "intel-gpu-tools installed successfully": "Intel-Gpu-Tools installé avec succès",
+  "intel-gpu-tools is already installed:": "intel-gpu-tools est déjà installé :",
+  "intel-gpu-tools is up to date": "Intel-Gpu-Tools est à jour",
+  "intel-gpu-tools uninstalled successfully": "Intel-Gpu-Tools désinstallé avec succès",
+  "intel-gpu-tools updated to": "Intel-Gpu-Tools mis à jour vers",
+  "intel_iommu/amd_iommu is set in cmdline but no IOMMU groups exist — IOMMU appears disabled in BIOS. Enable VT-d / AMD-Vi in firmware before continuing.": "intel_iommu/amd_iommu est défini dans cmdline mais aucun groupe IOMMU n'existe — IOMMU semble désactivé dans le BIOS. Activez VT-d / AMD-Vi dans le firmware avant de continuer.",
+  "interfaces": "interfaces",
+  "into an LXC.": "dans un LXC.",
+  "iperf3 - Bandwidth test": "iperf3 - Test de bande passante",
+  "iperf3 - Bandwidth test (Client mode)": "iperf3 - Test de bande passante (mode Client)",
+  "iperf3 - Bandwidth test (Server mode)": "iperf3 - Test de bande passante (mode serveur)",
+  "iperf3 client": "client iperf3",
+  "iperf3 client output": "sortie du client iperf3",
+  "iperf3 server": "serveur iperf3",
+  "iperf3 server is running on": "Le serveur iperf3 fonctionne sur",
+  "iperf3 server output": "sortie du serveur iperf3",
+  "iperf3 test failed": "Le test iperf3 a échoué",
+  "iptraf-ng usage": "utilisation d'iptraf-ng",
+  "is UNPRIVILEGED.": "n'est PAS PRIVILÉGIÉ.",
+  "is a Physical Function with": "est une fonction physique avec",
+  "is already assigned to the following VM(s) or CT(s):": "est déjà attribué aux VM ou CT suivants :",
+  "is already installed. Do you want to reinstall it? This will perform a clean uninstall first.": "est déjà installé. Voulez-vous le réinstaller ? Cela effectuera d’abord une désinstallation propre.",
+  "is already unprivileged.": "est déjà sans privilège.",
+  "is an SR-IOV Virtual Function (VF). Its parent Physical Function is": "est une fonction virtuelle (VF) SR-IOV. Sa fonction physique parente est",
+  "is in use by running VM": "est utilisé en exécutant la VM",
+  "is in use by the following running VM(s) or CT(s):": "est utilisé par les VM ou CT en cours d'exécution suivants :",
+  "is mounted at": "est monté à",
+  "is not configured as machine type q35.": "n'est pas configuré comme type de machine q35.",
+  "is not in the patch.sh supported list. The patch may no-op or fail; review keylase/nvidia-patch README before continuing.": "n'est pas dans la liste des patch.sh pris en charge. Le correctif peut ne pas fonctionner ou échouer ; consultez le fichier README keylase/nvidia-patch avant de continuer.",
+  "is not supported by the official Google libedgetpu APT repository.": "n'est pas pris en charge par le référentiel officiel Google libedgetpu APT.",
+  "is referenced in the following stopped VM(s)/CT(s):": "est référencé dans les VM/CT arrêtés suivants :",
+  "journald MaxLevelStore is adequate for auth logging": "journald MaxLevelStore est adéquat pour la journalisation d'authentification",
+  "journald drop-in created: /etc/systemd/journald.conf.d/proxmenux-loglevel.conf": "Journald drop-in créé : /etc/systemd/journald.conf.d/proxmenux-loglevel.conf",
+  "journald log level restored": "niveau de journalisation restauré",
+  "journald restarted - auth messages will now be stored": "journald redémarré - les messages d'authentification seront désormais stockés",
+  "jq is required for this operation but is not installed.": "jq est requis pour cette opération mais n'est pas installé.",
+  "jq is required to apply updates from this menu.": "jq est requis pour appliquer les mises à jour à partir de ce menu.",
+  "jq not available — skipping rollback execution": "jq non disponible – ignorer l'exécution de la restauration",
+  "keep-daily (0 disables)": "garder quotidiennement (0 désactive)",
+  "keep-hourly (0 disables)": "garder toutes les heures (0 désactive)",
+  "keep-last (0 disables)": "garder-dernier (0 désactive)",
+  "keep-monthly (0 disables)": "garder-mensuel (0 désactive)",
+  "keep-weekly (0 disables)": "garder-hebdomadaire (0 désactive)",
+  "keep-yearly (0 disables)": "conserver annuellement (0 désactive)",
+  "keeping current settings": "conserver les paramètres actuels",
+  "kexec configured successfully. Use the command: reboot-quick": "kexec configuré avec succès. Utilisez la commande : reboot-quick",
+  "kexec-pve service enabled": "Service kexec-pve activé",
+  "kexec-pve service file created": "fichier de service kexec-pve créé",
+  "kexec-tools and related settings removed": "kexec-tools et paramètres associés supprimés",
+  "kexec-tools installed successfully": "kexec-tools installé avec succès",
+  "kexec-tools is not installed or already removed.": "kexec-tools n'est pas installé ou déjà supprimé.",
+  "log2ram completely removed from system": "log2ram complètement supprimé du système",
+  "manually inside the container before starting it.": "manuellement à l'intérieur du conteneur avant de le démarrer.",
+  "manually inside the container.": "manuellement à l'intérieur du conteneur.",
+  "maximum performance": "performances maximales",
+  "may be closed — trying discovery anyway...": "peut être fermé — essayez quand même la découverte...",
+  "missing": "manquant",
+  "mkfs.btrfs not found. Install btrfs-progs and retry.": "mkfs.btrfs introuvable. Installez btrfs-progs et réessayez.",
+  "more": "plus",
+  "mount.cifs command not found after installation.": "Commande mount.cifs introuvable après l'installation.",
+  "mount.nfs command not found after installation.": "Commande mount.nfs introuvable après l'installation.",
+  "never": "jamais",
+  "nftables not available - using iptables ban action": "nftables non disponible - utilisation de l'action d'interdiction iptables",
+  "no": "non",
+  "no (kdf=none, not needed)": "non (kdf=aucun, pas nécessaire)",
+  "no (no escrow blob — set a recovery passphrase to enable recovery)": "non (pas de blob de dépôt fiduciaire – définissez une phrase secrète de récupération pour activer la récupération)",
+  "no passphrase": "pas de phrase secrète",
+  "no password": "pas de mot de passe",
+  "no_root_squash": "no_root_squash",
+  "non-ProxMenux .tar archive(s) in this path": "Archive(s) .tar non-ProxMenux dans ce chemin",
+  "not found.": "pas trouvé.",
+  "not installed": "non installé",
+  "not reliable on this hardware due to the following limitations": "non fiable sur ce matériel en raison des limitations suivantes",
+  "nouveau driver has been blacklisted.": "Le pilote nouveau a été mis sur liste noire.",
+  "nouveau module unloaded after initramfs rebuild.": "module nouveau déchargé après la reconstruction d'initramfs.",
+  "nouveau module unloaded successfully.": "nouveau module déchargé avec succès.",
+  "nouveau still active. Proceeding with installation. A reboot will be required for the driver to work.": "nouveau toujours actif. Poursuite de l'installation. Un redémarrage sera nécessaire pour que le pilote fonctionne.",
+  "now": "maintenant",
+  "now?": "maintenant?",
+  "nvidia-smi not found after install. Check log:": "nvidia-smi introuvable après l'installation. Journal de vérification :",
+  "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi introuvable dans PATH. Veuillez vérifier l'installation du pilote.",
+  "nvidia-smi not found in container": "nvidia-smi introuvable dans le conteneur",
+  "of": "de",
+  "of free disk space.": "d'espace disque libre.",
+  "older firmware may increase passthrough instability": "un firmware plus ancien peut augmenter l'instabilité du relais",
+  "on SSD/NVMe pools that support discard": "sur les pools SSD/NVMe prenant en charge la suppression",
+  "openssl encryption failed.": "Le cryptage openssl a échoué.",
+  "openssl is not installed — cannot create recovery copy. Install openssl and retry.": "openssl n'est pas installé - impossible de créer une copie de récupération. Installez openssl et réessayez.",
+  "or format it manually using external tools.": "ou formatez-le manuellement à l’aide d’outils externes.",
+  "or use the ProxMenux LXC Mount Manager.": "ou utilisez le gestionnaire de montage ProxMenux LXC.",
+  "orphan iface lines, no impact on restore": "lignes iface orphelines, aucun impact sur la restauration",
+  "other .tar archive(s) — not ProxMenux host backups (e.g. PVE vzdump or unrelated tarballs).": "autres archives .tar - pas les sauvegardes de l'hôte ProxMenux (par exemple, vzdump PVE ou archives tar sans rapport).",
+  "packages (this may take a few minutes)...": "packages (cela peut prendre quelques minutes)...",
+  "packages.": "paquets.",
+  "parent PF:": "PF parent :",
+  "partition(s). Partition table preserved.": "partition(s). Table de partition conservée.",
+  "paths for next boot (/etc/pve, guests, drivers, ...)": "chemins pour le prochain démarrage (/etc/pve, invités, pilotes, ...)",
+  "pci_passthrough_helpers.sh missing — SR-IOV / orphan-audio guards will be skipped": "pci_passthrough_helpers.sh manquant — Les gardes SR-IOV / orphelin-audio seront ignorés",
+  "pct exec authorization failed": "échec de l'autorisation d'exécution PCT",
+  "pct push failed. Check log:": "La poussée PCT a échoué. Journal de vérification :",
+  "pending (reboot required to enumerate full group)": "en attente (redémarrage requis pour énumérer le groupe complet)",
+  "pigz configuration completed": "configuration pigz terminée",
+  "pigz enabled in vzdump configuration": "pigz activé dans la configuration de vzdump",
+  "pigz installed successfully": "pigz installé avec succès",
+  "pigz removed": "cochon supprimé",
+  "pigz wrapper script created": "Script wrapper pigz créé",
+  "port": "port",
+  "portmapper/rpcbind has been disabled and removed": "portmapper/rpcbind a été désactivé et supprimé",
+  "proxmox-backup-client reported:": "proxmox-backup-client a signalé :",
+  "proxmox-boot-tool refreshed": "proxmox-boot-tool actualisé",
+  "pve-enterprise.list update skipped (no change)": "Mise à jour de pve-enterprise.list ignorée (aucun changement)",
+  "pve-enterprise.list updated to Trixie": "pve-enterprise.list mis à jour vers Trixie",
+  "pvecm command not found (might not be in a cluster)": "Commande pvecm introuvable (peut-être pas dans un cluster)",
+  "pvesm command found": "commande pvesm trouvée",
+  "pvesm command not found. This should not happen on Proxmox.": "Commande pvesm introuvable. Cela ne devrait pas arriver sur Proxmox.",
+  "pvesm not available.": "pvesm non disponible.",
+  "pvesm not found.": "pvesm introuvable.",
+  "pvesm path failed, trying manual detection...": "Échec du chemin pvesm, tentative de détection manuelle...",
+  "pvesm status failed": "le statut pvesm a échoué",
+  "raw USB disk — no filesystem (will be FORMATTED)": "disque USB brut — pas de système de fichiers (sera FORMATÉ)",
+  "reboot-quick alias added": "alias de redémarrage rapide ajouté",
+  "recommended": "recommandé",
+  "remapped users": "utilisateurs remappés",
+  "remove the (now-empty) directory if possible": "supprimez le répertoire (maintenant vide) si possible",
+  "removed from Proxmox": "supprimé de Proxmox",
+  "removed successfully from Proxmox.": "supprimé avec succès de Proxmox.",
+  "requires the package": "nécessite le paquet",
+  "restarted successfully": "redémarré avec succès",
+  "restoring /etc/network would lose connectivity": "la restauration de /etc/network perdrait la connectivité",
+  "restoring on:": "restauration sur :",
+  "retries": "nouvelles tentatives",
+  "reverse proxy": "proxy inverse",
+  "root and real users only": "utilisateurs root et réels uniquement",
+  "rpcbind service has been disabled and stopped": "Le service rpcbind a été désactivé et arrêté",
+  "running": "en cours d'exécution",
+  "safe paths now (configs, packages, /etc, /root, ...)": "chemins sécurisés maintenant (configurations, packages, /etc, /root, ...)",
+  "same MAC": "même MAC",
+  "seconds (default)": "secondes (par défaut)",
+  "see log:": "voir le journal :",
+  "selected path(s):": "chemin(s) sélectionné(s) :",
+  "server": "serveur",
+  "server IP or hostname:": "IP du serveur ou nom d'hôte :",
+  "server?": "serveur?",
+  "servers found on the network.": "serveurs trouvés sur le réseau.",
+  "servers found.": "serveurs trouvés.",
+  "sha256sum not found. Cannot verify Borg binary.": "somme sha256 introuvable. Impossible de vérifier le binaire Borg.",
+  "showmount command is not working properly.": "La commande showmount ne fonctionne pas correctement.",
+  "showmount command not found after installation.": "Commande showmount introuvable après l'installation.",
+  "single portable archive": "archive portable unique",
+  "skipped (already exist)": "ignoré (existe déjà)",
+  "smbclient command is not working properly.": "La commande smbclient ne fonctionne pas correctement.",
+  "smbclient command not found after installation.": "Commande smbclient introuvable après l'installation.",
+  "sources.list update skipped (no change)": "mise à jour de sources.list ignorée (aucun changement)",
+  "sources.list updated to Trixie": "sources.list mis à jour vers Trixie",
+  "ssh-keygen failed. Cannot create a new SSH key.": "ssh-keygen a échoué. Impossible de créer une nouvelle clé SSH.",
+  "standard performance": "performances standards",
+  "start/restart failures and reset instability.": "échecs de démarrage/redémarrage et réinitialisation de l'instabilité.",
+  "started successfully.": "démarré avec succès.",
+  "started.": "commencé.",
+  "startup/restart errors are likely.": "des erreurs de démarrage/redémarrage sont probables.",
+  "stop source VM first": "arrêter d'abord la VM source",
+  "stopped": "arrêté",
+  "storage yet.": "stockage pour le moment.",
+  "storage(s) from backup exist on target": "le ou les stockages de la sauvegarde existent sur la cible",
+  "storage.": "stockage.",
+  "successfully formatted with": "formaté avec succès avec",
+  "suggested:": "suggéré:",
+  "switch_gpu_mode.sh was not found.": "switch_gpu_mode.sh n'a pas été trouvé.",
+  "sysfs ROM dump failed — trying ACPI VFCT table...": "Échec du vidage de la ROM sysfs - tentative de la table ACPI VFCT...",
+  "systemctl restart networking failed:": "échec du redémarrage du réseau systemctl :",
+  "systemd OnCalendar expression": "expression systemd OnCalendar",
+  "this distribution": "cette répartition",
+  "to": "à",
+  "to CT": "au CT",
+  "to VM": "vers la machine virtuelle",
+  "to move the GPU safely.": "pour déplacer le GPU en toute sécurité.",
+  "to run without being killed by the OOM killer.": "courir sans être tué par le tueur OOM.",
+  "to sharedfiles group": "au groupe de fichiers partagés",
+  "total": "total",
+  "umount the path if currently mounted": "démonter le chemin s'il est actuellement monté",
+  "updating NVIDIA userspace libs": "mise à jour des bibliothèques d'espace utilisateur NVIDIA",
+  "user packages missing — will be installed automatically:": "packages utilisateur manquants – seront installés automatiquement :",
+  "users": "utilisateurs",
+  "users (for unprivileged compatibility)": "utilisateurs (pour une compatibilité non privilégiée)",
+  "using": "en utilisant",
+  "using direct path (not guaranteed to survive reboots).": "en utilisant un chemin direct (il n'est pas garanti de survivre aux redémarrages).",
+  "vCPUs:": "Processeurs virtuels :",
+  "vfio-pci IDs configured": "ID vfio-pci configurés",
+  "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "ID vfio-pci dans /etc/modprobe.d/vfio.conf",
+  "vzdump backup speed optimization completed": "Optimisation de la vitesse de sauvegarde de vzdump terminée",
+  "was": "était",
+  "wipefs failed on": "les wipefs ont échoué",
+  "with": "avec",
+  "with the password you provided.": "Message technique pour Proxmox et l'informatique.Traduisez : avec le mot de passe que vous avez fourni.",
+  "xfs   — Proxmox dir storage (large files and VMs)": "xfs — Stockage du répertoire Proxmox (fichiers volumineux et machines virtuelles)",
+  "xfs   — better for large files": "xfs – meilleur pour les gros fichiers",
+  "years old": "ans",
+  "yes": "oui",
+  "yes (scrypt-unlock passphrase stored)": "oui (phrase secrète de déverrouillage scrypt stockée)",
+  "yes (survives reboot)": "oui (survit au redémarrage)",
+  "yes (via PBS escrow + recovery passphrase)": "oui (via le séquestre PBS + phrase secrète de récupération)",
+  "zeroed.": "mis à zéro.",
+  "zfs   — Proxmox ZFS pool storage": "zfs — Stockage en pool Proxmox ZFS",
+  "zfs-auto-snapshot installed successfully": "zfs-auto-snapshot installé avec succès",
+  "zfs-auto-snapshot is already installed": "zfs-auto-snapshot est déjà installé",
+  "zfs-auto-snapshot removed (existing snapshots preserved on the pool)": "zfs-auto-snapshot supprimé (instantanés existants conservés sur le pool)",
+  "zpool command not found. Install zfsutils-linux and retry.": "Commande zpool introuvable. Installez zfsutils-linux et réessayez.",
+  "zpool not found. Install zfsutils-linux and retry.": "zpool introuvable. Installez zfsutils-linux et réessayez.",
+  "— Full/Custom restore will skip kernel-tied paths": "— La restauration complète/personnalisée ignorera les chemins liés au noyau",
+  "— disk may be busy. Skipping fstab removal.": "— le disque est peut-être occupé. Ignorer la suppression de fstab.",
+  "— restore proceeds as same-version (verified safe)": "— restaurer le produit avec la même version (coffre-fort vérifié)",
+  "— safe restore mode will skip boot/kernel/apt config": "— le mode de restauration sécurisé ignorera la configuration de démarrage/noyau/apt",
+  "— that part works on any distro and is harmless.": "- cette partie fonctionne sur n'importe quelle distribution et est inoffensive.",
+  "• Both: mounts twice (pvesm + an independent fstab entry)": "• Les deux : se monte deux fois (pvesm + une entrée fstab indépendante)",
+  "• Both: registers as Proxmox storage AND keeps the mount available for LXC bind-mounts": "• Les deux : s'enregistre en tant que stockage Proxmox ET conserve le support disponible pour les montages liés LXC.",
+  "• Both: two independent CIFS mounts (one for Proxmox UI, one for LXC bind-mounts with open perms)": "• Les deux : deux montages CIFS indépendants (un pour l'interface utilisateur de Proxmox, un pour les montages liés LXC avec autorisations ouvertes)",
+  "• Clean up remapped users": "• Nettoyer les utilisateurs remappés",
+  "• Host fstab: mounted at a path you choose, NOT visible as Proxmox storage": "• Hôte fstab : monté sur un chemin que vous choisissez, NON visible en tant que stockage Proxmox",
+  "• Host fstab: mounted at host path only, for LXC bind-mounts (NOT visible as Proxmox storage)": "• Hôte fstab : monté sur le chemin de l'hôte uniquement, pour les montages liés LXC (NON visible en tant que stockage Proxmox)",
+  "• Host fstab: mounted with open uid/gid/file_mode at a path you choose, ideal for LXC bind-mounts": "• Hôte fstab : monté avec open uid/gid/file_mode sur un chemin que vous choisissez, idéal pour les montages liés LXC",
+  "• Proxmox storage (pvesm): visible in Datacenter > Storage, mount at /mnt/pve/<id>": "• Stockage Proxmox (pvesm) : visible dans Datacenter > Stockage, monté sur /mnt/pve/<id>",
+  "• Proxmox storage (pvesm): visible in Datacenter > Storage, usable for VMs/backups/ISOs": "• Stockage Proxmox (pvesm) : visible dans Datacenter > Stockage, utilisable pour les VM/sauvegardes/ISO",
+  "• Remove Samba groups": "• Supprimer les groupes Samba",
+  "• Remove all Samba users": "• Supprimer tous les utilisateurs Samba",
+  "• Remove all exports": "• Supprimer toutes les exportations",
+  "• Remove all shares": "• Supprimer tous les partages",
+  "• Remove universal sharedfiles group": "• Supprimer le groupe de fichiers partagés universels",
+  "• Stop all NFS services": "• Arrêtez tous les services NFS",
+  "• Stop all Samba services": "• Arrêtez tous les services Samba",
+  "• Uninstall NFS packages": "• Désinstaller les packages NFS",
+  "• Uninstall Samba packages": "• Désinstaller les packages Samba",
+  "← Return": "← Retour",
+  "− Remove a path": "− Supprimer un chemin",
+  "──── [ Finish and continue ] ────": "──── [ Terminer et continuer ] ────",
+  "─────── Custom profile (choose paths manually) ───────": "─────── Profil personnalisé (choisir les chemins manuellement) ───────",
+  "────────────────── Default profile ───────────────────": "────────────────── Profil par défaut ───────────────────",
+  "⚠ Disk data will NOT be erased.": "⚠ Les données du disque ne seront PAS effacées.",
+  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ Le disque sera démonté et supprimé de /etc/fstab.",
+  "⚠ The /etc/fstab entry will be removed.": "⚠ L'entrée /etc/fstab sera supprimée.",
+  "⚠ The disk will be unmounted.": "⚠ Le disque sera démonté."
+}
diff --git a/lang/it.json b/lang/it.json
new file mode 100644
index 00000000..001cc16f
--- /dev/null
+++ b/lang/it.json
@@ -0,0 +1,5231 @@
+{
+  "# Alternative if you prefer screen": "# Alternativa se preferisci lo schermo",
+  "# Recommended: avoids disconnection during upgrade": "# Consigliato: evita la disconnessione durante l'aggiornamento",
+  "(Checked entries will be removed. Uncheck to keep in VM.)": "(Le voci selezionate verranno rimosse. Deseleziona per mantenerle nella VM.)",
+  "(Import is selected by default — required for disk image imports)": "(L'importazione è selezionata per impostazione predefinita: è necessaria per l'importazione di immagini disco)",
+  "(Only the host directory is modified. Nothing inside the container is changed.": "(Viene modificata solo la directory host. Non viene modificato nulla all'interno del contenitore.",
+  "(common default on Debian/LXC: PermitRootLogin prohibit-password).": "(impostazione predefinita comune su Debian/LXC: PermitRootLogin proibisce-password).",
+  "(disabled)": "(disabilitato)",
+  "(e.g.": "(es.",
+  "(for unprivileged LXCs)": "(per LXC non privilegiati)",
+  "(if only privileged LXCs need write access)": "(se solo gli LXC privilegiati necessitano dell'accesso in scrittura)",
+  "(make.log not found — DKMS may have failed before invoking make)": "(make.log non trovato: DKMS potrebbe non essere riuscito prima di richiamare make)",
+  "(need ≥ 1024MB)": "(richiede ≥ 1024 MB)",
+  "(no credentials file — guest mode)": "(nessun file delle credenziali - modalità ospite)",
+  "(none)": "(nessuno)",
+  "(not mounted — will be mounted)": "(non montato, verrà montato)",
+  "(only on SSD/NVMe) to protect your disk": "(solo su SSD/NVMe) per proteggere il tuo disco",
+  "(parent PF:": "(PF genitore:",
+  "(recommended)": "(raccomandato)",
+  "(same MAC — restored config adjusted automatically)": "(stesso MAC: configurazione ripristinata regolata automaticamente)",
+  ")": ")",
+  "+ Add a path": "+ Aggiungi un percorso",
+  "+ Add new Borg target": "+ Aggiungi un nuovo bersaglio Borg",
+  "+ Add new PBS manually": "+ Aggiungi manualmente il nuovo PBS",
+  "- Delete a saved target": "- Elimina un bersaglio salvato",
+  "/backup": "/backup",
+  "/etc/exports file does not exist.": "Il file /etc/exports non esiste.",
+  "/etc/fstab updated — permissions will persist after reboot": "/etc/fstab aggiornato: le autorizzazioni persisteranno dopo il riavvio",
+  "/etc/network controls active interfaces. Applying may immediately change or drop network connectivity, including active SSH sessions.": "/etc/network controlla le interfacce attive. L'applicazione potrebbe modificare o interrompere immediatamente la connettività di rete, incluse le sessioni SSH attive.",
+  "/etc/network/interfaces uses allow-hotplug. Renaming interfaces via systemd .link can break that flow — review the file after reboot.": "/etc/network/interfaces utilizza consent-hotplug. Rinominare le interfacce tramite systemd .link può interrompere questo flusso: rivedere il file dopo il riavvio.",
+  "/etc/pve is managed by pmxcfs (cluster filesystem). Applying this on a running node can corrupt cluster state. Use 'Export to file' and apply it manually during a maintenance window.": "/etc/pve è gestito da pmxcfs (filesystem del cluster). L'applicazione di questa procedura su un nodo in esecuzione può danneggiare lo stato del cluster. Utilizza \"Esporta su file\" e applicalo manualmente durante una finestra di manutenzione.",
+  "/etc/samba/smb.conf file does not exist.": "Il file /etc/samba/smb.conf non esiste.",
+  "/var/lib/pve-cluster is live cluster data. Never restore this while the node is running. Use 'Export to file' for manual recovery only.": "/var/lib/pve-cluster sono dati di cluster attivi. Non ripristinarlo mai mentre il nodo è in esecuzione. Utilizzare \"Esporta su file\" solo per il ripristino manuale.",
+  "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump (percorso vzdump predefinito di Proxmox)",
+  "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump (predefinito di Proxmox)",
+  "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = bit adesivo + rwx per tutti. Non è necessario alcun gruppo condiviso.",
+  "====== PVE UPDATE COMPLETED ======": "====== AGGIORNAMENTO PVE COMPLETATO ======",
+  "A VirtIO ISO already exists. Do you want to overwrite it?": "Esiste già un ISO VirtIO. Vuoi sovrascriverlo?",
+  "A ZFS pool with this name already exists.": "Esiste già un pool ZFS con questo nome.",
+  "A ZFS pool with this name already exists:": "Esiste già un pool ZFS con questo nome:",
+  "A complete restore will:": "Un ripristino completo:",
+  "A host reboot is required after this change.": "Dopo questa modifica è necessario il riavvio dell'host.",
+  "A host reboot is required before starting the VM. Reboot now?": "È necessario il riavvio dell'host prima di avviare la VM. Riavviare adesso?",
+  "A job with this ID already exists.": "Esiste già un lavoro con questo ID.",
+  "A keyfile is installed at:": "un file di chiavi è installato in:",
+  "A newer version is available:": "È disponibile una versione più recente:",
+  "A reboot is required after installation to load the new kernel modules.": "Dopo l'installazione è necessario un riavvio per caricare i nuovi moduli del kernel.",
+  "A reboot is required for VFIO binding to take effect. Do you want to restart now?": "È necessario un riavvio affinché l'associazione VFIO abbia effetto. Vuoi riavviare adesso?",
+  "A reboot is required to apply the new GPU mode. Do you want to restart now?": "È necessario un riavvio per applicare la nuova modalità GPU. Vuoi riavviare adesso?",
+  "A reboot is required to finish the restore.": "È necessario un riavvio per completare il ripristino.",
+  "A reboot will be required to complete the restore.": "sarà necessario un riavvio per completare il ripristino.",
+  "A server reboot is recommended for all changes to take full effect.": "Si consiglia di riavviare il server affinché tutte le modifiche abbiano pieno effetto.",
+  "A system reboot is recommended to ensure all changes take effect.": "Si consiglia di riavviare il sistema per garantire che tutte le modifiche abbiano effetto.",
+  "ACL Status:": "Stato ACL:",
+  "ACL permissions applied for local access for user:": "ACL permissions applied for local access for user:",
+  "ADVANCED SETTINGS COMPLETE": "IMPOSTAZIONI AVANZATE COMPLETATE",
+  "ALL DATA ON": "TUTTI I DATI SU",
+  "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "TUTTI I DATI SU QUESTO DISCO SARANNO PERDUTI PERMANENTEMENTE!",
+  "ALL Utilities": "TUTTE le utenze",
+  "AMD CPU detected": "Rilevata CPU AMD",
+  "AMD CPU fixes applied successfully": "Le correzioni della CPU AMD sono state applicate correttamente",
+  "AMD GPU Tools installation completed!": "Installazione degli strumenti GPU AMD completata!",
+  "AMD GPU passthrough configured.": "Passthrough GPU AMD configurato.",
+  "AMD GPU(s) detected:": "GPU AMD rilevate:",
+  "AMD fixes have been successfully reverted": "Le correzioni AMD sono state ripristinate con successo",
+  "AMD mesa drivers installed.": "Driver AMD Mesa installati.",
+  "AMD softdep configured": "AMD softdep configurato",
+  "AMD softdep configured in /etc/modprobe.d/vfio.conf": "AMD softdep configurato in /etc/modprobe.d/vfio.conf",
+  "ANALYSIS SUMMARY": "SOMMARIO DELL'ANALISI",
+  "API returned an invalid timezone": "L'API ha restituito un fuso orario non valido",
+  "API tokens (Home Assistant, scripts) will keep working.": "I token API (Home Assistant, script) continueranno a funzionare.",
+  "APT IPv4 configuration completed": "Configurazione APT IPv4 completata",
+  "APT IPv4 configuration removed": "Configurazione APT IPv4 rimossa",
+  "APT and repositories": "APT e repository",
+  "APT configured to skip additional languages": "APT configurato per saltare lingue aggiuntive",
+  "APT configured to skip downloading additional languages": "APT configurato per saltare il download di lingue aggiuntive",
+  "APT configured to use IPv4": "APT configurato per utilizzare IPv4",
+  "APT index update failed after switching to no-subscription. See log:": "L'aggiornamento dell'indice APT non è riuscito dopo il passaggio alla modalità senza abbonamento. Vedi registro:",
+  "APT index update failed. See log:": "Aggiornamento dell'indice APT non riuscito. Vedi registro:",
+  "APT indexes updated for Trixie": "Indici APT aggiornati per Trixie",
+  "APT indexes updated for Trixie (no-subscription)": "Indici APT aggiornati per Trixie (senza abbonamento)",
+  "APT language configuration already set": "Configurazione della lingua APT già impostata",
+  "APT language configuration updated": "Configurazione della lingua APT aggiornata",
+  "APT language downloads restored": "Download della lingua APT ripristinati",
+  "APT package lists updated": "Elenchi dei pacchetti APT aggiornati",
+  "Aborted": "Abortito",
+  "About to restore": "In procinto di ripristinare",
+  "Absolute directory path to use as backup target:": "percorso assoluto della directory da utilizzare come destinazione del backup:",
+  "Absolute path to a file or directory you want backed up:": "Percorso assoluto di un file o di una directory di cui desideri eseguire il backup:",
+  "Accept routes from other nodes?": "Accetti percorsi da altri nodi?",
+  "Access Scope:": "Ambito di accesso:",
+  "Access profile:": "Profilo di accesso:",
+  "Account is not locked": "L'account non è bloccato",
+  "Action cancelled due to previous xshok-proxmox modifications.": "Azione annullata a causa di precedenti modifiche a xshok-proxmox.",
+  "Action:": "Azione:",
+  "Activate Monitor": "Attiva Monitor",
+  "Activate ProxMenux Monitor": "Attiva il monitor ProxMenux",
+  "Active": "Attivo",
+  "Active Connections": "Connessioni attive",
+  "Active exports:": "Esportazioni attive:",
+  "Active session:": "Sessione attiva:",
+  "Add Audio Passthrough": "Aggiungi pass-through audio",
+  "Add CIFS storage:": "Aggiungi spazio di archiviazione CIFS:",
+  "Add Controller or NVMe (PCI passthrough)": "Aggiungi controller o NVMe (passthrough PCI)",
+  "Add Controller or NVMe PCIe to VM": "Aggiungi controller o NVMe PCIe alla VM",
+  "Add Coral TPU to LXC": "Aggiungi Coral TPU a LXC",
+  "Add GPU to LXC": "Aggiungi GPU a LXC",
+  "Add GPU to LXC   (Intel | AMD | NVIDIA)": "Aggiungi GPU a LXC (Intel | AMD | NVIDIA)",
+  "Add GPU to VM    (Intel | AMD | NVIDIA)": "Aggiungi GPU alla VM (Intel | AMD | NVIDIA)",
+  "Add Local Disk   as Proxmox Storage": "Aggiungi disco locale come archivio Proxmox",
+  "Add Local Disk (Proxmox storage + host mount)": "Aggiungi disco locale (archiviazione Proxmox + montaggio host)",
+  "Add Local Disk as Host Mount (for LXC bind-mounts)": "Aggiungi disco locale come montaggio host (per montaggi bind LXC)",
+  "Add Local Disk as Proxmox Storage": "Aggiungi disco locale come archivio Proxmox",
+  "Add NFS Share as Proxmox Storage": "Aggiungi condivisione NFS come archivio Proxmox",
+  "Add NFS share    as Proxmox Storage": "Aggiungi condivisione NFS come Proxmox Storage",
+  "Add NFS storage:": "Aggiungi spazio di archiviazione NFS:",
+  "Add PBS": "Aggiungi PBS",
+  "Add Samba Share as Proxmox Storage": "Aggiungi condivisione Samba come spazio di archiviazione Proxmox",
+  "Add Samba share  as Proxmox Storage": "Aggiungi la condivisione Samba come Proxmox Storage",
+  "Add as IDE": "Aggiungi come IDE",
+  "Add as SATA": "Aggiungi come SATA",
+  "Add as SCSI": "Aggiungi come SCSI",
+  "Add as VirtIO": "Aggiungi come VirtIO",
+  "Add as disk (standard)": "Aggiungi come disco (standard)",
+  "Add bind mount to container:": "Aggiungi il supporto di associazione al contenitore:",
+  "Add color prompts and useful aliases to the terminal environment": "Aggiungi prompt colorati e alias utili all'ambiente terminale",
+  "Add custom path": "Aggiungi percorso personalizzato",
+  "Add disk to LXC container": "Aggiungi il disco al contenitore LXC",
+  "Add explicit privileged flag (optional but recommended):": "Aggiungi flag privilegiato esplicito (facoltativo ma consigliato):",
+  "Add export rule:": "Aggiungi regola di esportazione:",
+  "Add iSCSI Target as Proxmox Storage": "Aggiungi destinazione iSCSI come spazio di archiviazione Proxmox",
+  "Add iSCSI storage in Proxmox Storage": "aggiungi spazio di archiviazione iSCSI in Proxmox Storage",
+  "Add iSCSI storage in Proxmox:": "Aggiungi spazio di archiviazione iSCSI in Proxmox:",
+  "Add import disk": "Aggiungi disco di importazione",
+  "Add latest Ceph support": "aggiungi il supporto Ceph più recente",
+  "Add new PVE 9 enterprise repository (deb822 format) (Only if using enterprise):": "Aggiungi il nuovo repository enterprise PVE 9 (formato deb822) (solo se utilizzi enterprise):",
+  "Add physical disk to VM via": "Aggiungi disco fisico alla VM tramite",
+  "Add share block in /etc/samba/smb.conf:": "Aggiungi il blocco di condivisione in /etc/samba/smb.conf:",
+  "Add unprivileged flag to container configuration:": "Aggiungi flag senza privilegi alla configurazione del contenitore:",
+  "Add virtual disk": "Aggiungi disco virtuale",
+  "Add: Mount Host Directory into LXC": "Aggiungi: monta la directory host in LXC",
+  "Added to /etc/fstab": "Aggiunto a /etc/fstab",
+  "Added to /etc/fstab for permanent mounting.": "Aggiunto a /etc/fstab per il montaggio permanente.",
+  "Added to /etc/fstab using UUID": "Aggiunto a /etc/fstab utilizzando l'UUID",
+  "Added to /etc/fstab using device path": "Aggiunto a /etc/fstab utilizzando il percorso del dispositivo",
+  "Added to /etc/fstab.": "Aggiunto a /etc/fstab.",
+  "Added user": "Utente aggiunto",
+  "Adding": "Aggiunta",
+  "Adding CIFS storage to Proxmox...": "Aggiunta dello spazio di archiviazione CIFS a Proxmox...",
+  "Adding QEMU Guest Agent support...": "Aggiunta del supporto per l'agente guest QEMU...",
+  "Adding disk using the generated command to the selected VM": "Aggiunta del disco utilizzando il comando generato alla VM selezionata",
+  "Adding existing users to sharedfiles group...": "Aggiunta di utenti esistenti al gruppo sharedfiles...",
+  "Adding iSCSI storage to Proxmox...": "Aggiunta di spazio di archiviazione iSCSI a Proxmox...",
+  "Adding new share to smb.conf...": "Aggiunta di una nuova condivisione a smb.conf...",
+  "Adding this NVMe as a PCIe device (via 'Add Controller or NVMe PCIe to VM') gives better performance.": "L'aggiunta di questo NVMe come dispositivo PCIe (tramite \"Aggiungi controller o NVMe PCIe alla VM\") offre prestazioni migliori.",
+  "Adding to /etc/fstab for permanent mounting...": "Aggiunta a /etc/fstab per il montaggio permanente...",
+  "Additional audio function(s) to be added": "Ulteriori funzioni audio da aggiungere",
+  "Adjust network/CIDR to your environment.": "Adatta la rete/CIDR al tuo ambiente.",
+  "Adjust options if needed (vers=4,hard,timeo,...).": "Modifica le opzioni se necessario (vers=4,hard,timeo,...).",
+  "Adjusting systemd-journald limits to match Log2RAM size...": "Regolazione dei limiti di systemd-journald in modo che corrispondano alle dimensioni di Log2RAM...",
+  "Adjusts journald log level if needed (Proxmox defaults may block auth logs)": "Regola il livello di registro journald se necessario (le impostazioni predefinite di Proxmox potrebbero bloccare i registri di autenticazione)",
+  "Advanced": "Avanzato",
+  "Advanced Diagnostics": "Diagnostica avanzata",
+  "Advanced Network Diagnostics": "Diagnostica di rete avanzata",
+  "Affected LXC containers": "Contenitori LXC interessati",
+  "After completing GPU setup, start the VM manually when the host is ready.": "Dopo aver completato la configurazione della GPU, avvia manualmente la VM quando l'host è pronto.",
+  "After confirming, you will be asked to choose the NVIDIA driver version to install.": "Dopo la conferma, ti verrà chiesto di scegliere la versione del driver NVIDIA da installare.",
+  "After detailed analysis, no changes are needed.": "Dopo un'analisi dettagliata, non sono necessarie modifiche.",
+  "After detailed analysis, no cleanup is needed.": "Dopo un'analisi dettagliata, non è necessaria alcuna pulizia.",
+  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Dopo aver effettuato l'accesso, eseguire: ip a per ottenere l'indirizzo IP.\nQuindi, inserisci l'indirizzo IP nel tuo browser web in questo modo:\n  http://INDIRIZZO_IP\n\nQuesto aprirà la dashboard del sistema operativo Umbral.",
+  "After pasting on the server, ensure the file is chmod 600 and owned by": "dopo aver incollato sul server, assicurati che il file sia chmod 600 e sia di proprietà di",
+  "After reboot the system will be fully accessible (SSH, web UI, login), but the following components will be reinstalled in BACKGROUND — until they finish, commands like nvidia-smi may not yet be available:": "Dopo il riavvio, il sistema sarà completamente accessibile (SSH, interfaccia utente web, accesso), ma i seguenti componenti verranno reinstallati in BACKGROUND; fino al loro completamento, comandi come nvidia-smi potrebbero non essere ancora disponibili:",
+  "After reboot, these components will reinstall in background:": "Dopo il riavvio, questi componenti verranno reinstallati in background:",
+  "After reboot, verify PVE version:": "Dopo il riavvio, verifica la versione PVE:",
+  "After switching mode, reboot the host if requested.": "Dopo aver cambiato modalità, riavviare l'host se richiesto.",
+  "After that, run this script again to add it.": "Successivamente, esegui nuovamente questo script per aggiungerlo.",
+  "After the reboot you can follow the post-restore work live from ProxMenux Monitor → Backups tab (estimated time, per-component status, log tail, rollback delta).": "dopo il riavvio è possibile seguire in tempo reale il lavoro post-ripristino da ProxMenux Monitor → scheda Backup (tempo stimato, stato per componente, coda del registro, delta di rollback).",
+  "After the reboot, you will only be able to access the Proxmox host via:": "Dopo il riavvio, potrai accedere all'host Proxmox solo tramite:",
+  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Dopo questo passaggio LXC → VM, riavviare l'host in modo che il nuovo stato di associazione venga applicato in modo pulito.",
+  "Aliases added to .bashrc": "Alias ​​aggiunti a .bashrc",
+  "All": "Tutto",
+  "All Available Scripts": "Tutti gli script disponibili",
+  "All GPUs Already Assigned": "Tutte le GPU già assegnate",
+  "All ProxMenux optimizations are up to date.": "Tutte le ottimizzazioni di ProxMenux sono aggiornate.",
+  "All block devices:": "Tutti i dispositivi a blocchi:",
+  "All changes applied. No reboot required.": "Tutte le modifiche sono state applicate. Nessun riavvio richiesto.",
+  "All changes are reversible using the ProxMenux uninstaller.": "Tutte le modifiche sono reversibili utilizzando il programma di disinstallazione di ProxMenux.",
+  "All dependencies installed and verified.": "Tutte le dipendenze installate e verificate.",
+  "All detected GPUs are already assigned to this VM.": "Tutte le GPU rilevate sono già assegnate a questa VM.",
+  "All detected controllers/NVMe are already present in the selected VM.": "Tutti i controller/NVMe rilevati sono già presenti nella VM selezionata.",
+  "All disks may already be in use or mounted.": "Tutti i dischi potrebbero essere già in uso o montati.",
+  "All images imported and configured successfully": "Tutte le immagini sono state importate e configurate correttamente",
+  "All imports failed": "Tutte le importazioni sono fallite",
+  "All partitions and metadata removed.": "Tutte le partizioni e i metadati rimossi.",
+  "All physical interfaces from backup are present on target": "Tutte le interfacce fisiche del backup sono presenti sulla destinazione",
+  "All types      (images, backup, iso, vztmpl, snippets)": "Tutti i tipi (immagini, backup, iso, vztmpl, snippet)",
+  "All user-installed packages from the backup are present on this host": "Tutti i pacchetti installati dall'utente dal backup sono presenti su questo host",
+  "All users with UID and GID": "Tutti gli utenti con UID e GID",
+  "Allocate CPU Cores": "Assegnare i core della CPU",
+  "Allocate RAM in MiB": "Assegna la RAM in MiB",
+  "Already Mounted": "Già montato",
+  "Already configured": "Già configurato",
+  "Already installed — skipping": "già installato: saltato",
+  "Also comment any remaining 'bookworm' entries in *.list if present.": "Commenta anche eventuali voci rimanenti di 'bookworm' in *.list, se presenti.",
+  "Also install the VirtIO network driver during setup to enable network access.": "Installare anche il driver di rete VirtIO durante la configurazione per abilitare l'accesso alla rete.",
+  "Although VFIO can bind to this device, full passthrough to a VM is": "Sebbene VFIO possa collegarsi a questo dispositivo, il passthrough completo a una VM lo è",
+  "Amount of RAM in MiB (default: 4096)": "Quantità di RAM in MiB (impostazione predefinita: 4096)",
+  "An AMD dedicated GPU has been detected without FLR support": "È stata rilevata una GPU dedicata AMD senza supporto FLR",
+  "An AMD integrated GPU (APU) has been detected": "È stata rilevata una GPU integrata AMD (APU).",
+  "An Intel dedicated GPU has been detected without FLR support": "È stata rilevata una GPU Intel dedicata senza supporto FLR",
+  "An fstab entry already exists for:": "Esiste già una voce fstab per:",
+  "Analysis Tools": "Strumenti di analisi",
+  "Analyze Bridge Configuration": "Analizzare la configurazione del bridge",
+  "Analyze Network Configuration": "Analizzare la configurazione di rete",
+  "Analyzing Bridge Configuration - READ ONLY MODE": "Analisi della configurazione del bridge - MODALITÀ SOLA LETTURA",
+  "Analyzing Network Configuration - READ ONLY MODE": "Analisi della configurazione di rete - MODALITÀ SOLA LETTURA",
+  "Analyzing selected disks...": "Analisi dei dischi selezionati...",
+  "Analyzing system for available PCIe storage devices...": "Analisi del sistema per i dispositivi di archiviazione PCIe disponibili...",
+  "Apply": "Fare domanda a",
+  "Apply AMD CPU fixes": "applica le correzioni della CPU AMD",
+  "Apply Available Updates": "Applica gli aggiornamenti disponibili",
+  "Apply and restart services:": "Applicare e riavviare i servizi:",
+  "Apply available updates": "applica gli aggiornamenti disponibili",
+  "Apply boot/initramfs changes": "Applica le modifiche boot/initramfs",
+  "Apply fix now?": "Applicare la correzione adesso?",
+  "Apply fix now? (The share will be briefly remounted)": "Applicare la correzione adesso? (La condivisione verrà brevemente rimontata)",
+  "Apply network optimizations": "applica ottimizzazioni di rete",
+  "Apply read+write access for 'others' on the host directory?": "Applicare l'accesso in lettura+scrittura per \"altri\" nella directory host?",
+  "Applying AMD-specific fixes...": "Applicazione delle correzioni specifiche di AMD...",
+  "Applying Changes": "Applicazione delle modifiche",
+  "Applying Controller/NVMe passthrough to VM": "Applicazione del passthrough Controller/NVMe alla VM",
+  "Applying balanced memory optimization settings...": "Applicazione delle impostazioni di ottimizzazione della memoria bilanciata in corso...",
+  "Applying changes safely...": "Applicazione delle modifiche in modo sicuro...",
+  "Applying custom restore": "applicazione del ripristino personalizzato",
+  "Applying default VM configuration": "Applicazione della configurazione predefinita della VM",
+  "Applying host permissions for unprivileged LXC bind-mounts...": "Applicazione delle autorizzazioni host per i montaggi bind LXC non privilegiati...",
+  "Applying optimized logrotate configuration...": "Applicazione della configurazione logrotate ottimizzata...",
+  "Applying passthrough to CT": "Applicazione del passthrough a CT",
+  "Applying safe paths and preparing pending restore": "Applicazione di percorsi sicuri e preparazione del ripristino in sospeso",
+  "Applying selected LXC switch action": "Applicazione dell'azione di commutazione LXC selezionata",
+  "Archive deleted.": "Archivio eliminato.",
+  "Archive extracted.": "Archivio estratto.",
+  "Archive format": "Formato dell'archivio",
+  "Archive ready": "Archivio pronto",
+  "Archive size:": "Dimensioni dell'archivio:",
+  "Archive:": "Archivio:",
+  "Are you absolutely sure?": "Ne sei assolutamente sicuro?",
+  "Are you sure you want to continue?": "Sei sicuro di voler continuare?",
+  "Are you sure you want to delete this export?": "Sei sicuro di voler eliminare questa esportazione?",
+  "Are you sure you want to delete this share?": "Sei sicuro di voler eliminare questa condivisione?",
+  "Are you sure you want to remove these configurations?": "Sei sicuro di voler rimuovere queste configurazioni?",
+  "Are you sure you want to restore this backup?\nCurrent configuration will be overwritten.": "Sei sicuro di voler ripristinare questo backup?\nLa configurazione corrente verrà sovrascritta.",
+  "Are you sure you want to uninstall ProxMenux?": "Sei sicuro di voler disinstallare ProxMenux?",
+  "Are you sure you want to uninstall the selected optimizations.": "Sei sicuro di voler disinstallare le ottimizzazioni selezionate.",
+  "Are you sure you want to unmount this NFS share?": "Sei sicuro di voler smontare questa condivisione NFS?",
+  "Are you sure you want to unmount this Samba share?": "Sei sicuro di voler smontare questa condivisione Samba?",
+  "Are you sure?": "Sei sicuro?",
+  "As Proxmox storage": "Come spazio di archiviazione Proxmox",
+  "As host fstab mount only": "Solo come host fstab montato",
+  "Assign GPU PCI function to VM": "Assegna la funzione GPU PCI alla VM",
+  "Assign controller/NVMe passthrough": "Assegna controller/passthrough NVMe",
+  "Assigned to VM": "Assegnato a VM",
+  "Assigned to VM(s)": "Assegnato alle VM",
+  "Assigning imported disk to VM using the generated command": "Assegnazione del disco importato alla VM utilizzando il comando generato",
+  "Associated Audio Devices": "Dispositivi audio associati",
+  "Associated audio removed from VM": "Audio associato rimosso dalla VM",
+  "At least 5GB free space on root filesystem": "Almeno 5 GB di spazio libero sul file system root",
+  "At least one selected GPU is blocked by policy for GPU -> VM mode due to passthrough instability risk.": "Almeno una GPU selezionata è bloccata dai criteri per GPU -> modalità VM a causa del rischio di instabilità del passthrough.",
+  "Attach imported disk to VM": "Allega il disco importato alla VM",
+  "Attach to an existing PVE vzdump job (inherit schedule + retention)": "collega a un lavoro vzdump PVE esistente (pianificazione ereditaria + conservazione)",
+  "Attached to PVE job:": "Allegato al lavoro PVE:",
+  "Attempting automatic repair...": "Tentativo di riparazione automatica...",
+  "Attempting passthrough with this GPU typically results in": "Il tentativo di passthrough con questa GPU in genere dà come risultato",
+  "Attention: Removing the subscription banner may cause issues in the web interface after a future update.": "Attenzione: la rimozione del banner di abbonamento potrebbe causare problemi nell'interfaccia web dopo un futuro aggiornamento.",
+  "Audit completed. Press Enter to continue...": "Verifica completata. Premi Invio per continuare...",
+  "Auth key is required.": "È richiesta la chiave di autenticazione.",
+  "Auth:": "Autenticazione:",
+  "Authentication": "Autenticazione",
+  "Authentication Error": "Errore di autenticazione",
+  "Authentication failed.": "Autenticazione non riuscita.",
+  "Authentication required:": "Autenticazione richiesta:",
+  "Authentication:": "Autenticazione:",
+  "Authorization failed": "Autorizzazione fallita",
+  "Authorization successful": "Autorizzazione riuscita",
+  "Authorize this key on the server": "Autorizzare questa chiave sul server",
+  "Authorize via 'pct exec' (Borg server is an LXC on a PVE host I can SSH into)": "Autorizza tramite 'pct exec' (il server Borg è un LXC su un host PVE in cui posso accedere tramite SSH)",
+  "Authorized": "Autorizzato",
+  "Auto-detected firewall backend (nftables/iptables)": "Backend firewall rilevato automaticamente (nftables/iptables)",
+  "Auto-discover servers on network": "Individuazione automatica dei server sulla rete",
+  "Auto-negotiate:": "Negoziazione automatica:",
+  "Auto-start was skipped because GPU passthrough setup was requested.": "L'avvio automatico è stato saltato perché è stata richiesta la configurazione del passthrough della GPU.",
+  "Auto-sync enabled when /var/log exceeds 80% of": "Sincronizzazione automatica abilitata quando /var/log supera l'80% di",
+  "Auto-sync was not enabled": "La sincronizzazione automatica non era abilitata",
+  "Automated Post-Install Script": "Script post-installazione automatizzato",
+  "Automated post-installation script": "script post-installazione automatizzato",
+  "Automatic/Unattended": "Automatico/non presidiato",
+  "Available": "Disponibile",
+  "Available Borg archives (newest first):": "Archivi Borg disponibili (prima il più recente):",
+  "Available Borg targets:": "Obiettivi Borg disponibili:",
+  "Available Disks on Host": "Dischi disponibili sull'host",
+  "Available ISO Images": "Immagini ISO disponibili",
+  "Available PBS repositories:": "Repository PBS disponibili:",
+  "Available PVE Version": "Disponibile versione PVE",
+  "Available Shares:": "Azioni disponibili:",
+  "Available action": "Azione disponibile",
+  "Available archives:": "Archivi disponibili:",
+  "Available disks detected.": "Rilevati dischi disponibili.",
+  "Available host backups:": "backup host disponibili:",
+  "Available images in /var/lib/vz/images/:": "Immagini disponibili in /var/lib/vz/images/:",
+  "Available network interfaces:": "Interfacce di rete disponibili:",
+  "Available output formats include:": "I formati di output disponibili includono:",
+  "Available physical disks for passthrough:": "Dischi fisici disponibili per passthrough:",
+  "Available shares for guest access:": "Condivisioni disponibili per l'accesso ospite:",
+  "Available space in /mnt:": "Spazio disponibile in /mnt:",
+  "Available storage information:": "Informazioni sullo spazio di archiviazione disponibile:",
+  "Available storage volumes:": "Volumi di archiviazione disponibili:",
+  "BIOS TYPE": "TIPO DI BIOS",
+  "BIOS Type": "Tipo di BIOS",
+  "BIOS from": "BIOS da",
+  "BIOS: OVMF (UEFI)": "BIOS: OVMF (UEFI)",
+  "BRIDGE CONFIGURATION ANALYSIS": "ANALISI DELLA CONFIGURAZIONE DEL PONTE",
+  "BTRFS:": "BTRFS:",
+  "Back to previous menu or Esc + Enter": "Torna al menu precedente o Esc + Invio",
+  "Backed up and cleared": "Effettuato il backup e cancellato",
+  "Backend": "Backend",
+  "Backend:": "Backend:",
+  "Backup            — VM and CT backups": "Backup: backup di VM e CT",
+  "Backup Created": "Backup creato",
+  "Backup ID (group name in PBS):": "ID backup (nome del gruppo in PBS):",
+  "Backup ID for this job:": "ID di backup per questo lavoro:",
+  "Backup ID:": "ID di backup:",
+  "Backup Preview": "Anteprima del backup",
+  "Backup Recommendation": "Raccomandazione per il backup",
+  "Backup Restored": "Backup ripristinato",
+  "Backup all VMs and CTs": "Esegui il backup di tutte le VM e i CT",
+  "Backup and Restore Commands": "Comandi di backup e ripristino",
+  "Backup available at": "Backup disponibile su",
+  "Backup completed successfully.": "Backup completato con successo.",
+  "Backup completed:": "Backup completato:",
+  "Backup created:": "Backup creato:",
+  "Backup declares unused NICs that are not on this host:": "Il backup dichiara le NIC inutilizzate che non si trovano su questo host:",
+  "Backup destination is inside the backup": "La destinazione del backup è all'interno del backup",
+  "Backup failed. See log:": "backup non riuscito.Vedi registro:",
+  "Backup file appears corrupted, will reinstall packages": "Il file di backup sembra danneggiato, i pacchetti verranno reinstallati",
+  "Backup host configuration": "Backup della configurazione dell'host",
+  "Backup includes /etc/zfs/zpool.cache. Restore it (same host detected)?": "Il backup include /etc/zfs/zpool.cache. Ripristinarlo (stesso host rilevato)?",
+  "Backup information": "Informazioni di backup",
+  "Backup location": "Posizione di backup",
+  "Backup metadata": "Metadati di backup",
+  "Backup of original MOTD created": "Backup del MOTD originale creato",
+  "Backup on newer kernel:": "backup sul kernel più recente:",
+  "Backup on older kernel:": "backup sul kernel precedente:",
+  "Backup origin metadata:": "Metadati di origine del backup:",
+  "Backup path:": "percorso di backup:",
+  "Backup pools not present on this host:": "pool di backup non presenti su questo host:",
+  "Backup saved to:": "Backup salvato in:",
+  "Backup scheduler and retention": "Pianificazione e conservazione del backup",
+  "Backup to Borg repository": "Backup nel repository Borg",
+  "Backup to Proxmox Backup Server (PBS)": "Backup sul server di backup Proxmox (PBS)",
+  "Backup to a specific directory": "Backup in una directory specifica",
+  "Backup to local archive  (.tar.zst)": "Backup nell'archivio locale (.tar.zst)",
+  "Backup:": "Backup:",
+  "Backups already on PBS were encrypted with the current key — downloading them will fail unless you first Download the current keyfile to keep a copy.": "i backup già presenti su PBS sono stati crittografati con la chiave corrente: il loro download fallirà a meno che non si scarichi prima il file di chiavi corrente per conservarne una copia.",
+  "Backups already stored on PBS were encrypted with the current keyfile. After this action:": "i backup già archiviati su PBS sono stati crittografati con il file di chiavi corrente.Dopo questa azione:",
+  "Bandwidth limit configured": "Limite di larghezza di banda configurato",
+  "Bandwidth test (iperf3)": "test della larghezza di banda (iperf3)",
+  "Bandwidth test completed successfully": "Test della larghezza di banda completato con successo",
+  "Base VM created with ID": "VM di base creata con ID",
+  "Bashrc customization completed": "Personalizzazione Bashrc completata",
+  "Basic Settings": "Impostazioni di base",
+  "Basic Utilities": "Utilità di base",
+  "Before making any changes, we'll create a safety backup.": "Prima di apportare qualsiasi modifica, creeremo un backup di sicurezza.",
+  "Beta (develop branch)": "Beta (ramo di sviluppo)",
+  "Beta version:": "Versione beta:",
+  "Binary not found in extracted content.": "Binario non trovato nel contenuto estratto.",
+  "Bind mount added:": "Aggiunto supporto di collegamento:",
+  "Blacklist nouveau driver": "Nouveau driver nella lista nera",
+  "Blacklisting GPU host drivers...": "Inserimento nella lista nera dei driver host GPU...",
+  "Blacklisting nouveau driver...": "Nouveau driver nella lista nera...",
+  "Blocked GPU ID": "ID GPU bloccato",
+  "Blocked GPU ID for VM Mode": "ID GPU bloccato per la modalità VM",
+  "Blocked device(s)": "Dispositivo/i bloccato/i",
+  "Blocked device(s):": "Dispositivi bloccati:",
+  "Boot Disk": "Disco di avvio",
+  "Boot artifacts regenerated — reboot the host to activate the merged config.": "artefatti di avvio rigenerati: riavvia l'host per attivare la configurazione unita.",
+  "Boot disk:": "Disco di avvio:",
+  "Boot order set to": "Ordine di avvio impostato su",
+  "Boot partition UUIDs from backup not found on this host:": "UUID della partizione di avvio dal backup non trovati su questo host:",
+  "Boot type (grub/zfs):": "Tipo di avvio (grub/zfs):",
+  "Borg backup error log": "Registro degli errori del backup Borg",
+  "Borg backup failed.": "Backup Borg fallito.",
+  "Borg binary checksum verification failed.": "La verifica del checksum binario Borg non è riuscita.",
+  "Borg encryption": "Crittografia borg",
+  "Borg extraction failed.": "L'estrazione dei Borg è fallita.",
+  "Borg not found. Downloading borg": "Borg non trovato. Scaricamento di borg",
+  "Borg passphrase:": "Passphrase Borg:",
+  "Borg ready.": "Borg pronto.",
+  "Borg repositories": "Repository Borg",
+  "Borg repository location": "Posizione del deposito Borg",
+  "Borg repository passphrase": "passphrase del repository Borg",
+  "Borg repository path:": "Percorso del repository Borg:",
+  "Borg restore error log": "Borg ripristina il registro degli errori",
+  "Borg server SSH user": "utente SSH del server Borg",
+  "Bridge": "Ponte",
+  "Bridge Analysis": "Analisi dei ponti",
+  "Bridge Configuration Analysis": "Analisi della configurazione del ponte",
+  "Bridge:": "Ponte:",
+  "Bridges analyzed": "Ponti analizzati",
+  "Broken gasket-dkms package state recovered.": "Stato del pacchetto guarnizione-dkms rotto ripristinato.",
+  "Browse manually (advanced)...": "Sfoglia manualmente (avanzato)...",
+  "Build and install the gasket and apex kernel modules (DKMS)": "Costruisci e installa i moduli guarnizione e apex kernel (DKMS)",
+  "Build dependencies installed.": "Costruisci dipendenze installate.",
+  "CHANGES APPLIED SUCCESSFULLY": "MODIFICHE APPLICATE CON SUCCESSO",
+  "CIFS Client Tools: AVAILABLE": "Strumenti client CIFS: DISPONIBILE",
+  "CIFS Client Tools: NOT AVAILABLE - installing...": "Strumenti client CIFS: NON DISPONIBILE - installazione in corso...",
+  "CIFS Client: INSTALLED": "Client CIFS: INSTALLATO",
+  "CIFS Client: NOT INSTALLED": "Client CIFS: NON INSTALLATO",
+  "CIFS Mount Not Found": "Montaggio CIFS non trovato",
+  "CIFS Mounts on Host": "CIFS si monta sull'host",
+  "CIFS Proxmox storages (pvesm):": "Archivi CIFS Proxmox (pvesm):",
+  "CIFS can cause file locking issues with VM disk operations.": "CIFS può causare problemi di blocco dei file con le operazioni del disco della VM.",
+  "CIFS client tools installed.": "Strumenti client CIFS installati.",
+  "CIFS share mounted at:": "Condivisione CIFS montata su:",
+  "CIFS share remounted — LXC containers can now read and write": "Condivisione CIFS rimontata: i contenitori LXC ora possono leggere e scrivere",
+  "CIFS storage added successfully to Proxmox!": "Lo storage CIFS è stato aggiunto con successo a Proxmox!",
+  "CLEANUP COMPLETED SUCCESSFULLY": "PULIZIA COMPLETATA CON SUCCESSO",
+  "CLUSTER UPGRADE NOTES:": "NOTE SULL'AGGIORNAMENTO DEL CLUSTER:",
+  "CONFIGURED INTERFACES": "INTERFACCE CONFIGURATE",
+  "CONFIRM FORMAT": "CONFERMA FORMATO",
+  "CPU Cores": "Core della CPU",
+  "CPU MODEL": "MODELLO CPU",
+  "CPU Model": "Modello della CPU",
+  "CPU set to host,hidden=1,flags=+pcid": "CPU impostata su host,hidden=1,flags=+pcid",
+  "CPU vendor (intel/amd):": "Fornitore della CPU (Intel/AMD):",
+  "CRITICAL: The selected disk is referenced by a RUNNING VM or CT.": "CRITICO: al disco selezionato fa riferimento una VM o un CT IN ESECUZIONE.",
+  "CT": "CT",
+  "CT started successfully.": "CT è stato avviato correttamente.",
+  "Cancel": "Cancellare",
+  "Cancel restore": "Annulla ripristino",
+  "Cancel this setup": "annulla questa configurazione",
+  "Cancelled by user or empty URL.": "Annullato dall'utente o URL vuoto.",
+  "Cancelled by user.": "Annullato dall'utente.",
+  "Cannot connect to server": "Impossibile connettersi al server",
+  "Cannot continue": "Impossibile continuare",
+  "Cannot create:": "Impossibile creare:",
+  "Cannot detect filesystem on": "Impossibile rilevare il file system attivo",
+  "Cannot find": "Impossibile trovare",
+  "Cannot load backup library: lib_host_backup_common.sh": "Impossibile caricare la libreria di backup: lib_host_backup_common.sh",
+  "Cannot proceed with invalid export path.": "Impossibile procedere con un percorso di esportazione non valido.",
+  "Cannot proceed with invalid share name.": "Impossibile procedere con un nome di condivisione non valido.",
+  "Cannot reach Proxmox repositories": "Impossibile raggiungere i repository Proxmox",
+  "Cannot reach portal:": "Impossibile raggiungere il portale:",
+  "Cannot reach server": "Impossibile raggiungere il server",
+  "Cannot validate credentials - no shares available for testing.": "Impossibile convalidare le credenziali: nessuna condivisione disponibile per il test.",
+  "Category": "Categoria",
+  "Caution: Maximum mode generates more heat.": "Attenzione: la modalità massima genera più calore.",
+  "Ceph check skipped by user flag (--ignore-ceph-check)": "Controllo Ceph saltato dal flag utente (--ignore-ceph-check)",
+  "Ceph components": "Componenti Ceph",
+  "Ceph detected as hyper-converged on this node. Checking version (require 19.x Squid)...": "Ceph rilevato come iperconvergente su questo nodo. Controllo della versione (richiede 19.x Squid)...",
+  "Ceph enterprise repository present": "Repository aziendale Ceph presente",
+  "Ceph installation check completed": "Controllo dell'installazione di Ceph completato",
+  "Ceph installation completed successfully": "L'installazione di Ceph è stata completata correttamente",
+  "Ceph installation could not be verified": "Impossibile verificare l'installazione di Ceph",
+  "Ceph installation process completed": "Processo di installazione di Ceph completato",
+  "Ceph installation process finished with warnings": "Il processo di installazione di Ceph è terminato con avvisi",
+  "Ceph installed but integration may need configuration": "Ceph installato ma l'integrazione potrebbe richiedere una configurazione",
+  "Ceph integration with PVE 9 verified": "Integrazione Ceph con PVE 9 verificata",
+  "Ceph is already installed": "Ceph è già installato",
+  "Ceph is not 19.x (Squid). Proceeding due to --warn-ceph-check. Detected:": "Ceph non è 19.x (Squid). Procedimento a causa di --warn-ceph-check. Rilevato:",
+  "Ceph is not 19.x (Squid). Upgrade Ceph first. Detected:": "Ceph non è 19.x (Squid). Aggiorna prima Ceph. Rilevato:",
+  "Ceph no-subscription repository present": "Repository Ceph senza abbonamento presente",
+  "Ceph packages and repository removed": "Pacchetti e repository Ceph rimossi",
+  "Ceph packages are available": "Sono disponibili pacchetti Ceph",
+  "Ceph packages installed and verified successfully": "Pacchetti Ceph installati e verificati correttamente",
+  "Ceph packages installed but service verification failed": "Pacchetti Ceph installati ma la verifica del servizio non è riuscita",
+  "Ceph packages may not be available, but continuing installation...": "I pacchetti Ceph potrebbero non essere disponibili, ma continuando l'installazione...",
+  "Ceph repository configured for PVE 8": "Repository Ceph configurato per PVE 8",
+  "Ceph repository configured for PVE 9": "Repository Ceph configurato per PVE 9",
+  "Ceph version OK:": "Versione Ceph OK:",
+  "Change Language": "Cambia lingua",
+  "Change Release Channel": "Cambia canale di rilascio",
+  "Changes applied. A system reboot is recommended for them to take full effect.": "Modifiche applicate. Si consiglia di riavviare il sistema affinché abbiano pieno effetto.",
+  "Changes detected. Updating ZFS ARC configuration...": "Modifiche rilevate. Aggiornamento della configurazione ZFS ARC in corso...",
+  "Changes have been applied to the configuration file.": "Le modifiche sono state applicate al file di configurazione.",
+  "Changes will apply after reboot.": "Le modifiche verranno applicate dopo il riavvio.",
+  "Changing Release Channel": "Modifica del canale di rilascio",
+  "Changing the machine type on an existing installed VM is not safe: it changes the chipset and PCI slot layout, which typically prevents the guest OS from booting.": "La modifica del tipo di macchina su una VM installata esistente non è sicura: modifica il chipset e il layout dello slot PCI, che in genere impedisce l'avvio del sistema operativo guest.",
+  "Check": "Controllo",
+  "Check BIOS/UEFI in Hardware > BIOS — must match what the original VM used": "Controlla BIOS/UEFI in Hardware > BIOS: deve corrispondere a quello utilizzato dalla VM originale",
+  "Check Coral USB/M.2 detection": "Controllare il rilevamento Coral USB/M.2",
+  "Check LXC GPU/TPU mapping": "Controlla la mappatura GPU/TPU LXC",
+  "Check NFS Status": "Controlla lo stato NFS",
+  "Check NVIDIA driver and devices": "Controlla driver e dispositivi NVIDIA",
+  "Check Proxmox Web UI status": "Controlla lo stato dell'interfaccia utente Web Proxmox",
+  "Check Proxmox firewall status": "Controlla lo stato del firewall Proxmox",
+  "Check Samba Status": "Controlla lo stato di Samba",
+  "Check VM disk/PCI slots": "Controllare gli slot del disco VM/PCI",
+  "Check VM passthrough settings": "Controlla le impostazioni del passthrough della VM",
+  "Check connectivity with another host": "Controlla la connettività con un altro host",
+  "Check container mount points": "Controllare i punti di montaggio del contenitore",
+  "Check if container is unprivileged:": "Controlla se il contenitore non è privilegiato:",
+  "Check kernel params (IOMMU flags)": "Controlla i parametri del kernel (flag IOMMU)",
+  "Check loaded GPU/TPU modules": "Controllare i moduli GPU/TPU caricati",
+  "Check log:": "Controlla il registro:",
+  "Check resulting config:": "Controlla la configurazione risultante:",
+  "Check script not found": "Controlla lo script non trovato",
+  "Check test progress   — show active or last test result": "Controlla l'avanzamento del test: mostra il risultato del test attivo o dell'ultimo test",
+  "Check that:": "Controlla che:",
+  "Check the error messages above for details.": "Controlla i messaggi di errore qui sopra per i dettagli.",
+  "Check the service status manually if needed.": "Controlla manualmente lo stato del servizio, se necessario.",
+  "Checking MOTD configuration...": "Controllo della configurazione MOTD...",
+  "Checking NVIDIA driver status with nvidia-smi": "Controllo dello stato del driver NVIDIA con nvidia-smi",
+  "Checking VFIO modules...": "Controllo dei moduli VFIO...",
+  "Checking VM virtual display model...": "Verifica del modello di visualizzazione virtuale della VM in corso...",
+  "Checking ZFS autotrim configuration...": "Controllo della configurazione del taglio automatico ZFS in corso...",
+  "Checking and repairing old LVM PV headers (if needed)...": "Controllo e riparazione dei vecchi collettori FV LVM (se necessario)...",
+  "Checking conflicting drivers blacklist...": "Controllo della lista nera dei driver in conflitto...",
+  "Checking existing ZFS ARC configuration...": "Controllo della configurazione ZFS ARC esistente...",
+  "Checking for updates...": "Controllo aggiornamenti...",
+  "Checking free space in /var/cache/apt/archives...": "Controllo dello spazio libero in /var/cache/apt/archives...",
+  "Checking if system disk is SSD or M.2...": "Verifica se il disco di sistema è SSD o M.2...",
+  "Checking if the server belongs to OVH...": "Verifica se il server appartiene a OVH...",
+  "Checking kernel headers and build tools...": "Controllo delle intestazioni del kernel e degli strumenti di compilazione in corso...",
+  "Checking remaining interfaces": "Controllo delle interfacce rimanenti",
+  "Checklist post-upgrade finished. Warnings:": "Elenco di controllo post-aggiornamento terminato. Avvertenze:",
+  "Checklist pre-check finished. Warnings:": "Controllo preliminare della lista di controllo terminato. Avvertenze:",
+  "Checks for LVM and storage issues": "Verifica la presenza di problemi di LVM e di archiviazione",
+  "Choose BIOS type": "Scegli il tipo di BIOS",
+  "Choose No to abort and roll back to the legacy refuse behaviour.": "Scegli No per interrompere e ripristinare il comportamento di rifiuto precedente.",
+  "Choose ZimaOS image option:": "Scegli l'opzione immagine ZimaOS:",
+  "Choose a Samba server:": "Scegli un server Samba:",
+  "Choose a Windows ISO to use:": "Scegli una ISO di Windows da utilizzare:",
+  "Choose a ZimaOS image:": "Scegli un'immagine ZimaOS:",
+  "Choose a custom image:": "Scegli un'immagine personalizzata:",
+  "Choose a custom logo:": "Scegli un logo personalizzato:",
+  "Choose a destination directory OUTSIDE of": "Scegli una directory di destinazione FUORI da",
+  "Choose a different path or unmount it first.": "Scegli un percorso diverso o smontalo prima.",
+  "Choose a folder to export:": "Scegli una cartella da esportare:",
+  "Choose a folder to mount the export:": "Scegli una cartella per montare l'esportazione:",
+  "Choose a folder to mount the share:": "Scegli una cartella per montare la condivisione:",
+  "Choose a folder to mount:": "Scegli una cartella da montare:",
+  "Choose a folder to share:": "Scegli una cartella da condividere:",
+  "Choose a group policy for this shared directory:": "Scegli una policy di gruppo per questa directory condivisa:",
+  "Choose a loader for Synology DSM:": "Scegli un caricatore per Synology DSM:",
+  "Choose a logo for Fastfetch:": "Scegli un logo per Fastfetch:",
+  "Choose a recent server:": "Scegli un server recente:",
+  "Choose a recovery passphrase (write it down somewhere safe):": "Scegli una passphrase di ripristino (scrivila in un posto sicuro):",
+  "Choose a script to execute:": "Scegli uno script da eseguire:",
+  "Choose a server:": "Scegli un server:",
+  "Choose a share to mount:": "Scegli una condivisione da montare:",
+  "Choose action for this controller/NVMe:": "Scegli l'azione per questo controller/NVMe:",
+  "Choose action:": "Scegli azione:",
+  "Choose an NFS server:": "Scegli un server NFS:",
+  "Choose an action:": "Scegli un'azione:",
+  "Choose an export to mount:": "Scegli un'esportazione da montare:",
+  "Choose an option:": "Scegli un'opzione:",
+  "Choose any host path you want to share with CTs.": "Scegli il percorso host che desideri condividere con i CT.",
+  "Choose conflict policy": "Scegli la politica di conflitto",
+  "Choose conflict policy for the source VM:": "Scegli la policy di conflitto per la VM di origine:",
+  "Choose conflict policy:": "Scegli la politica di conflitto:",
+  "Choose filesystem for the disk:": "Scegli il filesystem per il disco:",
+  "Choose how this host backup will be triggered:": "scegli come verrà attivato il backup dell'host:",
+  "Choose how to continue:": "Scegli come continuare:",
+  "Choose how to handle affected LXC containers before switching to VM mode.": "Scegli come gestire i contenitori LXC interessati prima di passare alla modalità VM.",
+  "Choose how to make the disk available on this host. Mark one or both options:": "Scegli come rendere disponibile il disco su questo host. Seleziona una o entrambe le opzioni:",
+  "Choose how to mount the NFS share on this host. Mark one or both options:": "Scegli come montare la condivisione NFS su questo host. Seleziona una o entrambe le opzioni:",
+  "Choose how to mount the Samba share on this host. Mark one or both options:": "Scegli come montare la condivisione Samba su questo host. Seleziona una o entrambe le opzioni:",
+  "Choose how to perform the upgrade:": "Scegli come eseguire l'aggiornamento:",
+  "Choose how to run the script:": "Scegli come eseguire lo script:",
+  "Choose iperf3 mode:": "Scegli la modalità iperf3:",
+  "Choose options to configure:": "Scegli le opzioni da configurare:",
+  "Choose the driver version for Coral M.2:": "Scegli la versione del driver per Coral M.2:",
+  "Choose the filesystem for the new partition:": "Scegli il filesystem per la nuova partizione:",
+  "Choose the release channel to use:": "Scegli il canale di rilascio da utilizzare:",
+  "Choose the storage volume for the EFI disk (4MB):\n\nUse Spacebar to select.": "Scegli il volume di archiviazione per il disco EFI (4 MB):\n\nUtilizzare la barra spaziatrice per selezionare.",
+  "Choose the storage volume for the virtual disk:": "Scegli il volume di archiviazione per il disco virtuale:",
+  "Choose the type of virtual system to install:": "Scegli il tipo di sistema virtuale da installare:",
+  "Choose what to do with the selected disk:": "Scegli cosa fare con il disco selezionato:",
+  "Choose where to save the backup:": "Scegli dove salvare il backup:",
+  "Clean disk metadata": "Pulisci i metadati del disco",
+  "Cleaned up": "Pulito",
+  "Cleaning cached files...": "Pulizia dei file memorizzati nella cache...",
+  "Cleaning disk metadata...": "Pulizia dei metadati del disco...",
+  "Cleaning previous Log2RAM installation...": "Pulizia dell'installazione precedente di Log2RAM...",
+  "Cleaning temporary files...": "Pulizia dei file temporanei...",
+  "Cleaning up Samba directories...": "Ripulitura delle directory di Samba in corso...",
+  "Cleaning up duplicate parameters...": "Eliminazione dei parametri duplicati...",
+  "Cleaning up duplicate repositories...": "Eliminazione dei repository duplicati...",
+  "Cleaning up remaining processes...": "Ripulitura dei processi rimanenti...",
+  "Cleaning up unused time synchronization services...": "Eliminazione dei servizi di sincronizzazione dell'ora inutilizzati...",
+  "Cleans duplicate or conflicting sources": "Pulisce le fonti duplicate o in conflitto",
+  "Cleanup Complete": "Pulizia completata",
+  "Cleanup finished": "La pulizia è terminata",
+  "Cleanup partial VM?": "Pulire la VM parziale?",
+  "Clear configured target": "Clear configured target",
+  "Clear pool error state": "Cancella lo stato di errore del pool",
+  "Cleared": "Cancellato",
+  "Clearing login credentials...": "Cancellazione delle credenziali di accesso...",
+  "Client (run a bandwidth test to a server)": "Client (esegui un test della larghezza di banda su un server)",
+  "Client determines best version to use": "Il client determina la versione migliore da utilizzare",
+  "Cloning Coral driver repository (feranick fork)...": "Clonazione del repository dei driver Coral (fork feranick)...",
+  "Cloning Lynis from GitHub...": "Clonazione di Lynis da GitHub...",
+  "Cloning and applying NVIDIA patch (keylase/nvidia-patch)...": "Clonazione e applicazione della patch NVIDIA (keylase/nvidia-patch)...",
+  "Closed": "Chiuso",
+  "Cloud-Init Automated Installers": "Programmi di installazione automatizzati Cloud-Init",
+  "Cluster certificates updated": "Certificati cluster aggiornati",
+  "Cluster configuration (advanced)": "Configurazione cluster (avanzata)",
+  "Cluster data will be applied automatically at next boot.": "i dati del cluster verranno applicati automaticamente al prossimo avvio.",
+  "Cluster upgrade mode": "Modalità di aggiornamento del cluster",
+  "Command": "Comando",
+  "Commenting any residual Bookworm lines in *.list...": "Commentando eventuali righe residue di Bookworm in *.list...",
+  "Commenting legacy PVE 8 repository .list files (if any)...": "Commento dei file .list del repository PVE 8 legacy (se presenti)...",
+  "Commenting legacy ceph.list (if present)...": "Commento legacy ceph.list (se presente)...",
+  "Common Issues Check": "Controllo dei problemi comuni",
+  "Community Scripts": "Script di comunità",
+  "Compatibility check": "Controllo di compatibilità",
+  "Compatibility check — OK": "Controllo di compatibilità: OK",
+  "Compatibility check — issues detected": "Controllo di compatibilità: problemi rilevati",
+  "Compatibility check — review warnings": "Controllo di compatibilità: esamina gli avvisi",
+  "Compatible with privileged and unprivileged LXC containers": "Compatibile con contenitori LXC privilegiati e non privilegiati",
+  "Compatible with:": "Compatibile con:",
+  "Compile firewall rules for all nodes": "Compilare le regole del firewall per tutti i nodi",
+  "Compiling Coral TPU drivers for current kernel...": "Compilazione dei driver Coral TPU per il kernel attuale in corso...",
+  "Complete": "Completare",
+  "Complete NVIDIA uninstallation finished.": "La disinstallazione completa di NVIDIA è terminata.",
+  "Complete post-installation optimization finished!": "Completata l'ottimizzazione post-installazione!",
+  "Complete restore": "Ripristino completo",
+  "Complete the DSM installation wizard": "Completa la procedura guidata di installazione del DSM",
+  "Complete the ZimaOS installation wizard": "Completa la procedura guidata di installazione di ZimaOS",
+  "Completed Successfully with GPU passthrough configured!": "Completato con successo con passthrough GPU configurato!",
+  "Completed Successfully!": "Completato con successo!",
+  "Completed with errors —": "Completato con errori —",
+  "Completed.": "Completato.",
+  "Completed. Press Enter to return to menu...": "Completato. Premere Invio per tornare al menu...",
+  "Compliance checking (PCI-DSS, HIPAA, etc.)": "Controllo della conformità (PCI-DSS, HIPAA, ecc.)",
+  "Component to uninstall manually (no --auto-uninstall yet):": "Componente da disinstallare manualmente (ancora no --auto-uninstall):",
+  "Component was installed on the backup source but no matching hardware was found on this host.": "il componente è stato installato sull'origine del backup ma non è stato trovato hardware corrispondente su questo host.",
+  "Component:": "Componente:",
+  "Components to uninstall (manual for now):": "Componenti da disinstallare (manuale per ora):",
+  "Compressed size:": "Dimensioni compresse:",
+  "Compressing": "Compressione",
+  "Compression Tools": "Strumenti di compressione",
+  "Concise output of logical volumes": "Output conciso di volumi logici",
+  "Concise output of physical volumes": "Output conciso di volumi fisici",
+  "Concise output of volume groups": "Output conciso dei gruppi di volumi",
+  "Configuration Analysis": "Analisi della configurazione",
+  "Configuration Menu": "Menù di configurazione",
+  "Configuration Summary:": "Riepilogo della configurazione:",
+  "Configuration analysis": "Analisi della configurazione",
+  "Configuration backup created:": "Backup della configurazione creato:",
+  "Configuration can continue now and will be effective after reboot.": "La configurazione può continuare ora e sarà effettiva dopo il riavvio.",
+  "Configuration completed successfully!": "Configurazione completata con successo!",
+  "Configuration file for container": "File di configurazione per il contenitore",
+  "Configuration has been stopped due to high reset risk.": "La configurazione è stata interrotta a causa dell'elevato rischio di ripristino.",
+  "Configuration has been stopped to prevent an unusable VM state.": "La configurazione è stata interrotta per impedire uno stato inutilizzabile della VM.",
+  "Configuration has been stopped to prevent leaving the VM in an unusable state.": "La configurazione è stata interrotta per evitare di lasciare la VM in uno stato inutilizzabile.",
+  "Configuration name:": "Nome della configurazione:",
+  "Configuration sections that will be REMOVED": "Sezioni di configurazione che verranno rimosse",
+  "Configuration to be Removed": "Configurazione da rimuovere",
+  "Configuration will continue now and be effective after reboot.": "La configurazione continuerà ora e sarà effettiva dopo il riavvio.",
+  "Configuration:": "Configurazione:",
+  "Configure": "Configura",
+  "Configure GPU passthrough with VFIO": "Configura il passthrough GPU con VFIO",
+  "Configure LXC Mount Points    (Host ↔ Container)": "Configurare i punti di montaggio LXC (Host ↔ Container)",
+  "Configure LXC mount points": "Configura i punti di montaggio LXC",
+  "Configure Mount Point inside LXC": "Configura Mount Point all'interno di LXC",
+  "Configure NFS   Client in LXC (only privileged)": "Configura il client NFS in LXC (solo privilegiato)",
+  "Configure NFS   Server in LXC (only privileged)": "Configura il server NFS in LXC (solo privilegiato)",
+  "Configure Proxmox APT repositories": "configura i repository APT Proxmox",
+  "Configure Samba Client in LXC (only privileged)": "Configura il client Samba in LXC (solo privilegiato)",
+  "Configure Samba Server in LXC (only privileged)": "Configura Samba Server in LXC (solo privilegiato)",
+  "Configure as guest (no authentication)": "Configura come ospite (nessuna autenticazione)",
+  "Configure backup destinations": "Configurare le destinazioni di backup",
+  "Configure backup destinations (PBS, Borg, local)": "Configurare le destinazioni di backup (PBS, Borg, locale)",
+  "Configure the Google Coral APT repository": "Configura il repository APT di Google Coral",
+  "Configure with username and password": "Configura con nome utente e password",
+  "Configured Ports": "Porte configurate",
+  "Configured but doesn't exist": "Configurato ma non esiste",
+  "Configuring AMD GPU passthrough...": "Configurazione del passthrough GPU AMD in corso...",
+  "Configuring AMD softdep...": "Configurazione del softdep AMD in corso...",
+  "Configuring APT to skip downloading additional languages": "Configurazione di APT per saltare il download di lingue aggiuntive",
+  "Configuring APT to skip downloading additional languages...": "Configurazione di APT per saltare il download di lingue aggiuntive...",
+  "Configuring APT to use IPv4...": "Configurazione di APT per utilizzare IPv4...",
+  "Configuring Ceph repository for PVE": "Configurazione del repository Ceph per PVE",
+  "Configuring Coral USB support...": "Configurazione del supporto USB Coral in corso...",
+  "Configuring EFI disk": "Configurazione del disco EFI",
+  "Configuring I/O priority for vzdump...": "Configurazione della priorità I/O per vzdump...",
+  "Configuring Intel iGPU passthrough...": "Configurazione del passthrough Intel iGPU...",
+  "Configuring MOTD (Message of the Day) banner...": "Configurazione del banner MOTD (Messaggio del giorno)...",
+  "Configuring NVIDIA GPU passthrough...": "Configurazione del passthrough GPU NVIDIA...",
+  "Configuring NVIDIA KVM hiding...": "Configurazione dell'occultamento di NVIDIA KVM in corso...",
+  "Configuring NVIDIA and VFIO modules...": "Configurazione dei moduli NVIDIA e VFIO...",
+  "Configuring PAM limits...": "Configurazione dei limiti PAM...",
+  "Configuring ProxMenux Monitor filter...": "Configurazione del filtro del monitor ProxMenux in corso...",
+  "Configuring ProxMenux Monitor jail...": "Configurazione della prigione di ProxMenux Monitor in corso...",
+  "Configuring Proxmox APT repositories...": "Configurazione dei repository APT Proxmox...",
+  "Configuring Proxmox filter...": "Configurazione del filtro Proxmox...",
+  "Configuring Proxmox jail...": "Configurazione della prigione Proxmox in corso...",
+  "Configuring TCP optimizations...": "Configurazione delle ottimizzazioni TCP...",
+  "Configuring TPM device": "Configurazione del dispositivo TPM",
+  "Configuring VFIO modules...": "Configurazione dei moduli VFIO...",
+  "Configuring VM": "Configurazione della macchina virtuale",
+  "Configuring bandwidth limit for vzdump...": "Configurazione del limite di larghezza di banda per vzdump...",
+  "Configuring boot order...": "Configurazione dell'ordine di avvio in corso...",
+  "Configuring disk as": "Configurazione del disco come",
+  "Configuring global Fail2Ban settings and SSH jail...": "Configurazione delle impostazioni globali Fail2Ban e jail SSH in corso...",
+  "Configuring host for GPU -> VM mode...": "Configurazione dell'host per GPU -> modalità VM...",
+  "Configuring journald...": "Configurazione journald...",
+  "Configuring kernel max Key limit...": "Configurazione del limite massimo di chiavi del kernel...",
+  "Configuring kernel panic behavior": "Configurazione del comportamento di panico del kernel",
+  "Configuring kernel swappiness...": "Configurazione dello swappiness del kernel...",
+  "Configuring kexec for quick reboots...": "Configurazione di kexec per riavvii rapidi...",
+  "Configuring max FD limit / ulimit...": "Configurazione del limite FD massimo/limite u...",
+  "Configuring max user watches...": "Configurazione del numero massimo di orologi utente...",
+  "Configuring pigz as a faster replacement for gzip...": "Configurazione di pigz come sostituto più veloce di gzip...",
+  "Configuring snapshot schedules...": "Configurazione delle pianificazioni delle istantanee...",
+  "Configuring system time settings...": "Configurazione delle impostazioni dell'ora del sistema in corso...",
+  "Configuring vfio-pci binding...": "Configurazione dell'associazione vfio-pci in corso...",
+  "Confirm Borg passphrase": "conferma la passphrase Borg",
+  "Confirm Borg passphrase:": "Conferma la passphrase Borg:",
+  "Confirm Controller + NVMe Assignment": "Conferma assegnazione controller + NVMe",
+  "Confirm Deletion": "Conferma l'eliminazione",
+  "Confirm Format": "Conferma formato",
+  "Confirm GPU Switch Mode": "Conferma la modalità di cambio GPU",
+  "Confirm Import": "Conferma l'importazione",
+  "Confirm Mount": "Conferma il montaggio",
+  "Confirm Mount Point Removal": "Conferma la rimozione del punto di montaggio",
+  "Confirm Password": "Conferma password",
+  "Confirm Remove": "Conferma Rimuovi",
+  "Confirm Restore": "Conferma ripristino",
+  "Confirm Uninstallation": "Conferma la disinstallazione",
+  "Confirm Unmount": "Conferma lo smontaggio",
+  "Confirm complete restore": "Conferma il ripristino completo",
+  "Confirm custom restore": "conferma il ripristino personalizzato",
+  "Confirm delete": "Conferma l'eliminazione",
+  "Confirm export": "Conferma l'esportazione",
+  "Confirm password for": "Conferma la password per",
+  "Confirm recovery passphrase:": "Conferma la passphrase di ripristino:",
+  "Confirm the keyfile passphrase:": "conferma la passphrase del file di chiavi:",
+  "Confirm the mount path is visible.": "Confermare che il percorso di montaggio sia visibile.",
+  "Confirm the password:": "Conferma la password:",
+  "Confirmation": "Conferma",
+  "Confirmation Failed": "Conferma non riuscita",
+  "Conflicting drivers blacklisted successfully.": "Driver in conflitto inseriti nella lista nera correttamente.",
+  "Conflicting path included in backup:": "Percorso in conflitto incluso nel backup:",
+  "Conflicting utilities removed": "Utilità in conflitto rimosse",
+  "Connect a Coral Accelerator and try again.": "Collega un Coral Accelerator e riprova.",
+  "Connected": "Collegato",
+  "Connecting to PBS and starting backup...": "Connessione a PBS e avvio del backup in corso...",
+  "Connection Details:": "Dettagli di connessione:",
+  "Connection Error": "Errore di connessione",
+  "Connection details:": "Dettagli della connessione:",
+  "Connectivity Test": "Prova di connettività",
+  "Connectivity Test Results": "Risultati dei test di connettività",
+  "Consider adding physical interface": "Prendi in considerazione l'aggiunta di un'interfaccia fisica",
+  "Consider removing its configuration": "Valuta la possibilità di rimuoverne la configurazione",
+  "Consider security implications for production environments": "Considerare le implicazioni sulla sicurezza per gli ambienti di produzione",
+  "Consider visiting the repository and supporting the project.": "valuta la possibilità di visitare il repository e sostenere il progetto.",
+  "Container": "Contenitore",
+  "Container         — LXC root directories": "Contenitore: directory root LXC",
+  "Container ID": "ID contenitore",
+  "Container ID not defined. Make sure to select a container first.": "ID contenitore non definito. Assicurati di selezionare prima un contenitore.",
+  "Container Mount Point": "Punto di montaggio del contenitore",
+  "Container OS:": "Sistema operativo contenitore:",
+  "Container Path": "Percorso del contenitore",
+  "Container Path:": "Percorso del contenitore:",
+  "Container Status": "Stato del contenitore",
+  "Container configuration not found": "Configurazione del contenitore non trovata",
+  "Container did not become ready in time. Skipping driver installation.": "Il contenitore non è stato pronto in tempo. Saltare l'installazione del driver.",
+  "Container did not start in time.": "Il contenitore non è stato avviato in tempo.",
+  "Container distro": "Distribuzione contenitore",
+  "Container does not have apt-get available. Coral driver installation only supports Debian/Ubuntu containers.": "Il contenitore non ha apt-get disponibile. L'installazione del driver Coral supporta solo i contenitori Debian/Ubuntu.",
+  "Container is already stopped.": "Il contenitore è già fermo.",
+  "Container is running. Restart to apply changes?": "Il contenitore è in esecuzione. Riavviare per applicare le modifiche?",
+  "Container is stopped. Start it now to verify the mount works?": "Il contenitore è fermo. Avviarlo ora per verificare che il montaggio funzioni?",
+  "Container mount point:": "Punto di montaggio del contenitore:",
+  "Container must be stopped before conversion": "Il contenitore deve essere arrestato prima della conversione",
+  "Container restarted successfully": "Il contenitore è stato riavviato correttamente",
+  "Container started successfully": "Il contenitore è stato avviato correttamente",
+  "Container started successfully.": "Il contenitore è stato avviato correttamente.",
+  "Container started.": "Il contenitore è stato avviato.",
+  "Container stopped.": "Contenitore fermo.",
+  "Container successfully converted to privileged.": "Contenitore convertito correttamente in privilegiato.",
+  "Container template— LXC templates": "Modello contenitore: modelli LXC",
+  "Container will pick up the mount on next start": "Il contenitore raccoglierà la montatura al prossimo avvio",
+  "Container with ID": "Contenitore con ID",
+  "Container:": "Contenitore:",
+  "Contains files": "Contiene file",
+  "Contains:": "Contiene:",
+  "Content Types": "Tipi di contenuto",
+  "Content Types:": "Tipi di contenuto:",
+  "Content is usually images for VM block devices.": "Il contenuto è solitamente costituito da immagini per i dispositivi a blocchi VM.",
+  "Content type is fixed to:": "Il tipo di contenuto è fisso su:",
+  "Content:": "Contenuto:",
+  "Continue": "Continuare",
+  "Continue anyway?": "Continuare comunque?",
+  "Continue despite failures?": "Continuare nonostante i fallimenti?",
+  "Continue the VM wizard and reboot the host at the end.": "Continua la procedura guidata della VM e riavvia l'host alla fine.",
+  "Continue the Windows installation as usual.": "Continua l'installazione di Windows come al solito.",
+  "Continue with Coral TPU configuration only?": "Continuare solo con la configurazione Coral TPU?",
+  "Continue with live apply now? SSH may disconnect immediately.": "Continuare con la candidatura dal vivo adesso? SSH potrebbe disconnettersi immediatamente.",
+  "Continue with the import?": "continuare con l'importazione?",
+  "Continue: Proceed with conversion": "Continua: Procedi con la conversione",
+  "Continue?": "Continuare?",
+  "Continuing with your selection.": "Continuando con la selezione.",
+  "Controller": "Controllore",
+  "Controller + NVMe": "Controller + NVMe",
+  "Controller + NVMe assignment will be written now and become active after host reboot.": "L'assegnazione Controller + NVMe verrà scritta ora e diventerà attiva dopo il riavvio dell'host.",
+  "Controller + NVMe passthrough requires machine type q35. Skipping controller assignment.": "Controller + passthrough NVMe richiede il tipo di macchina q35. Saltare l'assegnazione del controller.",
+  "Controller/NVMe Conflict Policy": "Politica di conflitto controller/NVMe",
+  "Controller/NVMe already present in VM config": "Controller/NVMe già presente nella configurazione della VM",
+  "Controller/NVMe assigned": "Controller/NVMe assegnato",
+  "Controller/NVMe is in use by running VM": "Il controller/NVMe è in uso eseguendo la VM",
+  "Controller/NVMe passthrough requires IOMMU enabled in BIOS/UEFI and kernel.": "Il passthrough controller/NVMe richiede IOMMU abilitato nel BIOS/UEFI e nel kernel.",
+  "Controller/NVMe passthrough requires machine type q35.": "Il passthrough controller/NVMe richiede il tipo di macchina q35.",
+  "Controller/NVMe passthrough to VMs requires IOMMU enabled in BIOS/UEFI and kernel.": "Il passthrough del controller/NVMe alle VM richiede che IOMMU sia abilitato nel BIOS/UEFI e nel kernel.",
+  "Controller/NVMe passthrough to VMs requires IOMMU to be enabled in the kernel.": "Il passthrough controller/NVMe alle VM richiede che IOMMU sia abilitato nel kernel.",
+  "Controller/NVMe passthrough — compatibility notice": "Passthrough controller/NVMe: avviso di compatibilità",
+  "Controller/NVMe removed from source VM": "Controller/NVMe rimosso dalla VM di origine",
+  "Controllers + NVMe": "Controller + NVMe",
+  "Controllers + NVMe Selected:": "Controller + NVMe selezionati:",
+  "Convert Privileged to Unprivileged": "Converti da privilegiato a non privilegiato",
+  "Convert Unprivileged to Privileged": "Converti da non privilegiato a privilegiato",
+  "Convert directory ownership:": "Converti la proprietà della directory:",
+  "Convert disk image format": "Converti il ​​formato dell'immagine del disco",
+  "Convert disk image format using QEMU-IMG": "Converti il ​​formato dell'immagine del disco utilizzando QEMU-IMG",
+  "Convert file ownership (this takes time):": "Converti la proprietà del file (questa operazione richiede tempo):",
+  "Converted + verified:": "Convertito + verificato:",
+  "Converted container ID:": "ID contenitore convertito:",
+  "Converting container to privileged...": "Conversione del contenitore in privilegiato...",
+  "Converting disk": "Conversione del disco",
+  "Converting file ownership (this may take several minutes)...": "Conversione della proprietà del file (l'operazione potrebbe richiedere diversi minuti)...",
+  "Converting image using command:": "Conversione dell'immagine utilizzando il comando:",
+  "Converts to deb822; keeps .list backups as .bak": "Converte in deb822; mantiene i backup .list come .bak",
+  "Copy failed": "copia non riuscita",
+  "Copy that file offsite yourself, or download it from the Monitor.": "copia tu stesso il file fuori sede o scaricalo dal Monitor.",
+  "Copy the correct keyfile to this host and rerun Restore — or pick an unencrypted backup.": "copia il file di chiavi corretto su questo host ed esegui nuovamente il ripristino oppure scegli un backup non crittografato.",
+  "Copy the keyfile to a path for offsite backup": "copia il file di chiavi in ​​un percorso per il backup fuori sede",
+  "Copy your PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to": "copia prima il file di chiavi PBS su questo host (tramite scp, USB, sftp, ecc.) e inserisci il suo percorso assoluto di seguito.Il file verrà copiato",
+  "Copy your existing PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to": "copia prima il file di chiavi PBS esistente su questo host (tramite scp, USB, sftp, ecc.) e inserisci il suo percorso assoluto di seguito.Il file verrà copiato",
+  "Copying installer to container": "Copia del programma di installazione nel contenitore",
+  "Copying sources to": "Copia delle fonti in",
+  "Coral APT repository ready.": "Repository APT Coral pronto.",
+  "Coral Actions": "Azioni dei coralli",
+  "Coral M.2 / PCIe detected — installing gasket and apex kernel modules...": "Rilevato Coral M.2 / PCIe: installazione della guarnizione e dei moduli kernel apex...",
+  "Coral M.2 Apex configuration added - device ready": "Aggiunta configurazione Coral M.2 Apex: dispositivo pronto",
+  "Coral M.2 Apex configuration added - device will be available after reboot": "Aggiunta configurazione Coral M.2 Apex: il dispositivo sarà disponibile dopo il riavvio",
+  "Coral M.2 Apex detected, configuring...": "Rilevato Coral M.2 Apex, configurazione in corso...",
+  "Coral TPU Installation": "Installazione in TPU corallo",
+  "Coral TPU Uninstall": "Disinstallazione di Coral TPU",
+  "Coral TPU device nodes detected with correct group (apex).": "Nodi del dispositivo Coral TPU rilevati con il gruppo corretto (apice).",
+  "Coral TPU driver installed successfully inside the container.": "Driver Coral TPU installato correttamente all'interno del contenitore.",
+  "Coral TPU drivers installed and loaded successfully.": "Driver Coral TPU installati e caricati correttamente.",
+  "Coral TPU is already installed on this host:": "Coral TPU è già installato su questo host:",
+  "Coral TPU is already installed:": "Coral TPU è già installato:",
+  "Coral USB Accelerator detected — installing Edge TPU runtime...": "Rilevato acceleratore USB Coral: installazione del runtime Edge TPU...",
+  "Coral USB configuration added - device detected": "Aggiunta configurazione USB Coral: dispositivo rilevato",
+  "Coral USB configured but device not currently connected": "Coral USB configurato ma dispositivo attualmente non connesso",
+  "Coral USB runtime installed. No reboot required.": "Runtime USB Coral installato. Nessun riavvio richiesto.",
+  "Coral hardware configuration completed for container": "Configurazione hardware Coral completata per container",
+  "Coral kernel modules unloaded.": "Moduli del kernel Coral scaricati.",
+  "Coral packages purged.": "Pacchetti di corallo eliminati.",
+  "Coral uninstallation completed.": "Disinstallazione di Coral completata.",
+  "Core Proxmox packages reinstalled successfully": "I pacchetti Core Proxmox sono stati reinstallati correttamente",
+  "Core packages": "Pacchetti principali",
+  "Could not add": "Impossibile aggiungere",
+  "Could not add disk": "Impossibile aggiungere il disco",
+  "Could not assign disk": "Impossibile assegnare il disco",
+  "Could not authorize the key via 'pct exec' on": "Impossibile autorizzare la chiave tramite 'pct exec'",
+  "Could not back up the existing auth.json": "Impossibile eseguire il backup del file auth.json esistente",
+  "Could not change VM virtual display to vga: std": "Impossibile modificare la visualizzazione virtuale della VM in vga: std",
+  "Could not clone any gasket-driver repository. Check your internet connection and": "Impossibile clonare alcun repository di driver di guarnizione. Controlla la tua connessione Internet e",
+  "Could not configure IOMMU kernel parameters automatically. Configure manually and reboot.": "Impossibile configurare automaticamente i parametri del kernel IOMMU. Configura manualmente e riavvia.",
+  "Could not copy the PVE keyfile into place. Check permissions on:": "impossibile copiare il file di chiavi PVE nella sua posizione.Controlla i permessi su:",
+  "Could not copy the keyfile into place.": "impossibile copiare il file di chiavi in ​​posizione.",
+  "Could not copy the keyfile into place. Check permissions on:": "impossibile copiare il file di chiavi in ​​posizione.Controlla i permessi su:",
+  "Could not create converter directory:": "Impossibile creare la directory del convertitore:",
+  "Could not create destination directory:": "Impossibile creare la directory di destinazione:",
+  "Could not create or access directory:": "Impossibile creare o accedere alla directory:",
+  "Could not create temporary directory:": "Impossibile creare la directory temporanea:",
+  "Could not create temporary working directory.": "Impossibile creare la directory di lavoro temporanea.",
+  "Could not detect apex major number from /proc/devices. Load the apex module first: modprobe apex": "Impossibile rilevare il numero principale dell'apice da /proc/devices. Caricare prima il modulo apex: modprobe apex",
+  "Could not detect the CIFS mount for this directory. Try accessing it manually.": "Impossibile rilevare il montaggio CIFS per questa directory. Prova ad accedervi manualmente.",
+  "Could not determine a valid ISO storage directory.": "Impossibile determinare una directory di archiviazione ISO valida.",
+  "Could not determine disk path for:": "Impossibile determinare il percorso del disco per:",
+  "Could not determine the IOMMU group for the selected GPU.": "Impossibile determinare il gruppo IOMMU per la GPU selezionata.",
+  "Could not download recovery blob from PBS.": "Impossibile scaricare il BLOB di ripristino da PBS.",
+  "Could not download the installer.": "Impossibile scaricare il programma di installazione.",
+  "Could not enable on-boot restore service.": "Impossibile abilitare il servizio di ripristino all'avvio.",
+  "Could not export ZFS pool": "Impossibile esportare il pool ZFS",
+  "Could not extract from PBS.": "Impossibile estrarre da PBS.",
+  "Could not fetch keylase/nvidia-patch supported list — patch reapply compatibility is not verified.": "Impossibile recuperare l'elenco supportato da keylase/nvidia-patch: la compatibilità con la riapplicazione della patch non è stata verificata.",
+  "Could not find a valid 'proxmox-ve' 9.x candidate after switching to no-subscription. Please verify your repository configuration and network, then retry.": "Impossibile trovare un candidato 'proxmox-ve' 9.x valido dopo il passaggio alla modalità senza abbonamento. Verifica la configurazione e la rete del repository, quindi riprova.",
+  "Could not find rootfs configuration for container.": "Impossibile trovare la configurazione rootfs per il contenitore.",
+  "Could not format the disk.": "Impossibile formattare il disco.",
+  "Could not fully zero": "Impossibile azzerarlo completamente",
+  "Could not identify the imported disk in VM config": "Impossibile identificare il disco importato nella configurazione della VM",
+  "Could not install": "Impossibile installare",
+  "Could not install Git — Lynis cannot be cloned. Run 'apt-get install git' manually.": "Impossibile installare Git: Lynis non può essere clonato. Esegui manualmente \"apt-get install git\".",
+  "Could not install exFAT tools automatically.": "Impossibile installare automaticamente gli strumenti exFAT.",
+  "Could not install sshpass automatically (no internet?). Falling back to manual paste mode — you'll see the line to copy onto the server next.": "Impossibile installare automaticamente sshpass (niente Internet?).Tornando alla modalità incolla manuale: successivamente vedrai la riga da copiare sul server.",
+  "Could not install vzdump hook in /etc/vzdump.conf": "Impossibile installare l'hook vzdump in /etc/vzdump.conf",
+  "Could not load shared functions. Script cannot continue.": "Impossibile caricare le funzioni condivise. Lo script non può continuare.",
+  "Could not locate imported disk in VM config.": "Impossibile individuare il disco importato nella configurazione della VM.",
+  "Could not mount": "Impossibile montare",
+  "Could not mount ISO on device": "Impossibile montare l'ISO sul dispositivo",
+  "Could not parse OVF file, or no disk image references found.": "Impossibile analizzare il file OVF o nessun riferimento all'immagine del disco trovato.",
+  "Could not push the key. Check the password and that": "Impossibile premere la chiave. Controlla la password e quello",
+  "Could not read SMART data from": "Impossibile leggere i dati SMART da",
+  "Could not read VM configuration.": "Impossibile leggere la configurazione della VM.",
+  "Could not remount automatically. Try manually or check credentials.": "Impossibile rimontare automaticamente. Prova manualmente o controlla le credenziali.",
+  "Could not remove VM automatically. Run manually:": "Impossibile rimuovere la VM automaticamente. Esegui manualmente:",
+  "Could not remove previous DKMS tree at": "Impossibile rimuovere l'albero DKMS precedente in",
+  "Could not restart ProxMenux Monitor service.": "Impossibile riavviare il servizio ProxMenux Monitor.",
+  "Could not restart the service — start it manually with systemctl start": "Impossibile riavviare il servizio: avvialo manualmente con systemctl start",
+  "Could not retrieve versions list from NVIDIA. Please check your internet connection.": "Impossibile recuperare l'elenco delle versioni da NVIDIA. Controlla la tua connessione Internet.",
+  "Could not run NVIDIA patch script. Please verify repository and driver version.": "Impossibile eseguire lo script della patch NVIDIA. Verificare il repository e la versione del driver.",
+  "Could not set VM virtual display to vga: std": "Impossibile impostare il display virtuale della VM su vga: std",
+  "Could not set boot order for": "Impossibile impostare l'ordine di avvio per",
+  "Could not stop LXC": "Impossibile fermare LXC",
+  "Could not unload nouveau module (may be in use). The blacklist will take effect after reboot. Installation will continue but a reboot will be required.": "Impossibile scaricare il modulo nouveau (potrebbe essere in uso). La lista nera avrà effetto dopo il riavvio. L'installazione continuerà ma sarà necessario un riavvio.",
+  "Could not unmount": "Impossibile smontare",
+  "Could not unmount — disk may be busy. Removing fstab entry anyway.": "Impossibile smontare: il disco potrebbe essere occupato. Rimozione comunque della voce fstab.",
+  "Could not update config file.": "Impossibile aggiornare il file di configurazione.",
+  "Could not write to:": "Impossibile scrivere a:",
+  "Create": "Creare",
+  "Create Directory": "Crea directory",
+  "Create GPT and one partition:": "Crea GPT e una partizione:",
+  "Create GPT partition": "Crea partizione GPT",
+  "Create LXC server NFS": "Crea NFS del server LXC",
+  "Create Network Backup": "crea backup di rete",
+  "Create Samba server service": "Crea il servizio server Samba",
+  "Create Samba user:": "Crea utente Samba:",
+  "Create Shared Directory": "Crea directory condivisa",
+  "Create Shared Directory on Host": "Crea directory condivisa sull'host",
+  "Create Universal NFS Export": "Crea esportazione NFS universale",
+  "Create VM from template or script": "Crea VM da modello o script",
+  "Create a VM first (machine type q35 + UEFI BIOS), then run this option again.": "Crea prima una VM (tipo di macchina q35 + UEFI BIOS), quindi esegui nuovamente questa opzione.",
+  "Create a backup of the container configuration:": "Crea un backup della configurazione del contenitore:",
+  "Create a backup of your container before proceeding": "Crea un backup del tuo contenitore prima di procedere",
+  "Create a fresh GPT + ext4 partition and mount it?": "Creare una nuova partizione GPT + ext4 e montarla?",
+  "Create a new dataset in a ZFS pool": "Crea un nuovo set di dati in un pool ZFS",
+  "Create a new group for isolation": "Crea un nuovo gruppo per l'isolamento",
+  "Create credentials file (recommended):": "Crea un file delle credenziali (consigliato):",
+  "Create directory": "Crea rubrica",
+  "Create export directory:": "Crea directory di esportazione:",
+  "Create mount point:": "Crea punto di montaggio:",
+  "Create new directory in /mnt": "Crea una nuova directory in /mnt",
+  "Create new folder in /mnt": "Crea una nuova cartella in /mnt",
+  "Create one first in Datacenter → Backup, then return here to attach.": "creane prima uno in Datacenter → Backup, quindi torna qui per allegarlo.",
+  "Create persistent network interface names?": "Creare nomi di interfacce di rete persistenti?",
+  "Create scheduled backup job": "Crea un processo di backup pianificato",
+  "Create share directory:": "Crea directory condivisa:",
+  "Create shared directory:": "Crea directory condivisa:",
+  "Created common remapped user": "Creato utente rimappato comune",
+  "Created directory on host:": "Directory creata sull'host:",
+  "Created persistent names for": "Creati nomi persistenti per",
+  "Created remapped user": "Creato utente rimappato",
+  "Created sharedfiles group (GID: 101000)": "Gruppo sharedfiles creato (GID: 101000)",
+  "Creating APT configuration to force IPv4...": "Creazione della configurazione APT per forzare IPv4...",
+  "Creating Ceph repository for PVE 8 (legacy format)...": "Creazione del repository Ceph per PVE 8 (formato legacy)...",
+  "Creating Ceph repository for PVE 9 (deb822 format)...": "Creazione del repository Ceph per PVE 9 (formato deb822)...",
+  "Creating Proxmox VE 9.x no-subscription repository...": "Creazione del repository senza abbonamento Proxmox VE 9.x...",
+  "Creating Proxmox auth logger service...": "Creazione del servizio di registrazione di autenticazione Proxmox in corso...",
+  "Creating SSH auth logger service...": "Creazione del servizio di registrazione di autenticazione SSH in corso...",
+  "Creating UID remapping for unprivileged container compatibility...": "Creazione della rimappatura UID per la compatibilità del contenitore non privilegiato...",
+  "Creating VM with the above configuration": "Creazione della VM con la configurazione precedente",
+  "Creating VM...": "Creazione della macchina virtuale...",
+  "Creating backup of configuration file...": "Creazione del backup del file di configurazione in corso...",
+  "Creating backup of network interfaces configuration...": "Creazione del backup della configurazione delle interfacce di rete in corso...",
+  "Creating compressed archive...": "Creazione archivio compresso...",
+  "Creating export archive...": "creazione dell'archivio di esportazione in corso...",
+  "Creating local archive...": "creazione dell'archivio locale...",
+  "Creating mount point...": "Creazione del punto di montaggio...",
+  "Creating new ZFS ARC configuration...": "Creazione nuova configurazione ZFS ARC...",
+  "Creating partition table and partition...": "Creazione della tabella delle partizioni e della partizione in corso...",
+  "Creating partition...": "Creazione della partizione...",
+  "Creating pigz wrapper script...": "Creazione dello script wrapper pigz in corso...",
+  "Credentials are correct": "Le credenziali sono corrette",
+  "Credentials cleared. jwt_secret and API tokens preserved.": "Credenziali cancellate. jwt_secret e token API conservati.",
+  "Credentials file created securely.": "File delle credenziali creato in modo sicuro.",
+  "Credentials file removed.": "File delle credenziali rimosso.",
+  "Credentials file:": "File delle credenziali:",
+  "Credentials validated successfully": "Credenziali convalidate correttamente",
+  "Cross-host restore: guest IDs in backup overlap live IDs on target:": "Ripristino tra host: gli ID guest nel backup si sovrappongono agli ID live sulla destinazione:",
+  "Cross-kernel restore — kernel-tied paths merged, not copied": "ripristino cross-kernel: percorsi collegati al kernel uniti, non copiati",
+  "Cross-kernel — paths hidden from picker": "Cross-kernel: percorsi nascosti dal selettore",
+  "Cross-version detected — safe restore mode": "Rilevata versione incrociata: modalità di ripristino sicuro",
+  "Current": "Attuale",
+  "Current CIFS mounts:": "Supporti CIFS attuali:",
+  "Current Configuration": "Configurazione attuale",
+  "Current LXC Mount Points": "Punti di montaggio LXC attuali",
+  "Current NFS Mounts": "Supporti NFS attuali",
+  "Current NFS client script supports privileged LXC only.": "Lo script client NFS corrente supporta solo LXC privilegiato.",
+  "Current NFS exports in CT": "Attuali esportazioni NFS in CT",
+  "Current NFS mounts:": "Supporti NFS attuali:",
+  "Current Network Configuration": "Configurazione di rete corrente",
+  "Current PVE Version": "Versione PVE attuale",
+  "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Gli attuali script host ProxMenux registrano le condivisioni remote come archivi Proxmox utilizzando pvesm.",
+  "Current ProxMenux version:": "Versione attuale di ProxMenux:",
+  "Current Samba Mounts": "Supporti Samba attuali",
+  "Current Samba client script supports privileged LXC only.": "Lo script client Samba corrente supporta solo LXC privilegiato.",
+  "Current Samba shares in CT": "Azioni attuali di Samba in CT",
+  "Current channel:": "Canale attuale:",
+  "Current driver": "Conducente attuale",
+  "Current free space:": "Spazio libero attuale:",
+  "Current language:": "Lingua attuale:",
+  "Current mode": "Modalità corrente",
+  "Current mount options:": "Opzioni di montaggio attuali:",
+  "Current permissions:": "Autorizzazioni attuali:",
+  "Current power state: D3cold (device currently inaccessible)": "Stato di alimentazione attuale: D3cold (dispositivo attualmente inaccessibile)",
+  "Current script uses native bind mounts with pct set -mpX.": "Lo script corrente utilizza montaggi di collegamento nativi con pct set -mpX.",
+  "Current selection:": "Selezione attuale:",
+  "Current status:": "Stato attuale:",
+  "Current user": "Utente attuale",
+  "Current user UID, GID and groups": "UID, GID e gruppi dell'utente corrente",
+  "Current version:": "Versione attuale:",
+  "Currently": "Attualmente",
+  "Currently Mounted:": "Attualmente montato:",
+  "Currently configured target:": "destinazione attualmente configurata:",
+  "Currently mounted:": "Attualmente montato:",
+  "Custom": "Costume",
+  "Custom Configuration": "Configurazione personalizzata",
+  "Custom Content": "Contenuto personalizzato",
+  "Custom Directory": "Directory personalizzata",
+  "Custom Logo Instructions": "Istruzioni per il logo personalizzato",
+  "Custom Options": "Opzioni personalizzate",
+  "Custom Path": "Percorso personalizzato",
+  "Custom backup paths": "percorsi di backup personalizzati",
+  "Custom backup profile": "Profilo di backup personalizzato",
+  "Custom backup to Borg": "Backup personalizzato su Borg",
+  "Custom backup to PBS": "Backup personalizzato su PBS",
+  "Custom backup to local archive": "Backup personalizzato nell'archivio locale",
+  "Custom local directory": "Directory locale personalizzata",
+  "Custom message added to MOTD": "Messaggio personalizzato aggiunto a MOTD",
+  "Custom options": "Opzioni personalizzate",
+  "Custom path": "Percorso personalizzato",
+  "Custom path...": "Percorso personalizzato...",
+  "Custom paths are included in BOTH default and custom backup profiles.": "I percorsi personalizzati sono inclusi SIA nei profili di backup predefiniti che in quelli personalizzati.",
+  "Custom restore by components": "Ripristino personalizzato per componenti",
+  "Custom restore by paths": "ripristino personalizzato per percorsi",
+  "Custom scripts and ProxMenux files": "Script personalizzati e file ProxMenux",
+  "Custom selection": "Selezione personalizzata",
+  "Custom systemd units": "Unità di sistema personalizzate",
+  "Customizable post-installation script": "script post-installazione personalizzabile",
+  "Customization": "personalizzazione",
+  "Customize bashrc": "personalizza bashrc",
+  "Customizing bashrc for root user...": "Personalizzazione bashrc per l'utente root...",
+  "DISABLED unless you enable it": "DISABILITATO a meno che non lo abiliti",
+  "DKMS add failed. Check": "Aggiunta DKMS non riuscita. Controllo",
+  "DKMS build failed.": "Creazione DKMS non riuscita.",
+  "DKMS build failed. Last lines of make.log:": "Creazione DKMS non riuscita. Ultime righe di make.log:",
+  "DKMS install failed.": "Installazione DKMS non riuscita.",
+  "DKMS module registered.": "Modulo DKMS registrato.",
+  "DNS Resolution": "Risoluzione DNS",
+  "DNS lookup for a domain": "Ricerca DNS per un dominio",
+  "Data size:": "Dimensione dei dati:",
+  "Data wipe complete.": "Cancellazione dei dati completata.",
+  "Data wiped from": "Dati cancellati da",
+  "Datastore name:": "Nome dell'archivio dati:",
+  "Deactivate Monitor": "Disattiva monitoraggio",
+  "Deactivate ProxMenux Monitor": "Disattiva il monitor ProxMenux",
+  "Debian repositories missing; creating default source file": "Mancano i repository Debian; creazione del file sorgente predefinito",
+  "Decompress backup manually": "Decomprimere manualmente il backup",
+  "Decryption failed. The passphrase may be wrong, or the blob is corrupt. Try again?": "La decrittografia non è riuscita. La passphrase potrebbe essere errata oppure il BLOB è danneggiato. Riprova?",
+  "Default ACLs applied for group inheritance.": "Gli ACL predefiniti hanno applicato l'ereditarietà del gruppo.",
+  "Default Credentials": "Credenziali predefinite",
+  "Default Gateway": "Gateway predefinito",
+  "Default ISO directory": "Directory ISO predefinita",
+  "Default Login Credentials:": "Credenziali di accesso predefinite:",
+  "Default Port": "Porta predefinita",
+  "Default Proxmox logo applied": "Logo Proxmox predefinito applicato",
+  "Default is none (video-only passthrough). Use SPACE to toggle selections.": "L'impostazione predefinita è nessuno (passthrough solo video). Usa lo SPAZIO per alternare le selezioni.",
+  "Default journald configuration restored": "Configurazione journal predefinita ripristinata",
+  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "La posizione predefinita è /mnt/<nome>. La condivisione verrà montata qui sull'host con autorizzazioni aperte in modo che un LXC non privilegiato possa eseguire il bind-mount e scrivere su di essa. Per l'accesso LXC, eseguire il bind-mount di questo percorso con LXC Mount Manager.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "La posizione predefinita è /mnt/<nome>. La condivisione verrà montata qui sull'host. Utilizzare questo percorso in /etc/fstab. Per l'accesso LXC, eseguire il bind-mount di questo percorso con LXC Mount Manager.",
+  "Default options": "Opzioni predefinite",
+  "Default options read/write": "Opzioni predefinite di lettura/scrittura",
+  "Default will be used:": "Verrà utilizzato il valore predefinito:",
+  "Default:": "Predefinito:",
+  "Delete Borg target": "Elimina il bersaglio Borg",
+  "Delete Export": "Elimina esportazione",
+  "Delete Share": "Elimina condivisione",
+  "Delete a CT (irreversible). Use the correct <ctid>": "Eliminare un CT (irreversibile). Utilizzare il <ctid> corretto",
+  "Delete a VM (irreversible). Use the correct <vmid>": "Elimina una VM (irreversibile). Utilizzare il <vmid> corretto",
+  "Delete archive": "Elimina archivio",
+  "Delete job": "Elimina lavoro",
+  "Delete scheduled backup job?": "Eliminare il processo di backup pianificato?",
+  "Delete this corrupt archive and pick another": "Elimina questo archivio corrotto e scegline un altro",
+  "Dependencies installed successfully": "Dipendenze installate correttamente",
+  "Deploy with this configuration?": "Distribuire con questa configurazione?",
+  "Deploying Secure Gateway...": "Distribuzione del gateway sicuro...",
+  "Deployment cancelled.": "Distribuzione annullata.",
+  "Deployment failed": "Distribuzione non riuscita",
+  "Description": "Descrizione",
+  "Desktop UI backup created": "Backup dell'interfaccia utente desktop creato",
+  "Desktop and Mobile UI patched": "Patch per l'interfaccia utente desktop e mobile",
+  "Destination Directory": "Directory di destinazione",
+  "Destination directory does not exist:": "La directory di destinazione non esiste:",
+  "Destination directory is not writable:": "La directory di destinazione non è scrivibile:",
+  "Destination path for the copy (typically outside ProxMenux state):": "percorso di destinazione per la copia (in genere all'esterno dello stato ProxMenux):",
+  "Destination:": "Destinazione:",
+  "Destroy a ZFS dataset (irreversible)": "Distruggi un set di dati ZFS (irreversibile)",
+  "Destructive rollback": "rollback distruttivo",
+  "Detailed Proxmox version info": "Informazioni dettagliate sulla versione di Proxmox",
+  "Detailed partition layout with GPT info": "Layout dettagliato della partizione con informazioni GPT",
+  "Detailed service information": "Informazioni dettagliate sul servizio",
+  "Details": "Dettagli",
+  "Detect GPUs in host": "Rileva GPU nell'host",
+  "Detect controller/NVMe BDF": "Rileva controller/NVMe BDF",
+  "Detected": "Rilevato",
+  "Detected AMD CPU": "Rilevata CPU AMD",
+  "Detected Coral hardware:": "Hardware corallo rilevato:",
+  "Detected GPU(s):": "GPU rilevate:",
+  "Detected Intel CPU": "Rilevata CPU Intel",
+  "Detected Proxmox VE": "Rilevato Proxmox VE",
+  "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Rilevato Proxmox VE 8.x - Installazione di Ceph Squid per Debian",
+  "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Rilevato Proxmox VE 9.x - Installazione di Ceph Squid per Debian Trixie",
+  "Detected RAM:": "RAM rilevata:",
+  "Detected a mounted directory from host. Setting up shared group...": "Rilevata una directory montata dall'host. Configurazione del gruppo condiviso...",
+  "Detected backups — newest first:": "Backup rilevati: prima il più recente:",
+  "Detected broken gasket-dkms package state:": "Rilevato stato del pacchetto guarnizione-dkms rotto:",
+  "Detected existing Samba user:": "Rilevato utente Samba esistente:",
+  "Detected filesystem:": "File system rilevato:",
+  "Detected nftables - using nftables ban action": "Nftable rilevati: utilizzo dell'azione di divieto di nftables",
+  "Detected paths in this backup:": "Percorsi rilevati in questo backup:",
+  "Detected power state": "Stato di alimentazione rilevato",
+  "Detected reset method": "Metodo di ripristino rilevato",
+  "Detected risk factor": "Fattore di rischio rilevato",
+  "Detected subtype": "Sottotipo rilevato",
+  "Detected:": "Rilevato:",
+  "Detecting AMD CPU and applying fixes if necessary...": "Rilevamento della CPU AMD e applicazione delle correzioni, se necessario...",
+  "Detecting PCI storage controllers and NVMe devices...": "Rilevamento dei controller di storage PCI e dei dispositivi NVMe...",
+  "Detecting available disks...": "Rilevamento dischi disponibili...",
+  "Detecting container OS...": "Rilevamento sistema operativo contenitore...",
+  "Detecting if this is an OVH server and installing OVH RTM if necessary...": "Verificare se si tratta di un server OVH ed eventualmente installare OVH RTM...",
+  "Detecting previous optimizations...": "Rilevamento ottimizzazioni precedenti...",
+  "Detecting virtualization and installing  guest agent...": "Rilevamento della virtualizzazione e installazione dell'agente guest in corso...",
+  "Development Tools": "Strumenti di sviluppo",
+  "Device In Use": "Dispositivo in uso",
+  "Device added": "Dispositivo aggiunto",
+  "Device already present in target VM — existing hostpci entry reused": "Dispositivo già presente nella VM di destinazione: voce hostpci esistente riutilizzata",
+  "Device assignments will be written now and become active after reboot.": "Le assegnazioni dei dispositivi verranno scritte ora e diventeranno attive dopo il riavvio.",
+  "Device hostname": "Nome host del dispositivo",
+  "Device path mismatch. Format cancelled.": "Mancata corrispondenza del percorso del dispositivo. Formato annullato.",
+  "Device:": "Dispositivo:",
+  "Devices to add to VM": "Dispositivi da aggiungere alla VM",
+  "Diff: current system vs backup (--- system  +++ backup)": "Differenza: sistema attuale vs backup (--- sistema +++ backup)",
+  "Different host. Backup from:": "Ospite diverso. Backup da:",
+  "Direct conversion completed for container": "Conversione diretta completata per il contenitore",
+  "Directory Exists": "La directory esiste",
+  "Directory Not Empty": "Directory non vuota",
+  "Directory Not Found": "Directory non trovata",
+  "Directory already exists. Continue with permission setup?": "La directory esiste già. Continuare con la configurazione delle autorizzazioni?",
+  "Directory configured for sharedfiles group access on:": "Directory configurata per l'accesso al gruppo sharedfiles su:",
+  "Directory configured with sharedfiles group ownership": "Directory configurata con la proprietà del gruppo sharedfiles",
+  "Directory created successfully.": "Directory creata con successo.",
+  "Directory created successfully:": "Directory creata con successo:",
+  "Directory created:": "Directory creata:",
+  "Directory does not exist and was not created.": "La directory non esiste e non è stata creata.",
+  "Directory does not exist:": "La directory non esiste:",
+  "Directory error": "Errore nella directory",
+  "Directory not found": "Directory non trovata",
+  "Directory storage added successfully to Proxmox!": "Archiviazione di directory aggiunta con successo a Proxmox!",
+  "Directory successfully.": "Elenco con successo.",
+  "Directory:": "Rubrica:",
+  "Disable NIC Offloading (Intel e1000e)": "disabilita l'offload della scheda NIC (Intel e1000e)",
+  "Disable autostart on conflicting VM": "Disabilita l'avvio automatico sulla VM in conflitto",
+  "Disable autostart on one VM to avoid startup conflicts.": "Disabilita l'avvio automatico su una VM per evitare conflitti di avvio.",
+  "Disable kernel audit messages (optional but recommended):": "Disabilita i messaggi di controllo del kernel (facoltativo ma consigliato):",
+  "Disable onboot on affected VM(s)/CT(s)": "Disabilita l'avvio sulle VM/CT interessati",
+  "Disable portmapper/rpcbind": "disabilita portmapper/rpcbind",
+  "Disabled": "Disabilitato",
+  "Disabling High Availability services...": "Disabilitazione dei servizi ad alta disponibilità...",
+  "Disabling ZFS autotrim applied by ProxMenux...": "Disattivazione del taglio automatico ZFS applicato da ProxMenux...",
+  "Disabling and removing NetworkManager...": "Disabilitazione e rimozione di NetworkManager...",
+  "Disabling and stopping rpcbind service...": "Disabilitazione e arresto del servizio rpcbind in corso...",
+  "Disabling non-free firmware warnings...": "Disabilitare gli avvisi del firmware non libero...",
+  "Disabling portmapper/rpcbind for security...": "Disabilitare portmapper/rpcbind per sicurezza...",
+  "Discover targets on portal:": "Scopri target sul portale:",
+  "Discovering iSCSI targets...": "Individuazione delle destinazioni iSCSI...",
+  "Discovery successful": "Scoperta riuscita",
+  "Disk": "Disco",
+  "Disk Already Assigned": "Disco già assegnato",
+  "Disk In Use": "Disco in uso",
+  "Disk In Use by Running VM": "Disco in uso dalla VM in esecuzione",
+  "Disk Manager": "Gestione disco",
+  "Disk Reference Conflict": "Conflitto di riferimento del disco",
+  "Disk Setup": "Configurazione del disco",
+  "Disk added as": "Disco aggiunto come",
+  "Disk already has": "Il disco lo ha già",
+  "Disk and Storage Manager - Manual CLI Guide": "Gestione dischi e archivi: Guida CLI manuale",
+  "Disk appears empty. It will be formatted.": "Il disco sembra vuoto. Verrà formattato.",
+  "Disk assigned at": "Disco assegnato a",
+  "Disk attached as:": "Disco allegato come:",
+  "Disk configured as": "Disco configurato come",
+  "Disk conversion failed for": "Conversione del disco non riuscita per",
+  "Disk file not found:": "File su disco non trovato:",
+  "Disk formatted as": "Disco formattato come",
+  "Disk formatted successfully.": "Disco formattato correttamente.",
+  "Disk image        — VM disk images": "Immagine disco: immagini del disco della VM",
+  "Disk interface is required to continue VM creation.": "Per continuare la creazione della VM è necessaria l'interfaccia del disco.",
+  "Disk interface selected:": "Interfaccia disco selezionata:",
+  "Disk interface selection cancelled.": "Selezione dell'interfaccia del disco annullata.",
+  "Disk is part of a host ZFS pool": "Il disco fa parte di un pool ZFS host",
+  "Disk is part of host LVM": "Il disco fa parte dell'host LVM",
+  "Disk is ready for VM passthrough.": "Il disco è pronto per il passthrough della VM.",
+  "Disk is ready to be added to Proxmox storage.": "Il disco è pronto per essere aggiunto allo spazio di archiviazione Proxmox.",
+  "Disk metadata cleaned.": "Metadati del disco puliti.",
+  "Disk mounted at": "Disco montato a",
+  "Disk path resolved via pvesm:": "Percorso del disco risolto tramite pvesm:",
+  "Disk path:": "Percorso del disco:",
+  "Disk safety revalidation failed.": "La riconvalida della sicurezza del disco non è riuscita.",
+  "Disk safety validation passed.": "Convalida della sicurezza del disco superata.",
+  "Disk unmounted from": "Disco smontato da",
+  "Disk verified and accessible inside CT at": "Disco verificato e accessibile all'interno di CT all'indirizzo",
+  "Disk:": "Disco:",
+  "Disks exported:": "Dischi esportati:",
+  "Disks to export:": "Dischi da esportare:",
+  "Disks to import:": "Dischi da importare:",
+  "Disks to process:": "Dischi da elaborare:",
+  "Disks:": "Dischi:",
+  "Display  :": "Visualizzazione:",
+  "Display logical volumes (LVM)": "Visualizza volumi logici (LVM)",
+  "Display physical volumes (LVM)": "Visualizza volumi fisici (LVM)",
+  "Display system summary in ASCII format": "Visualizza il riepilogo del sistema in formato ASCII",
+  "Display volume groups (LVM)": "Visualizza gruppi di volumi (LVM)",
+  "Do not run the upgrade from the Web UI virtual console (it will disconnect)": "Non eseguire l'aggiornamento dalla console virtuale dell'interfaccia utente Web (si disconnetterà)",
+  "Do not start the VM until the system has been rebooted.": "Non avviare la VM finché il sistema non è stato riavviato.",
+  "Do you want ProxMenux to stop it now?": "Vuoi che ProxMenux lo interrompa adesso?",
+  "Do you want to activate ProxMenux Monitor?": "Vuoi attivare ProxMenux Monitor?",
+  "Do you want to apply the optional NVIDIA patch to remove some GPU limitations?": "Vuoi applicare la patch NVIDIA opzionale per rimuovere alcune limitazioni della GPU?",
+  "Do you want to apply these optimizations now?": "Vuoi applicare queste ottimizzazioni adesso?",
+  "Do you want to configure GPU passthrough for this VM now?": "Vuoi configurare il passthrough GPU per questa VM adesso?",
+  "Do you want to continue anyway?": "Vuoi continuare comunque?",
+  "Do you want to continue with the conversion now, or exit to create a backup first?": "Vuoi continuare con la conversione adesso o uscire per creare prima un backup?",
+  "Do you want to continue?": "Vuoi continuare?",
+  "Do you want to convert it to a privileged container now?": "Vuoi convertirlo in un contenitore privilegiato adesso?",
+  "Do you want to create it now?": "Vuoi crearlo adesso?",
+  "Do you want to create it?": "Vuoi crearlo?",
+  "Do you want to deactivate ProxMenux Monitor?": "Vuoi disattivare ProxMenux Monitor?",
+  "Do you want to disable and remove it now?": "Vuoi disabilitarlo e rimuoverlo adesso?",
+  "Do you want to enable IOMMU now?": "Vuoi abilitare IOMMU adesso?",
+  "Do you want to enable the serial port": "Vuoi abilitare la porta seriale",
+  "Do you want to encrypt this backup?": "vuoi crittografare questo backup?",
+  "Do you want to install Log2RAM anyway to reduce log write load?": "Vuoi installare comunque Log2RAM per ridurre il carico di scrittura del registro?",
+  "Do you want to make this mount permanent?": "Vuoi rendere permanente questa montatura?",
+  "Do you want to open Switch GPU Mode now?": "Vuoi aprire la modalità Cambia GPU adesso?",
+  "Do you want to proceed and run the Proxmox System Update?": "Vuoi procedere ed eseguire l'aggiornamento del sistema Proxmox?",
+  "Do you want to proceed with the system update?": "Vuoi procedere con l'aggiornamento del sistema?",
+  "Do you want to proceed?": "Vuoi procedere?",
+  "Do you want to reboot now?": "Vuoi riavviare adesso?",
+  "Do you want to restart the network service now to apply changes?": "Riavviare adesso il servizio di rete per applicare le modifiche?",
+  "Do you want to restart the network service to apply changes?": "Riavviare il servizio di rete per applicare le modifiche?",
+  "Do you want to run the network script from": "Vuoi eseguire lo script di rete da",
+  "Do you want to run the post-installation script from": "Vuoi eseguire lo script post-installazione da",
+  "Do you want to run the script now?": "Vuoi eseguire lo script adesso?",
+  "Do you want to schedule selected paths for next boot now?": "Vuoi pianificare adesso i percorsi selezionati per il prossimo avvio?",
+  "Do you want to start the converted unprivileged container": "Vuoi avviare il contenitore non privilegiato convertito",
+  "Do you want to start the privileged container": "Vuoi avviare il contenitore privilegiato",
+  "Do you want to try different credentials or authentication method?": "Vuoi provare credenziali o metodi di autenticazione diversi?",
+  "Do you want to unmount it first?": "Vuoi smontarlo prima?",
+  "Do you want to update now?": "Vuoi aggiornare adesso?",
+  "Do you want to update the NVIDIA userspace libraries inside these containers to match the host?": "Vuoi aggiornare le librerie dello spazio utente NVIDIA all'interno di questi contenitori in modo che corrispondano all'host?",
+  "Do you want to update the existing export?": "Vuoi aggiornare l'esportazione esistente?",
+  "Do you want to update the existing share?": "Vuoi aggiornare la condivisione esistente?",
+  "Do you want to view the selected backup before restoring?": "Vuoi visualizzare il backup selezionato prima del ripristino?",
+  "Download failed for all attempted URLs": "Download non riuscito per tutti gli URL tentati",
+  "Download keyfile": "scarica il file chiave",
+  "Download latest VirtIO ISO automatically": "Scarica automaticamente l'ultima ISO VirtIO",
+  "Downloaded amdgpu_top": "Scaricato amdgpu_top",
+  "Downloading": "Download in corso",
+  "Downloading Helper-Scripts logo...": "Download del logo degli script di supporto in corso...",
+  "Downloading Home-Labs-Club logo...": "Download del logo Home-Labs-Club...",
+  "Downloading JC Channel logo...": "Download del logo JC Channel in corso...",
+  "Downloading ProxMenux logo...": "Download del logo ProxMenux...",
+  "Downloading Proxmology logo...": "Download del logo Proxmology...",
+  "Downloading UUP converter...": "Download del convertitore UUP in corso...",
+  "Downloading amdgpu_top": "Download di amdgpu_top",
+  "Downloading official installer...": "Download del programma di installazione ufficiale in corso...",
+  "Downloading pre-existing encrypted backups from this host will fail unless you kept a copy of the current key.": "il download di backup crittografati preesistenti da questo host fallirà a meno che tu non conservi una copia della chiave corrente.",
+  "Downloading the latest Fastfetch release...": "Download dell'ultima versione di Fastfetch in corso...",
+  "Driver blacklist entries removed": "Voci della lista nera dei driver rimosse",
+  "Driver blacklist removed for": "Lista nera dei driver rimossa per",
+  "Driver installed successfully. Press Enter to continue...": "Driver installato correttamente. Premi Invio per continuare...",
+  "Drivers  :": "Driver:",
+  "Drivers compiled and installed via DKMS.": "Driver compilati e installati tramite DKMS.",
+  "Dumping AMD GPU ROM BIOS via sysfs...": "Dumping del BIOS ROM della GPU AMD tramite sysfs...",
+  "Duplicate IP addresses found": "Trovati indirizzi IP duplicati",
+  "Duplicate parameters cleaned": "Parametri duplicati puliti",
+  "Duration": "Durata",
+  "Duration:": "Durata:",
+  "EFI disk created and configured on": "Disco EFI creato e configurato su",
+  "EFI storage selection cancelled.": "Selezione dell'archiviazione EFI annullata.",
+  "EFI storage selection failed or was cancelled. VM creation aborted.": "La selezione dell'archivio EFI non è riuscita o è stata annullata. Creazione della VM interrotta.",
+  "EMERGENCY PROXMOX SYSTEM REPAIR": "RIPARAZIONE DEL SISTEMA PROXMOX IN EMERGENZA",
+  "ENABLED for restore": "ABILITATO per il ripristino",
+  "EXISTS": "ESISTE",
+  "Each LUN will appear as a block device assignable to VMs.": "Ogni LUN apparirà come un dispositivo a blocchi assegnabile alle VM.",
+  "Edge TPU runtime installed.": "Runtime Edge TPU installato.",
+  "Edit raw CT configuration file": "Modifica il file di configurazione CT grezzo",
+  "Edit raw VM configuration file": "Modifica il file di configurazione grezzo della VM",
+  "Edit the VM machine type to q35 and try again.": "Modifica il tipo di macchina VM su q35 e riprova.",
+  "Emergency Proxmox System Repair": "Riparazione di emergenza del sistema Proxmox",
+  "Emergency recovery:": "Recupero d'emergenza:",
+  "Empty": "Vuoto",
+  "Enable": "Abilitare",
+  "Enable / disable job timer": "Abilita/disabilita il timer del lavoro",
+  "Enable High Availability services": "abilita i servizi ad alta disponibilità",
+  "Enable IOMMU in GRUB or ZFS boot": "Abilita IOMMU nell'avvio GRUB o ZFS",
+  "Enable IOMMU support if not enabled": "Abilita il supporto IOMMU se non abilitato",
+  "Enable IOMMU, reboot the host, and try again.": "Abilita IOMMU, riavvia l'host e riprova.",
+  "Enable Remote Desktop (RDP) before disabling the virtual display.": "Abilita Desktop remoto (RDP) prima di disabilitare il display virtuale.",
+  "Enable SSD emulation for this disk?": "Abilitare l'emulazione SSD per questo disco?",
+  "Enable TCP BBR/Fast Open control": "abilita il controllo TCP BBR/Fast Open",
+  "Enable VFIO IOMMU support": "abilita il supporto VFIO IOMMU",
+  "Enable ZFS autotrim (SSD/NVMe pools)": "abilita il taglio automatico ZFS (pool SSD/NVMe)",
+  "Enable auto-sync if /var/log exceeds 90% of its size?": "Abilitare la sincronizzazione automatica se /var/log supera il 90% delle sue dimensioni?",
+  "Enable fast reboots": "abilita i riavvii rapidi",
+  "Enable restart on kernel panic": "abilita il riavvio in caso di panico del kernel",
+  "Enable/Disable job": "Abilita/Disabilita lavoro",
+  "Enabled": "Abilitato",
+  "Enabled (device pending — load apex module or reboot)": "Abilitato (dispositivo in sospeso: carica il modulo apex o riavvia)",
+  "Enabled (repokey)": "Abilitato (repokey)",
+  "Enabled and detected": "Abilitato e rilevato",
+  "Enabled and ready": "Abilitato e pronto",
+  "Enabled but not connected": "Abilitato ma non connesso",
+  "Enabled memory compaction proactiveness": "Abilitata la proattività della compattazione della memoria",
+  "Enabling Google TCP BBR congestion control...": "Abilitazione del controllo congestione BBR TCP di Google in corso...",
+  "Enabling High Availability (HA) services...": "Abilitazione dei servizi ad alta disponibilità (HA)...",
+  "Enabling IOMMU": "Abilitazione dell'IOMMU",
+  "Enabling IOMMU and configuring VFIO for PCI passthrough...": "Abilitazione di IOMMU e configurazione di VFIO per passthrough PCI...",
+  "Enabling TCP Fast Open...": "Abilitazione dell'apertura rapida TCP...",
+  "Enabling pigz in vzdump configuration...": "Abilitazione di pigz nella configurazione di vzdump...",
+  "Encrypt this Borg repository?": "Crittografare questo repository Borg?",
+  "Encryption": "Crittografia",
+  "Encryption key": "chiave di crittografia",
+  "Encryption key creation failed": "Creazione della chiave di crittografia non riuscita",
+  "Encryption:": "Crittografia:",
+  "English": "Inglese",
+  "Ensure there are no errors and that proxmox-ve candidate shows 9.x": "Assicurarsi che non vi siano errori e che il candidato proxmox-ve mostri 9.x",
+  "Ensuring apex group and udev rules...": "Garantire le regole dell'apex group e dell'udev...",
+  "Ensuring ceph.sources (enterprise, Trixie) is present...": "Garantire la presenza di ceph.sources (enterprise, Trixie)...",
+  "Ensuring ceph.sources (no-subscription, Trixie) is present...": "Assicurarsi che ceph.sources (senza abbonamento, Trixie) sia presente...",
+  "Ensuring proxmox.sources (PVE 9, no-subscription, deb822) is present...": "Assicurarsi che proxmox.sources (PVE 9, senza abbonamento, deb822) sia presente...",
+  "Ensuring pve-enterprise.sources (PVE 9, deb822) is present...": "Assicurarsi che pve-enterprise.sources (PVE 9, deb822) sia presente...",
+  "Enter": "Entra",
+  "Enter CT ID:": "Inserisci l'ID CT:",
+  "Enter MSR register (e.g. 0x10):": "Inserisci il registro MSR (ad esempio 0x10):",
+  "Enter NFS export path (e.g., /mnt/shared):": "Inserisci il percorso di esportazione NFS (ad esempio, /mnt/shared):",
+  "Enter NFS server IP or hostname:": "Inserisci l'IP o il nome host del server NFS:",
+  "Enter NVMe device (e.g., nvme0):": "Inserisci il dispositivo NVMe (ad esempio, nvme0):",
+  "Enter PCI BDF (e.g. 0000:01:00.0):": "Inserisci PCI BDF (ad esempio 0000:01:00.0):",
+  "Enter PCI BDF (e.g. 0000:04:00.0):": "Inserisci PCI BDF (ad esempio 0000:04:00.0):",
+  "Enter Path": "Inserisci il percorso",
+  "Enter Samba server IP:": "Inserisci l'IP del server Samba:",
+  "Enter Samba share name:": "Inserisci il nome della condivisione Samba:",
+  "Enter Tailscale Auth Key": "Inserisci la chiave di autenticazione Tailscale",
+  "Enter VM ID:": "Inserisci l'ID della VM:",
+  "Enter VM/CT ID:": "Inserisci l'ID VM/CT:",
+  "Enter ZFS pool name for the selected disk:": "Inserisci il nome del pool ZFS per il disco selezionato:",
+  "Enter a name for the mount point (used as /mnt/<name>):": "Inserisci un nome per il punto di montaggio (usato come /mnt/<nome>):",
+  "Enter a name for the new virtual machine:": "Inserisci un nome per la nuova macchina virtuale:",
+  "Enter a number, or write or paste a command:": "Inserisci un numero oppure scrivi o incolla un comando:",
+  "Enter backup file (.zst):": "Inserisci il file di backup (.zst):",
+  "Enter backup path (.tar.zst):": "Inserisci il percorso di backup (.tar.zst):",
+  "Enter backup path (.vma.zst):": "Inserisci il percorso di backup (.vma.zst):",
+  "Enter base folder for temporary files and converter (default:": "Inserisci la cartella di base per i file temporanei e il convertitore (impostazione predefinita:",
+  "Enter boot target (e.g. scsi0, sata0, ide0):": "Inserisci la destinazione di avvio (ad esempio scsi0, sata0, ide0):",
+  "Enter content types (comma-separated):": "Inserisci i tipi di contenuto (separati da virgole):",
+  "Enter custom CIFS mount options (open uid/gid/file_mode strongly recommended for LXC bind-mounts):": "Inserisci le opzioni di montaggio CIFS personalizzate (open uid/gid/file_mode fortemente consigliato per i montaggi bind LXC):",
+  "Enter custom NFS mount options:": "Inserisci le opzioni di montaggio NFS personalizzate:",
+  "Enter custom NFS options:": "Inserisci le opzioni NFS personalizzate:",
+  "Enter custom Samba configuration for this share:": "Inserisci la configurazione Samba personalizzata per questa condivisione:",
+  "Enter custom mount options:": "Inserisci le opzioni di montaggio personalizzate:",
+  "Enter custom path": "Inserisci il percorso personalizzato",
+  "Enter custom pathr": "Inserisci il percorso personalizzato",
+  "Enter destination directory for exported file(s):": "Inserisci la directory di destinazione per i file esportati:",
+  "Enter destination path for ISO file": "Immettere il percorso di destinazione per il file ISO",
+  "Enter destination path:": "Inserisci il percorso di destinazione:",
+  "Enter device (e.g., sda or nvme0):": "Inserisci il dispositivo (ad esempio, sda o nvme0):",
+  "Enter directory containing OVA/OVF files:": "Entra nella directory contenente i file OVA/OVF:",
+  "Enter directory path:": "Inserisci il percorso della directory:",
+  "Enter disk image path:": "Inserisci il percorso dell'immagine del disco:",
+  "Enter disk or partition path (prefer /dev/disk/by-id/...):": "Inserisci il percorso del disco o della partizione (preferisci /dev/disk/by-id/...):",
+  "Enter domain name:": "Inserisci il nome del dominio:",
+  "Enter domain:": "Inserisci il dominio:",
+  "Enter filesystem (ext4/xfs/btrfs):": "Inserisci il file system (ext4/xfs/btrfs):",
+  "Enter folder name for /mnt:": "Inserisci il nome della cartella per /mnt:",
+  "Enter full disk path as shown above (starting with /dev/disk/by-id/xxx...):": "Inserisci il percorso completo del disco come mostrato sopra (iniziando con /dev/disk/by-id/xxx...):",
+  "Enter full path for mount point:": "Inserisci il percorso completo per il punto di montaggio:",
+  "Enter full path to the disk image (e.g., /var/lib/vz/images/xyz.img):": "Inserisci il percorso completo dell'immagine del disco (ad esempio, /var/lib/vz/images/xyz.img):",
+  "Enter full path to the input image (e.g., /var/lib/vz/images/disk.vmdk):": "Inserisci il percorso completo dell'immagine di input (ad esempio, /var/lib/vz/images/disk.vmdk):",
+  "Enter full path:": "Inserisci il percorso completo:",
+  "Enter host IP (e.g., 192.168.0.100):": "Inserisci l'IP dell'host (ad esempio, 192.168.0.100):",
+  "Enter host or IP:": "Inserisci host o IP:",
+  "Enter hostpci slot (e.g. 0):": "Inserisci lo slot hostpci (ad esempio 0):",
+  "Enter hostpci slot number (e.g. 0):": "Inserisci il numero dello slot hostpci (ad esempio 0):",
+  "Enter iSCSI target portal IP or hostname:": "Inserisci l'IP o il nome host del portale di destinazione iSCSI:",
+  "Enter image full path:": "Inserisci il percorso completo dell'immagine:",
+  "Enter imported disk reference (e.g. local-lvm:vm-100-disk-0):": "Inserisci il riferimento del disco importato (ad esempio local-lvm:vm-100-disk-0):",
+  "Enter interface (sata/scsi/virtio/ide):": "Inserisci l'interfaccia (sata/scsi/virtio/ide):",
+  "Enter interface name (e.g. eth0):": "Inserisci il nome dell'interfaccia (ad esempio eth0):",
+  "Enter mount path on host:": "Inserisci il percorso di montaggio sull'host:",
+  "Enter mount point in CT (e.g. /mnt/data):": "Inserisci il punto di montaggio in CT (ad esempio /mnt/data):",
+  "Enter mp slot number (e.g. 0):": "Inserisci il numero dello slot mp (ad esempio 0):",
+  "Enter name for the imported VM:": "Inserisci il nome per la VM importata:",
+  "Enter networks to advertise (comma-separated CIDR):": "Inserisci le reti da pubblicizzare (CIDR separati da virgole):",
+  "Enter new folder name:": "Inserisci il nome della nuova cartella:",
+  "Enter new group name:": "Inserisci il nuovo nome del gruppo:",
+  "Enter partition path (e.g. /dev/sdX1):": "Inserisci il percorso della partizione (ad esempio /dev/sdX1):",
+  "Enter password for": "Inserisci la password per",
+  "Enter password:": "Inserisci la password:",
+  "Enter path manually": "Immettere il percorso manualmente",
+  "Enter path to analyze:": "Inserisci il percorso da analizzare:",
+  "Enter path:": "Inserisci il percorso:",
+  "Enter pool name to clear errors:": "Inserisci il nome del pool per cancellare gli errori:",
+  "Enter pool name to export:": "Inserisci il nome del pool da esportare:",
+  "Enter pool name to import:": "Inserisci il nome del pool da importare:",
+  "Enter pool name:": "Inserisci il nome della piscina:",
+  "Enter pool/dataset name:": "Inserisci il nome del pool/set di dati:",
+  "Enter pool/dataset to destroy:": "Inserisci il pool/set di dati da distruggere:",
+  "Enter pool/dataset to mount:": "Inserisci il pool/set di dati da montare:",
+  "Enter search term (leave empty to show all scripts):": "Inserisci il termine di ricerca (lascia vuoto per mostrare tutti gli script):",
+  "Enter server IP": "Inserisci l'IP del server",
+  "Enter server IP/hostname manually": "Inserisci manualmente l'IP/nome host del server",
+  "Enter server IP:": "Inserisci l'IP del server:",
+  "Enter slot number (e.g. 0):": "Inserisci il numero dello slot (ad esempio 0):",
+  "Enter storage ID for Proxmox:": "Inserisci l'ID di archiviazione per Proxmox:",
+  "Enter storage ID:": "Inserisci l'ID di archiviazione:",
+  "Enter storage name:": "Inserisci il nome dell'archivio:",
+  "Enter subnet (e.g., 192.168.0.0/24):": "Inserisci la sottorete (ad esempio, 192.168.0.0/24):",
+  "Enter target disk (e.g. /dev/sdX):": "Inserisci il disco di destinazione (ad esempio /dev/sdX):",
+  "Enter target storage name (e.g., local-lvm):": "Inserisci il nome dell'archivio di destinazione (ad esempio, local-lvm):",
+  "Enter target storage:": "Inserisci lo spazio di archiviazione di destinazione:",
+  "Enter the BORG REPOKEY passphrase for target:": "inserisci la passphrase BORG REPOKEY per la destinazione:",
+  "Enter the Samba username:": "Inserisci il nome utente Samba:",
+  "Enter the VMID for the new VM:": "Inserisci il VMID per la nuova VM:",
+  "Enter the container terminal:": "Inserisci il terminal container:",
+  "Enter the full path to the directory containing disk images:": "Inserisci il percorso completo della directory contenente le immagini del disco:",
+  "Enter the full path to the host directory:": "Inserisci il percorso completo della directory host:",
+  "Enter the full path to the host folder:": "Inserisci il percorso completo della cartella host:",
+  "Enter the full path to the output image (e.g., /var/lib/vz/images/output.qcow2):": "Inserisci il percorso completo dell'immagine di output (ad esempio, /var/lib/vz/images/output.qcow2):",
+  "Enter the host mount path:": "Inserisci il percorso di montaggio dell'host:",
+  "Enter the iperf3 server IP or hostname:": "Inserisci l'IP o il nome host del server iperf3:",
+  "Enter the maximum size (in MB) to allocate for /var/log in RAM (e.g. 128, 256, 512):": "Inserisci la dimensione massima (in MB) da allocare per /var/log nella RAM (ad esempio 128, 256, 512):",
+  "Enter the mount point for the NFS export (e.g., /mnt/mynfs):": "Inserisci il punto di montaggio per l'esportazione NFS (ad esempio, /mnt/mynfs):",
+  "Enter the mount point for the shared folder (e.g., /mnt/myshare):": "Inserisci il punto di montaggio per la cartella condivisa (ad esempio, /mnt/myshare):",
+  "Enter the mount point inside the CT for": "Immettere il punto di montaggio all'interno del CT per",
+  "Enter the number or type the interface name:": "Inserisci il numero o digita il nome dell'interfaccia:",
+  "Enter the password for Samba user:": "Inserisci la password per l'utente Samba:",
+  "Enter the recovery passphrase set when the keyfile was created:": "Inserisci la passphrase di ripristino impostata al momento della creazione del file di chiavi:",
+  "Enter username for Samba server:": "Inserisci il nome utente per il server Samba:",
+  "Enter username:": "Inserisci il nome utente:",
+  "Enterprise Proxmox Ceph repository disabled": "Repository Enterprise Proxmox Ceph disabilitato",
+  "Enterprise Proxmox repository disabled": "Repository Enterprise Proxmox disabilitato",
+  "Enterprise repositories restored": "Repository aziendali ripristinati",
+  "Enterprise repository present": "Repository aziendale presente",
+  "Enterprise repository returned 401 Unauthorized (no valid subscription). Switch to the no-subscription repository and retry?": "Il repository aziendale ha restituito 401 Non autorizzato (nessun abbonamento valido). Passare al repository senza abbonamento e riprovare?",
+  "Enterprise repository unauthorized and fallback declined by user": "Repository aziendale non autorizzato e fallback rifiutato dall'utente",
+  "Entropy generation optimization removed": "Ottimizzazione della generazione di entropia rimossa",
+  "Equivalent manual flow of disk_host.sh: partition, format, mount, persist, register in Proxmox.": "Flusso manuale equivalente di disk_host.sh: partizione, formattazione, montaggio, persistenza, registrazione in Proxmox.",
+  "Equivalent manual flow of iscsi_host.sh.": "Flusso manuale equivalente di iscsi_host.sh.",
+  "Equivalent manual flow used by Local Shared Manager.": "Flusso manuale equivalente utilizzato dal Local Shared Manager.",
+  "Error": "Errore",
+  "Error applying patch. Backups preserved at": "Errore durante l'applicazione della patch. Backup conservati in",
+  "Error details:": "Dettagli dell'errore:",
+  "Error installing": "Errore durante l'installazione",
+  "Error installing build dependencies. Check": "Errore durante l'installazione delle dipendenze di build. Controllo",
+  "Error:": "Errore:",
+  "Error: Cannot create directory": "Errore: impossibile creare la directory",
+  "Error: Failed to download the script.": "Errore: impossibile scaricare lo script.",
+  "Error: No script data found for slug:": "Errore: nessun dato di script trovato per lo slug:",
+  "Error: No write permissions in directory": "Errore: nessuna autorizzazione di scrittura nella directory",
+  "Essential Proxmox packages installed": "Pacchetti Proxmox essenziali installati",
+  "Estimated required free space:": "Spazio libero richiesto stimato:",
+  "Every 12 hours": "Ogni 12 ore",
+  "Every 3 hours": "Ogni 3 ore",
+  "Every 6 hours": "Ogni 6 ore",
+  "Every hour": "Ogni ora",
+  "Every path in this backup is kernel-tied: the restore applies these paths automatically via the safe-subset filter and re-merges the operator's tuning.": "ogni percorso in questo backup è legato al kernel: il ripristino applica questi percorsi automaticamente tramite il filtro del sottoinsieme sicuro e unisce nuovamente l'ottimizzazione dell'operatore.",
+  "Everything restorable in this backup will be restored": "tutto ciò che è ripristinabile in questo backup verrà ripristinato",
+  "Example output: rootfs: local-lvm:vm-114-disk-0,size=8G": "Output di esempio: rootfs: local-lvm:vm-114-disk-0,size=8G",
+  "Example target: /dev/sdb": "Destinazione di esempio: /dev/sdb",
+  "Example: /dev/pve/vm-114-disk-0": "Esempio: /dev/pve/vm-114-disk-0",
+  "Example: /rpool/data/subvol-114-disk-0": "Esempio: /rpool/data/subvol-114-disk-0",
+  "Example: MOUNT_PATH=\"/rpool/data/subvol-114-disk-0\"": "Esempio: MOUNT_PATH=\"/rpool/data/subvol-114-disk-0\"",
+  "Example: cp /etc/pve/lxc/110.conf /etc/pve/lxc/110.conf.bak": "Esempio: cp /etc/pve/lxc/110.conf /etc/pve/lxc/110.conf.bak",
+  "Example: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak": "Esempio: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak",
+  "Example: daily or Mon..Fri 03:00": "Esempio: tutti i giorni o lun..ven 03:00",
+  "Example: mkdir -p /tmp/lxc_convert_114": "Esempio: mkdir -p /tmp/lxc_convert_114",
+  "Example: pct config 110 | grep unprivileged": "Esempio: pct config 110 | grep senza privilegi",
+  "Example: pct stop 110": "Esempio: pct stop 110",
+  "Example: pct stop 114": "Esempio: pct stop 114",
+  "Example: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup": "Esempio: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup",
+  "Example: pvesm path local-lvm:vm-114-disk-0": "Esempio: percorso pvesm local-lvm:vm-114-disk-0",
+  "Example: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf": "Esempio: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf",
+  "Examples:": "Esempi:",
+  "Execute destructive rollback?": "eseguire un rollback distruttivo?",
+  "Executing destructive rollback (operator confirmed) ...": "Esecuzione di un rollback distruttivo (confermato dall'operatore) ...",
+  "Executing:": "In esecuzione:",
+  "Existing Groups": "Gruppi esistenti",
+  "Existing file, re-downloading...": "File esistente, nuovo download in corso...",
+  "Existing filesystem:": "File system esistente:",
+  "Existing hostpci entries detected — they will be reused": "Rilevate voci hostpci esistenti: verranno riutilizzate",
+  "Existing key is at:": "la chiave esistente è in:",
+  "Existing recovery envelopes already on PBS stay intact — they still recover the old key with its original passphrase.": "le buste di ripristino esistenti già su PBS rimangono intatte: recuperano ancora la vecchia chiave con la sua passphrase originale.",
+  "Exit": "Uscita",
+  "Exit and repair manually": "Uscire e riparare manualmente",
+  "Exit the container terminal:": "Esci dal terminal container:",
+  "Exit: Stop to create backup manually": "Esci: interrompe per creare manualmente il backup",
+  "Exiting for manual repair...": "Uscita per la riparazione manuale...",
+  "Expected /tmp/gasket-driver/src not found. The clone seems incomplete or uses an unknown layout.": "Previsto /tmp/gasket-driver/src non trovato. Il clone sembra incompleto o utilizza un layout sconosciuto.",
+  "Expected Makefile not found in /tmp/gasket-driver/src. Source tree is incomplete.": "Makefile previsto non trovato in /tmp/gasket-driver/src. L'albero di origine è incompleto.",
+  "Expected path:": "Percorso previsto:",
+  "Expected: rootfs/ directory, or /etc /var /root at archive root.": "Previsto: directory rootfs/ o /etc /var /root nella root dell'archivio.",
+  "Export Format": "Formato di esportazione",
+  "Export Options": "Opzioni di esportazione",
+  "Export Path": "Percorso di esportazione",
+  "Export Summary": "Riepilogo dell'esportazione",
+  "Export VM to OVA or OVF": "Esporta VM in OVA o OVF",
+  "Export a ZFS pool": "Esporta un pool ZFS",
+  "Export added successfully.": "Esportazione aggiunta correttamente.",
+  "Export backup data to file": "Esporta i dati di backup su file",
+  "Export completed. The running system has not been modified.": "Esportazione completata. Il sistema di corsa non è stato modificato.",
+  "Export completed:": "Esportazione completata:",
+  "Export deleted and NFS service restarted.": "Esportazione eliminata e servizio NFS riavviato.",
+  "Export error log": "Esporta registro errori",
+  "Export exists:": "L'esportazione esiste:",
+  "Export failed.": "Esportazione non riuscita.",
+  "Export list test": "Prova dell'elenco di esportazione",
+  "Export list:": "Elenco esportazioni:",
+  "Export mode:": "Modalità di esportazione:",
+  "Export not found on server:": "Esportazione non trovata sul server:",
+  "Export path:": "Percorso di esportazione:",
+  "Export permissions allow access": "Le autorizzazioni di esportazione consentono l'accesso",
+  "Export to file (no system changes)": "Esporta su file (nessuna modifica al sistema)",
+  "Export updated successfully.": "Esportazione aggiornata correttamente.",
+  "Export:": "Esportare:",
+  "Exporting ZFS pool...": "Esportazione pool ZFS in corso...",
+  "Exports cleared.": "Le esportazioni si sono stabilizzate.",
+  "Exports:": "Esportazioni:",
+  "Extended Filesystem 4 (recommended)": "Filesystem esteso 4 (consigliato)",
+  "External disk for backup": "Disco esterno per il backup",
+  "Extracting NVIDIA installer on host...": "Estrazione del programma di installazione NVIDIA sull'host in corso...",
+  "Extracting OVA archive...": "Estrazione dell'archivio OVA...",
+  "Extracting archive...": "Estrazione archivio...",
+  "Extracting data from Borg...": "Estrazione dati da Borg...",
+  "Extracting data from PBS...": "Estrazione dei dati da PBS...",
+  "Extraction completed.": "Estrazione completata.",
+  "Extraction failed.": "Estrazione fallita.",
+  "Extraction failed. Check log:": "Estrazione fallita. Controlla il registro:",
+  "Extraction successful": "Estrazione riuscita",
+  "FAILED": "FALLITO",
+  "FINAL CONFIRMATION — DATA WILL BE ERASED": "CONFERMA FINALE — I DATI VERRANNO CANCELLATI",
+  "Fail2Ban - Intrusion Prevention": "Fail2Ban - Prevenzione delle intrusioni",
+  "Fail2Ban Management": "Gestione Fail2Ban",
+  "Fail2Ban has been removed": "Fail2Ban è stato rimosso",
+  "Fail2Ban installation and configuration completed successfully!": "Installazione e configurazione di Fail2Ban completate con successo!",
+  "Fail2Ban installed successfully": "Fail2Ban installato correttamente",
+  "Fail2Ban is NOT running!": "Fail2Ban NON è in esecuzione!",
+  "Fail2Ban is currently installed.": "Fail2Ban è attualmente installato.",
+  "Fail2Ban is not installed on this system.": "Fail2Ban non è installato su questo sistema.",
+  "Fail2Ban is running correctly": "Fail2Ban funziona correttamente",
+  "Failed": "Fallito",
+  "Failed to access log2ram directory": "Impossibile accedere alla directory log2ram",
+  "Failed to access share with provided credentials.": "Impossibile accedere alla condivisione con le credenziali fornite.",
+  "Failed to access:": "Impossibile accedere:",
+  "Failed to add CIFS storage to Proxmox.": "Impossibile aggiungere l'archiviazione CIFS a Proxmox.",
+  "Failed to add GPU audio function": "Impossibile aggiungere la funzione audio della GPU",
+  "Failed to add GPU to target VM": "Impossibile aggiungere GPU alla VM di destinazione",
+  "Failed to add IOMMU group device": "Impossibile aggiungere il dispositivo del gruppo IOMMU",
+  "Failed to add NFS storage to Proxmox.": "Impossibile aggiungere spazio di archiviazione NFS a Proxmox.",
+  "Failed to add bind mount:": "Impossibile aggiungere il montaggio del collegamento:",
+  "Failed to add iSCSI storage to Proxmox.": "Impossibile aggiungere spazio di archiviazione iSCSI a Proxmox.",
+  "Failed to add storage to Proxmox.": "Impossibile aggiungere spazio di archiviazione a Proxmox.",
+  "Failed to assign Controller/NVMe": "Impossibile assegnare Controller/NVMe",
+  "Failed to assign virtual disk": "Impossibile assegnare il disco virtuale",
+  "Failed to clone Lynis from GitHub": "Impossibile clonare Lynis da GitHub",
+  "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "Impossibile clonare il repository log2ram. Controllare /tmp/log2ram_install.log",
+  "Failed to configure EFI disk": "Impossibile configurare il disco EFI",
+  "Failed to configure IOMMU automatically.": "Impossibile configurare IOMMU automaticamente.",
+  "Failed to configure Proxmox repositories": "impossibile configurare i repository Proxmox",
+  "Failed to configure TPM device in VM": "Impossibile configurare il dispositivo TPM nella VM",
+  "Failed to configure repositories.": "Impossibile configurare i repository.",
+  "Failed to configure repositories. Installation aborted.": "Impossibile configurare i repository. Installazione interrotta.",
+  "Failed to connect to": "Impossibile connettersi a",
+  "Failed to connect to server.": "Impossibile connettersi al server.",
+  "Failed to copy sources into": "Impossibile copiare le fonti in",
+  "Failed to create EFI disk": "Impossibile creare il disco EFI",
+  "Failed to create OVA archive.": "Impossibile creare l'archivio OVA.",
+  "Failed to create TPM state disk": "Impossibile creare il disco di stato del TPM",
+  "Failed to create VM": "Impossibile creare la VM",
+  "Failed to create base VM. Check VM ID and host configuration.": "Impossibile creare la VM di base. Controlla l'ID della VM e la configurazione dell'host.",
+  "Failed to create directory on host:": "Impossibile creare la directory sull'host:",
+  "Failed to create directory:": "Impossibile creare la directory:",
+  "Failed to create disk": "Impossibile creare il disco",
+  "Failed to create encryption key. Backup cancelled — fix the underlying issue and retry.": "impossibile creare la chiave di crittografia.Backup annullato: risolvi il problema sottostante e riprova.",
+  "Failed to create group:": "Impossibile creare il gruppo:",
+  "Failed to create mount point.": "Impossibile creare il punto di montaggio.",
+  "Failed to create mount point:": "Impossibile creare il punto di montaggio:",
+  "Failed to create partition table": "Impossibile creare la tabella delle partizioni",
+  "Failed to create partition table on disk": "Impossibile creare la tabella delle partizioni sul disco",
+  "Failed to create partition.": "Impossibile creare la partizione.",
+  "Failed to create temporary directory:": "Impossibile creare la directory temporanea:",
+  "Failed to create/update ZFS ARC configuration file": "Impossibile creare/aggiornare il file di configurazione ZFS ARC",
+  "Failed to destroy LXC:": "Impossibile distruggere LXC:",
+  "Failed to destroy VM:": "Impossibile distruggere la VM:",
+  "Failed to detect RAM size. Using default value of 16GB for ZFS ARC optimization.": "Impossibile rilevare la dimensione della RAM. Utilizzo del valore predefinito di 16 GB per l'ottimizzazione ZFS ARC.",
+  "Failed to detect installed NVIDIA driver version.": "Impossibile rilevare la versione del driver NVIDIA installata.",
+  "Failed to detect partition on disk": "Impossibile rilevare la partizione sul disco",
+  "Failed to determine timezone from IP address - keeping current timezone settings": "Impossibile determinare il fuso orario dall'indirizzo IP: mantenendo le impostazioni attuali del fuso orario",
+  "Failed to disable Start on boot for LXC": "Impossibile disabilitare l'avvio all'avvio per LXC",
+  "Failed to disable Start on boot for VM": "Impossibile disabilitare l'avvio all'avvio per la VM",
+  "Failed to disable ZFS autotrim for pool:": "Impossibile disabilitare il taglio automatico ZFS per il pool:",
+  "Failed to download Borg.": "Impossibile scaricare Borg.",
+  "Failed to download Figurine": "Impossibile scaricare la statuetta",
+  "Failed to download Helper-Scripts logo": "Impossibile scaricare il logo degli script di supporto",
+  "Failed to download Home-Lab-Club logo": "Impossibile scaricare il logo Home-Lab-Club",
+  "Failed to download ISO image": "Impossibile scaricare l'immagine ISO",
+  "Failed to download JC Channel logo": "Impossibile scaricare il logo JC Channel",
+  "Failed to download NVIDIA installer": "Impossibile scaricare il programma di installazione NVIDIA",
+  "Failed to download ProxMenux logo": "Impossibile scaricare il logo ProxMenux",
+  "Failed to download Proxmology logo": "Impossibile scaricare il logo Proxmology",
+  "Failed to download VirtIO driver ISO.": "Impossibile scaricare l'ISO del driver VirtIO.",
+  "Failed to download amdgpu_top": "Impossibile scaricare amdgpu_top",
+  "Failed to edit /etc/fstab — remove the line manually.": "Impossibile modificare /etc/fstab: rimuovi la riga manualmente.",
+  "Failed to enable ZFS autotrim for pool:": "Impossibile abilitare il taglio automatico ZFS per il pool:",
+  "Failed to enable automatic time synchronization": "Impossibile abilitare la sincronizzazione automatica dell'ora",
+  "Failed to extract OVA file:": "Impossibile estrarre il file OVA:",
+  "Failed to extract package": "Impossibile estrarre il pacchetto",
+  "Failed to fetch the Google Coral GPG key. Check": "Impossibile recuperare la chiave GPG di Google Coral. Controllo",
+  "Failed to format disk as": "Impossibile formattare il disco come",
+  "Failed to format partition": "Impossibile formattare la partizione",
+  "Failed to format the partition.": "Impossibile formattare la partizione.",
+  "Failed to get .deb download URL": "Impossibile ottenere l'URL di download di .deb",
+  "Failed to get latest version from GitHub": "Impossibile ottenere la versione più recente da GitHub",
+  "Failed to get release information from GitHub": "Impossibile ottenere informazioni sulla versione da GitHub",
+  "Failed to get shares": "Impossibile ottenere le condivisioni",
+  "Failed to get shares from": "Impossibile ottenere condivisioni da",
+  "Failed to import": "Impossibile importare",
+  "Failed to initialize Borg repository at:": "Impossibile inizializzare il repository Borg in:",
+  "Failed to install Coral TPU driver inside the container.": "Impossibile installare il driver Coral TPU all'interno del contenitore.",
+  "Failed to install Fail2Ban": "Impossibile installare Fail2Ban",
+  "Failed to install Fastfetch.": "Impossibile installare Fastfetch.",
+  "Failed to install NFS client packages.": "Impossibile installare i pacchetti client NFS.",
+  "Failed to install OVH RTM": "Impossibile installare OVH RTM",
+  "Failed to install OpenVSwitch": "Impossibile installare OpenVSwitch",
+  "Failed to install Samba client packages.": "Impossibile installare i pacchetti client Samba.",
+  "Failed to install amdgpu_top": "Impossibile installare amdgpu_top",
+  "Failed to install dependencies": "Impossibile installare le dipendenze",
+  "Failed to install gawk": "Impossibile installare gawk",
+  "Failed to install intel-gpu-tools": "Impossibile installare Intel-GPU-Tools",
+  "Failed to install libedgetpu1-std. Check": "Impossibile installare libedgetpu1-std. Controllo",
+  "Failed to install pigz": "Impossibile installare pigz",
+  "Failed to install zfs-auto-snapshot": "Impossibile installare zfs-auto-snapshot",
+  "Failed to mount CIFS share on host.": "Impossibile montare la condivisione CIFS sull'host.",
+  "Failed to mount NFS share on host.": "Impossibile montare la condivisione NFS sull'host.",
+  "Failed to mount NFS share.": "Impossibile montare la condivisione NFS.",
+  "Failed to mount Samba share.": "Impossibile montare la condivisione Samba.",
+  "Failed to mount container filesystem.": "Impossibile montare il filesystem del contenitore.",
+  "Failed to mount disk": "Impossibile montare il disco",
+  "Failed to obtain public IP address - keeping current timezone settings": "Impossibile ottenere l'indirizzo IP pubblico: mantenendo le impostazioni attuali del fuso orario",
+  "Failed to refresh boot configuration": "Impossibile aggiornare la configurazione di avvio",
+  "Failed to refresh proxmox-boot-tool": "Impossibile aggiornare lo strumento di avvio di proxmox",
+  "Failed to reinstall Proxmox packages": "Impossibile reinstallare i pacchetti Proxmox",
+  "Failed to reinstall packages": "Impossibile reinstallare i pacchetti",
+  "Failed to remove gateway.": "Impossibile rimuovere il gateway.",
+  "Failed to remove mount point": "Impossibile rimuovere il punto di montaggio",
+  "Failed to remove storage from Proxmox.": "Impossibile rimuovere lo spazio di archiviazione da Proxmox.",
+  "Failed to remove storage.": "Impossibile rimuovere lo spazio di archiviazione.",
+  "Failed to resolve group GID for": "Impossibile risolvere il GID del gruppo per",
+  "Failed to restart": "Impossibile riavviare",
+  "Failed to restart container — restart manually": "Impossibile riavviare il contenitore: riavvia manualmente",
+  "Failed to restart gateway.": "Impossibile riavviare il gateway.",
+  "Failed to restart network service": "Impossibile riavviare il servizio di rete",
+  "Failed to restart — restart manually to activate mount": "Impossibile riavviare: riavvia manualmente per attivare il montaggio",
+  "Failed to restore subscription banner completely": "Impossibile ripristinare completamente il banner di abbonamento",
+  "Failed to retrieve Fastfetch download URL.": "Impossibile recuperare l'URL di download di Fastfetch.",
+  "Failed to run log2ram installer. Check /tmp/log2ram_install.log": "Impossibile eseguire il programma di installazione di log2ram. Controllare /tmp/log2ram_install.log",
+  "Failed to set VM description": "Impossibile impostare la descrizione della VM",
+  "Failed to set timezone - keeping current settings": "Impossibile impostare il fuso orario: mantenere le impostazioni attuali",
+  "Failed to start CT": "Impossibile avviare CT",
+  "Failed to start container — start manually and check the mount": "Impossibile avviare il contenitore: avvia manualmente e controlla il montaggio",
+  "Failed to start gateway.": "Impossibile avviare il gateway.",
+  "Failed to start long self-test on": "Impossibile avviare l'autotest lungo",
+  "Failed to start self-test on": "Impossibile avviare l'autotest",
+  "Failed to start the CT.": "Impossibile avviare il CT.",
+  "Failed to start the container.": "Impossibile avviare il contenitore.",
+  "Failed to stop gateway.": "Impossibile arrestare il gateway.",
+  "Failed to stop the container.": "Impossibile arrestare il contenitore.",
+  "Failed to uninstall amdgpu_top": "Impossibile disinstallare amdgpu_top",
+  "Failed to uninstall intel-gpu-tools": "Impossibile disinstallare intel-gpu-tools",
+  "Failed to update GRUB": "Impossibile aggiornare GRUB",
+  "Failed to update GRUB configuration": "Impossibile aggiornare la configurazione di GRUB",
+  "Failed to update Lynis": "Impossibile aggiornare Lynis",
+  "Failed to update amdgpu_top": "Impossibile aggiornare amdgpu_top",
+  "Failed to update auth.json — restoring backup.": "Impossibile aggiornare auth.json: ripristino del backup.",
+  "Failed to update cluster certificates (might not be in a cluster)": "Impossibile aggiornare i certificati del cluster (potrebbe non trovarsi in un cluster)",
+  "Failed to update intel-gpu-tools": "Impossibile aggiornare Intel-GPU-Tools",
+  "Failed to update package list.": "Impossibile aggiornare l'elenco dei pacchetti.",
+  "Failed to update package lists": "Impossibile aggiornare gli elenchi dei pacchetti",
+  "Failed to write": "Impossibile scrivere",
+  "Failed transitions from D3cold to D0": "Transizioni non riuscite da D3cold a D0",
+  "Failed. See log:": "Fallito. Vedi registro:",
+  "Falling back to manual paste mode.": "ritorno alla modalità incolla manuale.",
+  "Fastfetch Logo Selection": "Selezione logo Fastfetch",
+  "Fastfetch configuration updated": "Configurazione fastfetch aggiornata",
+  "Fastfetch download URL retrieved successfully.": "URL di download Fastfetch recuperato correttamente.",
+  "Fastfetch installation and configuration completed": "Installazione e configurazione di Fastfetch completate",
+  "Fastfetch installed successfully": "Fastfetch è stato installato correttamente",
+  "Fastfetch is not installed correctly.": "Fastfetch non è installato correttamente.",
+  "Fastfetch is not installed.": "Fastfetch non è installato.",
+  "Fastfetch is not installed. Run: apt install fastfetch": "Fastfetch non è installato. Esegui: apt installa fastfetch",
+  "Fastfetch now displays: System optimised by: ProxMenux": "Fastfetch ora visualizza: Sistema ottimizzato da: ProxMenux",
+  "Fastfetch removed from system": "Fastfetch rimosso dal sistema",
+  "Fastfetch will start automatically in the console": "Fastfetch si avvierà automaticamente nella console",
+  "Figurine installation and configuration completed successfully.": "L'installazione e la configurazione della statuetta sono state completate con successo.",
+  "Figurine is not installed.": "La statuetta non è installata.",
+  "Figurine removed from system": "Statuetta rimossa dal sistema",
+  "File:": "File:",
+  "Filesystem": "File system",
+  "Filesystem Tools Required": "Strumenti del file system obbligatori",
+  "Filesystem:": "File system:",
+  "Final Confirmation": "Conferma finale",
+  "Final confirmation": "Conferma finale",
+  "Final storage health/status check": "Controllo finale dell'integrità/stato dell'archiviazione",
+  "Find your device using https://finds.synology.com": "Trova il tuo dispositivo utilizzando https://finds.synology.com",
+  "Fingerprint:": "Impronta digitale:",
+  "Firewall allows port": "Il firewall consente la porta",
+  "Firewall settings": "Impostazioni del firewall",
+  "Firmware :": "Firmware:",
+  "First complete DSM setup and verify Web UI/SSH access.": "Per prima cosa completare la configurazione DSM e verificare l'accesso all'interfaccia utente Web/SSH.",
+  "First complete ZimaOS setup and verify remote access (web/SSH).": "Per prima cosa completa la configurazione di ZimaOS e verifica l'accesso remoto (web/SSH).",
+  "First install the GPU drivers inside the guest and verify remote access (RDP/SSH).": "Per prima cosa installa i driver GPU all'interno del guest e verifica l'accesso remoto (RDP/SSH).",
+  "Fix CIFS Permissions": "Correggi le autorizzazioni CIFS",
+  "Fix Ceph version:": "Correzione della versione di Ceph:",
+  "Fix NFS Access for Unprivileged LXC": "Correzione dell'accesso NFS per LXC non privilegiato",
+  "Fix disk space:": "Correggi lo spazio su disco:",
+  "Fix kernel version:": "Correggi la versione del kernel:",
+  "Fix network connectivity": "Correggere la connettività di rete",
+  "Fix network:": "Correggi la rete:",
+  "Fix package conflicts:": "Risolvi i conflitti tra pacchetti:",
+  "Fix repositories:": "Correggi i repository:",
+  "Fix repository configuration": "Correggi la configurazione del repository",
+  "Fix systemd-boot meta-package conflict": "Risolto il conflitto del metapacchetto systemd-boot",
+  "Fix systemd-boot:": "Correggi l'avvio di systemd:",
+  "Fix: on the host, run": "Correzione: sull'host, esegui",
+  "Fixing GPG key issues...": "Risoluzione dei problemi chiave di GPG...",
+  "Folder Name": "Nome della cartella",
+  "Folders in /mnt": "Cartelle in /mnt",
+  "Follow post-restore progress live from ProxMenux Monitor → Backups tab after the reboot.": "segui l'avanzamento post-ripristino in tempo reale da ProxMenux Monitor → scheda Backup dopo il riavvio.",
+  "For LVM - Create mount directory and mount:": "Per LVM: crea la directory di montaggio e monta:",
+  "For ZFS, storage ID must start with a letter and use only letters, numbers, dot, dash, underscore or colon.": "Per ZFS, l'ID di archiviazione deve iniziare con una lettera e utilizzare solo lettere, numeri, punto, trattino, carattere di sottolineatura o due punti.",
+  "For ZFS/BTRFS - Set the mount path:": "Per ZFS/BTRFS: imposta il percorso di montaggio:",
+  "For a consistent export, the VM should be stopped.": "Per un'esportazione coerente, la VM dovrebbe essere arrestata.",
+  "For any question, issue or bug report, please use the official repository": "per qualsiasi domanda, problema o segnalazione di bug, utilizza il repository ufficiale",
+  "For dedicated GPUs, FLR is required by this policy to reduce VM": "Per le GPU dedicate, FLR è richiesto da questa policy per ridurre le VM",
+  "For example: pct enter 101": "Ad esempio: pct inserire 101",
+  "For guest shares add: --options guest": "Per le condivisioni guest aggiungere: --options guest",
+  "For security reasons, the system cannot format it.": "Per motivi di sicurezza, il sistema non può formattarlo.",
+  "For unprivileged containers, use instead:": "Per i contenitori non privilegiati, utilizzare invece:",
+  "For your safety, a backup of the current configuration will be created automatically before restoring.": "Per la tua sicurezza, verrà creato automaticamente un backup della configurazione corrente prima del ripristino.",
+  "Force APT to use IPv4": "forza APT a utilizzare IPv4",
+  "Force NFSv3:": "Forza NFSv3:",
+  "Force NFSv4:": "Forza NFSv4:",
+  "Force stop VM now?": "Forzare l'arresto della VM adesso?",
+  "Force stop a container. Use the correct <ctid>": "Arresto forzato di un contenitore. Utilizzare il <ctid> corretto",
+  "Force stop a virtual machine. Use the correct <vmid>": "Forza l'arresto di una macchina virtuale. Utilizzare il <vmid> corretto",
+  "Forcing removal...": "Forzatura della rimozione...",
+  "Format / Wipe Physical Disk (Safe)": "Formatta/Cancella disco fisico (sicuro)",
+  "Format Mode": "Modalità formattazione",
+  "Format USB disk?": "Formattare il disco USB?",
+  "Format disk (ERASE all data)": "Formattare il disco (CANCELLARE tutti i dati)",
+  "Format failed": "Formattazione fallita",
+  "Format filesystem": "Formattare il filesystem",
+  "Format partition:": "Formattare la partizione:",
+  "Format — erase and create new filesystem": "Formatta: cancella e crea un nuovo filesystem",
+  "Format:": "Formato:",
+  "Format: ERASE all data and create new filesystem": "Formato: CANCELLARE tutti i dati e creare un nuovo filesystem",
+  "Formatted and mounted": "Formattato e montato",
+  "Formatting": "Formattazione",
+  "Formatting as": "Formattazione come",
+  "Formatting partition": "Formattazione della partizione",
+  "Found": "Trovato",
+  "Found guest-accessible shares:": "Condivisioni accessibili agli ospiti trovate:",
+  "Free public Proxmox repository enabled": "Repository Proxmox pubblico gratuito abilitato",
+  "Free space OK:": "Spazio libero OK:",
+  "Free up disk space": "Liberare spazio su disco",
+  "Free:": "Gratuito:",
+  "French": "francese",
+  "Full SMART Report": "Rapporto SMART completo",
+  "Full SMART info and attributes": "Informazioni e attributi SMART completi",
+  "Full format       — new GPT partition + filesystem": "Formato completo: nuova partizione GPT + filesystem",
+  "Full format — new GPT partition + filesystem": "Formato completo: nuova partizione GPT + filesystem",
+  "Full format: clean + new GPT partition + filesystem": "Formato completo: pulito + nuova partizione GPT + filesystem",
+  "Full log:": "Registro completo:",
+  "Full report           — complete SMART data (scrollable)": "Report completo: dati SMART completi (scorribili)",
+  "Full system upgrade, including dependencies": "Aggiornamento completo del sistema, comprese le dipendenze",
+  "Function Level Reset (FLR) not available": "Reset del livello di funzione (FLR) non disponibile",
+  "GID already in use:": "GID già in uso:",
+  "GID in CT": "GID nella TC",
+  "GPU": "GPU",
+  "GPU -> VM Mode Detected": "GPU -> Modalità VM rilevata",
+  "GPU Already Added": "GPU già aggiunta",
+  "GPU Already Assigned to Another VM": "GPU già assegnata a un'altra VM",
+  "GPU Already Assigned to This VM": "GPU già assegnata a questa VM",
+  "GPU Busy in Running VM": "GPU occupata nell'esecuzione della VM",
+  "GPU Not Available for Reliable VM Passthrough": "GPU non disponibile per Reliable VM Passthrough",
+  "GPU Not Compatible with VM Passthrough": "GPU non compatibile con VM Passthrough",
+  "GPU Passthrough Commands": "Comandi passthrough GPU",
+  "GPU Passthrough Not Configured": "Passthrough GPU non configurato",
+  "GPU Passthrough to VM": "Passthrough GPU alla VM",
+  "GPU Passthrough to VM (from LXC)": "Passthrough GPU alla VM (da LXC)",
+  "GPU Passthrough to VM (reassign from LXC and another VM)": "Passthrough GPU alla VM (riassegnare da LXC e un'altra VM)",
+  "GPU Passthrough to VM (reassign from another VM)": "Passthrough GPU alla VM (riassegnare da un'altra VM)",
+  "GPU ROM dump to /usr/share/kvm/": "Dump della ROM GPU su /usr/share/kvm/",
+  "GPU ROM dumped to": "ROM GPU scaricata in",
+  "GPU ROM extracted from ACPI VFCT table to": "ROM GPU estratta dalla tabella ACPI VFCT in",
+  "GPU Switch Mode": "Modalità cambio GPU",
+  "GPU Switch Mode Blocked": "Modalità cambio GPU bloccata",
+  "GPU Used in LXC Containers": "GPU utilizzata nei contenitori LXC",
+  "GPU access removed from LXC": "Accesso alla GPU rimosso da LXC",
+  "GPU added": "Aggiunta GPU",
+  "GPU already present in target VM — existing hostpci entry reused": "GPU già presente nella VM di destinazione: voce hostpci esistente riutilizzata",
+  "GPU audio added": "Aggiunto audio GPU",
+  "GPU audio already present in target VM — existing hostpci entry reused": "Audio GPU già presente nella VM di destinazione: voce hostpci esistente riutilizzata",
+  "GPU driver blacklisted": "Driver GPU nella lista nera",
+  "GPU guard hook will block concurrent start when another VM is already using this GPU": "Il guard hook della GPU bloccherà l'avvio simultaneo quando un'altra VM sta già utilizzando questa GPU",
+  "GPU host driver blacklisted in /etc/modprobe.d/blacklist.conf": "Driver host GPU inserito nella lista nera in /etc/modprobe.d/blacklist.conf",
+  "GPU in VM Passthrough Mode": "GPU in modalità passthrough VM",
+  "GPU kept in source VM config": "GPU mantenuta nella configurazione della VM di origine",
+  "GPU not found with slot": "GPU non trovata con lo slot",
+  "GPU passthrough assistant not found. You can run it later from Hardware Graphics.": "Assistente passthrough GPU non trovato. Puoi eseguirlo in seguito da Hardware Graphics.",
+  "GPU passthrough changes require a host reboot.": "Le modifiche al passthrough della GPU richiedono il riavvio dell'host.",
+  "GPU passthrough configuration will continue now and will become effective after host reboot.": "La configurazione del passthrough GPU continuerà ora e diventerà effettiva dopo il riavvio dell'host.",
+  "GPU passthrough configured for LXC": "Passthrough GPU configurato per LXC",
+  "GPU passthrough configured for VM": "Passthrough GPU configurato per VM",
+  "GPU passthrough to VMs requires IOMMU to be enabled in the kernel.": "Il passthrough GPU alle macchine virtuali richiede che IOMMU sia abilitato nel kernel.",
+  "GPU passthrough was not applied.": "Il passthrough GPU non è stato applicato.",
+  "GPU passthrough was skipped (no compatible GPU detected).": "Il passthrough della GPU è stato saltato (nessuna GPU compatibile rilevata).",
+  "GPU removed from VM": "GPU rimossa dalla VM",
+  "GPU removed from VM config": "GPU rimossa dalla configurazione della VM",
+  "GPU switch complete: LXC mode prepared.": "Switch GPU completato: modalità LXC preparata.",
+  "GPU switch complete: VM mode prepared.": "Switch GPU completato: modalità VM preparata.",
+  "GPU switch mode completed. No reboot required.": "Modalità di cambio GPU completata. Nessun riavvio richiesto.",
+  "GPU will be removed from source VM config": "La GPU verrà rimossa dalla configurazione della VM di origine",
+  "GPU will remain configured in source VM": "La GPU rimarrà configurata nella VM di origine",
+  "GPU/TPU - Manual CLI Guide": "GPU/TPU: guida CLI manuale",
+  "GPU/TPU Passthrough Commands": "Comandi passthrough GPU/TPU",
+  "GPUs and Coral-TPU Menu": "GPU e menu Coral-TPU",
+  "GRUB config file not found; skipping GRUB changes": "File di configurazione di GRUB non trovato; saltando le modifiche di GRUB",
+  "GRUB configuration updated": "Configurazione GRUB aggiornata",
+  "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT non trovato nella configurazione di GRUB",
+  "GUI mode (if available)": "Modalità GUI (se disponibile)",
+  "Gateway is not installed.": "Il gateway non è installato.",
+  "Gateway removed.": "Gateway rimosso.",
+  "Gateway restarted.": "Il gateway è stato riavviato.",
+  "Gateway started.": "Il gateway è stato avviato.",
+  "Gateway stopped.": "Il gateway si è fermato.",
+  "Gathering container privilege information...": "Raccolta delle informazioni sui privilegi del contenitore...",
+  "Generate a new key and authorize it on the server automatically (recommended)": "genera una nuova chiave e la autorizza automaticamente sul server (consigliato)",
+  "Generate a new key, show me the line to paste manually": "genera una nuova chiave, mostrami la riga da incollare manualmente",
+  "Generate a new keyfile": "genera un nuovo file di chiavi",
+  "Generating OVF descriptor...": "Generazione del descrittore OVF in corso...",
+  "Generating dkms.conf...": "Generazione dkms.conf...",
+  "Generating manifest...": "Generazione manifesto...",
+  "Generating missing locale:": "Generazione della lingua mancante:",
+  "German": "tedesco",
+  "Get a list of all your containers:": "Ottieni un elenco di tutti i tuoi contenitori:",
+  "Get the actual disk path:": "Ottieni il percorso effettivo del disco:",
+  "Get the container's storage information:": "Ottieni le informazioni sullo spazio di archiviazione del contenitore:",
+  "Git installed": "Git installato",
+  "Global settings and SSH jail configured": "Impostazioni globali e jail SSH configurati",
+  "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "Vai su \"Gestisci percorsi personalizzati\" e rimuovi la voce personalizzata che include la destinazione",
+  "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "Google fornisce solo un repository APT libedgetpu ufficiale per Debian/Ubuntu. Il passthrough hardware è già scritto",
+  "Graceful shutdown timed out.": "Lo spegnimento ordinato è scaduto.",
+  "Group": "Gruppo",
+  "Group 'sharedfiles' already exists inside the CT": "Il gruppo \"file condivisi\" esiste già all'interno del CT",
+  "Group GID:": "GID del gruppo:",
+  "Group created:": "Gruppo creato:",
+  "Group name cannot be empty.": "Il nome del gruppo non può essere vuoto.",
+  "Group:": "Gruppo:",
+  "Groups": "Gruppi",
+  "Groups:": "Gruppi:",
+  "Guest Access Denied": "Accesso ospite negato",
+  "Guest Access Error": "Errore di accesso ospite",
+  "Guest Access Failed": "Accesso ospite non riuscito",
+  "Guest Access Validation Results:": "Risultati della convalida dell'accesso ospite:",
+  "Guest Agent configuration applied": "Configurazione dell'agente guest applicata",
+  "Guest access (no authentication)": "Accesso ospite (nessuna autenticazione)",
+  "Guest access confirmed for share:": "Accesso ospite confermato per la condivisione:",
+  "Guest access denied for share:": "Accesso ospite negato per la condivisione:",
+  "Guest access failed.": "Accesso ospite non riuscito.",
+  "Guest access is not allowed on this server.": "L'accesso ospite non è consentito su questo server.",
+  "Guest access test:": "Test di accesso ospite:",
+  "Guest access validated successfully!": "Accesso ospite convalidato con successo!",
+  "Guest access works for listing, but no shares are available.": "L'accesso ospite funziona per l'elenco, ma non sono disponibili condivisioni.",
+  "Guest accessible share": "Condivisione accessibile agli ospiti",
+  "Guest accessible:": "Accessibile agli ospiti:",
+  "Guest agent detection completed": "Rilevamento dell'agente guest completato",
+  "Guest agent installation process completed": "Processo di installazione dell'agente guest completato",
+  "Guest agent packages removed": "Pacchetti agente ospite rimossi",
+  "Guest configs restored:": "Configurazioni guest ripristinate:",
+  "Guest share listing successful": "Elenco di condivisione degli ospiti riuscito",
+  "Guided Cleanup Available": "Pulizia guidata disponibile",
+  "Guided Repair Available": "Riparazione guidata disponibile",
+  "HA groups will be migrated to HA rules automatically": "I gruppi HA verranno migrati automaticamente alle regole HA",
+  "HA services disabled (configs preserved)": "Servizi HA disabilitati (configurazioni conservate)",
+  "Hardening SSH: setting MaxAuthTries to 3...": "Rafforzamento di SSH: impostazione di MaxAuthTries su 3...",
+  "Hardware": "Hardware",
+  "Hardware compatibility — these items will be skipped to keep the boot safe:": "Compatibilità hardware: questi elementi verranno ignorati per mantenere l'avvio sicuro:",
+  "Hardware passthrough is already configured — the Coral device is visible inside the container as /dev/apex_0 (M.2) and/or /dev/bus/usb (USB).": "Il passthrough hardware è già configurato: il dispositivo Coral è visibile all'interno del contenitore come /dev/apex_0 (M.2) e/o /dev/bus/usb (USB).",
+  "Hardware: GPUs and Coral-TPU": "Hardware: GPU e Coral-TPU",
+  "Have valid backups of all VMs and containers": "Disporre di backup validi di tutte le macchine virtuali e i contenitori",
+  "Help & Info (commands)": "Aiuto e informazioni (comandi)",
+  "Help & Information": "Aiuto e informazioni",
+  "Help and Info": "Aiuto e informazioni",
+  "Help and Info Commands": "Comandi di aiuto e informazioni",
+  "Helper-Scripts logo applied": "Logo Helper-Scripts applicato",
+  "Hidden for safety": "Nascosto per sicurezza",
+  "Hidden:": "Nascosto:",
+  "High Availability services have been enabled successfully": "I servizi ad alta disponibilità sono stati abilitati correttamente",
+  "High Availability setup completed": "Configurazione dell'alta disponibilità completata",
+  "High risk confirmation": "Conferma ad alto rischio",
+  "High-Risk GPU Power State": "Stato di alimentazione della GPU ad alto rischio",
+  "Home-Lab-Club logo applied": "Logo Home-Lab-Club applicato",
+  "Host": "Ospite",
+  "Host Backup  →  Borg": "Backup dell'host → Borg",
+  "Host Backup  →  Local archive": "Backup dell'host → Archivio locale",
+  "Host Backup  →  PBS": "Backup dell'host → PBS",
+  "Host Backup & Restore": "Backup e ripristino dell'host",
+  "Host Config Backup": "Backup della configurazione dell'host",
+  "Host Config Backup / Restore": "Backup/ripristino della configurazione dell'host",
+  "Host Config Restore": "Ripristino configurazione host",
+  "Host Directory": "Directory dell'ospite",
+  "Host Directory to LXC Mount Point": "Directory host per punto di montaggio LXC",
+  "Host Directory:": "Directory host:",
+  "Host GPU binding changed — reboot required.": "Il collegamento della GPU dell'host è stato modificato: è necessario il riavvio.",
+  "Host GPU detected": "Rilevata GPU host",
+  "Host GPU is already bound to vfio-pci. Host reconfiguration/reboot should not be required for this VM-to-VM reassignment.": "La GPU host è già associata a vfio-pci. La riconfigurazione/riavvio dell'host non dovrebbe essere necessario per questa riassegnazione da VM a VM.",
+  "Host IP": "IP dell'ospite",
+  "Host Mount Path": "Percorso di montaggio dell'host",
+  "Host NFS/Samba as Proxmox Storage (pvesm)": "Ospita NFS/Samba come storage Proxmox (pvesm)",
+  "Host Path": "Percorso dell'ospite",
+  "Host Path:": "Percorso host:",
+  "Host Storage (NFS / Samba via Proxmox)": "Archiviazione host (NFS/Samba tramite Proxmox)",
+  "Host VFIO config was already up to date — no reboot needed.": "La configurazione dell'host VFIO era già aggiornata: non è necessario il riavvio.",
+  "Host VFIO configuration already up to date": "Configurazione Host VFIO già aggiornata",
+  "Host VFIO configuration changed (initramfs updated). Reboot required before starting the VM.": "La configurazione dell'host VFIO è stata modificata (initramfs aggiornato). Riavvio richiesto prima di avviare la VM.",
+  "Host VFIO configuration changed — reboot required before starting the VM.": "La configurazione VFIO dell'host è stata modificata: è necessario riavviare prima di avviare la VM.",
+  "Host already in VFIO mode — skipping host reconfiguration for VM reassignment": "Host già in modalità VFIO: salta la riconfigurazione dell'host per la riassegnazione della VM",
+  "Host backup attached to PVE job": "backup dell'host collegato al lavoro PVE",
+  "Host directory access for unprivileged containers has been prepared above": "L'accesso alla directory host per i contenitori non privilegiati è stato preparato sopra",
+  "Host directory permissions updated — unprivileged containers can now access it": "Autorizzazioni della directory host aggiornate: ora i contenitori non privilegiati possono accedervi",
+  "Host directory:": "Directory host:",
+  "Host fstab CIFS Mounts:": "Montaggi CIFS host fstab:",
+  "Host fstab CIFS mounts (not registered with pvesm):": "Montaggi CIFS host fstab (non registrato con pvesm):",
+  "Host fstab CIFS mounts:": "Montaggi CIFS host fstab:",
+  "Host fstab Mount:": "Montaggio fstab dell'host:",
+  "Host fstab NFS Mounts:": "Montaggi NFS host fstab:",
+  "Host fstab NFS mounts (not registered with pvesm):": "Supporti NFS host fstab (non registrati con pvesm):",
+  "Host fstab NFS mounts:": "Supporti NFS host fstab:",
+  "Host fstab mounts (not registered as Proxmox storage):": "Montaggi host fstab (non registrato come spazio di archiviazione Proxmox):",
+  "Host identity (hostname, hosts)": "Identità host (nome host, host)",
+  "Host permissions applied (o+rwx + default ACL) — unprivileged LXCs can read/write through bind-mounts": "Autorizzazioni host applicate (o+rwx + ACL predefinito): gli LXC non privilegiati possono leggere/scrivere tramite montaggi bind",
+  "Host write access confirmed.": "Accesso in scrittura dell'host confermato.",
+  "Hostname": "Nome host",
+  "Hot changes applied. No reboot needed for these paths.": "Sono state applicate modifiche importanti. Non è necessario il riavvio per questi percorsi.",
+  "How do you want to add it?": "Come vuoi aggiungerlo?",
+  "How do you want to authenticate this backup target?": "Come vuoi autenticare questa destinazione di backup?",
+  "How do you want to select the": "Come vuoi selezionare il",
+  "How do you want to select the HOST folder to mount?": "Come vuoi selezionare la cartella HOST da montare?",
+  "How do you want to select the NFS server?": "Come vuoi selezionare il server NFS?",
+  "How do you want to select the Samba server?": "Come vuoi selezionare il server Samba?",
+  "How do you want to select the folder to export?": "Come vuoi selezionare la cartella da esportare?",
+  "How do you want to select the folder to share?": "Come vuoi selezionare la cartella da condividere?",
+  "How to Access an LXC Terminal": "Come accedere a un terminale LXC",
+  "How to Access an LXC Terminal from Proxmox Host": "Come accedere a un terminale LXC dall'host Proxmox",
+  "How to schedule": "Come pianificare",
+  "I have read this": "Ho letto questo",
+  "I/O priority configured": "Priorità I/O configurata",
+  "ID already in use. Please choose another.": "ID già in uso. Per favore scegline un altro.",
+  "IMPORTANT": "IMPORTANTE",
+  "IMPORTANT NOTES:": "NOTE IMPORTANTI:",
+  "IMPORTANT PREREQUISITES:": "PREREQUISITI IMPORTANTI:",
+  "IMPORTANT — Save this passphrase": "IMPORTANTE: salva questa passphrase",
+  "IOMMU Group": "Gruppo IOMMU",
+  "IOMMU Group Error": "Errore del gruppo IOMMU",
+  "IOMMU Group Pending": "Gruppo IOMMU in attesa",
+  "IOMMU Pending Reboot": "Riavvio IOMMU in sospeso",
+  "IOMMU Required": "IOMMU Obbligatorio",
+  "IOMMU already configured in /etc/kernel/cmdline": "IOMMU già configurato in /etc/kernel/cmdline",
+  "IOMMU already configured in GRUB": "IOMMU già configurato in GRUB",
+  "IOMMU already configured in kernel parameters": "IOMMU già configurato nei parametri del kernel",
+  "IOMMU already enabled in GRUB configuration": "IOMMU già abilitato nella configurazione di GRUB",
+  "IOMMU and VFIO setup completed": "Configurazione IOMMU e VFIO completata",
+  "IOMMU configured successfully.": "IOMMU configurato correttamente.",
+  "IOMMU configured. GPU passthrough setup will continue now and will be effective after reboot.": "IOMMU configurato. La configurazione del passthrough GPU continuerà ora e sarà effettiva dopo il riavvio.",
+  "IOMMU enabled in GRUB configuration": "IOMMU abilitato nella configurazione di GRUB",
+  "IOMMU groups are not available yet because reboot is pending.": "I gruppi IOMMU non sono ancora disponibili perché il riavvio è in sospeso.",
+  "IOMMU has been enabled on this system.": "IOMMU è stato abilitato su questo sistema.",
+  "IOMMU has been enabled on this system. A reboot is required to apply the changes. Reboot now?": "IOMMU è stato abilitato su questo sistema. È necessario un riavvio per applicare le modifiche. Riavviare adesso?",
+  "IOMMU has been enabled — a system reboot is required": "IOMMU è stato abilitato: è necessario il riavvio del sistema",
+  "IOMMU interrupt remapping configured": "Rimappatura degli interrupt IOMMU configurata",
+  "IOMMU is already active on this system": "IOMMU è già attivo su questo sistema",
+  "IOMMU is already configured for next boot, but it is not active yet.": "IOMMU è già configurato per il prossimo avvio, ma non è ancora attivo.",
+  "IOMMU is enabled on the system": "IOMMU è abilitato sul sistema",
+  "IOMMU is not active on this host.": "IOMMU non è attivo su questo host.",
+  "IOMMU is not active on this system.": "IOMMU non è attivo su questo sistema.",
+  "IOMMU is not active. Skipping Controller + NVMe assignment.": "IOMMU non è attivo. Saltare l'assegnazione Controller + NVMe.",
+  "IOMMU kernel parameters configured": "Parametri del kernel IOMMU configurati",
+  "IOMMU parameters added to /etc/kernel/cmdline": "Parametri IOMMU aggiunti a /etc/kernel/cmdline",
+  "IOMMU parameters added to GRUB": "Parametri IOMMU aggiunti a GRUB",
+  "IOMMU parameters removed from /etc/kernel/cmdline": "Parametri IOMMU rimossi da /etc/kernel/cmdline",
+  "IOMMU parameters removed from GRUB": "Parametri IOMMU rimossi da GRUB",
+  "IOMMU was configured during this wizard and a reboot is pending.": "IOMMU è stato configurato durante questa procedura guidata ed è in sospeso un riavvio.",
+  "IOMMU/VFIO configuration reverted": "Configurazione IOMMU/VFIO ripristinata",
+  "IP": "IP",
+  "IP or hostname of the PVE node hosting the Borg server LXC:": "IP o nome host del nodo PVE che ospita il server Borg LXC:",
+  "ISO": "ISO",
+  "ISO created successfully:": "ISO creato con successo:",
+  "ISO image         — installation images": "Immagine ISO: immagini di installazione",
+  "ISO image downloaded": "Immagine ISO scaricata",
+  "ISO not found to mount on device": "ISO non trovato per il montaggio sul dispositivo",
+  "Identical:": "Identico:",
+  "Identify candidate disk (never use system disk):": "Identificare il disco candidato (non utilizzare mai il disco di sistema):",
+  "Identify persistent disk paths": "Identificare i percorsi del disco permanente",
+  "If 'proxmox-ve' removal warning:": "Se avviso di rimozione 'proxmox-ve':",
+  "If Code 43 error appears, KVM hiding is already configured.": "Se viene visualizzato l'errore Codice 43, l'occultamento KVM è già configurato.",
+  "If GUI does not load:": "Se la GUI non viene caricata:",
+  "If ZFS errors occur:": "Se si verificano errori ZFS:",
+  "If booting in EFI mode with root on LVM: install GRUB for EFI": "Se si esegue l'avvio in modalità EFI con root su LVM: installare GRUB per EFI",
+  "If config issues occur:": "Se si verificano problemi di configurazione:",
+  "If container won't start:": "Se il contenitore non si avvia:",
+  "If imported from ESXi: install qemu-guest-agent inside the guest OS": "Se importato da ESXi: installa qemu-guest-agent all'interno del sistema operativo guest",
+  "If it still fails, the NFS server export options must be changed on the server.": "Se il problema persiste, è necessario modificare le opzioni di esportazione del server NFS sul server.",
+  "If it warns about 'systemd-boot' meta-package, remove it:": "Se avvisa del metapacchetto \"systemd-boot\", rimuovilo:",
+  "If mount fails (LVM):": "Se il montaggio fallisce (LVM):",
+  "If needed again, re-add GPU to LXC from GPUs and Coral-TPU Menu → Add GPU to LXC.": "Se necessario, aggiungere nuovamente GPU a LXC da GPU e menu Coral-TPU → Aggiungi GPU a LXC.",
+  "If network does not work:": "Se la rete non funziona:",
+  "If not 19.x, upgrade Ceph (Reef→Squid) first per the official guide:": "Se non è 19.x, aggiorna prima Ceph (Reef→Squid) secondo la guida ufficiale:",
+  "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.": "Se le notifiche sono abilitate (Telegram/Discord/ntfy/...), riceverai un messaggio \"Ripristino host terminato\" al termine di tutte le attività in background.",
+  "If passthrough fails on Windows: install RadeonResetBugFix.": "Se il passthrough fallisce su Windows: installa RadeonResetBugFix.",
+  "If path not accessible (ZFS/BTRFS):": "Se percorso non accessibile (ZFS/BTRFS):",
+  "If pvesm path returned a DEVICE (LVM):": "Se il percorso pvesm ha restituito un DISPOSITIVO (LVM):",
+  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Se il percorso pvesm ha restituito una DIRECTORY (ZFS/BTRFS):",
+  "If repositories error:": "Se si verificano errori nei repository:",
+  "If the host freezes, remove hostpci entries from": "Se l'host si blocca, rimuovi le voci hostpci da",
+  "If this happens, you can restore the backup from the 'Subscription Banner Removal' option in 'Uninstall optimizations'.": "In questo caso, puoi ripristinare il backup dall'opzione \"Rimozione banner di abbonamento\" in \"Disinstalla ottimizzazioni\".",
+  "If this node runs hyper-converged Ceph: ensure Ceph is 19.x (Squid) BEFORE upgrading PVE.": "Se questo nodo esegue Ceph iperconvergente: assicurati che Ceph sia 19.x (Squid) PRIMA di aggiornare PVE.",
+  "If upgrade fails:": "Se l'aggiornamento fallisce:",
+  "If you are sure you want to use it, please remove the": "Se sei sicuro di volerlo utilizzare, rimuovi il file",
+  "If you choose No, install": "Se scegli No, installa",
+  "If you continue, some adjustments may be duplicated or conflict with those already made by xshok.": "Se continui, alcune modifiche potrebbero essere duplicate o entrare in conflitto con quelle già apportate da xshok.",
+  "If you lose connectivity, you can restore from backup using the console.": "Se perdi la connettività, puoi ripristinare dal backup utilizzando la console.",
+  "If you lose or reinstall this host without a copy of the passphrase somewhere else (password manager, offline note, another host, USB stick...), every encrypted archive in this Borg repository becomes UNRECOVERABLE.": "se perdi o reinstalli questo host senza una copia della passphrase da qualche altra parte (gestore password, nota offline, un altro host, chiavetta USB...), ogni archivio crittografato in questo repository Borg diventa IRREVERSIBILE.",
+  "If you want HDMI/analog audio inside the VM, select the audio controller(s) to pass through along with the GPU.": "Se desideri l'audio HDMI/analogico all'interno della VM, seleziona i controller audio da far passare insieme alla GPU.",
+  "If you want to use a physical monitor on the passthrough GPU:": "Se desideri utilizzare un monitor fisico sulla GPU passthrough:",
+  "If your DHCP has a static reservation for the old MAC, update it.": "se il tuo DHCP ha una prenotazione statica per il vecchio MAC, aggiornalo.",
+  "Image Source Directory": "Directory di origine delle immagini",
+  "Image directory:": "Directory delle immagini:",
+  "Image file not found:": "File immagine non trovato:",
+  "Image imported:": "Immagine importata:",
+  "Images to import:": "Immagini da importare:",
+  "Import            — disk image imports": "Importa: importa immagini disco",
+  "Import Disk Image to VM": "Importa immagine disco nella VM",
+  "Import Disk to LXC": "Importa disco su LXC",
+  "Import Disk to VM": "Importa disco nella VM",
+  "Import Disks Selected:": "Importa dischi selezionati:",
+  "Import PBS keyfile": "importa il file di chiavi PBS",
+  "Import Summary": "Riepilogo dell'importazione",
+  "Import VM from OVA or OVF": "Importa VM da OVA o OVF",
+  "Import a ZFS pool": "Importa un pool ZFS",
+  "Import a keyfile from an absolute path (replaces the current one)": "importa un file di chiavi da un percorso assoluto (sostituisce quello corrente)",
+  "Import disk assigned": "Importa disco assegnato",
+  "Import disk image to VM": "Importa l'immagine del disco nella VM",
+  "Import disks": "Importa dischi",
+  "Import encryption keyfile": "importa il file delle chiavi di crittografia",
+  "Import failed": "importazione non riuscita",
+  "Import failed for:": "Importazione non riuscita per:",
+  "Important: both VMs cannot be running at the same time with the same GPU.": "Importante: entrambe le VM non possono essere eseguite contemporaneamente con la stessa GPU.",
+  "Important: some GPUs may still fail in passthrough and can affect host stability or overall performance depending on hardware/firmware quality.": "Importante: alcune GPU potrebbero comunque non riuscire a eseguire il passthrough e influire sulla stabilità dell'host o sulle prestazioni generali a seconda della qualità dell'hardware/firmware.",
+  "Importing": "Importazione",
+  "Importing disk": "Importazione del disco",
+  "Importing:": "Importazione:",
+  "Improve log rotation and limit log size to save space and extend disk life": "Migliora la rotazione dei registri e limita le dimensioni dei registri per risparmiare spazio e prolungare la durata del disco",
+  "In the loader interface, follow the instructions to select your Synology model": "Nell'interfaccia del caricatore, seguire le istruzioni per selezionare il modello Synology",
+  "In use": "In uso",
+  "In use by VM/LXC config": "Utilizzato dalla configurazione VM/LXC",
+  "In use by running VM/LXC — stop it first": "In uso eseguendo VM/LXC: arrestalo prima",
+  "Inaccessible device during VM startup": "Dispositivo inaccessibile durante l'avvio della VM",
+  "Inactive": "Inattivo",
+  "Inactive (entry in fstab, not currently mounted)": "Inattivo (voce in fstab, attualmente non montata)",
+  "Includes /etc/network (may drop SSH immediately)": "Include /etc/network (potrebbe eliminare immediatamente SSH)",
+  "Includes /etc/zfs": "Include /etc/zfs",
+  "Includes cluster data (/etc/pve, /var/lib/pve-cluster)": "Include i dati del cluster (/etc/pve, /var/lib/pve-cluster)",
+  "Incompatible GPU for VM Passthrough": "GPU incompatibile per Passthrough VM",
+  "Incompatible Machine Type": "Tipo di macchina incompatibile",
+  "Incompatible Reset Capability for AMD dGPU": "Funzionalità di ripristino incompatibile per AMD dGPU",
+  "Incompatible Reset Capability for Intel GPU": "Funzionalità di ripristino incompatibile per GPU Intel",
+  "Incompatible Reset Capability for Intel dGPU": "Funzionalità di ripristino incompatibile per Intel dGPU",
+  "Incompatible archive": "Archivio incompatibile",
+  "Increase container RAM temporarily to": "Aumenta temporaneamente la RAM del contenitore a",
+  "Increase file and process limits for advanced workloads": "Aumenta i limiti di file e processi per carichi di lavoro avanzati",
+  "Increase various system limits": "Aumenta i vari limiti del sistema",
+  "Increase vzdump backup speed": "aumenta la velocità di backup di vzdump",
+  "Increasing maximum file system open files...": "Aumento del numero massimo di file aperti del file system...",
+  "Increasing various system limits...": "Aumento dei vari limiti del sistema...",
+  "Inherited retention:": "Conservazione ereditata:",
+  "Inherited schedule:": "pianificazione ereditata:",
+  "Initializing Borg repository if needed...": "Inizializzazione del repository Borg, se necessario...",
+  "Initiator IQN is authorised on the target": "L'IQN dell'iniziatore è autorizzato sul target",
+  "Initiator IQN:": "IQN dell'iniziatore:",
+  "Inspect disks before any action": "Ispezionare i dischi prima di qualsiasi azione",
+  "Inspect host device nodes": "Ispezionare i nodi del dispositivo host",
+  "Inspect passthrough/kernel events": "Ispezionare gli eventi passthrough/kernel",
+  "Inspect storage config block:": "Esamina il blocco di configurazione dell'archiviazione:",
+  "Inspection commands run directly. Template commands [T] require parameter substitution.": "I comandi di ispezione vengono eseguiti direttamente. I comandi modello [T] richiedono la sostituzione dei parametri.",
+  "Install": "Installare",
+  "Install ALL utilities": "Installa TUTTE le utilità",
+  "Install AMD GPU drivers inside the guest.": "Installa i driver GPU AMD all'interno del guest.",
+  "Install CIFS client packages inside CT:": "Installa i pacchetti client CIFS all'interno di CT:",
+  "Install Coral TPU in LXC": "Installa Coral TPU in LXC",
+  "Install Fail2Ban": "Installa Fail2Ban",
+  "Install Figurine": "installa la statuetta",
+  "Install Intel Graphics Driver inside the guest.": "Installa il driver di grafica Intel all'interno del guest.",
+  "Install Lynis": "Installa Lynis",
+  "Install NFS client packages inside CT:": "Installa i pacchetti client NFS all'interno di CT:",
+  "Install NVIDIA Drivers on Host": "Installa i driver NVIDIA sull'host",
+  "Install NVIDIA drivers from nvidia.com inside the guest.": "Installa i driver NVIDIA da nvidia.com all'interno del guest.",
+  "Install NVIDIA proprietary drivers": "Installa i driver proprietari NVIDIA",
+  "Install OVH Real Time Monitoring": "Installa OVH Real Time Monitoring",
+  "Install Open vSwitch": "installa Open vSwitch",
+  "Install Samba inside CT:": "Installa Samba all'interno di CT:",
+  "Install ZFS auto-snapshot": "installa l'istantanea automatica ZFS",
+  "Install analysis tools": "Installa strumenti di analisi",
+  "Install and configure": "Installa e configura",
+  "Install and configure Fastfetch": "installa e configura Fastfetch",
+  "Install and configure Log2RAM": "installa e configura Log2RAM",
+  "Install and start iSCSI initiator:": "Installa e avvia l'iniziatore iSCSI:",
+  "Install basic utilities": "Installa le utilità di base",
+  "Install common system utilities": "installa le utilità di sistema comuni",
+  "Install compression tools": "Installa strumenti di compressione",
+  "Install development tools": "Installa strumenti di sviluppo",
+  "Install maintainer's version (Y)": "Installa la versione del manutentore (Y)",
+  "Install manually and retry: apt-get install -y exfatprogs": "Installa manualmente e riprova: apt-get install -y exfatprogs",
+  "Install manually with:": "Installa manualmente con:",
+  "Install network tools": "Installa strumenti di rete",
+  "Install podman or docker to continue.": "Installa podman o docker per continuare.",
+  "Install relevant guest agent": "installa l'agente ospite pertinente",
+  "Install server packages inside CT:": "Installa i pacchetti server all'interno di CT:",
+  "Install terminal multiplexers": "Installare multiplexer terminali",
+  "Install the Edge TPU runtime (libedgetpu1-std)": "Installa il runtime Edge TPU (libdgetpu1-std)",
+  "Install with Cloud-Init script": "Installa con lo script Cloud-Init",
+  "Install with ISO from UUP Dump": "Installa con ISO da UUP Dump",
+  "Install with personal ISO": "Installa con ISO personale",
+  "Install with traditional method": "Installazione con metodo tradizionale",
+  "Install with: apt-get install open-iscsi": "Installa con: apt-get install open-iscsi",
+  "Install/Update Coral TPU on Host": "Installa/Aggiorna Coral TPU sull'host",
+  "Install/Update NVIDIA Drivers (Host + LXC)": "Installa/Aggiorna i driver NVIDIA (Host + LXC)",
+  "Installation Complete": "Installazione completata",
+  "Installation completed.": "Installazione completata.",
+  "Installation completed. Please reboot the server manually as soon as possible.": "Installazione completata. Riavviare manualmente il server il prima possibile.",
+  "Installation completed. Press Enter to continue...": "Installazione completata. Premi Invio per continuare...",
+  "Installation failed": "Installazione non riuscita",
+  "Installation finished but drivers are not loaded. A reboot may be required.": "L'installazione è terminata ma i driver non sono caricati. Potrebbe essere necessario un riavvio.",
+  "Installation log:": "Registro di installazione:",
+  "Installation summary": "Riepilogo dell'installazione",
+  "Installed": "Installato",
+  "Installed at:": "Installato presso:",
+  "Installed components:": "Componenti installati:",
+  "Installed:": "Installato:",
+  "Installer already downloaded and verified.": "Programma di installazione già scaricato e verificato.",
+  "Installer copied to container.": "Programma di installazione copiato nel contenitore.",
+  "Installer downloaded.": "Programma di installazione scaricato.",
+  "Installer finished with errors.": "Programma di installazione terminato con errori.",
+  "Installer not found:": "Programma di installazione non trovato:",
+  "Installing": "Installazione",
+  "Installing AMD mesa drivers in container...": "Installazione dei driver AMD Mesa nel contenitore...",
+  "Installing Ceph packages...": "Installazione dei pacchetti Ceph in corso...",
+  "Installing Ceph support...": "Installazione del supporto Ceph in corso...",
+  "Installing Coral TPU driver inside the container...": "Installazione del driver Coral TPU all'interno del contenitore...",
+  "Installing Edge TPU runtime (libedgetpu1-std)...": "Installazione del runtime di Edge TPU (libdgetpu1-std) in corso...",
+  "Installing Fail2Ban...": "Installazione di Fail2Ban...",
+  "Installing Git as a prerequisite...": "Installazione di Git come prerequisito...",
+  "Installing Intel VA-API drivers in container...": "Installazione dei driver Intel VA-API nel contenitore...",
+  "Installing Log2RAM from GitHub...": "Installazione di Log2RAM da GitHub...",
+  "Installing Log2RAM from source...": "Installazione di Log2RAM dal sorgente...",
+  "Installing NFS Client in LXC": "Installazione del client NFS in LXC",
+  "Installing NFS client packages...": "Installazione dei pacchetti client NFS in corso...",
+  "Installing NFS client tools...": "Installazione degli strumenti client NFS in corso...",
+  "Installing NFS server packages inside the CT...": "Installazione dei pacchetti server NFS all'interno di CT...",
+  "Installing NVIDIA drivers in container. This may take several minutes...": "Installazione dei driver NVIDIA nel contenitore. L'operazione potrebbe richiedere diversi minuti...",
+  "Installing NVIDIA udev rules and persistence service...": "Installazione delle regole NVIDIA udev e del servizio di persistenza in corso...",
+  "Installing NVIDIA utils (Alpine)...": "Installazione delle utility NVIDIA (Alpine) in corso...",
+  "Installing NVIDIA utils (Arch)...": "Installazione delle utility NVIDIA (Arch) in corso...",
+  "Installing OVH RTM (Real Time Monitoring)...": "Installazione di OVH RTM (Monitoraggio in tempo reale)...",
+  "Installing OpenVSwitch for virtual internal network...": "Installazione di OpenVSwitch per la rete interna virtuale in corso...",
+  "Installing OpenVSwitch packages...": "Installazione dei pacchetti OpenVSwitch in corso...",
+  "Installing Samba Client": "Installazione del client Samba",
+  "Installing Samba Client in LXC": "Installazione del client Samba in LXC",
+  "Installing Samba client tools...": "Installazione degli strumenti client Samba in corso...",
+  "Installing Samba server packages inside the CT...": "Installazione dei pacchetti server Samba all'interno di CT...",
+  "Installing Samba/CIFS client packages...": "Installazione dei pacchetti client Samba/CIFS in corso...",
+  "Installing amdgpu_top...": "Installazione amdgpu_top...",
+  "Installing and configuring Fail2Ban to protect Proxmox web interface and SSH...": "Installazione e configurazione di Fail2Ban per proteggere l'interfaccia web Proxmox e SSH...",
+  "Installing and configuring Fastfetch...": "Installazione e configurazione di Fastfetch...",
+  "Installing and configuring Figurine...": "Installazione e configurazione di Figurine...",
+  "Installing and configuring ZFS auto-snapshot...": "Installazione e configurazione dell'istantanea automatica ZFS in corso...",
+  "Installing build dependencies...": "Installazione delle dipendenze della build...",
+  "Installing dependency:": "Dipendenza di installazione:",
+  "Installing essential Proxmox packages...": "Installazione dei pacchetti Proxmox essenziali...",
+  "Installing gawk (required for OVF parsing)...": "Installazione di gawk (richiesto per l'analisi OVF)...",
+  "Installing group": "Gruppo di installazione",
+  "Installing host drivers while the GPU is assigned to a VM could break passthrough and destabilize the system.": "L'installazione dei driver host mentre la GPU è assegnata a una VM potrebbe interrompere il passthrough e destabilizzare il sistema.",
+  "Installing iSCSI initiator tools...": "Installazione degli strumenti iniziatori iSCSI in corso...",
+  "Installing intel-gpu-tools...": "Installazione di Intel-Gpu-Tools...",
+  "Installing kexec-tools...": "Installazione di kexec-tools...",
+  "Installing latest Lynis security scan tool...": "Installazione dell'ultimo strumento di scansione di sicurezza di Lynis in corso...",
+  "Installing packages...": "Installazione dei pacchetti...",
+  "Installing pigz...": "Installazione di Pigz...",
+  "Installing required dependencies...": "Installazione delle dipendenze richieste...",
+  "Installing required package: git": "Installazione del pacchetto richiesto: git",
+  "Installing required tools...": "Installazione degli strumenti richiesti...",
+  "Installing selected utilities": "Installazione delle utilità selezionate",
+  "Installing system utilities...": "Installazione delle utilità di sistema...",
+  "Installing zfs-auto-snapshot package...": "Installazione del pacchetto zfs-auto-snapshot in corso...",
+  "Installs essential packages if missing": "Installa i pacchetti essenziali se mancanti",
+  "Insufficient Disk Space": "Spazio su disco insufficiente",
+  "Insufficient disk space. Skipping LXC": "Spazio su disco insufficiente. Saltare LXC",
+  "Insufficient memory. NVIDIA install aborted.": "Memoria insufficiente. Installazione NVIDIA interrotta.",
+  "Insufficient memory. Skipping LXC": "Memoria insufficiente. Saltare LXC",
+  "Insufficient space:": "Spazio insufficiente:",
+  "Integrity check failed on": "Il controllo di integrità non è riuscito",
+  "Intel CPU detected": "Rilevata CPU Intel",
+  "Intel GPU Tools installation completed!": "Installazione degli strumenti GPU Intel completata!",
+  "Intel GPU(s) detected:": "GPU Intel rilevate:",
+  "Intel VA-API drivers installed.": "Driver Intel VA-API installati.",
+  "Intel iGPU passthrough configured.": "Passthrough Intel iGPU configurato.",
+  "Interactive (guided, prompts visible)": "Interattivo (guidato, istruzioni visibili)",
+  "Interactive process viewer (press q to exit)": "Visualizzatore interattivo dei processi (premi q per uscire)",
+  "Interface": "Interfaccia",
+  "Interface MTU": "MTU di interfaccia",
+  "Interface Names (persistent)": "nomi interfaccia (persistente)",
+  "Interface Type": "Tipo di interfaccia",
+  "Interface names will return to default systemd behavior.": "I nomi delle interfacce torneranno al comportamento systemd predefinito.",
+  "Interface type:": "Tipo di interfaccia:",
+  "Interfaces configured": "Interfacce configurate",
+  "Interfaces defined with 'auto' but no 'iface' block": "Interfacce definite con il blocco \"auto\" ma senza blocco \"iface\".",
+  "Interfaces to Remove": "Interfacce da rimuovere",
+  "Internal error: NVIDIA installer path is empty or file not found.": "Errore interno: il percorso del programma di installazione NVIDIA è vuoto o il file non è stato trovato.",
+  "Internal error: missing arguments in pmx_prepare_host_shared_dir": "Errore interno: argomenti mancanti in pmx_prepare_host_shared_dir",
+  "Invalid 'proxmox-ve' candidate (not 9.x or none). Please verify your repository configuration and network, then retry.": "Candidato 'proxmox-ve' non valido (non 9.xo nessuno). Verifica la configurazione e la rete del repository, quindi riprova.",
+  "Invalid ID": "ID non valido",
+  "Invalid Option": "Opzione non valida",
+  "Invalid Path": "Percorso non valido",
+  "Invalid VMID": "VMID non valido",
+  "Invalid ZFS pool name.": "Nome del pool ZFS non valido.",
+  "Invalid group name. Use letters, digits, underscore or hyphen, and start with a letter or underscore.": "Nome del gruppo non valido. Utilizza lettere, cifre, trattino basso o trattino e inizia con una lettera o un trattino basso.",
+  "Invalid input": "Immissione non valida",
+  "Invalid name": "Nome non valido",
+  "Invalid name. Use only letters, numbers, hyphens and underscores.": "Nome non valido. Utilizza solo lettere, numeri, trattini e trattini bassi.",
+  "Invalid option": "Opzione non valida",
+  "Invalid option, please try again.": "Opzione non valida, riprova.",
+  "Invalid option. Skipping.": "Opzione non valida. Saltare.",
+  "Invalid parameters for bind mount": "Parametri non validi per il montaggio del collegamento",
+  "Invalid selection": "Selezione non valida",
+  "Invalid size. Please enter a number in MB (e.g., 128, 256, 512).": "Taglia non valida. Inserisci un numero in MB (ad esempio, 128, 256, 512).",
+  "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "ID di archiviazione non valido. Utilizza solo lettere, numeri, trattini e trattini bassi.",
+  "Invalid username or password.": "Nome utente o password non validi.",
+  "Issue": "Problema",
+  "Issues found": "Problemi rilevati",
+  "Issues were found. Would you like to use the Guided Cleanup Assistant?": "Sono stati rilevati problemi. Desideri utilizzare l'Assistente di pulizia guidata?",
+  "Issues were found. Would you like to use the Guided Repair Assistant?": "Sono stati rilevati problemi. Desideri utilizzare l'Assistente riparazione guidata?",
+  "It appears that you have already executed the xshok-proxmox post-install script on this system.": "Sembra che tu abbia già eseguito lo script di post-installazione xshok-proxmox su questo sistema.",
+  "It is recommended to create a backup before continuing.": "Si consiglia di creare un backup prima di continuare.",
+  "It is strongly recommended to create a backup of your container before proceeding with the conversion.": "Si consiglia vivamente di creare un backup del proprio contenitore prima di procedere con la conversione.",
+  "It will be installed from the official GitHub repository.": "Verrà installato dal repository GitHub ufficiale.",
+  "Italian": "Italiano",
+  "JC Channel logo applied": "Logo JC Channel applicato",
+  "JSON output for scripts": "Output JSON per gli script",
+  "Job ID (letters, numbers, - _)": "ID lavoro (lettere, numeri, - _)",
+  "Job ID:": "ID lavoro:",
+  "Job deleted:": "Lavoro eliminato:",
+  "Job disabled:": "Lavoro disabilitato:",
+  "Job enabled:": "Lavoro abilitato:",
+  "Job selection returned empty id — aborting.": "La selezione del lavoro ha restituito un ID vuoto: interruzione.",
+  "Journald configuration adjusted to": "Configurazione journal adattata a",
+  "Journald configuration is already optimized": "La configurazione journaled è già ottimizzata",
+  "Journald configuration updated and service restarted": "Configurazione journal aggiornata e servizio riavviato",
+  "Journald optimization completed": "Ottimizzazione del journal completata",
+  "Journald optimized - Max size: 64M": "Ottimizzato per journal - Dimensione massima: 64M",
+  "KDF:": "KDF:",
+  "KVM MSR options added to /etc/modprobe.d/kvm.conf": "Opzioni KVM MSR aggiunte a /etc/modprobe.d/kvm.conf",
+  "KVM MSR options ensured in /etc/modprobe.d/kvm.conf": "Opzioni KVM MSR garantite in /etc/modprobe.d/kvm.conf",
+  "KVM MSR options not present, nothing to revert": "Opzioni KVM MSR non presenti, niente da ripristinare",
+  "Keep GPU in LXC config (disable Start on boot)": "Mantieni la GPU nella configurazione LXC (disabilita Avvia all'avvio)",
+  "Keep GPU in LXC config + disable Start on boot": "Mantieni la GPU nella configurazione LXC + disabilita l'avvio all'avvio",
+  "Keep GPU in VM config (disable Start on boot)": "Mantieni la GPU nella configurazione della VM (disabilita Avvia all'avvio)",
+  "Keep GPU in source VM config (disable Start on boot if enabled)": "Mantieni la GPU nella configurazione della VM di origine (disabilita Avvia all'avvio se abilitato)",
+  "Keep GPU in source VM config + disable Start on boot if enabled": "Mantieni la GPU nella configurazione della VM di origine + disabilita l'avvio all'avvio se abilitato",
+  "Keep current version (N)": "Mantieni la versione corrente (N)",
+  "Keep current version (N) if modified": "Mantieni la versione corrente (N) se modificata",
+  "Keep in source VM(s) + disable onboot + add to target VM": "Mantieni le VM di origine + disabilita l'avvio + aggiungi alla VM di destinazione",
+  "Keeping GPU in source VM config": "Mantenere la GPU nella configurazione della VM di origine",
+  "Kept sharedfiles group (has regular users assigned).": "Mantenuto il gruppo sharedfiles (ha utenti regolari assegnati).",
+  "Kernel and architecture info": "Informazioni sul kernel e sull'architettura",
+  "Kernel headers and build tools verified.": "Intestazioni del kernel e strumenti di creazione verificati.",
+  "Kernel max Key limit configured": "Limite massimo della chiave del kernel configurato",
+  "Kernel panic behavior configuration completed": "Configurazione del comportamento di panico del kernel completata",
+  "Kernel panic configuration removed": "Configurazione Kernel Panic rimossa",
+  "Kernel panic configuration updated and applied": "Configurazione Kernel Panic aggiornata e applicata",
+  "Kernel, modules and boot config": "Kernel, moduli e configurazione di avvio",
+  "Kernel/boot-tied files (boot config, /etc/systemd/system, initramfs config, apt sources, ZFS state, ...) are NOT copied verbatim to keep the target's boot safe. The operator's own tuning inside them (IOMMU cmdline, VFIO IDs, custom quirks, GRUB timeout, ...) is merged into the target's fresh copies automatically via kernel-agnostic merge.": "i file legati al kernel/avvio (configurazione di avvio, /etc/systemd/system, configurazione di initramfs, origini apt, stato ZFS, ...) NON vengono copiati parola per parola per mantenere sicuro l'avvio della destinazione.L'ottimizzazione dell'operatore al loro interno (linea cmd IOMMU, ID VFIO, stranezze personalizzate, timeout GRUB, ...) viene unita automaticamente alle nuove copie della destinazione tramite unione indipendente dal kernel.",
+  "Keyfile copied": "file chiave copiato",
+  "Keyfile copied to:": "file di chiavi copiato in:",
+  "Keyfile passphrase": "passphrase del file chiave",
+  "Keyfile passphrase stored:": "passphrase del file chiave memorizzata:",
+  "Keyfile recovered": "File di chiavi recuperato",
+  "Keyfile recovered successfully.": "File di chiavi recuperato con successo.",
+  "Keyfile recovery available": "Recupero file chiave disponibile",
+  "Keyfile recovery — pick source host": "Recupero file chiave: scegli l'host di origine",
+  "Keyfile removed.": "file di chiavi rimosso.",
+  "Keyrings method failed; trying apt-key fallback": "Il metodo dei portachiavi non è riuscito; provando il fallback con la chiave apt",
+  "LUNs appear as block devices assignable to VMs": "I LUN vengono visualizzati come dispositivi a blocchi assegnabili alle VM",
+  "LVM PV headers check completed": "Controllo delle intestazioni PV LVM completato",
+  "LVM physical volume detected": "Rilevato volume fisico LVM",
+  "LVM tools not available, skipping LVM check": "Strumenti LVM non disponibili, saltando il controllo LVM",
+  "LVM:": "LVM:",
+  "LXC Conflict Policy": "Politica sui conflitti LXC",
+  "LXC Container Privilege Status": "Stato dei privilegi del contenitore LXC",
+  "LXC Conversion Manual Guides": "Guide manuali di conversione LXC",
+  "LXC Management": "Gestione LXC",
+  "LXC Mount Manager": "Gestore del montaggio LXC",
+  "LXC Privileged to Unprivileged conversion": "Conversione da LXC da privilegiato a non privilegiato",
+  "LXC Unprivileged to Privileged conversion": "Conversione LXC da non privilegiato a privilegiato",
+  "LXC already stopped": "LXC si è già fermato",
+  "LXC containers with NVIDIA passthrough:": "Contenitori LXC con passthrough NVIDIA:",
+  "LXC conversion from privileged to unprivileged completed successfully!": "Conversione LXC da privilegiato a non privilegiato completata con successo!",
+  "LXC conversion from unprivileged to privileged completed successfully!": "Conversione LXC da non privilegiato a privilegiato completata con successo!",
+  "LXC removed:": "LXC rimosso:",
+  "LXC stopped": "LXC si fermò",
+  "LXC update skipped by user.": "Aggiornamento LXC saltato dall'utente.",
+  "LXCs to destroy:": "LXC da distruggere:",
+  "Label:": "Etichetta:",
+  "Language Change": "Cambio di lingua",
+  "Language changed to": "La lingua è cambiata in",
+  "Last 50 kernel log lines": "Ultime 50 righe di registro del kernel",
+  "Last run:": "Ultima esecuzione:",
+  "Last system boot time": "Ora dell'ultimo avvio del sistema",
+  "Latest available": "Ultimo disponibile",
+  "Latest version:": "Ultima versione:",
+  "Launching GPU passthrough assistant for VM": "Avvio dell'assistente passthrough GPU per VM",
+  "Legacy PVE 8 .list files commented or not present": "File legacy PVE 8 .list commentati o non presenti",
+  "Legacy ceph.list commented or not present": "Ceph.list legacy commentato o non presente",
+  "Legacy network tools (e.g., ifconfig)": "Strumenti di rete legacy (ad esempio ifconfig)",
+  "Legend:": "Leggenda:",
+  "Let's review your current network configuration.": "Rivediamo la tua attuale configurazione di rete.",
+  "Likely cause: host directory permissions deny the container's mapped UID.": "Causa probabile: le autorizzazioni della directory host negano l'UID mappato del contenitore.",
+  "Limiting size and optimizing journald": "Limitare le dimensioni e ottimizzare journald",
+  "Limiting size and optimizing journald...": "Limitazione delle dimensioni e ottimizzazione del journal...",
+  "Line to paste (single line, including \"command=...\" prefix):": "Riga da incollare (riga singola, incluso il prefisso \"command=...\"):",
+  "Linux Installation Options": "Opzioni di installazione di Linux",
+  "Linux/Mac path:": "Percorso Linux/Mac:",
+  "List Available Disks": "Elenca i dischi disponibili",
+  "List IOMMU group mapping": "Elenca la mappatura dei gruppi IOMMU",
+  "List NVMe devices": "Elenca i dispositivi NVMe",
+  "List SMART-capable devices": "Elenca i dispositivi compatibili con SMART",
+  "List VM/CT IDs to operate on": "Elenca gli ID VM/CT su cui operare",
+  "List ZFS datasets and snapshots": "Elenca set di dati e snapshot ZFS",
+  "List all LXC containers": "Elenca tutti i contenitori LXC",
+  "List all ZFS pools": "Elenca tutti i pool ZFS",
+  "List all containers to identify the privileged one:": "Elenca tutti i contenitori per identificare quello privilegiato:",
+  "List all containers to identify the unprivileged one:": "Elenca tutti i contenitori per identificare quello non privilegiato:",
+  "List all virtual machines": "Elenca tutte le macchine virtuali",
+  "List backups in a specific storage": "Elenca i backup in un archivio specifico",
+  "List block devices and partitions": "Elenca i dispositivi a blocchi e le partizioni",
+  "List configured storages:": "Elenca gli archivi configurati:",
+  "List containers:": "Elenco contenitori:",
+  "List content of specific storage": "Elenca il contenuto di uno spazio di archiviazione specifico",
+  "List disk persistent identifiers": "Elenca gli identificatori persistenti del disco",
+  "List disks with detailed info": "Elenca i dischi con informazioni dettagliate",
+  "List importable ZFS pools": "Elenca i pool ZFS importabili",
+  "List local backups": "Elenca i backup locali",
+  "List storages valid for image import": "Elenca gli archivi validi per l'importazione di immagini",
+  "Listening Ports": "Porte di ascolto",
+  "Listening on:": "Ascolto su:",
+  "Listening ports:": "Porte di ascolto:",
+  "Listing relevant CT users and their mapped UID/GID on host...": "Elenco degli utenti CT rilevanti e dei relativi UID/GID mappati sull'host...",
+  "Loading modules...": "Caricamento moduli...",
+  "Local Disk Manager - Proxmox Host": "Gestione disco locale - Host Proxmox",
+  "Local Disk Storages": "Archiviazioni su disco locale",
+  "Local Shared Directory on Host": "Directory condivisa locale sull'host",
+  "Local archive targets (paths + USB mount/unmount)": "destinazioni di archivio locale (percorsi + montaggio/smontaggio USB)",
+  "Local backup error log": "Registro degli errori di backup locale",
+  "Local backup failed.": "Il backup locale non è riuscito.",
+  "Local directory  (single-machine — only use if it is a SEPARATE disk)": "Directory locale (macchina singola: da utilizzare solo se si tratta di un disco SEPARATO)",
+  "Local keyfile is missing but a recovery copy was found in PBS.": "Manca il file di chiavi locale ma è stata trovata una copia di ripristino in PBS.",
+  "Local network only (192.168.0.0/16)": "Solo rete locale (192.168.0.0/16)",
+  "Local restore error log": "Registro degli errori di ripristino locale",
+  "Locale generated": "Locale generata",
+  "Location:": "Posizione:",
+  "Log": "Tronco d'albero",
+  "Log file": "File di registro",
+  "Log2RAM already registered — updating to latest configuration": "Log2RAM già registrato: aggiornamento all'ultima configurazione",
+  "Log2RAM installation and configuration completed successfully.": "L'installazione e la configurazione di Log2RAM sono state completate con successo.",
+  "Log2RAM installation cancelled by user": "Installazione di Log2RAM annullata dall'utente",
+  "Log2RAM installation verification failed. Check /tmp/log2ram_install.log": "La verifica dell'installazione di Log2RAM non è riuscita. Controllare /tmp/log2ram_install.log",
+  "Log2RAM installed successfully": "Log2RAM installato correttamente",
+  "Log2RAM size set to:": "Dimensione Log2RAM impostata su:",
+  "Log2RAM write scheduled every": "Scrittura Log2RAM programmata ogni",
+  "Log:": "Tronco d'albero:",
+  "Logged-in users": "Utenti registrati",
+  "Logrotate optimization completed": "Ottimizzazione di Logrotate completata",
+  "Logrotate service restarted successfully": "Il servizio Logrotate è stato riavviato correttamente",
+  "Long Test — Background": "Test lungo: contesto",
+  "Long self-test started on": "È iniziato l'autotest lungo",
+  "Long test             — full scan, runs in background if closed": "Test lungo: scansione completa, viene eseguito in background se chiuso",
+  "Look for containers with 'unprivileged: 1' in their config": "Cerca i contenitori con \"non privilegiato: 1\" nella loro configurazione",
+  "Look for containers without 'unprivileged: 1' in their config": "Cerca i contenitori senza \"non privilegiato: 1\" nella loro configurazione",
+  "Lookup domain registration info": "Cerca informazioni sulla registrazione del dominio",
+  "Low Container Memory": "Memoria contenitore insufficiente",
+  "Low free space warning": "Avviso di spazio libero insufficiente",
+  "Low-power CPU platform": "Piattaforma CPU a basso consumo",
+  "Lynis - Security Audit": "Lynis - Controllo della sicurezza",
+  "Lynis Management": "Gestione Lynis",
+  "Lynis command not found": "Comando Lynis non trovato",
+  "Lynis has been removed": "Lynis è stata rimossa",
+  "Lynis installation could not be verified": "Impossibile verificare l'installazione di Lynis",
+  "Lynis installed successfully from GitHub": "Lynis è stato installato correttamente da GitHub",
+  "Lynis is a security auditing tool that performs comprehensive system scans including:": "Lynis è uno strumento di controllo della sicurezza che esegue scansioni complete del sistema, tra cui:",
+  "Lynis is currently installed.": "Lynis è attualmente installato.",
+  "Lynis is not installed on this system.": "Lynis non è installato su questo sistema.",
+  "Lynis is not installed. Run: apt install lynis": "Lynis non è installato. Esegui: apt installa lynis",
+  "Lynis is ready to use": "Lynis è pronto per l'uso",
+  "Lynis updated to version:": "Lynis aggiornato alla versione:",
+  "Lynis version:": "Versione Lynis:",
+  "Lynis was not installed from Git. Reinstalling...": "Lynis non è stato installato da Git. Reinstallazione...",
+  "M.2 / PCIe devices:": "Dispositivi M.2/PCIe:",
+  "MAC Address": "Indirizzo MAC",
+  "MACHINE TYPE": "TIPO DI MACCHINA",
+  "MOTD configuration updated successfully": "Configurazione MOTD aggiornata con successo",
+  "Machine Type": "Tipo di macchina",
+  "Machine type: q35": "Tipo macchina: q35",
+  "Machine: q35": "Macchina: q35",
+  "Major version differs:": "La versione principale differisce:",
+  "Make sure IOMMU is properly enabled and the system has been rebooted after activation.": "Assicurati che IOMMU sia abilitato correttamente e che il sistema sia stato riavviato dopo l'attivazione.",
+  "Make sure there are no critical services running as they will be interrupted. Ensure your server can be safely rebooted.": "Assicurati che non ci siano servizi critici in esecuzione poiché verranno interrotti. Assicurati che il tuo server possa essere riavviato in sicurezza.",
+  "Make sure you have SSH or Web UI access before rebooting.": "Assicurati di avere accesso SSH o all'interfaccia utente Web prima di riavviare.",
+  "Makefile missing in": "Makefile mancante",
+  "Malformed repository entries cleaned": "Voci del repository non valide pulite",
+  "Manage PBS encryption keyfile": "gestisci il file di chiavi di crittografia PBS",
+  "Manage Secure Gateway": "Gestisci gateway sicuro",
+  "Manage and inspect VM disk images": "Gestisci e ispeziona le immagini del disco della VM",
+  "Manage custom backup paths": "Gestisci percorsi di backup personalizzati",
+  "Manage custom paths (add / remove your folders)": "Gestisci percorsi personalizzati (aggiungi/rimuovi le tue cartelle)",
+  "Manage local backup target": "gestisci la destinazione di backup locale",
+  "Manual CLI Guide (Disk and Storage Manager)": "Guida CLI manuale (Gestione dischi e archiviazione)",
+  "Manual CLI Guide (GPU/TPU)": "Guida CLI manuale (GPU/TPU)",
+  "Manual Guide: Convert LXC Privileged to Unprivileged": "Guida manuale: convertire LXC privilegiato in non privilegiato",
+  "Manual Guide: Convert LXC Unprivileged to Privileged": "Guida manuale: convertire LXC da non privilegiato a privilegiato",
+  "Manual Path Entry": "Inserimento manuale del percorso",
+  "Manual backup of a VM or CT": "Backup manuale di una VM o CT",
+  "Manual command template (copy/paste):": "Modello di comando manuale (copia/incolla):",
+  "Manual destination path": "Percorso di destinazione manuale",
+  "Manual guide script not found": "Script della guida manuale non trovato",
+  "Manual install required inside CT": "Installazione manuale richiesta all'interno del CT",
+  "Manual path entry": "Immissione manuale del percorso",
+  "Manual steps recommended after import": "Passaggi manuali consigliati dopo l'importazione",
+  "Manual upgrade guide step by step": "Guida all'aggiornamento manuale passo dopo passo",
+  "Mapped GID on host": "GID mappato sull'host",
+  "Mapped UID on host": "UID mappato sull'host",
+  "Max FD limit / ulimit configured": "Limite FD massimo/limite u configurato",
+  "Max FS open files configuration created successfully": "Configurazione dei file aperti di Max FS creata correttamente",
+  "Max user watches configured": "Numero massimo di orologi utente configurati",
+  "Maximum auto-repair attempts reached (3). Please review the log and run any remaining commands manually.": "È stato raggiunto il numero massimo di tentativi di riparazione automatica (3). Esamina il registro ed esegui manualmente gli eventuali comandi rimanenti.",
+  "May need to restart terminal": "Potrebbe essere necessario riavviare il terminale",
+  "Memory optimization completed.": "Ottimizzazione della memoria completata.",
+  "Memory optimizations removed": "Ottimizzazioni della memoria rimosse",
+  "Memory restored.": "Memoria ripristinata.",
+  "Memory settings optimized successfully": "Impostazioni di memoria ottimizzate con successo",
+  "Memory:": "Memoria:",
+  "Method:": "Metodo:",
+  "Migrate VMs away from node being upgraded": "Migrare le VM dal nodo in fase di aggiornamento",
+  "Migrate away any guests that must keep running": "Migrare tutti gli ospiti che devono continuare a funzionare",
+  "Migrated legacy ProxMenux NVIDIA blacklist state — module will reload after reboot": "Stato della lista nera NVIDIA ProxMenux legacy migrato: il modulo verrà ricaricato dopo il riavvio",
+  "Mirror URL not available for this script.": "URL mirror non disponibile per questo script.",
+  "Missing": "Mancante",
+  "Missing commands after installation:": "Comandi mancanti dopo l'installazione:",
+  "Missing dependency": "Dipendenza mancante",
+  "Missing on target:": "Obiettivo mancato:",
+  "Missing or invalid parameter": "Parametro mancante o non valido",
+  "Missing required parameter": "Parametro obbligatorio mancante",
+  "Mixed GPU Modes": "Modalità GPU miste",
+  "Mixed current mode detected in selected GPU(s).": "Modalità corrente mista rilevata nelle GPU selezionate.",
+  "Mobile UI backup created": "Backup dell'interfaccia utente mobile creato",
+  "Mode": "Modalità",
+  "Model": "Modello",
+  "Modern resource monitor (press q to exit)": "Monitoraggio delle risorse moderne (premi q per uscire)",
+  "Modifying Fastfetch configuration...": "Modifica della configurazione Fastfetch...",
+  "Modules configuration updated.": "Configurazione dei moduli aggiornata.",
+  "Modules loaded.": "Moduli caricati.",
+  "Monitor Activated": "Monitor attivato",
+  "Monitor Deactivated": "Monitor disattivato",
+  "Monitor URL": "Monitora l'URL",
+  "Monitor disk I/O usage (press q to exit)": "Monitorare l'utilizzo dell'I/O del disco (premi q per uscire)",
+  "Monitor progress:": "Monitorare i progressi:",
+  "Monitoring": "monitoraggio",
+  "Most common cause: the archive is corrupted (interrupted write, partial copy, or storage issue).": "Causa più comune: l'archivio è danneggiato (scrittura interrotta, copia parziale o problema di archiviazione).",
+  "Mount Added Successfully:": "Montaggio aggiunto con successo:",
+  "Mount CIFS share:": "Montare condivisione CIFS:",
+  "Mount Configuration Summary:": "Riepilogo della configurazione di montaggio:",
+  "Mount Details:": "Dettagli del montaggio:",
+  "Mount Examples:": "Esempi di montaggio:",
+  "Mount Host Directory to LXC": "Montare la directory host su LXC",
+  "Mount Host Directory to LXC Container": "Montare la directory host sul contenitore LXC",
+  "Mount Information:": "Informazioni sul montaggio:",
+  "Mount Method": "Metodo di montaggio",
+  "Mount NFS Client in LXC": "Montare il client NFS in LXC",
+  "Mount NFS Share": "Montare la condivisione NFS",
+  "Mount NFS Share on Host": "Montare la condivisione NFS sull'host",
+  "Mount NFS share:": "Montare condivisione NFS:",
+  "Mount Name": "Nome del monte",
+  "Mount Name:": "Nome della montatura:",
+  "Mount Options": "Opzioni di montaggio",
+  "Mount Path": "Sentiero del Monte",
+  "Mount Path:": "Percorso del monte:",
+  "Mount Point": "Punto di montaggio",
+  "Mount Point ID": "ID del punto di montaggio",
+  "Mount Point Removal Summary:": "Riepilogo della rimozione del punto di montaggio:",
+  "Mount Point:": "Punto di montaggio:",
+  "Mount Samba Share": "Monte Samba Condividi",
+  "Mount Samba Share on Host": "Monte Samba Condividi sull'host",
+  "Mount USB disk?": "Montare il disco USB?",
+  "Mount a USB drive now": "Monta ora un'unità USB",
+  "Mount all datasets": "Montare tutti i set di dati",
+  "Mount already exists for this path in container": "Il montaggio esiste già per questo percorso nel contenitore",
+  "Mount and persist with UUID:": "Montare e persistere con l'UUID:",
+  "Mount failed": "Il montaggio non è riuscito",
+  "Mount options:": "Opzioni di montaggio:",
+  "Mount path must be an absolute path starting with /": "Il percorso di montaggio deve essere un percorso assoluto che inizia con /",
+  "Mount path:": "Percorso di montaggio:",
+  "Mount point created": "Punto di montaggio creato",
+  "Mount point created.": "Punto di montaggio creato.",
+  "Mount point is visible but NOT writable from inside the container": "Il punto di montaggio è visibile ma NON scrivibile dall'interno del contenitore",
+  "Mount point is writable from inside the container": "Il punto di montaggio è scrivibile dall'interno del contenitore",
+  "Mount point not visible inside the container yet": "Punto di montaggio non ancora visibile all'interno del contenitore",
+  "Mount point ready:": "Punto di montaggio pronto:",
+  "Mount point removed successfully": "Punto di montaggio rimosso correttamente",
+  "Mount point:": "Punto di montaggio:",
+  "Mount shares on HOST first": "Montare prima le condivisioni su HOST",
+  "Mount specific dataset": "Montare un set di dati specifico",
+  "Mount status:": "Stato del montaggio:",
+  "Mount this device and use it as the backup destination?": "Montare questo dispositivo e utilizzarlo come destinazione del backup?",
+  "Mount was busy — performed lazy unmount": "Il montaggio era occupato: ha eseguito lo smontaggio pigro",
+  "Mounted": "Montato",
+  "Mounted ISO on device": "ISO montato sul dispositivo",
+  "Mounted at": "Montato a",
+  "Mounted external disk": "Disco esterno montato",
+  "Mounted external disk  (offline-safe, single-machine dedup)": "Disco esterno montato (deduplicazione offline sicura su un singolo computer)",
+  "Mounted filesystem detected": "Rilevato file system montato",
+  "Mounting CIFS share...": "Montaggio condivisione CIFS in corso...",
+  "Mounting NFS share...": "Montaggio condivisione NFS in corso...",
+  "Mounting container filesystem": "Montaggio del filesystem del contenitore",
+  "Mounting disk...": "Disco di montaggio...",
+  "Mounting existing": "Montaggio esistente",
+  "Mounting here will hide existing files until unmounted.": "Il montaggio qui nasconderà i file esistenti finché non verranno smontati.",
+  "Move that copy offsite (USB, password manager, another host). Delete it from this path when done.": "sposta la copia fuori sede (USB, gestore password, un altro host).Eliminalo da questo percorso una volta terminato.",
+  "Move to target VM (remove from source VM config)": "Sposta nella VM di destinazione (rimuovi dalla configurazione della VM di origine)",
+  "Multiple recovery groups found in PBS. Pick the one that originally created the keyfile:": "Più gruppi di recupero trovati in PBS. Scegli quello che originariamente ha creato il file di chiavi:",
+  "Multiple rootfs directories were found in this archive. Restore cannot continue automatically.": "In questo archivio sono state trovate più directory rootfs. Il ripristino non può continuare automaticamente.",
+  "NAS Systems": "Sistemi NAS",
+  "NETWORK CONFIGURATION ANALYSIS": "ANALISI DELLA CONFIGURAZIONE DELLA RETE",
+  "NFS Access Restricted": "Accesso NFS limitato",
+  "NFS Client Error": "Errore del client NFS",
+  "NFS Client Manager - CT": "Gestore client NFS-CT",
+  "NFS Client Status in CT": "Stato del client NFS in CT",
+  "NFS Client Tools: AVAILABLE": "Strumenti client NFS: DISPONIBILI",
+  "NFS Client Tools: NOT AVAILABLE": "Strumenti client NFS: NON DISPONIBILE",
+  "NFS Client in LXC (Privileged)": "Client NFS in LXC (privilegiato)",
+  "NFS Client in LXC (privileged)": "Client NFS in LXC (privilegiato)",
+  "NFS Client: INSTALLED": "Client NFS: INSTALLATO",
+  "NFS Client: NOT INSTALLED": "Client NFS: NON INSTALLATO",
+  "NFS Error": "Errore NFS",
+  "NFS Host Manager - Proxmox Host": "Gestore host NFS: host Proxmox",
+  "NFS LXC Manager - CT": "Gestore NFS LXC - CT",
+  "NFS Mounts on Host": "NFS si monta sull'host",
+  "NFS Not Installed": "NFS non installato",
+  "NFS Port Error": "Errore porta NFS",
+  "NFS Proxmox storages (pvesm):": "Archiviazioni NFS Proxmox (pvesm):",
+  "NFS Server": "Server NFS",
+  "NFS Server Selection": "Selezione del server NFS",
+  "NFS Server in LXC (Privileged)": "Server NFS in LXC (privilegiato)",
+  "NFS Server in LXC (privileged)": "Server NFS in LXC (privilegiato)",
+  "NFS Server: INSTALLED": "Server NFS: INSTALLATO",
+  "NFS Server: NOT INSTALLED": "Server NFS: NON INSTALLATO",
+  "NFS Service Status in CT": "Stato del servizio NFS in CT",
+  "NFS Service: RUNNING": "Servizio NFS: IN FUNZIONE",
+  "NFS Service: STOPPED": "Servizio NFS: ARRESTATO",
+  "NFS Version Configuration:": "Configurazione della versione NFS:",
+  "NFS Version:": "Versione NFS:",
+  "NFS Version: Auto-negotiation (NFSv3/NFSv4)": "Versione NFS: negoziazione automatica (NFSv3/NFSv4)",
+  "NFS client installed successfully.": "Client NFS installato correttamente.",
+  "NFS client tools installed": "Strumenti client NFS installati",
+  "NFS directory permissions set — containers should now be able to write": "Set di autorizzazioni per la directory NFS: i contenitori ora dovrebbero essere in grado di scrivere",
+  "NFS export": "Esportazione NFS",
+  "NFS export Selected": "Esportazione NFS selezionata",
+  "NFS export created successfully!": "Esportazione NFS creata con successo!",
+  "NFS export:": "Esportazione NFS:",
+  "NFS is recommended for VM disk image storage.": "NFS è consigliato per l'archiviazione delle immagini del disco della VM.",
+  "NFS mounts in CT": "NFS si monta in CT",
+  "NFS packages removed.": "Pacchetti NFS rimossi.",
+  "NFS port (2049) is not accessible on": "La porta NFS (2049) non è accessibile su",
+  "NFS port 2049": "Porta NFS 2049",
+  "NFS server Selected": "Server NFS selezionato",
+  "NFS server installed successfully.": "Server NFS installato correttamente.",
+  "NFS server is already installed.": "Il server NFS è già installato.",
+  "NFS server is not installed in this CT.": "Il server NFS non è installato in questo CT.",
+  "NFS server is running": "Il server NFS è in esecuzione",
+  "NFS server:": "Server NFS:",
+  "NFS servers detected": "Rilevati server NFS",
+  "NFS service is enabled": "Il servizio NFS è abilitato",
+  "NFS services stopped and disabled.": "Servizi NFS interrotti e disabilitati.",
+  "NFS share mounted at:": "Condivisione NFS montata su:",
+  "NFS share mounted successfully!": "Condivisione NFS montata correttamente!",
+  "NFS share unmount completed.": "Smontaggio condivisione NFS completato.",
+  "NFS storage added successfully!": "Spazio di archiviazione NFS aggiunto correttamente!",
+  "NFS storage adding in progress...": "Aggiunta dello spazio di archiviazione NFS in corso...",
+  "NIC": "NIC",
+  "NIC changes detected — adjusted automatically": "modifiche NIC rilevate: regolate automaticamente",
+  "NICs:": "NIC:",
+  "NOT FOUND": "NON TROVATO",
+  "NOTE: The host directory and its contents will remain unchanged.": "NOTA: la directory host e il suo contenuto rimarranno invariati.",
+  "NVENC patch detected — list narrowed to versions supported by keylase/nvidia-patch.": "Rilevata patch NVENC: elenco ristretto alle versioni supportate da keylase/nvidia-patch.",
+  "NVIDIA Actions": "Azioni NVIDIA",
+  "NVIDIA CPU hiding already configured": "Nascondere la CPU NVIDIA già configurata",
+  "NVIDIA DKMS entries removed.": "Voci NVIDIA DKMS rimosse.",
+  "NVIDIA Driver Uninstall": "Disinstallazione del driver NVIDIA",
+  "NVIDIA Driver Version": "Versione del driver NVIDIA",
+  "NVIDIA Drivers": "Driver NVIDIA",
+  "NVIDIA Drivers Not Found": "Driver NVIDIA non trovati",
+  "NVIDIA GPU Driver Installation": "Installazione del driver GPU NVIDIA",
+  "NVIDIA GPU passthrough configured.": "Passthrough GPU NVIDIA configurato.",
+  "NVIDIA KVM args configured (kvm=off, vendor_id spoof)": "Argomenti NVIDIA KVM configurati (kvm=off, spoofing vendor_id)",
+  "NVIDIA KVM hiding (cpu hidden=1)": "Nascondimento NVIDIA KVM (cpu nascosta=1)",
+  "NVIDIA KVM hiding already configured": "Nascondiglio NVIDIA KVM già configurato",
+  "NVIDIA Patch": "Patch NVIDIA",
+  "NVIDIA driver": "Driver NVIDIA",
+  "NVIDIA driver installed successfully.": "Driver NVIDIA installato correttamente.",
+  "NVIDIA driver installed:": "Driver NVIDIA installato:",
+  "NVIDIA driver verification in container:": "Verifica del driver NVIDIA nel contenitore:",
+  "NVIDIA drivers are not installed or not loaded on this host.": "I driver NVIDIA non sono installati o non caricati su questo host.",
+  "NVIDIA host services already aligned for VFIO mode": "Servizi host NVIDIA già allineati per la modalità VFIO",
+  "NVIDIA host services disabled for VFIO mode": "Servizi host NVIDIA disabilitati per la modalità VFIO",
+  "NVIDIA host services/autoload already aligned for VFIO mode": "Servizi host NVIDIA/carico automatico già allineati per la modalità VFIO",
+  "NVIDIA host services/autoload already aligned for native mode": "Servizi host/caricamento automatico NVIDIA già allineati per la modalità nativa",
+  "NVIDIA host services/autoload disabled for VFIO mode": "Servizi host NVIDIA/caricamento automatico disabilitati per la modalità VFIO",
+  "NVIDIA host services/autoload restored for native mode": "Servizi host NVIDIA/carico automatico ripristinati per la modalità nativa",
+  "NVIDIA install incomplete. Check log:": "Installazione NVIDIA incompleta. Controlla il registro:",
+  "NVIDIA installer downloaded successfully": "Il programma di installazione NVIDIA è stato scaricato correttamente",
+  "NVIDIA installer extracted.": "Estratto il programma di installazione NVIDIA.",
+  "NVIDIA installer not found at": "Programma di installazione NVIDIA non trovato in",
+  "NVIDIA installer reported an error. Check /tmp/nvidia_install.log": "Il programma di installazione NVIDIA ha segnalato un errore. Controlla /tmp/nvidia_install.log",
+  "NVIDIA installer returned error": "Il programma di installazione NVIDIA ha restituito un errore",
+  "NVIDIA kernel modules unloaded successfully.": "I moduli del kernel NVIDIA sono stati scaricati correttamente.",
+  "NVIDIA libs require approximately 1.5GB of free space.": "Le librerie NVIDIA richiedono circa 1,5 GB di spazio libero.",
+  "NVIDIA patch applied - check README for supported versions.": "Patch NVIDIA applicata: controlla README per le versioni supportate.",
+  "NVIDIA patch not applied.": "Patch NVIDIA non applicata.",
+  "NVIDIA per-BDF VFIO binding configured": "Associazione VFIO NVIDIA per-BDF configurata",
+  "NVIDIA services stopped and disabled.": "I servizi NVIDIA sono stati interrotti e disabilitati.",
+  "NVIDIA udev rules and persistence service installed.": "Regole NVIDIA udev e servizio di persistenza installati.",
+  "NVIDIA uninstallation steps completed.": "Passaggi di disinstallazione di NVIDIA completati.",
+  "NVIDIA uninstaller completed.": "Programma di disinstallazione NVIDIA completato.",
+  "NVIDIA update failed for LXC": "L'aggiornamento NVIDIA non è riuscito per LXC",
+  "NVIDIA userspace libraries installed.": "Librerie dello spazio utente NVIDIA installate.",
+  "NVMe Disk Detected": "Rilevato disco NVMe",
+  "NVMe health status: PASSED": "Stato di salute NVMe: SUPERATO",
+  "NVMe health status: WARNING (critical_warning =": "Stato di integrità NVMe: ATTENZIONE (critical_warning =",
+  "NVMe skipped (to add as PCIe use 'Add Controller or NVMe PCIe to VM'):": "NVMe saltato (per aggiungere come PCIe utilizzare 'Aggiungi controller o NVMe PCIe alla VM'):",
+  "NVMe-specific SMART log": "Log SMART specifico per NVMe",
+  "Name for this target:": "Nome per questo obiettivo:",
+  "Name:": "Nome:",
+  "Neither /etc/kernel/cmdline nor /etc/default/grub found.": "Non sono stati trovati né /etc/kernel/cmdline né /etc/default/grub.",
+  "Nesting feature enabled": "Funzionalità di annidamento abilitata",
+  "NetBIOS Service: RUNNING": "Servizio NetBIOS: IN ESECUZIONE",
+  "NetBIOS Service: STOPPED": "Servizio NetBIOS: ARRESTATO",
+  "NetBIOS port 139:": "Porta NetBIOS 139:",
+  "Network": "Rete",
+  "Network  :": "Rete  :",
+  "Network (interfaces, DNS)": "Rete (interfacce, DNS)",
+  "Network Bridge": "Ponte di rete",
+  "Network Commands": "Comandi di rete",
+  "Network Configuration": "Configurazione di rete",
+  "Network Configuration Analysis": "Analisi della configurazione di rete",
+  "Network Configuration File": "File di configurazione di rete",
+  "Network Diagnostics": "Diagnostica di rete",
+  "Network Error": "Errore di rete",
+  "Network Interface Setup": "Configurazione dell'interfaccia di rete",
+  "Network Interfaces": "Interfacce di rete",
+  "Network Management": "Gestione della rete",
+  "Network Management - SAFE MODE": "Gestione della rete - MODALITÀ SICURA",
+  "Network Restart": "Riavvio della rete",
+  "Network Restart Failed": "Riavvio della rete non riuscito",
+  "Network Restarted": "Rete riavviata",
+  "Network Tools": "Strumenti di rete",
+  "Network access:": "Accesso alla rete:",
+  "Network configuration backed up": "Backup della configurazione di rete",
+  "Network configuration has been restored from backup.": "La configurazione di rete è stata ripristinata dal backup.",
+  "Network connection failed to": "La connessione di rete non è riuscita",
+  "Network connectivity": "Connettività di rete",
+  "Network connectivity to": "Connettività di rete a",
+  "Network interfaces added:": "Interfacce di rete aggiunte:",
+  "Network monitoring tool (iptraf-ng)": "strumento di monitoraggio della rete (iptraf-ng)",
+  "Network optimization completed": "Ottimizzazione della rete completata",
+  "Network optimizations removed": "Ottimizzazioni di rete rimosse",
+  "Network service restarted successfully": "Il servizio di rete è stato riavviato correttamente",
+  "Network service restarted successfully.": "Il servizio di rete è stato riavviato correttamente.",
+  "Network share mounting (NFS/Samba) requires a PRIVILEGED container.": "Il montaggio della condivisione di rete (NFS/Samba) richiede un contenitore PRIVILEGED.",
+  "Network throughput test (client/server)": "Test di throughput della rete (client/server)",
+  "NetworkManager Detected": "Rilevato gestore di rete",
+  "NetworkManager has been removed successfully": "NetworkManager è stato rimosso con successo",
+  "NetworkManager is running (may cause conflicts)": "NetworkManager è in esecuzione (potrebbe causare conflitti)",
+  "NetworkManager is running, which may conflict with Proxmox.": "NetworkManager è in esecuzione, il che potrebbe entrare in conflitto con Proxmox.",
+  "NetworkManager not running": "NetworkManager non in esecuzione",
+  "New Folder in /mnt": "Nuova cartella in /mnt",
+  "New Group": "Nuovo gruppo",
+  "New Search": "Nuova ricerca",
+  "New VM:": "Nuova macchina virtuale:",
+  "New Virtual Machine": "Nuova macchina virtuale",
+  "New backup job": "Nuovo lavoro di backup",
+  "New backups on this host will be unencrypted until a new keyfile is set up.": "i nuovi backup su questo host non saranno crittografati finché non verrà impostato un nuovo file di chiavi.",
+  "New mount options to apply:": "Nuove opzioni di montaggio da applicare:",
+  "New scheduled job (own timer + retention)": "Nuovo lavoro pianificato (timer personale + conservazione)",
+  "New version available": "Nuova versione disponibile",
+  "New version:": "Nuova versione:",
+  "Next Step Required": "Passaggio successivo obbligatorio",
+  "Next Steps:": "Passaggi successivi:",
+  "Next step: stop that VM first, then run": "Passaggio successivo: arresta prima la VM, quindi eseguila",
+  "No": "NO",
+  "No .link files found in": "Nessun file .link trovato in",
+  "No .ova or .ovf files found in:": "Nessun file .ova o .ovf trovato in:",
+  "No .ovf descriptor found inside OVA.": "Nessun descrittore .ovf trovato in OVA.",
+  "No .pxar archives were found in this backup:": "in questo backup non è stato trovato alcun archivio .pxar:",
+  "No AMD CPU detected. Skipping AMD fixes.": "Nessuna CPU AMD rilevata. Salto delle correzioni AMD.",
+  "No AMD GPU detected on this system.": "Nessuna GPU AMD rilevata su questo sistema.",
+  "No Available Exports": "Nessuna esportazione disponibile",
+  "No Available Shares": "Nessuna azione disponibile",
+  "No Backups": "Nessun backup",
+  "No CIFS Proxmox storage and no CIFS fstab mount found on this host.": "Nessuno spazio di archiviazione CIFS Proxmox e nessun montaggio CIFS fstab trovato su questo host.",
+  "No CIFS Proxmox storage configured.": "Nessuno spazio di archiviazione CIFS Proxmox configurato.",
+  "No CIFS Proxmox storages configured.": "Nessun archivio CIFS Proxmox configurato.",
+  "No CIFS mounts active.": "Nessun montaggio CIFS attivo.",
+  "No CT was selected.": "Non è stata selezionata alcuna TC.",
+  "No CTs available in the system.": "Nessun CT disponibile nel sistema.",
+  "No Changes Needed": "Nessuna modifica necessaria",
+  "No Cleanup Needed": "Nessuna pulizia necessaria",
+  "No Controller/NVMe selected for now.": "Nessun controller/NVMe selezionato per ora.",
+  "No Coral Detected": "Nessun corallo rilevato",
+  "No Coral TPU device was found on this host (neither PCIe/M.2 nor USB).": "Nessun dispositivo Coral TPU è stato trovato su questo host (né PCIe/M.2 né USB).",
+  "No Custom Logos Found": "Nessun logo personalizzato trovato",
+  "No Disk Images Found": "Nessuna immagine disco trovata",
+  "No Disk Storage": "Nessuna archiviazione su disco",
+  "No Disks Available": "Nessun disco disponibile",
+  "No Disks Found": "Nessun disco trovato",
+  "No Exports": "Nessuna esportazione",
+  "No Exports Found": "Nessuna esportazione trovata",
+  "No Folders": "Nessuna cartella",
+  "No GPU Detected": "Nessuna GPU rilevata",
+  "No GPU selected.": "Nessuna GPU selezionata.",
+  "No GPU selected. Please select at least one GPU to continue.": "Nessuna GPU selezionata. Seleziona almeno una GPU per continuare.",
+  "No GPUs detected on this host.": "Nessuna GPU rilevata su questo host.",
+  "No Guest Shares": "Nessuna condivisione degli ospiti",
+  "No IP": "Nessun IP",
+  "No IP assigned": "Nessun IP assegnato",
+  "No ISO file detected after UUP Dump process.": "Nessun file ISO rilevato dopo il processo di dump UUP.",
+  "No ISO images found in Proxmox ISO storages.": "Nessuna immagine ISO trovata negli archivi ISO Proxmox.",
+  "No ISO selected.": "Nessun ISO selezionato.",
+  "No ISO was generated.": "Non è stata generata alcuna ISO.",
+  "No Images Found": "Nessuna immagine trovata",
+  "No Intel GPU detected on this system.": "Nessuna GPU Intel rilevata su questo sistema.",
+  "No LXC containers available": "Nessun contenitore LXC disponibile",
+  "No LXC containers found": "Nessun contenitore LXC trovato",
+  "No LXC containers found on this system.": "Nessun contenitore LXC trovato su questo sistema.",
+  "No MAC": "Nessun MAC",
+  "No Method Selected": "Nessun metodo selezionato",
+  "No Mounts": "Nessun supporto",
+  "No NFS Proxmox storage and no NFS fstab mount found on this host.": "Nessuno spazio di archiviazione NFS Proxmox e nessun montaggio fstab NFS trovato su questo host.",
+  "No NFS Proxmox storage configured.": "Nessun archivio NFS Proxmox configurato.",
+  "No NFS Proxmox storages configured.": "Nessun archivio NFS Proxmox configurato.",
+  "No NFS mounts active.": "Nessun supporto NFS attivo.",
+  "No NFS mounts found.": "Nessun supporto NFS trovato.",
+  "No NFS ports found": "Nessuna porta NFS trovata",
+  "No NFS servers configured to test.": "Nessun server NFS configurato per il test.",
+  "No NFS servers found on the network.": "Nessun server NFS trovato sulla rete.",
+  "No NFS shares currently mounted.": "Nessuna condivisione NFS attualmente montata.",
+  "No NVIDIA GPU detected on this system.": "Nessuna GPU NVIDIA rilevata su questo sistema.",
+  "No NVIDIA GPU has been detected on this system. The installer will now exit.": "Nessuna GPU NVIDIA è stata rilevata su questo sistema. Il programma di installazione verrà ora chiuso.",
+  "No NVIDIA driver installed.": "Nessun driver NVIDIA installato.",
+  "No PBS keyfile is installed on this host and no automatic recovery was possible.": "su questo host non è installato alcun file di chiavi PBS e non è stato possibile il ripristino automatico.",
+  "No PVE vzdump job uses a": "nessun lavoro PVE vzdump utilizza a",
+  "No PVs with old headers found.": "Nessun PV con intestazioni vecchie trovato.",
+  "No ProxMenux ZFS autotrim state file found.": "Nessun file di stato di taglio automatico ProxMenux ZFS trovato.",
+  "No ProxMenux host-backup archives were found in:": "Nessun archivio di backup host ProxMenux trovato in:",
+  "No Recent Servers": "Nessun server recente",
+  "No Samba mounts found.": "Nessun supporto Samba trovato.",
+  "No Samba ports found": "Nessuna porta Samba trovata",
+  "No Samba servers configured to test.": "Nessun server Samba configurato per il test.",
+  "No Samba servers found on the network.": "Nessun server Samba trovato sulla rete.",
+  "No Samba shares currently mounted.": "Nessuna condivisione Samba attualmente montata.",
+  "No Samba users found": "Nessun utente Samba trovato",
+  "No Selection": "Nessuna selezione",
+  "No Servers Found": "Nessun server trovato",
+  "No Shares": "Nessuna condivisione",
+  "No Shares Available": "Nessuna azione disponibile",
+  "No Shares Found": "Nessuna azione trovata",
+  "No Storage Found": "Nessun spazio di archiviazione trovato",
+  "No USB drives detected. Enter the mountpoint path manually:": "Nessuna unità USB rilevata. Immettere manualmente il percorso del punto di montaggio:",
+  "No USB drives mounted by ProxMenux yet. Mount one first to use it as a target.": "ancora nessuna unità USB montata da ProxMenux.Montane uno prima per usarlo come bersaglio.",
+  "No UUP folder found.": "Nessuna cartella UUP trovata.",
+  "No VM was selected.": "Non è stata selezionata alcuna VM.",
+  "No VMID defined. Cannot apply guest agent config.": "Nessun VMID definito. Impossibile applicare la configurazione dell'agente guest.",
+  "No VMs Found": "Nessuna VM trovata",
+  "No VMs available in the system.": "Nessuna macchina virtuale disponibile nel sistema.",
+  "No VMs available on this host.": "Nessuna macchina virtuale disponibile su questo host.",
+  "No VMs found": "Nessuna VM trovata",
+  "No Valid Servers": "Nessun server valido",
+  "No VirtIO ISO found. Please download one.": "Nessuna ISO VirtIO trovata. Per favore scaricane uno.",
+  "No VirtIO ISO selected. Please choose again.": "Nessun ISO VirtIO selezionato. Per favore scegli di nuovo.",
+  "No Virtual Machines found on this system.": "Nessuna macchina virtuale trovata su questo sistema.",
+  "No ZFS pools detected. Skipping ZFS autotrim.": "Nessun pool ZFS rilevato. Saltare l'autotrim ZFS.",
+  "No accessible": "Non accessibile",
+  "No accessible NFS servers found.": "Nessun server NFS accessibile trovato.",
+  "No accessible Samba servers found.": "Nessun server Samba accessibile trovato.",
+  "No accessible exports found.": "Nessuna esportazione accessibile trovata.",
+  "No accessible shares found.": "Nessuna condivisione accessibile trovata.",
+  "No active exports or showmount not available": "Nessuna esportazione attiva o showmount non disponibile",
+  "No active session": "Nessuna sessione attiva",
+  "No additional GPU can be added.": "Non è possibile aggiungere alcuna GPU aggiuntiva.",
+  "No additional device needs to be added.": "Non è necessario aggiungere alcun dispositivo aggiuntivo.",
+  "No archives": "Nessun archivio",
+  "No archives found in this Borg repository.": "Nessun archivio trovato in questo repository Borg.",
+  "No available Controllers/NVMe devices were found.": "Non è stato trovato alcun controller/dispositivo NVMe disponibile.",
+  "No available disks found.": "Nessun disco disponibile trovato.",
+  "No backup found, logrotate configuration not changed": "Nessun backup trovato, configurazione logrotate non modificata",
+  "No backups": "nessun backup",
+  "No backups found": "Nessun backup trovato",
+  "No bridge configuration issues found": "Nessun problema di configurazione del bridge trovato",
+  "No bridges found in system": "Nessun bridge trovato nel sistema",
+  "No changes are required for": "Non sono necessarie modifiche per",
+  "No changes are required.": "Non sono necessarie modifiche.",
+  "No changes have been made to your system": "Non è stata apportata alcuna modifica al tuo sistema",
+  "No changes will be made to the running system.": "Non verrà apportata alcuna modifica al sistema in esecuzione.",
+  "No compatible GPU detected for VM passthrough. Skipping GPU wizard option.": "Nessuna GPU compatibile rilevata per il passthrough della VM. Saltare l'opzione della procedura guidata GPU.",
+  "No compatible GPU was detected on this host.": "Nessuna GPU compatibile rilevata su questo host.",
+  "No compatible GPUs detected on this host.": "Nessuna GPU compatibile rilevata su questo host.",
+  "No compatible GPUs were detected on this host.": "Nessuna GPU compatibile rilevata su questo host.",
+  "No compatible PVE jobs": "Nessun lavoro PVE compatibile",
+  "No compatible disk images found in:": "Nessuna immagine disco compatibile trovata in:",
+  "No compatible versions found for your kernel": "Nessuna versione compatibile trovata per il tuo kernel",
+  "No configuration issues found": "Nessun problema di configurazione trovato",
+  "No container runtime available.": "Nessun runtime del contenitore disponibile.",
+  "No container selected. Exiting.": "Nessun contenitore selezionato. In uscita.",
+  "No controller/NVMe selected.": "Nessun controller/NVMe selezionato.",
+  "No controllers remaining after conflict resolution.": "Nessun controller rimasto dopo la risoluzione del conflitto.",
+  "No custom key (rely on default SSH config)": "Nessuna chiave personalizzata (si basa sulla configurazione SSH predefinita)",
+  "No custom logos were found in /usr/local/share/fastfetch/logos/.\n\nPlease add a logo and try again.": "Nessun logo personalizzato trovato in /usr/local/share/fastfetch/logos/.\n\nAggiungi un logo e riprova.",
+  "No desktop UI backup found, will reinstall packages": "Nessun backup dell'interfaccia utente desktop trovato. I pacchetti verranno reinstallati",
+  "No directories found in": "Nessuna directory trovata in",
+  "No disk images found in /var/lib/vz/images/. Please add an image first.": "Nessuna immagine del disco trovata in /var/lib/vz/images/. Per favore aggiungi prima un'immagine.",
+  "No disks available for this CT.": "Nessun disco disponibile per questo CT.",
+  "No disks available for this VM.": "Nessun disco disponibile per questa VM.",
+  "No disks were added.": "Nessun disco è stato aggiunto.",
+  "No disks were configured for processing.": "Nessun disco configurato per l'elaborazione.",
+  "No disks were selected.": "Nessun disco selezionato.",
+  "No duplicate IP addresses": "Nessun indirizzo IP duplicato",
+  "No duplicate repositories found": "Nessun repository duplicato trovato",
+  "No eligible Controller/NVMe devices remain after SR-IOV filtering. Skipping.": "Dopo il filtraggio SR-IOV non rimane alcun dispositivo Controller/NVMe idoneo. Saltare.",
+  "No eligible controllers remain after SR-IOV filtering.": "Dopo il filtraggio SR-IOV non rimane alcun controller idoneo.",
+  "No encryption key is stored on this host. Choose how to set one up:": "su questo host non è archiviata alcuna chiave di crittografia.Scegli come configurarne uno:",
+  "No exportable VM disks were found (CD-ROM/cloud-init are excluded).": "Non è stato trovato alcun disco VM esportabile (CD-ROM/cloud-init esclusi).",
+  "No exportable disks": "Nessun disco esportabile",
+  "No exports configured.": "Nessuna esportazione configurata.",
+  "No exports file found.": "Nessun file di esportazione trovato.",
+  "No exports found in /etc/exports.": "Nessuna esportazione trovata in /etc/exports.",
+  "No exports found on server": "Nessuna esportazione trovata sul server",
+  "No files found": "Nessun file trovato",
+  "No folders found in /mnt.": "Nessuna cartella trovata in /mnt.",
+  "No folders found in /mnt. Please create a new folder.": "Nessuna cartella trovata in /mnt. Per favore crea una nuova cartella.",
+  "No folders found inside /mnt in the CT.": "Nessuna cartella trovata all'interno di /mnt nel CT.",
+  "No format-safe disks are available.": "Non sono disponibili dischi formattati.",
+  "No group creation required — uses world-writable sticky bit permissions.": "Non è richiesta la creazione di gruppi: utilizza autorizzazioni sticky bit scrivibili da tutti.",
+  "No host VFIO reconfiguration expected": "Non è prevista alcuna riconfigurazione VFIO dell'host",
+  "No host VFIO/native binding changes were required.": "Non sono state necessarie modifiche al VFIO host/associazione nativa.",
+  "No host backups were found in this PBS repository:": "non è stato trovato alcun backup dell'host in questo repository PBS:",
+  "No host reboot expected": "Non è previsto il riavvio dell'host",
+  "No host write access — server-side ACL or root_squash. Continuing anyway.": "Nessun accesso in scrittura sull'host: ACL lato server o root_squash. Continuando comunque.",
+  "No host write access — server-side ACL. Continuing anyway.": "Nessun accesso in scrittura sull'host: ACL lato server. Continuando comunque.",
+  "No iSCSI Storage": "Nessuna archiviazione iSCSI",
+  "No iSCSI storage configured in Proxmox.": "Nessun archivio iSCSI configurato in Proxmox.",
+  "No iSCSI storage configured.": "Nessun archivio iSCSI configurato.",
+  "No iSCSI storage found in Proxmox.": "Nessun archivio iSCSI trovato in Proxmox.",
+  "No iSCSI targets found on portal": "Nessuna destinazione iSCSI trovata nel portale",
+  "No import disks selected for now.": "Nessun disco di importazione selezionato per ora.",
+  "No importable disks available. System disks and protected disks are hidden.": "Nessun disco importabile disponibile. I dischi di sistema e i dischi protetti sono nascosti.",
+  "No installation information available.": "Nessuna informazione di installazione disponibile.",
+  "No interface type was selected for the disks.": "Non è stato selezionato alcun tipo di interfaccia per i dischi.",
+  "No jobs": "Nessun lavoro",
+  "No language selected.": "Nessuna lingua selezionata.",
+  "No local disk storage configured.": "Nessuna archiviazione su disco locale configurata.",
+  "No main sources.list present (skipped)": "Nessuna fonte principale.list presente (saltata)",
+  "No mount point was specified.": "Non è stato specificato alcun punto di montaggio.",
+  "No mount points found in any container": "Nessun punto di montaggio trovato in nessun contenitore",
+  "No mount points found in container": "Nessun punto di montaggio trovato nel contenitore",
+  "No network configuration backups found.": "Nessun backup della configurazione di rete trovato.",
+  "No network interfaces configured (besides loopback)": "Nessuna interfaccia di rete configurata (a parte il loopback)",
+  "No new Controller/NVMe entries were added.": "Non sono state aggiunte nuove voci Controller/NVMe.",
+  "No optimizations detected to uninstall.": "Nessuna ottimizzazione rilevata da disinstallare.",
+  "No partitions found on disk. Nothing was wiped.": "Nessuna partizione trovata sul disco. Niente è stato cancellato.",
+  "No password provided.": "Nessuna password fornita.",
+  "No paths available": "Nessun percorso disponibile",
+  "No paths selected. Select at least one path.": "Nessun percorso selezionato. Seleziona almeno un percorso.",
+  "No pending paths to schedule for reboot.": "Nessun percorso in sospeso da pianificare per il riavvio.",
+  "No permanent NFS mounts configured.": "Nessun montaggio NFS permanente configurato.",
+  "No permanent Samba mounts configured.": "Nessun supporto Samba permanente configurato.",
+  "No persistent path found for": "Nessun percorso persistente trovato per",
+  "No physical disks detected for SMART testing.": "Nessun disco fisico rilevato per i test SMART.",
+  "No physical interfaces found": "Nessuna interfaccia fisica trovata",
+  "No ports configured": "Nessuna porta configurata",
+  "No privileged containers available in Proxmox.": "Nessun contenitore privilegiato disponibile in Proxmox.",
+  "No pve-enterprise.list present (skipped)": "Nessun pve-enterprise.list presente (saltato)",
+  "No recent": "Non recente",
+  "No recent Samba servers found.": "Nessun server Samba recente trovato.",
+  "No routing information found.": "Nessuna informazione sul percorso trovata.",
+  "No scheduled backup jobs configured.": "nessun processo di backup pianificato configurato.",
+  "No scheduled backup jobs found.": "Nessun processo di backup pianificato trovato.",
+  "No scripts found for:": "Nessuno script trovato per:",
+  "No self-test history found for": "Nessuna cronologia di autotest trovata per",
+  "No self-test log available for": "Nessun registro di autotest disponibile per",
+  "No server IP or hostname provided.": "Nessun IP del server o nome host fornito.",
+  "No shared mount detected. Applying standard local access.": "Nessun montaggio condiviso rilevato. Applicazione dell'accesso locale standard.",
+  "No shares configured.": "Nessuna condivisione configurata.",
+  "No shares found in smb.conf.": "Nessuna condivisione trovata in smb.conf.",
+  "No shares found on server": "Nessuna condivisione trovata sul server",
+  "No smb.conf file found.": "Nessun file smb.conf trovato.",
+  "No specific LXC action selected": "Nessuna azione LXC specifica selezionata",
+  "No specific VM action selected": "Nessuna azione VM specifica selezionata",
+  "No storage": "Nessun spazio di archiviazione",
+  "No storage volumes available for VM images.": "Nessun volume di archiviazione disponibile per le immagini VM.",
+  "No storage volumes available for disk images.": "Nessun volume di archiviazione disponibile per le immagini disco.",
+  "No stored credentials found.": "Nessuna credenziale memorizzata trovata.",
+  "No suitable disks found.": "Nessun disco adatto trovato.",
+  "No sysfs ROM entry — trying ACPI VFCT table...": "Nessuna voce nella ROM sysfs: provo la tabella ACPI VFCT...",
+  "No target configured.": "No target configured.",
+  "No test currently running": "Nessun test attualmente in corso",
+  "No uninstaller found for:": "Nessun programma di disinstallazione trovato per:",
+  "No unprivileged containers available in Proxmox.": "Nessun contenitore non privilegiato disponibile in Proxmox.",
+  "No updates available — run a scan first or wait for the Monitor to refresh.": "Nessun aggiornamento disponibile: esegui prima una scansione o attendi l'aggiornamento del monitor.",
+  "No updates or failed to fetch templates": "Nessun aggiornamento o impossibile recuperare i modelli",
+  "No user groups found.": "Nessun gruppo utenti trovato.",
+  "No user-created disk storage or fstab mount found.": "Non è stato trovato alcun dispositivo di archiviazione su disco creato dall'utente o montaggio fstab.",
+  "No username provided.": "Nessun nome utente fornito.",
+  "No utilities selected": "Nessuna utilità selezionata",
+  "No utilities were selected": "Nessuna utilità è stata selezionata",
+  "No valid containers found": "Nessun contenitore valido trovato",
+  "No valid mount points found": "Nessun punto di montaggio valido trovato",
+  "No version in this branch is currently supported by keylase/nvidia-patch — the NVENC patch will not reapply after reinstall.": "Nessuna versione in questo ramo è attualmente supportata da keylase/nvidia-patch: la patch NVENC non verrà riapplicata dopo la reinstallazione.",
+  "No virtual machines were found on this host.": "Nessuna macchina virtuale trovata su questo host.",
+  "No write permissions on:": "Nessuna autorizzazione di scrittura su:",
+  "No, keep local only": "No, mantieni solo locale",
+  "No-subscription repository present": "Nessun repository di abbonamento presente",
+  "No: the key stays only at": "No: la chiave rimane solo a",
+  "Non-Debian container detected": "Rilevato contenitore non Debian",
+  "Non-free firmware warnings disabled": "Avvisi firmware non liberi disabilitati",
+  "None": "Nessuno",
+  "Normalizing stable monitor service...": "Normalizzazione del servizio di monitoraggio stabile in corso...",
+  "Not Mounted": "Non montato",
+  "Not all platforms support Controller/NVMe passthrough reliably.": "Non tutte le piattaforme supportano il passthrough Controller/NVMe in modo affidabile.",
+  "Not an OVH server, skipping RTM installation": "Non è un server OVH, salta l'installazione RTM",
+  "Not currently mounted": "Attualmente non montato",
+  "Not currently mounted — skipping umount.": "Attualmente non montato: salta lo smontaggio.",
+  "Not found": "Non trovato",
+  "Not imported:": "Non importato:",
+  "Not mounted": "Non montato",
+  "Not portable:": "Non portatile:",
+  "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "Non registrato come storage Proxmox: utilizzare \"LXC Mount Manager\" per eseguire il bind-mount",
+  "Note: A system reboot will be required after enabling IOMMU.": "Nota: sarà necessario riavviare il sistema dopo aver abilitato IOMMU.",
+  "Note: this only works if the NFS server does NOT use 'all_squash' for root.": "Nota: funziona solo se il server NFS NON utilizza 'all_squash' per root.",
+  "Notes": "Note",
+  "Nothing inside the container is modified": "Niente all'interno del contenitore viene modificato",
+  "Nothing selectable": "Niente selezionabile",
+  "Nothing selected": "Niente selezionato",
+  "Nothing to apply — none of the selected updates have a runnable function on disk.": "Niente da applicare: nessuno degli aggiornamenti selezionati dispone di una funzione eseguibile su disco.",
+  "Nothing to remove": "Niente da rimuovere",
+  "Nothing to restore": "Niente da ripristinare",
+  "Nothing to schedule for reboot from selected paths.": "Niente da pianificare per il riavvio dai percorsi selezionati.",
+  "Nouveau module is loaded, attempting to unload...": "Il modulo Nouveau è caricato, tentativo di scaricamento...",
+  "Number of CPU cores (default: 2)": "Numero di core della CPU (impostazione predefinita: 2)",
+  "OCI containers require Proxmox VE 9.1 or later.": "I contenitori OCI richiedono Proxmox VE 9.1 o versione successiva.",
+  "OK": "OK",
+  "OR add new PVE 9 no-subscription repository:": "OPPURE aggiungi un nuovo repository PVE 9 senza abbonamento:",
+  "OS hint:": "Suggerimento del sistema operativo:",
+  "OS release details": "Dettagli sulla versione del sistema operativo",
+  "OS type  :": "Tipo di sistema operativo:",
+  "OS type:": "Tipo di sistema operativo:",
+  "OS:": "Sistema operativo:",
+  "OVA (single portable file)": "OVA (file portatile singolo)",
+  "OVF (descriptor + VMDK files)": "OVF (descrittore + file VMDK)",
+  "OVF parsed:": "OVF analizzato:",
+  "OVH RTM installed successfully": "OVH RTM installato con successo",
+  "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM rimosso (gli artefatti dei pupazzi potrebbero richiedere una pulizia manuale)",
+  "OVH server detected": "Rilevato server OVH",
+  "OVH server detection and RTM installation process completed": "Processo di rilevamento dei server OVH e installazione RTM completato",
+  "Offer as exit node?": "Offrire come nodo di uscita?",
+  "Official Linux Distributions": "Distribuzioni Linux ufficiali",
+  "Old debian.sources file removed to prevent duplication": "Il vecchio file debian.sources è stato rimosso per evitare duplicazioni",
+  "Old memory configuration detected. Replacing with balanced optimization...": "Rilevata vecchia configurazione di memoria. Sostituzione con ottimizzazione bilanciata...",
+  "Old time services removed successfully": "I vecchi servizi sono stati rimossi con successo",
+  "On a privileged CT the mount options carry the only permissions.": "Su un CT privilegiato le opzioni di montaggio hanno le uniche autorizzazioni.",
+  "On some systems, when starting the VM the host may slow down for several minutes until it stabilizes, or freeze completely.": "Su alcuni sistemi, all'avvio della VM l'host potrebbe rallentare per diversi minuti fino a stabilizzarsi, o bloccarsi completamente.",
+  "On the Borg server, append the following line to:": "Sul server Borg, aggiungi la seguente riga a:",
+  "Once finished, re-run 'PVE 8 to 9 check' to verify that all issues are resolved \n    before executing the PVE 8 → PVE 9 upgrade.": "Una volta terminato, esegui nuovamente il \"controllo PVE da 8 a 9\" per verificare che tutti i problemi siano stati risolti \n    prima di eseguire l'aggiornamento PVE 8 → PVE 9.",
+  "Once finished, re-run the script 'PVE 8 to 9 check' to verify that all issues are resolved \n   before rebooting.": "Una volta terminato, eseguire nuovamente lo script \"PVE 8 to 9 check\" per verificare che tutti i problemi siano stati risolti \n   prima di riavviare.",
+  "Once finished, re-run the script 'PVE 8 to 9 check' to verify that all issues.": "Una volta terminato, eseguire nuovamente lo script \"PVE 8 to 9 check\" per verificare che tutti i problemi siano corretti.",
+  "Once installed, open the VirtIO ISO and run the installer to complete driver setup.": "Una volta installato, apri l'ISO VirtIO ed esegui il programma di installazione per completare la configurazione del driver.",
+  "One or more NVIDIA GPUs are currently configured for VM passthrough (vfio-pci):": "Una o più GPU NVIDIA sono attualmente configurate per il passthrough VM (vfio-pci):",
+  "Only convert to privileged if absolutely necessary for your use case.": "Converti in privilegiato solo se assolutamente necessario per il tuo caso d'uso.",
+  "Only fully free disks are shown (not system-used and not referenced by VM/LXC).": "Vengono visualizzati solo i dischi completamente liberi (non utilizzati dal sistema e non referenziati da VM/LXC).",
+  "Only if using enterprise subscription": "Solo se si utilizza l'abbonamento aziendale",
+  "Only if using no-subscription repository": "Solo se si utilizza un repository senza abbonamento",
+  "Only needed if you mounted the filesystem in step 6b": "Necessario solo se hai montato il filesystem nel passaggio 6b",
+  "Only removes storage definition, not remote data.": "Rimuove solo la definizione di archiviazione, non i dati remoti.",
+  "Only run this if you used LVM (step 6b):": "Eseguilo solo se hai utilizzato LVM (passaggio 6b):",
+  "Only the host backup hook is removed — PVE vzdump jobs targeting this storage stay intact.": "viene rimosso solo l'hook di backup dell'host: i processi PVE vzdump destinati a questo storage rimangono intatti.",
+  "Open": "Aprire",
+  "Open rwx + default inheritance for new files": "Apri rwx + ereditarietà predefinita per i nuovi file",
+  "Open the VM console and wait for the installer to boot": "Apri la console della VM e attendi l'avvio del programma di installazione",
+  "Open the VM console and wait for the loader to boot": "Apri la console della VM e attendi l'avvio del caricatore",
+  "Open the dashboard from this host on port 8008 to create a new admin account.": "Apri la dashboard da questo host sulla porta 8008 per creare un nuovo account amministratore.",
+  "Open the dashboard to create a new admin account:": "Apri la dashboard per creare un nuovo account amministratore:",
+  "OpenVSwitch installation could not be verified": "Impossibile verificare l'installazione di OpenVSwitch",
+  "OpenVSwitch installed successfully": "OpenVSwitch installato correttamente",
+  "OpenVSwitch is ready to use": "OpenVSwitch è pronto per l'uso",
+  "OpenVSwitch removed": "OpenVSwitch rimosso",
+  "Operation": "Operazione",
+  "Operation cancelled by user": "Operazione annullata dall'utente",
+  "Operation cancelled by user to create backup.": "Operazione annullata dall'utente per creare il backup.",
+  "Operation cancelled by user.": "Operazione annullata dall'utente.",
+  "Operation cancelled. Cannot continue with an unprivileged container.": "Operazione annullata. Impossibile continuare con un contenitore senza privilegi.",
+  "Operation log": "Registro delle operazioni",
+  "Operator config re-applied via kernel-agnostic merge": "configurazione dell'operatore riapplicata tramite unione indipendente dal kernel",
+  "Operator config that WILL be re-applied via kernel-agnostic merge": "configurazione dell'operatore che verrà riapplicata tramite unione indipendente dal kernel",
+  "Optimizations detected and ready to revert.": "Ottimizzazioni rilevate e pronte per essere ripristinate.",
+  "Optimize": "Ottimizzare",
+  "Optimize Memory": "ottimizza la memoria",
+  "Optimize ZFS ARC size": "ottimizza le dimensioni ZFS ARC",
+  "Optimize journald": "ottimizza journald",
+  "Optimize logrotate": "ottimizza logrotate",
+  "Optimizing ZFS ARC size according to available memory...": "Ottimizzazione delle dimensioni di ZFS ARC in base alla memoria disponibile...",
+  "Optimizing logrotate configuration...": "Ottimizzazione della configurazione di logrotate...",
+  "Optimizing memory settings...": "Ottimizzazione delle impostazioni della memoria...",
+  "Optimizing network settings...": "Ottimizzazione delle impostazioni di rete...",
+  "Optimizing vzdump backup speed...": "Ottimizzazione della velocità di backup di vzdump in corso...",
+  "Optional": "facoltativo",
+  "Optional GPU Passthrough": "Passthrough GPU opzionale",
+  "Optional safety helper if you ever need to re-apply manually:": "Assistente di sicurezza opzionale se hai bisogno di riapplicare manualmente:",
+  "Optional: Modernize repository sources:": "Facoltativo: modernizzare le origini del repository:",
+  "Optional: apply default ACL so new files inherit permissions:": "Facoltativo: applica l'ACL predefinito in modo che i nuovi file ereditino le autorizzazioni:",
+  "Optional: register this path as Proxmox dir storage:": "Facoltativo: registrare questo percorso come archiviazione della directory Proxmox:",
+  "Optionally remove": "Facoltativamente rimuovere",
+  "Optionally update NVIDIA libs in LXC containers with passthrough": "Facoltativamente, aggiorna le librerie NVIDIA nei contenitori LXC con passthrough",
+  "Options:": "Opzioni:",
+  "Or press CTRL + D": "Oppure premi CTRL + D",
+  "Or re-run this script and accept the 'apply host permissions' prompt.": "Oppure esegui nuovamente questo script e accetta la richiesta \"applica autorizzazioni host\".",
+  "Or use ProxMenux update function": "Oppure usa la funzione di aggiornamento di ProxMenux",
+  "Or, if your terminal can't select text, copy it from:": "oppure, se il tuo terminale non può selezionare il testo, copialo da:",
+  "Original ZFS ARC config restored from .bak": "Configurazione originale di ZFS ARC ripristinata da .bak",
+  "Original bashrc restored": "Bashrc originale restaurato",
+  "Original logrotate configuration restored": "Configurazione logrotate originale ripristinata",
+  "Other Prebuilt Linux VMs": "Altre VM Linux predefinite",
+  "Output archive:": "Archivio di output:",
+  "Owner:": "Proprietario:",
+  "Ownership set to root:sharedfiles with 2775 on:": "Proprietà impostata su root:sharedfiles con 2775 su:",
+  "PAM limits configured": "Limiti PAM configurati",
+  "PBS backup error log": "Registro degli errori del backup PBS",
+  "PBS backup failed.": "Il backup PBS non è riuscito.",
+  "PBS encryption keyfile (show / replace / remove)": "file chiave di crittografia PBS (mostra/sostituisci/rimuovi)",
+  "PBS encryption keyfile — detailed info": "file chiave di crittografia PBS: informazioni dettagliate",
+  "PBS extraction failed": "L'estrazione PBS non è riuscita",
+  "PBS host or IP address:": "Host PBS o indirizzo IP:",
+  "PBS upload": "caricamento PBS",
+  "PCI Address": "Indirizzo PCI",
+  "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "Passthrough PCI, stato TPM, configurazione cloud-init, hook Proxmox",
+  "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "Passthrough PCI, stato TPM, cloud-init, snapshot, hook specifici di Proxmox",
+  "PCI reset method": "Metodo di ripristino PCI",
+  "PCIe GPU passthrough requires:": "Il passthrough GPU PCIe richiede:",
+  "PCIe/M.2 gasket-dkms": "Guarnizione PCIe/M.2-dkms",
+  "POSIX ACLs applied (access + default for inheritance).": "ACL POSIX applicati (accesso + impostazione predefinita per ereditarietà).",
+  "PVE application manager updated": "Gestore applicazioni PVE aggiornato",
+  "PVE cache regenerated": "Cache PVE rigenerata",
+  "PVE host (where the Borg LXC lives)": "host PVE (dove vive il Borg LXC)",
+  "PVE host, VMID and password are all required for this mode.": "host PVE, VMID e password sono tutti richiesti per questa modalità.",
+  "PVE9: udev rules reloaded — new interfaces will get correct names without reboot": "PVE9: regole udev ricaricate: le nuove interfacce riceveranno nomi corretti senza riavvio",
+  "Package Updates Available": "Aggiornamenti del pacchetto disponibili",
+  "Package lists": "Elenchi dei pacchetti",
+  "Package lists updated after GPG fix": "Elenchi dei pacchetti aggiornati dopo la correzione di GPG",
+  "Package lists updated successfully": "Elenchi dei pacchetti aggiornati correttamente",
+  "Package update completed with warnings, continuing...": "Aggiornamento del pacchetto completato con avvisi, continuando...",
+  "Package update had issues, checking details...": "L'aggiornamento del pacchetto presentava problemi, verifica dei dettagli...",
+  "Package update still has issues, continuing anyway...": "L'aggiornamento del pacchetto presenta ancora problemi, continua comunque...",
+  "Packages from backup to install:": "pacchetti dal backup all'installazione:",
+  "Packages upgrade successfull": "Aggiornamento dei pacchetti riuscito",
+  "Packages upgraded": "Pacchetti aggiornati",
+  "Packages:": "Pacchetti:",
+  "Packaging OVA file...": "Confezione del file OVA...",
+  "Packing installer archive...": "Compressione dell'archivio del programma di installazione...",
+  "Parsing OVF descriptor...": "Analisi del descrittore OVF in corso...",
+  "Partial VM removed": "VM parziale rimossa",
+  "Partition": "Partizione",
+  "Partition created": "Partizione creata",
+  "Partition created:": "Partizione creata:",
+  "Partition table wiped": "Tabella delle partizioni cancellata",
+  "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "passphrase utilizzata per sbloccare il file di chiavi importato (lascia vuoto se il file di chiavi non è crittografato / kdf=none):",
+  "Passphrases do not match.": "Le passphrase non corrispondono.",
+  "Passphrases do not match. Try again.": "Le passphrase non corrispondono. Riprova.",
+  "Passthrough may fail depending on hardware/firmware implementation.": "Il passthrough potrebbe non riuscire a seconda dell'implementazione hardware/firmware.",
+  "Passthrough may still work without a ROM file.": "Passthrough potrebbe continuare a funzionare senza un file ROM.",
+  "Passthrough may work, but startup/restart reliability is not guaranteed.": "Il passthrough potrebbe funzionare, ma l'affidabilità di avvio/riavvio non è garantita.",
+  "Password": "Password",
+  "Password Mismatch": "Mancata corrispondenza della password",
+  "Password cannot be empty.": "La password non può essere vuota.",
+  "Password confirmation cannot be empty.": "La conferma della password non può essere vuota.",
+  "Password confirmation is required.": "È richiesta la conferma della password.",
+  "Password for": "Parola d'ordine per",
+  "Password for:": "Password per:",
+  "Password is correct": "La password è corretta",
+  "Password or API token secret:": "Segreto password o token API:",
+  "Password reset completed.": "Reimpostazione della password completata.",
+  "Passwords do not match. Please try again.": "Le password non corrispondono. Per favore riprova.",
+  "Paste the UUP Dump URL here": "Incolla qui l'URL del dump UUP",
+  "Patching source for kernel compatibility...": "Fonte di patch per la compatibilità del kernel...",
+  "Path does not exist.": "Il percorso non esiste.",
+  "Path must be absolute (start with /)": "Il percorso deve essere assoluto (inizia con /)",
+  "Path must be absolute (start with /).": "Il percorso deve essere assoluto (inizia con /).",
+  "Path not found": "Percorso non trovato",
+  "Path:": "Sentiero:",
+  "Paths applied:": "Percorsi applicati:",
+  "Paths included in backup": "Percorsi inclusi nel backup",
+  "Paths not found at backup time": "Percorsi non trovati al momento del backup",
+  "Paths skipped:": "Percorsi saltati:",
+  "Paths to back up:": "Percorsi di cui eseguire il backup:",
+  "Paths:": "Percorsi:",
+  "Pending restore ID:": "ID ripristino in sospeso:",
+  "Pending restore dir:": "Dir ripristino in attesa:",
+  "Pending restore prepared. A reboot is required to complete it.": "Ripristino in attesa preparato. Per completarlo è necessario un riavvio.",
+  "Pending restore prepared. It will run automatically at next boot.": "Ripristino in attesa preparato. Verrà eseguito automaticamente al prossimo avvio.",
+  "Pending restore script not found or not executable:": "Script di ripristino in sospeso non trovato o non eseguibile:",
+  "Pending upgrades detected on a clustered node.\n\nTo proceed safely, update this node to the latest Proxmox VE 8.x before switching to Trixie/PVE 9.\n\nSelect Yes for AUTOMATIC upgrade (recommended), or No for MANUAL instructions.": "Aggiornamenti in sospeso rilevati su un nodo in cluster.\n\nPer procedere in sicurezza, aggiorna questo nodo all'ultimo Proxmox VE 8.x prima di passare a Trixie/PVE 9.\n\nSelezionare Sì per l'aggiornamento AUTOMATICO (consigliato) o No per le istruzioni MANUALI.",
+  "Pending upgrades detected on a clustered node. Perform AUTOMATIC upgrade now? (y = automatic, n = manual):": "Aggiornamenti in sospeso rilevati su un nodo in cluster. Eseguire l'aggiornamento AUTOMATICO adesso? (y = automatico, n = manuale):",
+  "Per official known issues; ensures proper boot after upgrade": "Per problemi noti ufficiali; garantisce un avvio corretto dopo l'aggiornamento",
+  "Performance": "prestazioni",
+  "Performance optimized": "Prestazioni ottimizzate",
+  "Performing complete package reinstallation...": "Esecuzione della reinstallazione completa del pacchetto in corso...",
+  "Performing packages upgrade...": "Esecuzione dell'aggiornamento dei pacchetti in corso...",
+  "Performing system cleanup...": "Esecuzione della pulizia del sistema in corso...",
+  "Performs automatic cleanup after updating": "Esegue la pulizia automatica dopo l'aggiornamento",
+  "Permanent Mount": "Montaggio permanente",
+  "Permanent Mounts (fstab):": "Supporti permanenti (fstab):",
+  "Permanent:": "Permanente:",
+  "Permanently delete saved target:": "Elimina definitivamente il target salvato:",
+  "Permanently delete this archive and its sidecar?": "Eliminare definitivamente questo archivio e il relativo sidecar?",
+  "Permission error": "Errore di autorizzazione",
+  "Permissions:": "Autorizzazioni:",
+  "Persist mount in CT /etc/fstab (optional):": "Persistenza del montaggio in CT /etc/fstab (opzionale):",
+  "Persistent:": "Persistente:",
+  "Physical Function with": "Funzione fisica con",
+  "Physical interface": "Interfaccia fisica",
+  "Physical interfaces available": "Interfacce fisiche disponibili",
+  "Pick PVE vzdump job": "scegli il lavoro PVE vzdump",
+  "Pick USB target": "seleziona la destinazione USB",
+  "Pick Yes to destroy them now (before reboot). Pick No to keep the additive restore and clean up manually later.": "scegli Sì per distruggerli ora (prima del riavvio).Selezionare No per mantenere il ripristino additivo e ripulirlo manualmente in seguito.",
+  "Pick a USB disk:": "Scegli un disco USB:",
+  "Pick a drive to unmount:": "Scegli un'unità da smontare:",
+  "Pick a mounted USB as target": "scegli un USB montato come destinazione",
+  "Pick a target to remove:": "Scegli un target da rimuovere:",
+  "Pick an SSH private key (auto-detected on this host):": "scegli una chiave privata SSH (rilevata automaticamente su questo host):",
+  "Pick an alternative way to authorize the new key:": "scegli un modo alternativo per autorizzare la nuova chiave:",
+  "Please check network connectivity.": "Controlla la connettività di rete.",
+  "Please check permissions and try again.": "Controlla le autorizzazioni e riprova.",
+  "Please check the installation.": "Si prega di verificare l'installazione.",
+  "Please check:": "Si prega di controllare:",
+  "Please choose another path.": "Scegli un altro percorso.",
+  "Please configure it manually and reboot.": "Configuralo manualmente e riavvia.",
+  "Please expand the container disk and run this option again.": "Espandi il disco contenitore ed esegui nuovamente questa opzione.",
+  "Please install the NVIDIA drivers first using the option:": "Installare prima i driver NVIDIA utilizzando l'opzione:",
+  "Please mark at least one option, or press Cancel to exit.": "Seleziona almeno un'opzione o premi Annulla per uscire.",
+  "Please reboot manually and run the passthrough step again.": "Riavviare manualmente ed eseguire nuovamente il passaggio passthrough.",
+  "Please reboot manually to complete the switch.": "Riavviare manualmente per completare il passaggio.",
+  "Please reboot the system manually to complete the GPU switch.": "Riavviare manualmente il sistema per completare il cambio GPU.",
+  "Please reselect GPU(s) and choose only compatible devices for VM mode.": "Riseleziona le GPU e scegli solo i dispositivi compatibili per la modalità VM.",
+  "Please resolve the problem(s) as described above, then re-run the upgrade script.": "Risolvi i problemi come descritto sopra, quindi esegui nuovamente lo script di aggiornamento.",
+  "Please select GPU(s) that are currently in the same mode and try again.": "Seleziona le GPU che sono attualmente nella stessa modalità e riprova.",
+  "Please select a valid option": "Seleziona un'opzione valida",
+  "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Utilizza una sessione SSH (Linux, macOS, Windows/PuTTY) o una console fisica per eseguire l'aggiornamento.",
+  "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "Il pool non sembra utilizzare dispositivi SSD/NVMe con supporto di eliminazione. Saltare l'autotrim ZFS per il pool:",
+  "Pool exists": "La piscina esiste",
+  "Pool name matches but GUID differs (fresh ZFS install):": "il nome del pool corrisponde ma il GUID è diverso (nuova installazione ZFS):",
+  "Pool:": "Piscina:",
+  "Port": "Porta",
+  "Port:": "Porta:",
+  "Portal IP and port are correct": "L'IP e la porta del portale sono corretti",
+  "Portal is reachable": "Il portale è raggiungibile",
+  "Portal:": "Portale:",
+  "Portuguese": "portoghese",
+  "Post-Installation Options": "Opzioni post-installazione",
+  "Post-Installation Scripts": "Script post-installazione",
+  "Postfix configuration": "Configurazione suffissa",
+  "Potential QEMU startup/assertion failures": "Potenziali errori di avvio/asserzione di QEMU",
+  "Power state D3cold/D0 transitions may be inaccessible": "Le transizioni dello stato di alimentazione D3freddo/D0 potrebbero essere inaccessibili",
+  "Pre-check found": "Pre-controllo trovato",
+  "Pre-configure destinations so you don't have to enter them every time you back up.": "Preconfigura le destinazioni in modo da non doverle inserire ogni volta che esegui il backup.",
+  "Pre-existing gasket-dkms package removed.": "Pacchetto guarnizione-dkms preesistente rimosso.",
+  "Pre-restore backup:": "Backup pre-ripristino:",
+  "Pre-upgrade check FAILED: the simulation shows that 'proxmox-ve' would be REMOVED.\n    This indicates a repository or dependency issue and upgrading now could break your Proxmox installation.": "Controllo pre-aggiornamento FALLITO: la simulazione mostra che 'proxmox-ve' verrebbe RIMOSSO.\n    Ciò indica un problema di repository o dipendenza e l'aggiornamento ora potrebbe interrompere l'installazione di Proxmox.",
+  "Pre-upgrade simulation passed: 'proxmox-ve' will be kept or upgraded safely.": "Simulazione pre-aggiornamento superata: 'proxmox-ve' verrà mantenuto o aggiornato in modo sicuro.",
+  "Preparing Log2RAM configuration": "Preparazione della configurazione Log2RAM",
+  "Preparing files for backup...": "Preparazione dei file per il backup...",
+  "Preparing host mount...": "Preparazione del montaggio dell'host in corso...",
+  "Preparing pending restore (network-safe)": "Preparazione del ripristino in sospeso (sicuro per la rete)",
+  "Preparing staging area...": "Preparazione dell'area di sosta...",
+  "Preserving logs to /var/log.hdd before unmounting...": "Conservazione dei log su /var/log.hdd prima dello smontaggio...",
+  "Press 'q' to exit": "Premere 'q' per uscire",
+  "Press Ctrl+C to stop the server and return to menu.": "Premi Ctrl+C per arrestare il server e tornare al menu.",
+  "Press ENTER to continue...": "Premere INVIO per continuare...",
+  "Press ENTER to return to the menu...": "Premere INVIO per tornare al menu...",
+  "Press ENTER to return...": "Premere INVIO per tornare...",
+  "Press Enter to close...": "premi Invio per chiudere...",
+  "Press Enter to continue": "Premere Invio per continuare",
+  "Press Enter to continue...": "Premi Invio per continuare...",
+  "Press Enter to exit and repair": "Premere Invio per uscire e riparare",
+  "Press Enter to exit the script after reading instructions...": "Premi Invio per uscire dallo script dopo aver letto le istruzioni...",
+  "Press Enter to exit...": "Premi Invio per uscire...",
+  "Press Enter to return": "Premere Invio per tornare",
+  "Press Enter to return to menu...": "Premere Invio per tornare al menu...",
+  "Press Enter to return to the main menu...": "Premere Invio per tornare al menu principale...",
+  "Press Enter to return...": "Premi Invio per tornare...",
+  "Press Enter when the line has been pasted on the server...": "premi Invio quando la riga è stata incollata sul server...",
+  "Press OK to see the preview, then confirm": "Premere OK per vedere l'anteprima, quindi confermare",
+  "Pretty uptime format": "Formato piuttosto attivo",
+  "Preview Backup": "Anteprima del backup",
+  "Preview Changes": "Anteprima delle modifiche",
+  "Preview changes (diff)": "Anteprima modifiche (diff)",
+  "Preview: changes that would be applied": "Anteprima: modifiche che verrebbero applicate",
+  "Previous DKMS tree cleared.": "L'albero DKMS precedente è stato cancellato.",
+  "Previous installation cleaned": "Installazione precedente pulita",
+  "Previous installation removed": "Installazione precedente rimossa",
+  "Previous shutdowns": "Arresti precedenti",
+  "Privileged": "Privilegiato",
+  "Privileged Container": "Contenitore privilegiato",
+  "Privileged Container Required": "Contenitore privilegiato obbligatorio",
+  "Privileged container": "Contenitore privilegiato",
+  "Privileged container selected:": "Contenitore privilegiato selezionato:",
+  "Privileged container — UID-shift remapping skipped (not applicable)": "Contenitore privilegiato: rimappatura dello spostamento UID ignorata (non applicabile)",
+  "Privileged container — direct root access": "Contenitore privilegiato: accesso root diretto",
+  "Privileged container — host root maps directly, no permission changes needed": "Contenitore privilegiato: ospita direttamente le mappe root, senza bisogno di modifiche alle autorizzazioni",
+  "Privileged containers can access host devices directly": "I contenitori privilegiati possono accedere direttamente ai dispositivi host",
+  "Privileged containers have full root access to the host system!": "I contenitori privilegiati hanno pieno accesso root al sistema host!",
+  "Privileged: Full host access (less secure)": "Privilegiato: accesso completo all'host (meno sicuro)",
+  "Proceed": "Procedere",
+  "Proceed with removal": "Procedere con la rimozione",
+  "Proceed?": "Procedere?",
+  "Proceeding with Log2RAM setup on non-SSD disk as requested by user.": "Procedere con la configurazione di Log2RAM su disco non SSD come richiesto dall'utente.",
+  "Process may take several minutes depending on container size": "Il processo potrebbe richiedere diversi minuti a seconda delle dimensioni del contenitore",
+  "Process may take several minutes for large containers": "Il processo potrebbe richiedere diversi minuti per i contenitori di grandi dimensioni",
+  "Processes using NVIDIA:": "Processi che utilizzano NVIDIA:",
+  "Profile": "Profilo",
+  "Profile:": "Profilo:",
+  "Proposed Changes": "Modifiche proposte",
+  "Provided by newer version — skipping": "fornito dalla versione più recente: saltato",
+  "ProxMenux Information": "Informazioni su ProxMenux",
+  "ProxMenux Monitor": "Monitor ProxMenux",
+  "ProxMenux Monitor Service Verification": "Verifica del servizio ProxMenux Monitor",
+  "ProxMenux Monitor authentication is not configured on this host — there is no password to reset.": "L'autenticazione ProxMenux Monitor non è configurata su questo host: non è presente alcuna password da reimpostare.",
+  "ProxMenux Monitor filter configured": "Filtro ProxMenux Monitor configurato",
+  "ProxMenux Monitor has been activated.": "ProxMenux Monitor è stato attivato.",
+  "ProxMenux Monitor has been deactivated.": "ProxMenux Monitor è stato disattivato.",
+  "ProxMenux Monitor is not installed": "ProxMenux Monitor non è installato",
+  "ProxMenux Monitor is not installed.": "ProxMenux Monitor non è installato.",
+  "ProxMenux Monitor jail configured": "Jail di ProxMenux Monitor configurato",
+  "ProxMenux Monitor protection": "Protezione del monitor ProxMenux",
+  "ProxMenux Monitor unit repaired and restarted": "Unità monitor ProxMenux riparata e riavviata",
+  "ProxMenux Monitor → Backups tab (live progress card with estimated time, logs, rollback delta)": "ProxMenux Monitor → scheda Backup (scheda di avanzamento in tempo reale con tempo stimato, registri, delta di rollback)",
+  "ProxMenux can apply open permissions on this NFS directory from the host so the container can read and write:": "ProxMenux può applicare autorizzazioni di apertura su questa directory NFS dall'host in modo che il contenitore possa leggere e scrivere:",
+  "ProxMenux can remount it with open permissions so any LXC can read and write.": "ProxMenux può rimontarlo con permessi aperti in modo che qualsiasi LXC possa leggere e scrivere.",
+  "ProxMenux cannot override NFS server-side permissions from the host.": "ProxMenux non può sovrascrivere le autorizzazioni lato server NFS dall'host.",
+  "ProxMenux customizations removed from bashrc": "Personalizzazioni ProxMenux rimosse da bashrc",
+  "ProxMenux does not validate the contents; any keyfile your PBS accepts is accepted here.": "ProxMenux non convalida i contenuti;qualsiasi file di chiavi accettato dal PBS viene accettato qui.",
+  "ProxMenux files:": "File ProxMenux:",
+  "ProxMenux logo applied": "Logo ProxMenux applicato",
+  "ProxMenux only acts as a launcher — once the script starts, control leaves ProxMenux.": "ProxMenux funge solo da launcher: una volta avviato lo script, il controllo lascia ProxMenux.",
+  "ProxMenux saved it locally at:": "ProxMenux lo ha salvato localmente in:",
+  "Proxmology logo applied": "Logo Proxmology applicato",
+  "Proxmox 9 system update allready": "Già l'aggiornamento del sistema Proxmox 9",
+  "Proxmox APT repositories configured": "repository APT Proxmox configurati",
+  "Proxmox Backup Server (PBS) destinations": "Destinazioni Proxmox Backup Server (PBS).",
+  "Proxmox CIFS Storage Status:": "Stato di archiviazione CIFS Proxmox:",
+  "Proxmox NFS Storage Status:": "Stato di archiviazione NFS Proxmox:",
+  "Proxmox System Update": "Aggiornamento del sistema Proxmox",
+  "Proxmox Update": "Aggiornamento Proxmox",
+  "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 system update completed successfully": "L'aggiornamento del sistema Proxmox VE 8 è stato completato con successo",
+  "Proxmox VE 8 to 9 Manual Upgrade Guide": "Guida all'aggiornamento manuale di Proxmox VE da 8 a 9",
+  "Proxmox VE 9.x no-subscription repository created": "Repository senza abbonamento Proxmox VE 9.x creato",
+  "Proxmox VE Helper Scripts": "Script di supporto Proxmox VE",
+  "Proxmox VE configuration completed.": "Configurazione Proxmox VE completata.",
+  "Proxmox auth logger service created and started": "Servizio di registrazione di autenticazione Proxmox creato e avviato",
+  "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "Il repository aziendale Proxmox potrebbe essere mancante o inaccessibile. Tentativo di passare alla modalità senza abbonamento...",
+  "Proxmox filter configured": "Filtro Proxmox configurato",
+  "Proxmox iSCSI Storage Status:": "Stato di archiviazione iSCSI Proxmox:",
+  "Proxmox jail configured": "Jail Proxmox configurato",
+  "Proxmox local storages:": "Archivi locali Proxmox:",
+  "Proxmox repository OK (candidate is 9.x)": "Repository Proxmox OK (il candidato è 9.x)",
+  "Proxmox repository configuration completed": "Configurazione del repository Proxmox completata",
+  "Proxmox repository fixed (no-subscription, candidate is 9.x)": "Repository Proxmox corretto (nessuna sottoscrizione, il candidato è 9.x)",
+  "Proxmox status:": "Stato di Proxmox:",
+  "Proxmox storages:": "Memorie Proxmox:",
+  "Proxmox system repair completed successfully!": "Riparazione del sistema Proxmox completata con successo!",
+  "Proxmox system repair completed with some issues.": "Riparazione del sistema Proxmox completata con alcuni problemi.",
+  "Proxmox system update": "Aggiornamento del sistema Proxmox",
+  "Proxmox web interface protection": "Protezione dell'interfaccia web Proxmox",
+  "Proxmox web interface: Datacenter > Storage > Add > Directory": "Interfaccia web Proxmox: Datacenter > Archiviazione > Aggiungi > Directory",
+  "Proxmox web interface: Datacenter > Storage > Add > NFS": "Interfaccia web Proxmox: Datacenter > Archiviazione > Aggiungi > NFS",
+  "Proxmox web interface: Datacenter > Storage > Add > SMB/CIFS": "Interfaccia web Proxmox: Datacenter > Archiviazione > Aggiungi > SMB/CIFS",
+  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Interfaccia web Proxmox: Datacenter > Archiviazione > Aggiungi > ZFS",
+  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Interfaccia web Proxmox: Datacenter > Archiviazione > Aggiungi > iSCSI",
+  "Pulling latest changes from GitHub...": "Estrazione delle ultime modifiche da GitHub...",
+  "Purging log2ram apt package...": "Eliminazione del pacchetto apt log2ram in corso...",
+  "Quick health check (PASSED / FAILED)": "Controllo rapido dello stato (SUPERATO/FALLITO)",
+  "Quick health status   — overall SMART result + key attributes": "Stato di salute rapido: risultato SMART complessivo + attributi chiave",
+  "RAID Detected": "RAID rilevato",
+  "RAID member detected": "Membro RAID rilevato",
+  "RAM Size": "Dimensioni della RAM",
+  "RAM and swap usage": "Utilizzo della RAM e dello swap",
+  "REPAIR SUMMARY": "SOMMARIO DELLA RIPARAZIONE",
+  "REQUIREMENTS:": "REQUISITI:",
+  "ROM dump not available — configuring without romfile.": "Dump della ROM non disponibile: configurazione senza file rom.",
+  "ROM file used": "File ROM utilizzato",
+  "RPC Bind Service: RUNNING": "Servizio di associazione RPC: IN ESECUZIONE",
+  "RPC Bind Service: STOPPED": "Servizio di associazione RPC: ARRESTATO",
+  "RPC Bind Service: STOPPED - starting...": "Servizio di associazione RPC: ARRESTATO - avvio in corso...",
+  "Re-enter the BORG REPOKEY passphrase to confirm:": "Reinserisci la passphrase BORG REPOKEY per confermare:",
+  "Re-running pre-check after repairs...": "Nuova esecuzione del controllo preliminare dopo la riparazione...",
+  "Reachable": "Raggiungibile",
+  "Read-Only": "Sola lettura",
+  "Read-Only access": "Accesso di sola lettura",
+  "Read-Write (universal)": "Lettura-scrittura (universale)",
+  "Read-Write access": "Accesso in lettura-scrittura",
+  "Read-only": "Sola lettura",
+  "Read-only access (or no write permissions).": "Accesso di sola lettura (o nessuna autorizzazione di scrittura).",
+  "Read-only mount": "Montaggio di sola lettura",
+  "Read/Write (default)": "Lettura/Scrittura (impostazione predefinita)",
+  "Read/write CPU model-specific registers": "Lettura/scrittura registri specifici del modello di CPU",
+  "Readable user table (UID, shell, etc.)": "Tabella utente leggibile (UID, shell, ecc.)",
+  "Reading NVMe SMART data...": "Lettura dei dati NVMe SMART...",
+  "Reading NVMe self-test log...": "Lettura del registro dell'autotest NVMe...",
+  "Reading SMART data...": "Lettura dei dati SMART...",
+  "Reading SMART self-test log...": "Lettura del registro dell'autotest SMART...",
+  "Reading full SMART report...": "Leggendo il rapporto SMART completo...",
+  "Real-time bandwidth usage (press q to exit)": "Utilizzo della larghezza di banda in tempo reale (premi q per uscire)",
+  "Real-time network monitoring (press q to exit)": "Monitoraggio della rete in tempo reale (premi q per uscire)",
+  "Real-time network usage (iftop)": "utilizzo della rete in tempo reale (iftop)",
+  "Reason: Access denied": "Motivo: accesso negato",
+  "Reason: Authentication required": "Motivo: Autenticazione richiesta",
+  "Reason: Permission denied": "Motivo: Autorizzazione negata",
+  "Reboot Recommended": "Riavvio consigliato",
+  "Reboot Required": "Riavvio obbligatorio",
+  "Reboot is required to apply the scheduled restore.": "Per applicare il ripristino pianificato è necessario il riavvio.",
+  "Reboot is required to complete the pending restore.": "È necessario il riavvio per completare il ripristino in sospeso.",
+  "Reboot now?": "Riavviare adesso?",
+  "Reboot pending — changes will take full effect after the next restart.": "Riavvio in sospeso: le modifiche avranno pieno effetto dopo il riavvio successivo.",
+  "Reboot the VM to complete the driver installation.": "Riavviare la VM per completare l'installazione del driver.",
+  "Reboot the system:": "Riavviare il sistema:",
+  "Rebooting the system...": "Riavvio del sistema...",
+  "Rebuilding initramfs to apply nouveau blacklist before installation...": "Ricostruire initramfs per applicare la nuova blacklist prima dell'installazione...",
+  "Recent": "Recente",
+  "Recent Samba Servers": "Server Samba recenti",
+  "Recent Samba server": "Server Samba recente",
+  "Recent logs:": "Registri recenti:",
+  "Recent test results:": "Risultati dei test recenti:",
+  "Recommendation: reformat the disk to ext4 for a robust setup — see docs.": "Raccomandazione: riformattare il disco in ext4 per una configurazione solida: vedere la documentazione.",
+  "Recommendation: start with Complete restore.": "Raccomandazione: iniziare con il ripristino completo.",
+  "Recommendation: use 'Export to file' for these paths and apply manually during a maintenance window.": "Raccomandazione: utilizzare \"Esporta in file\" per questi percorsi e applicarli manualmente durante una finestra di manutenzione.",
+  "Recommended diagnostic commands": "Comandi diagnostici consigliati",
+  "Recommended: Install the QEMU Guest Agent in the VM": "Consigliato: installare l'agente guest QEMU nella VM",
+  "Recommended: run": "Consigliato: corri",
+  "Recommended: schedule these paths for next boot to avoid immediate SSH disconnection.": "Consigliato: pianifica questi percorsi per il prossimo avvio per evitare la disconnessione SSH immediata.",
+  "Recommended: use GPU -> LXC mode for these devices.": "Consigliato: utilizzare GPU -> modalità LXC per questi dispositivi.",
+  "Recommended: use GPU with LXC workloads instead of VM passthrough on this hardware.": "Consigliato: utilizzare la GPU con carichi di lavoro LXC invece del passthrough VM su questo hardware.",
+  "Recover the keyfile using your recovery passphrase?": "Recuperare il file di chiavi utilizzando la passphrase di ripristino?",
+  "Recoverable:": "Recuperabile:",
+  "Recovery blob upload failed — main backup is OK, but keyfile recovery from PBS will not be available for this backup.": "caricamento del BLOB di ripristino non riuscito: il backup principale è OK, ma il ripristino del file di chiavi da PBS non sarà disponibile per questo backup.",
+  "Recovery blob:": "BLOB di ripristino:",
+  "Recovery failed": "Il ripristino non è riuscito",
+  "Recovery passphrase": "Passphrase di ripristino",
+  "Recovery setup failed": "La configurazione del ripristino non è riuscita",
+  "Refresh APT index and verify repositories:": "Aggiorna l'indice APT e verifica i repository:",
+  "Refresh your browser (Ctrl+Shift+R) to see changes": "Aggiorna il browser (Ctrl+Shift+R) per vedere le modifiche",
+  "Refresh your browser to see changes (server restart may be required)": "Aggiorna il browser per vedere le modifiche (potrebbe essere necessario il riavvio del server)",
+  "Refreshing apt cache...": "Aggiornamento della cache di apt in corso...",
+  "Regenerating PVE package cache...": "Rigenerazione della cache dei pacchetti PVE in corso...",
+  "Regenerating boot artifacts for the merged kernel-agnostic changes...": "rigenerazione degli artefatti di avvio per le modifiche unite indipendenti dal kernel...",
+  "Regenerating certificates and restarting services...": "Rigenerazione certificati e riavvio servizi...",
+  "Register mount path in Proxmox:": "Registra il percorso di montaggio in Proxmox:",
+  "Registering disk as Proxmox storage...": "Registrazione del disco come archivio Proxmox in corso...",
+  "Registering module with DKMS...": "Modulo di registrazione con DKMS...",
+  "Reinstall / update Coral drivers": "Reinstallare/aggiornare i driver Coral",
+  "Reinstall Fail2Ban": "Reinstallare Fail2Ban",
+  "Reinstall Lynis": "Reinstallare Lynis",
+  "Reinstall and reconfigure Fail2Ban": "Reinstallare e riconfigurare Fail2Ban",
+  "Reinstall/Update NVIDIA drivers": "Reinstallare/aggiornare i driver NVIDIA",
+  "Reinstalled": "Reinstallato",
+  "Reinstalled Proxmox packages successfully": "Pacchetti Proxmox reinstallati correttamente",
+  "Reinstalling core Proxmox packages...": "Reinstallazione dei pacchetti Proxmox principali in corso...",
+  "Release Channel": "Canale di rilascio",
+  "Release channel set to Beta.": "Canale di rilascio impostato su Beta.",
+  "Release channel set to Stable.": "Canale di rilascio impostato su Stabile.",
+  "Release channel:": "Canale di rilascio:",
+  "Reload Proxmox firewall rules": "Ricarica le regole del firewall Proxmox",
+  "Reload network configuration (ifupdown2)": "Ricarica la configurazione di rete (ifupdown2)",
+  "Remapped Users:": "Utenti rimappati:",
+  "Remapped users:": "Utenti rimappati:",
+  "Reminder: You must install the QEMU Guest Agent inside the Windows VM": "Promemoria: è necessario installare l'agente guest QEMU all'interno della VM Windows",
+  "Remote repository path:": "Percorso del repository remoto:",
+  "Remote server via SSH  (recommended — off-host, dedup across machines)": "Server remoto tramite SSH (consigliato: fuori host, deduplicazione su più computer)",
+  "Remounting CIFS share with open permissions...": "Rimontaggio della condivisione CIFS con autorizzazioni aperte in corso...",
+  "Remove CIFS Mount": "Rimuovere il montaggio CIFS",
+  "Remove CIFS Mount (pvesm or fstab)": "Rimuovere il montaggio CIFS (pvesm o fstab)",
+  "Remove CIFS Storage": "Rimuovere l'archiviazione CIFS",
+  "Remove CIFS fstab Mount": "Rimuovere il supporto CIFS fstab",
+  "Remove CIFS fstab mount:": "Rimuovere il montaggio fstab CIFS:",
+  "Remove CIFS storage:": "Rimuovere l'archiviazione CIFS:",
+  "Remove Disk Storage": "Rimuovere l'archiviazione su disco",
+  "Remove Disk from fstab": "Rimuovi il disco da fstab",
+  "Remove FS labels  — partitions and data preserved": "Rimuovi le etichette FS: partizioni e dati preservati",
+  "Remove FS labels — partitions and data preserved": "Rimuovi le etichette FS: partizioni e dati preservati",
+  "Remove Fail2Ban": "Rimuovere Fail2Ban",
+  "Remove GPU from LXC config (keep Start on boot)": "Rimuovi la GPU dalla configurazione LXC (mantieni Start all'avvio)",
+  "Remove GPU from LXC config + keep Start on boot unchanged": "Rimuovi la GPU dalla configurazione LXC e mantieni invariato l'avvio all'avvio",
+  "Remove GPU from VM config (keep Start on boot)": "Rimuovi la GPU dalla configurazione della VM (mantieni Start all'avvio)",
+  "Remove GPU from source VM config (keep Start on boot)": "Rimuovi la GPU dalla configurazione della VM di origine (mantieni Start all'avvio)",
+  "Remove GPU from source VM config + keep Start on boot unchanged": "Rimuovi la GPU dalla configurazione della VM di origine e mantieni invariato l'avvio all'avvio",
+  "Remove LXC Mount Point": "Rimuovere il punto di montaggio LXC",
+  "Remove Lynis": "Rimuovi Lynis",
+  "Remove Mount Point": "Rimuovi punto di montaggio",
+  "Remove Mount Point Confirmation:": "Conferma rimozione punto di montaggio:",
+  "Remove NFS Mount": "Rimuovi il montaggio NFS",
+  "Remove NFS Mount (pvesm or fstab)": "Rimuovere il montaggio NFS (pvesm o fstab)",
+  "Remove NFS Storage": "Rimuovere l'archiviazione NFS",
+  "Remove NFS fstab Mount": "Rimuovere il supporto NFS fstab",
+  "Remove NFS fstab mount:": "Rimuovere il montaggio fstab NFS:",
+  "Remove NFS storage:": "Rimuovere l'archiviazione NFS:",
+  "Remove Proxmox CIFS storage:": "Rimuovere lo storage CIFS Proxmox:",
+  "Remove Proxmox NFS storage:": "Rimuovere lo spazio di archiviazione NFS Proxmox:",
+  "Remove Proxmox iSCSI storage:": "Rimuovere lo spazio di archiviazione iSCSI Proxmox:",
+  "Remove Secure Gateway? State will be preserved.": "Rimuovere il gateway sicuro? Lo Stato sarà preservato.",
+  "Remove custom paths": "Rimuovi percorsi personalizzati",
+  "Remove disk references from affected VM(s)/CT(s) config": "Rimuovere i riferimenti al disco dalla configurazione delle VM/CT interessate",
+  "Remove iSCSI Storage": "Rimuovere l'archiviazione iSCSI",
+  "Remove iSCSI storage definition:": "Rimuovere la definizione di archiviazione iSCSI:",
+  "Remove invalid port": "Rimuovi la porta non valida",
+  "Remove invalid port(s)": "Rimuovi le porte non valide",
+  "Remove keyfile from this host": "rimuovi il file di chiavi da questo host",
+  "Remove mount point:": "Rimuovi punto di montaggio:",
+  "Remove obsolete systemd-boot meta-package": "Rimuovi il metapacchetto systemd-boot obsoleto",
+  "Remove old repository files:": "Rimuovi i vecchi file del repository:",
+  "Remove passthrough device from VM": "Rimuovere il dispositivo passthrough dalla VM",
+  "Remove subscription banner": "rimuovi il banner di abbonamento",
+  "Remove the unprivileged flag from configuration:": "Rimuovi il flag senza privilegi dalla configurazione:",
+  "Remove unused packages and their config": "Rimuovi i pacchetti non utilizzati e la loro configurazione",
+  "Removed": "RIMOSSO",
+  "Removed KVM MSR options from configuration": "Rimosse le opzioni KVM MSR dalla configurazione",
+  "Removed Mount:": "Supporto rimosso:",
+  "Removed all .link files from": "Rimossi tutti i file .link da",
+  "Removed bwlimit/ionice tuning (no .bak found)": "Rimosso il tuning bwlimit/ionice (nessun .bak trovato)",
+  "Removed configurations for": "Configurazioni rimosse per",
+  "Removed credentials file:": "File delle credenziali rimosso:",
+  "Removed empty KVM configuration file": "Rimosso il file di configurazione KVM vuoto",
+  "Removed empty mount directory:": "Rimossa la directory di montaggio vuota:",
+  "Removed entry from /etc/fstab": "Voce rimossa da /etc/fstab",
+  "Removed from /etc/fstab": "Rimosso da /etc/fstab",
+  "Removed from /etc/fstab.": "Rimosso da /etc/fstab.",
+  "Removed idle=nomwait from /etc/kernel/cmdline (ZFS)": "Rimosso idle=nomwait da /etc/kernel/cmdline (ZFS)",
+  "Removed idle=nomwait from GRUB configuration": "Rimosso idle=nomwait dalla configurazione di GRUB",
+  "Removed remapped user:": "Utente rimappato rimosso:",
+  "Removed sharedfiles group.": "Gruppo file condivisi rimosso.",
+  "Removed:": "RIMOSSO:",
+  "Removing APT IPv4 configuration...": "Rimozione della configurazione IPv4 APT in corso...",
+  "Removing Coral packages...": "Rimozione dei pacchetti Coral...",
+  "Removing Fail2Ban...": "Rimozione di Fail2Ban...",
+  "Removing GPU from VM": "Rimozione della GPU dalla VM",
+  "Removing Lynis...": "Rimozione di Lynis...",
+  "Removing NVIDIA DKMS entries...": "Rimozione delle voci NVIDIA DKMS in corso...",
+  "Removing NVIDIA packages...": "Rimozione dei pacchetti NVIDIA...",
+  "Removing OVH RTM...": "Rimozione dell'RTM OVH...",
+  "Removing OpenVSwitch...": "Rimozione di OpenVSwitch...",
+  "Removing VFIO ownership for selected GPU(s)...": "Rimozione della proprietà VFIO per le GPU selezionate in corso...",
+  "Removing all .link files from": "Rimozione di tutti i file .link da",
+  "Removing any pre-existing gasket-dkms package...": "Rimozione dell'eventuale pacchetto guarnizioni-dkms preesistente...",
+  "Removing conflicting utilities...": "Rimozione delle utilità in conflitto...",
+  "Removing entropy generation optimization...": "Rimozione dell'ottimizzazione della generazione di entropia in corso...",
+  "Removing filesystem signatures...": "Rimozione delle firme del file system in corso...",
+  "Removing from /etc/fstab...": "Rimozione da /etc/fstab...",
+  "Removing gasket DKMS modules...": "Rimozione della guarnizione dei moduli DKMS...",
+  "Removing gateway...": "Rimozione del gateway...",
+  "Removing guest agent...": "Rimozione dell'agente ospite in corso...",
+  "Removing invalid configurations...": "Rimozione delle configurazioni non valide...",
+  "Removing invalid existing file...": "Rimozione del file esistente non valido...",
+  "Removing kernel panic configuration...": "Rimozione della configurazione Kernel Panic in corso...",
+  "Removing memory optimizations...": "Rimozione delle ottimizzazioni della memoria in corso…",
+  "Removing mount point": "Rimozione del punto di montaggio",
+  "Removing network optimizations...": "Rimozione delle ottimizzazioni di rete in corso...",
+  "Removing no longer required packages and purging old cached updates...": "Rimozione dei pacchetti non più necessari ed eliminazione dei vecchi aggiornamenti memorizzati nella cache...",
+  "Removing partial VM": "Rimozione della VM parziale",
+  "Removing previous DKMS source tree...": "Rimozione dell'albero dei sorgenti DKMS precedente...",
+  "Removing previous Lynis installation...": "Rimozione dell'installazione precedente di Lynis in corso...",
+  "Removing remapped users...": "Rimozione degli utenti rimappati in corso...",
+  "Removing storage from Proxmox...": "Rimozione dello spazio di archiviazione da Proxmox in corso...",
+  "Removing system limits optimizations...": "Rimozione delle ottimizzazioni dei limiti di sistema...",
+  "Removing zfs-auto-snapshot...": "Rimozione dell'istantanea automatica zfs in corso...",
+  "Renamed": "rinominato",
+  "Renamed NIC:": "NIC rinominato:",
+  "Repair Complete": "Riparazione completata",
+  "Repair Options:": "Opzioni di riparazione:",
+  "Repairs and optimizes repositories": "Ripara e ottimizza i repository",
+  "Replace": "Sostituire",
+  "Replace <container-id> with the actual ID.": "Sostituisci <container-id> con l'ID effettivo.",
+  "Replace <container-id> with your actual container ID": "Sostituisci <container-id> con il tuo ID contenitore effettivo",
+  "Replace <storage-identifier> with the value from step 4": "Sostituisci <storage-identifier> con il valore del passaggio 4",
+  "Replace invalid port(s)": "Sostituisci le porte non valide",
+  "Replace it?": "Sostituirlo?",
+  "Replace paths with your actual values from step 5": "Sostituisci i percorsi con i valori effettivi del passaggio 5",
+  "Replace with your actual path from step 5": "Sostituisci con il percorso effettivo del passaggio 5",
+  "Replacing gzip with pigz wrapper...": "Sostituzione di gzip con wrapper pigz...",
+  "Repositories switched to no-subscription": "I repository sono passati alla modalità senza abbonamento",
+  "Repository ready.": "Archivio pronto.",
+  "Repository:": "Deposito:",
+  "Require reboot": "Richiede il riavvio",
+  "Required command not found:": "Comando richiesto non trovato:",
+  "Required if using a VirtIO or SCSI disk.": "Necessario se si utilizza un disco VirtIO o SCSI.",
+  "Required install helpers not available.": "Assistenti di installazione richiesti non disponibili.",
+  "Requires acl package. Skip if setfacl is not available.": "Richiede il pacchetto ACL. Salta se setfacl non è disponibile.",
+  "Requires authentication": "Richiede l'autenticazione",
+  "Reset Capability Blocked": "Funzionalità di ripristino bloccata",
+  "Reset Capability Warning": "Reimposta avviso capacità",
+  "Reset Monitor Password": "Reimposta la password del monitor",
+  "Reset ProxMenux Monitor Password": "Reimposta la password del monitor ProxMenux",
+  "Reset current storage selection": "Reimposta la selezione di archiviazione corrente",
+  "Resetting time synchronization...": "Reimpostazione della sincronizzazione dell'ora...",
+  "Residual Bookworm entries commented where applicable": "Voci residue dei Bookworm commentate dove applicabile",
+  "Resolve package conflicts": "Risolvere i conflitti tra pacchetti",
+  "Restart Network": "Riavvia la rete",
+  "Restart Network Service": "Riavviare il servizio di rete",
+  "Restart Web UI proxy": "Riavviare il proxy dell'interfaccia utente Web",
+  "Restart and enable Samba:": "Riavvia e abilita Samba:",
+  "Restart container to activate mount?": "Riavviare il contenitore per attivare il montaggio?",
+  "Restarting ProxMenux Monitor service...": "Riavvio del servizio ProxMenux Monitor in corso...",
+  "Restarting Proxmox services...": "Riavvio dei servizi Proxmox...",
+  "Restarting container...": "Riavvio del contenitore...",
+  "Restarting gateway...": "Riavvio del gateway...",
+  "Restarting network service...": "Riavvio del servizio di rete...",
+  "Restarting the server...": "Riavvio del server...",
+  "Restore Backup": "Ripristina backup",
+  "Restore Network Backup": "Ripristina backup di rete",
+  "Restore a CT from backup": "Ripristina un CT dal backup",
+  "Restore a VM from backup": "Ripristina una VM dal backup",
+  "Restore actions": "Azioni di ripristino",
+  "Restore applied:": "Ripristino applicato:",
+  "Restore can now proceed.": "Il ripristino può ora procedere.",
+  "Restore failed": "Ripristino non riuscito",
+  "Restore from Borg  →  staging": "Ripristina da Borg → staging",
+  "Restore from Borg repository": "Ripristina dal repository Borg",
+  "Restore from PBS  →  staging": "Ripristino da PBS → staging",
+  "Restore from Proxmox Backup Server (PBS)": "Ripristino da Proxmox Backup Server (PBS)",
+  "Restore from local archive  (.tar.gz / .tar.zst)": "Ripristina dall'archivio locale (.tar.gz / .tar.zst)",
+  "Restore from local archive  →  staging": "Ripristino da archivio locale → staging",
+  "Restore host configuration": "Ripristina la configurazione dell'host",
+  "Restore it ONLY if the target host has the same pools and disks as the source. Otherwise Proxmox may try to import non-existent pools at next boot.": "Ripristinarlo SOLO se l'host di destinazione ha gli stessi pool e dischi dell'origine. Altrimenti Proxmox potrebbe tentare di importare pool inesistenti al prossimo avvio.",
+  "Restore plan": "Ripristina il piano",
+  "Restore plan summary": "Ripristina il riepilogo del piano",
+  "Restore source location": "Ripristina la posizione di origine",
+  "Restored config is on disk; reboot the host to apply.": "La configurazione ripristinata è su disco; riavviare l'host per applicare.",
+  "Restored original /bin/gzip": "/bin/gzip originale ripristinato",
+  "Restored original /etc/vzdump.conf from .bak": "/etc/vzdump.conf originale ripristinato da .bak",
+  "Restoring APT language downloads...": "Ripristino dei download della lingua APT in corso...",
+  "Restoring container memory to": "Ripristino della memoria del contenitore in",
+  "Restoring default journald configuration...": "Ripristino della configurazione journald predefinita in corso...",
+  "Restoring enterprise repositories...": "Ripristino dei repository aziendali...",
+  "Restoring guest configs (LXC + QEMU)...": "Ripristino delle configurazioni guest (LXC + QEMU) in corso...",
+  "Restoring original bashrc...": "Ripristino bashrc originale...",
+  "Restoring original logrotate configuration...": "Ripristino della configurazione originale di logrotate...",
+  "Restoring subscription banner...": "Ripristino del banner di abbonamento in corso...",
+  "Results will be saved automatically to:": "I risultati verranno salvati automaticamente in:",
+  "Results will be saved to:": "I risultati verranno salvati in:",
+  "Retention": "Conservazione",
+  "Return": "Ritorno",
+  "Return to Main Menu": "Ritorna al menu principale",
+  "Return to Share Menu": "Torna al menu Condividi",
+  "Return to main menu": "Ritorna al menu principale",
+  "Reused the encryption key from the PVE storage entry.": "riutilizzata la chiave di crittografia dalla voce di archiviazione PVE.",
+  "Reverting AMD (Ryzen/EPYC) fixes...": "Ripristino delle correzioni AMD (Ryzen/EPYC)...",
+  "Reverting IOMMU/VFIO configuration...": "Ripristino della configurazione IOMMU/VFIO...",
+  "Reverting TCP BBR + Fast Open...": "Ripristino TCP BBR + Apertura rapida...",
+  "Reverting ZFS ARC tuning...": "Ripristino della sintonizzazione ZFS ARC...",
+  "Reverting pigz wrapper...": "Ripristino dell'involucro del maiale...",
+  "Reverting vzdump speed tuning...": "Ripristino della regolazione della velocità di vzdump in corso...",
+  "Review passthrough config files": "Esaminare i file di configurazione passthrough",
+  "Review what will be removed": "Controlla cosa verrà rimosso",
+  "Rollback: nothing to remove (host matches backup)": "Rollback: niente da rimuovere (l'host corrisponde al backup)",
+  "Root SSH keys/config": "Chiavi/config. SSH root",
+  "Root inside container = root on host system": "Root all'interno del contenitore = root sul sistema host",
+  "Root shell/profile config": "Configurazione della shell/profilo root",
+  "Root user on the PVE host (default 'root'):": "Utente root sull'host PVE (default 'root'):",
+  "Rotate the recovery passphrase": "ruota la passphrase di ripristino",
+  "Routing Information": "Informazioni sul percorso",
+  "Routing Table": "Tabella di instradamento",
+  "Run 'Mount NFS Share' to install NFS client automatically.": "Eseguire \"Monta condivisione NFS\" per installare automaticamente il client NFS.",
+  "Run 'Mount Samba Share' to install CIFS client automatically.": "Eseguire 'Mount Samba Share' per installare automaticamente il client CIFS.",
+  "Run PVE 8 to 9": "Esegui PVE da 8 a 9",
+  "Run PVE 8 to 9 check": "Esegui il controllo PVE da 8 a 9",
+  "Run \\\"Install NVIDIA Drivers on Host\\\" first so the installer is cached.": "Eseguire prima \\\"Installa driver NVIDIA sull'host\\\" in modo che il programma di installazione venga memorizzato nella cache.",
+  "Run a full security audit": "Esegui un controllo di sicurezza completo",
+  "Run a job now": "Esegui un lavoro adesso",
+  "Run as server or client? [s/c]:": "Eseguire come server o client? [s/c]:",
+  "Run checklist again to verify upgrade:": "Esegui nuovamente l'elenco di controllo per verificare l'aggiornamento:",
+  "Run from console, or SSH inside tmux/screen": "Esegui dalla console o SSH all'interno di tmux/screen",
+  "Run job now": "Esegui il lavoro adesso",
+  "Run mode selected: Automatic": "Modalità di esecuzione selezionata: Automatica",
+  "Run mode selected: Automatic/Unattended": "Modalità di esecuzione selezionata: automatica/non presidiata",
+  "Run mode selected: Interactive": "Modalità di esecuzione selezionata: interattiva",
+  "Run mode: Unattended": "Modalità di esecuzione: automatica",
+  "Run security audit now": "Esegui subito il controllo di sicurezza",
+  "Run the following inside the VM:": "Esegui quanto segue all'interno della VM:",
+  "Run upgrade checklist script:": "Esegui lo script dell'elenco di controllo dell'aggiornamento:",
+  "Running": "Corsa",
+  "Running Lynis security audit...": "Esecuzione del controllo di sicurezza di Lynis in corso...",
+  "Running NVIDIA installer in container. This may take several minutes...": "Esecuzione del programma di installazione NVIDIA nel contenitore. L'operazione potrebbe richiedere diversi minuti...",
+  "Running NVIDIA uninstaller...": "Esecuzione del programma di disinstallazione NVIDIA...",
+  "Running VM detected": "Rilevata VM in esecuzione",
+  "Running backup job:": "Esecuzione del processo di backup:",
+  "Running containers detected": "Contenitori in esecuzione rilevati",
+  "Running pre-upgrade simulation to verify 'proxmox-ve' will remain installed...": "Esecuzione della simulazione pre-aggiornamento per verificare che 'proxmox-ve' rimanga installato...",
+  "SATA   (standard - high compatibility)": "SATA (standard - alta compatibilità)",
+  "SCSI   (recommended for Linux and Windows)": "SCSI (consigliato per Linux e Windows)",
+  "SCSI   (recommended for Linux)": "SCSI (consigliato per Linux)",
+  "SECURITY CONSIDERATIONS:": "CONSIDERAZIONI SULLA SICUREZZA:",
+  "SECURITY WARNING:": "AVVISO DI SICUREZZA:",
+  "SMART Action": "Azione INTELLIGENTE",
+  "SMART Disk Health & Test": "Integrità e test del disco SMART",
+  "SMART health status: PASSED": "Stato di salute SMART: SUPERATO",
+  "SMB Client Error": "Errore client PMI",
+  "SMB Client Tools: AVAILABLE": "Strumenti client PMI: DISPONIBILI",
+  "SMB Client Tools: NOT AVAILABLE": "Strumenti client PMI: NON DISPONIBILE",
+  "SMB Error": "Errore SMB",
+  "SMB port 445:": "Porta PMI 445:",
+  "SMB ports:": "Porte PMI:",
+  "SR-IOV Configuration Detected": "Rilevata configurazione SR-IOV",
+  "SSD Emulation": "Emulazione SSD",
+  "SSH access (host + root)": "Accesso SSH (host + root)",
+  "SSH auth logger service created and started": "Servizio di registrazione di autenticazione SSH creato e avviato",
+  "SSH hardening: MaxAuthTries set to 3 (Lynis recommendation)": "Rafforzamento SSH: MaxAuthTries impostato su 3 (consiglio Lynis)",
+  "SSH host or IP:": "Host o IP SSH:",
+  "SSH key strategy": "Strategia chiave SSH",
+  "SSH login failed": "accesso SSH non riuscito",
+  "SSH network risk": "Rischio della rete SSH",
+  "SSH password auth refused on server": "autenticazione password SSH rifiutata sul server",
+  "SSH protection (aggressive mode)": "Protezione SSH (modalità aggressiva)",
+  "STEP 6: Choose commands based on your storage type": "PASSO 6: Scegli i comandi in base al tipo di archiviazione",
+  "STEP 9: Cleanup (LVM only)": "PASSO 9: Pulizia (solo LVM)",
+  "STORAGE TYPE IDENTIFICATION:": "IDENTIFICAZIONE DEL TIPO DI STOCCAGGIO:",
+  "SUGGESTION FOR": "CONSIGLIO PER",
+  "Safe design: no automatic ACL/ownership mutation on host or CT.": "Progettazione sicura: nessuna mutazione automatica dell'ACL/della proprietà sull'host o sul CT.",
+  "Safe to apply now": "Sicuro da applicare ora",
+  "Safety Backup": "Backup di sicurezza",
+  "Safety backup created": "Backup di sicurezza creato",
+  "Safety check failed: selected disk is now used by host/system.": "Controllo di sicurezza fallito: il disco selezionato è ora utilizzato dall'host/sistema.",
+  "Safety check failed: selected disk is referenced by a VM/LXC config.": "Controllo di sicurezza non riuscito: al disco selezionato fa riferimento una configurazione VM/LXC.",
+  "Samba Client Manager - CT": "Gestore clienti Samba - CT",
+  "Samba Client in LXC (Privileged)": "Client Samba in LXC (privilegiato)",
+  "Samba Client in LXC (privileged)": "Client Samba in LXC (privilegiato)",
+  "Samba Credentials": "Credenziali Samba",
+  "Samba Host Manager - Proxmox Host": "Gestore host Samba - Host Proxmox",
+  "Samba LXC Manager": "Responsabile Samba LXC",
+  "Samba Manager - CT": "Responsabile Samba - CT",
+  "Samba Not Installed": "Samba non installato",
+  "Samba Password": "Parola d'ordine di Samba",
+  "Samba Server": "Server Samba",
+  "Samba Server Selection": "Selezione del server Samba",
+  "Samba Server in LXC (Privileged)": "Server Samba in LXC (privilegiato)",
+  "Samba Server in LXC (privileged)": "Server Samba in LXC (privilegiato)",
+  "Samba Server: INSTALLED": "Server Samba: INSTALLATO",
+  "Samba Server: NOT INSTALLED": "Server Samba: NON INSTALLATO",
+  "Samba Service Status in CT": "Stato del servizio Samba in CT",
+  "Samba Service: RUNNING": "Servizio Samba: CORRENTE",
+  "Samba Service: STOPPED": "Servizio Samba: INTERROTTO",
+  "Samba User": "Utente Samba",
+  "Samba Username": "Nome utente Samba",
+  "Samba client tools installed": "Strumenti client Samba installati",
+  "Samba configuration backed up.": "Backup della configurazione di Samba.",
+  "Samba group kept (has users assigned).": "Gruppo Samba mantenuto (ha utenti assegnati).",
+  "Samba group removed.": "Gruppo Samba rimosso.",
+  "Samba packages removed.": "Pacchetti Samba rimossi.",
+  "Samba server has been completely uninstalled!": "Il server Samba è stato completamente disinstallato!",
+  "Samba server installed successfully.": "Server Samba installato correttamente.",
+  "Samba server is already installed.": "Il server Samba è già installato.",
+  "Samba server is not installed in this CT.": "Il server Samba non è installato in questo CT.",
+  "Samba server is running": "Il server Samba è in esecuzione",
+  "Samba servers detected": "Rilevati server Samba",
+  "Samba services stopped and disabled.": "I servizi Samba sono stati interrotti e disabilitati.",
+  "Samba share": "Condivisione di samba",
+  "Samba share created successfully!": "Condivisione Samba creata con successo!",
+  "Samba share mounted successfully!": "Condivisione Samba montata con successo!",
+  "Samba share unmount successfully. Reboot LXC required to take effect.": "Smontaggio della condivisione Samba riuscito. Per avere effetto è necessario riavviare LXC.",
+  "Samba users removed.": "Utenti Samba rimossi.",
+  "Samba users:": "Utenti Samba:",
+  "Samba/CIFS Client Status in CT": "Stato del client Samba/CIFS in CT",
+  "Samba/CIFS client installed successfully.": "Client Samba/CIFS installato correttamente.",
+  "Samba/CIFS mounts in CT": "Samba/CIFS si monta in CT",
+  "Samba/NFS clients will likely receive 'permission denied'. Review the steps above.": "I client Samba/NFS riceveranno probabilmente \"permesso negato\". Rivedi i passaggi precedenti.",
+  "Same Version Detected": "Stessa versione rilevata",
+  "Same host:": "Stesso ospite:",
+  "Same major series:": "Stessa serie principale:",
+  "Same major.minor:": "Stesso major.minor:",
+  "Sanitizing NVIDIA host services for VFIO mode...": "Disinfezione dei servizi host NVIDIA per la modalità VFIO in corso...",
+  "Save the passphrase somewhere safe NOW, before continuing.": "salva la passphrase in un posto sicuro ORA, prima di continuare.",
+  "Save this Borg target so you don't need to enter the details again?": "Salvare questo target Borg in modo da non dover inserire nuovamente i dettagli?",
+  "Scan storage for new content": "Scansione dello spazio di archiviazione per nuovi contenuti",
+  "Scanning available physical disks...": "Scansione dei dischi fisici disponibili...",
+  "Scanning network for NFS servers...": "Scansione della rete per server NFS...",
+  "Scanning network for Samba servers...": "Scansione della rete per i server Samba...",
+  "Schedule": "Programma",
+  "Schedule:": "Programma:",
+  "Scheduled backup job created": "Processo di backup pianificato creato",
+  "Scheduled backup jobs": "Lavori di backup pianificati",
+  "Scheduled backups and retention policies": "Backup pianificati e policy di conservazione",
+  "Scheduled tasks (cron)": "Attività pianificate (cron)",
+  "Scheduler script not found:": "Script dello scheduler non trovato:",
+  "Script Information": "Informazioni sulla sceneggiatura",
+  "Script not found:": "Script non trovato:",
+  "Scripts in": "Script dentro",
+  "Search Results for:": "Risultati della ricerca per:",
+  "Search/Filter Scripts": "Script di ricerca/filtro",
+  "Secure Disk Formatter": "Formattatore di dischi sicuro",
+  "Secure Gateway (Tailscale VPN)": "Gateway sicuro (VPN Tailscale)",
+  "Secure Gateway deployed successfully!": "Secure Gateway distribuito con successo!",
+  "Secure Gateway is already installed.": "Secure Gateway è già installato.",
+  "Security": "Sicurezza",
+  "Security Updates": "Aggiornamenti di sicurezza",
+  "Security Warning — read before applying": "Avviso di sicurezza: leggere prima di presentare domanda",
+  "See": "vedi",
+  "See /tmp/proxmenux-mount.log for details.": "Vedi /tmp/proxmenux-mount.log per i dettagli.",
+  "Select": "Selezionare",
+  "Select Borg target": "Seleziona il bersaglio Borg",
+  "Select CPU model": "Seleziona il modello della CPU",
+  "Select CT": "Seleziona CT",
+  "Select CT for destination disk": "Seleziona CT per il disco di destinazione",
+  "Select Disk": "Seleziona Disco",
+  "Select Disk Images": "Seleziona Immagini disco",
+  "Select Disk Interface": "Seleziona Interfaccia disco",
+  "Select Disks": "Seleziona Dischi",
+  "Select Existing Folder": "Seleziona Cartella esistente",
+  "Select Filesystem": "Seleziona File system",
+  "Select Folder": "Seleziona Cartella",
+  "Select GPU for VM Passthrough": "Seleziona GPU per Passthrough VM",
+  "Select GPU(s)": "Seleziona GPU",
+  "Select Host Directory": "Seleziona Directory host",
+  "Select Host Folder": "Seleziona Cartella host",
+  "Select LXC Container": "Seleziona contenitore LXC",
+  "Select Mount Point": "Seleziona punto di montaggio",
+  "Select Mount Point to Remove": "Seleziona il punto di montaggio da rimuovere",
+  "Select NFS Export": "Seleziona Esportazione NFS",
+  "Select NFS Server": "Seleziona Server NFS",
+  "Select OVA/OVF file": "Seleziona il file OVA/OVF",
+  "Select PBS repository": "Seleziona archivio PBS",
+  "Select Privileged Container": "Seleziona Contenitore privilegiato",
+  "Select SSH private key": "seleziona la chiave privata SSH",
+  "Select SSH private key file": "Seleziona il file della chiave privata SSH",
+  "Select Samba Server": "Seleziona Server Samba",
+  "Select Samba Share": "Seleziona Condividi Samba",
+  "Select Shared Directory Location": "Seleziona Posizione directory condivisa",
+  "Select Storage": "Seleziona Archiviazione",
+  "Select Storage Volume": "Seleziona Volume di archiviazione",
+  "Select System Type": "Seleziona Tipo di sistema",
+  "Select Unprivileged Container": "Seleziona Contenitore senza privilegi",
+  "Select VM": "Seleziona macchina virtuale",
+  "Select VM to export:": "Seleziona la VM da esportare:",
+  "Select Virtual Machine": "Seleziona Macchina virtuale",
+  "Select a Custom Logo": "Seleziona un logo personalizzato",
+  "Select a VirtIO ISO to use:": "Seleziona un ISO VirtIO da utilizzare:",
+  "Select a category of useful commands:": "Seleziona una categoria di comandi utili:",
+  "Select a category or search for scripts:": "Seleziona una categoria o cerca gli script:",
+  "Select a custom ISO to use:": "Seleziona un ISO personalizzato da utilizzare:",
+  "Select a job:": "Seleziona un lavoro:",
+  "Select a network management option:": "Seleziona un'opzione di gestione della rete:",
+  "Select a new language for the menu:": "Seleziona una nuova lingua per il menu:",
+  "Select a post-installation script:": "Seleziona uno script post-installazione:",
+  "Select a pre-configured Linux VM script to execute:": "Seleziona uno script VM Linux preconfigurato da eseguire:",
+  "Select a script or action:": "Seleziona uno script o un'azione:",
+  "Select a share to delete:": "Seleziona una condivisione da eliminare:",
+  "Select access mode": "Seleziona la modalità di accesso",
+  "Select an existing group": "Seleziona un gruppo esistente",
+  "Select an existing group:": "Seleziona un gruppo esistente:",
+  "Select an export to delete:": "Seleziona un'esportazione da eliminare:",
+  "Select an option": "Seleziona un'opzione",
+  "Select an option:": "Seleziona un'opzione:",
+  "Select another source path and try again.": "Seleziona un altro percorso di origine e riprova.",
+  "Select archive": "Seleziona archivio",
+  "Select archive to restore": "Seleziona l'archivio da ripristinare",
+  "Select at least one path to continue.": "seleziona almeno un percorso per continuare.",
+  "Select authentication mode:": "Seleziona la modalità di autenticazione:",
+  "Select authentication type:": "Seleziona il tipo di autenticazione:",
+  "Select available Controllers/NVMe to add:": "Seleziona i controller/NVMe disponibili da aggiungere:",
+  "Select backup archive": "Seleziona l'archivio di backup",
+  "Select backup archive to restore": "Seleziona l'archivio di backup da ripristinare",
+  "Select backup backend:": "Seleziona il backend di backup:",
+  "Select backup method and profile:": "Seleziona il metodo e il profilo di backup:",
+  "Select backup profile:": "Seleziona il profilo di backup:",
+  "Select backup to restore": "seleziona il backup da ripristinare",
+  "Select backup to restore:": "Seleziona il backup da ripristinare:",
+  "Select bridge for network interface(s):": "Seleziona il bridge per le interfacce di rete:",
+  "Select container:": "Seleziona contenitore:",
+  "Select content types for this storage:": "Seleziona i tipi di contenuto per questo spazio di archiviazione:",
+  "Select conversion guide:": "Seleziona la guida alla conversione:",
+  "Select conversion option:": "Seleziona l'opzione di conversione:",
+  "Select destination": "Seleziona la destinazione",
+  "Select disk interface type:": "Seleziona il tipo di interfaccia del disco:",
+  "Select driver version": "Seleziona la versione del driver",
+  "Select export format:": "Seleziona il formato di esportazione:",
+  "Select export permissions:": "Seleziona i permessi di esportazione:",
+  "Select from /mnt directories": "Seleziona dalle directory /mnt",
+  "Select from existing folders in /mnt": "Seleziona dalle cartelle esistenti in /mnt",
+  "Select from folders inside /mnt": "Seleziona dalle cartelle all'interno di /mnt",
+  "Select from recent servers": "Seleziona dai server recenti",
+  "Select help topic:": "Seleziona l'argomento della guida:",
+  "Select how to provide VirtIO drivers": "Seleziona come fornire i driver VirtIO",
+  "Select iSCSI Target": "Seleziona destinazione iSCSI",
+  "Select local archive format:": "Seleziona il formato di archivio locale:",
+  "Select machine type": "Seleziona il tipo di macchina",
+  "Select mount configuration:": "Seleziona la configurazione di montaggio:",
+  "Select mount options. Open uid/gid/file_mode are always applied so unprivileged LXC bind-mounts can write:": "Seleziona le opzioni di montaggio. Uid/gid/file_mode aperti vengono sempre applicati in modo che i bind-mount LXC non privilegiati possano scrivere:",
+  "Select mount options:": "Seleziona le opzioni di montaggio:",
+  "Select mount point to remove from container": "Seleziona il punto di montaggio da rimuovere dal contenitore",
+  "Select mount point to unmount:": "Seleziona il punto di montaggio da smontare:",
+  "Select network access level:": "Seleziona il livello di accesso alla rete:",
+  "Select one of the ready-to-run Linux VMs:": "Seleziona una delle VM Linux pronte per l'esecuzione:",
+  "Select one or more GPU(s) to switch mode:": "Seleziona una o più GPU per cambiare modalità:",
+  "Select one or more disk images to import:": "Seleziona una o più immagini disco da importare:",
+  "Select operation:": "Seleziona operazione:",
+  "Select optimizations to uninstall:": "Seleziona le ottimizzazioni da disinstallare:",
+  "Select option": "Seleziona l'opzione",
+  "Select option [1-2] (default: 2):": "Selezionare l'opzione [1-2] (impostazione predefinita: 2):",
+  "Select option [1-3] (default: 3):": "Selezionare l'opzione [1-3] (impostazione predefinita: 3):",
+  "Select repository destination:": "Seleziona la destinazione del repository:",
+  "Select restore source:": "Seleziona l'origine del ripristino:",
+  "Select run mode": "Seleziona la modalità di esecuzione",
+  "Select share permissions:": "Seleziona i permessi di condivisione:",
+  "Select storage for imported disk(s):": "Seleziona lo spazio di archiviazione per i dischi importati:",
+  "Select storage to remove:": "Seleziona lo spazio di archiviazione da rimuovere:",
+  "Select target IQN:": "Seleziona l'IQN target:",
+  "Select target mode for selected GPU(s):": "Seleziona la modalità di destinazione per le GPU selezionate:",
+  "Select the CT to manage NFS/Samba client:": "Seleziona il CT per gestire il client NFS/Samba:",
+  "Select the CT to which you want to add disks:": "Seleziona il CT a cui vuoi aggiungere i dischi:",
+  "Select the GPU to pass through to the VM:": "Seleziona la GPU da passare alla VM:",
+  "Select the GPU(s) to add to LXC": "Seleziona le GPU da aggiungere a LXC",
+  "Select the LXC container:": "Seleziona il contenitore LXC:",
+  "Select the Linux distribution to install:": "Seleziona la distribuzione Linux da installare:",
+  "Select the NAS system to install:": "Selezionare il sistema NAS da installare:",
+  "Select the NVIDIA driver version to install:": "Seleziona la versione del driver NVIDIA da installare:",
+  "Select the VM to add the GPU to:": "Seleziona la VM a cui aggiungere la GPU:",
+  "Select the VM to which you want to add disks:": "Seleziona la VM a cui vuoi aggiungere i dischi:",
+  "Select the VM where you want to import the disk image:": "Seleziona la VM in cui desideri importare l'immagine del disco:",
+  "Select the bus type for the disks:": "Seleziona il tipo di bus per i dischi:",
+  "Select the directory containing disk images:": "Seleziona la directory contenente le immagini del disco:",
+  "Select the directory to bind to container:": "Seleziona la directory da associare al contenitore:",
+  "Select the disk to add as Proxmox storage:": "Seleziona il disco da aggiungere come spazio di archiviazione Proxmox:",
+  "Select the disk to test or inspect:": "Seleziona il disco da testare o ispezionare:",
+  "Select the disk you want to format:": "Seleziona il disco che desideri formattare:",
+  "Select the disks you want to add:": "Seleziona i dischi che desideri aggiungere:",
+  "Select the disks you want to import (use spacebar to toggle):": "Seleziona i dischi che desideri importare (usa la barra spaziatrice per attivare/disattivare):",
+  "Select the entry to remove. [pvesm] entries are removed from Proxmox storage; [fstab] entries are unmounted and removed from /etc/fstab.": "Seleziona la voce da rimuovere. le voci [pvesm] vengono rimosse dallo spazio di archiviazione Proxmox; Le voci [fstab] vengono smontate e rimosse da /etc/fstab.",
+  "Select the entry to remove. [pvesm] entries are removed from Proxmox storage; [fstab] entries are unmounted, removed from /etc/fstab and have their credentials file deleted.": "Seleziona la voce da rimuovere. le voci [pvesm] vengono rimosse dallo spazio di archiviazione Proxmox; Le voci [fstab] vengono smontate, rimosse da /etc/fstab e i relativi file delle credenziali vengono eliminati.",
+  "Select the file to import:": "Seleziona il file da importare:",
+  "Select the filesystem for": "Seleziona il file system per",
+  "Select the folder to mount:": "Seleziona la cartella da montare:",
+  "Select the interface type for all disks:": "Seleziona il tipo di interfaccia per tutti i dischi:",
+  "Select the interface type for:": "Seleziona il tipo di interfaccia per:",
+  "Select the mounted USB to use as backup target:": "seleziona l'USB montato da utilizzare come destinazione del backup:",
+  "Select the optimizations to update. Each one re-runs its post-install function and registers the new version.": "Seleziona le ottimizzazioni da aggiornare. Ognuno riesegue la sua funzione post-installazione e registra la nuova versione.",
+  "Select the parent job to attach to:": "seleziona il lavoro principale a cui allegarlo:",
+  "Select the paths to restore (one per backup entry):": "seleziona i percorsi da ripristinare (uno per voce di backup):",
+  "Select the privileged LXC container to convert:": "Seleziona il contenitore LXC privilegiato da convertire:",
+  "Select the storage volume for disk import:": "Seleziona il volume di archiviazione per l'importazione del disco:",
+  "Select the sync interval (in hours):": "Seleziona l'intervallo di sincronizzazione (in ore):",
+  "Select the target VM for PCI passthrough:": "Seleziona la VM di destinazione per il passthrough PCI:",
+  "Select the type of Linux installation:": "Seleziona il tipo di installazione Linux:",
+  "Select the type of Windows installation:": "Seleziona il tipo di installazione di Windows:",
+  "Select the unprivileged LXC container to convert:": "Seleziona il contenitore LXC non privilegiato da convertire:",
+  "Select utilities to install": "Seleziona le utilità da installare",
+  "Select what to do with this disk:": "Seleziona cosa fare con questo disco:",
+  "Select where to export VM files (OVA/OVF + temporary workspace):": "Seleziona dove esportare i file VM (OVA/OVF + spazio di lavoro temporaneo):",
+  "Selected GPU function": "Funzione GPU selezionata",
+  "Selected GPU(s)": "GPU selezionate",
+  "Selected GPU(s):": "GPU selezionate:",
+  "Selected LXC action": "Azione LXC selezionata",
+  "Selected VM": "Macchina virtuale selezionata",
+  "Selected VM action": "Azione VM selezionata",
+  "Selected container": "Contenitore selezionato",
+  "Selected controller/NVMe is already assigned to other VM(s):": "Il controller/NVMe selezionato è già assegnato ad altre VM:",
+  "Selected device is already assigned to other VM(s):": "Il dispositivo selezionato è già assegnato ad altre VM:",
+  "Selected devices": "Dispositivi selezionati",
+  "Selected optimizations have been uninstalled.": "Le ottimizzazioni selezionate sono state disinstallate.",
+  "Selected paths produced no entries to apply.": "i percorsi selezionati non hanno prodotto voci da applicare.",
+  "Selected utilities installation completed": "Installazione delle utilità selezionate completata",
+  "Sending backup to Borg repository...": "invio del backup al repository Borg...",
+  "Sending backup to PBS...": "Invio del backup a PBS...",
+  "Server": "Server",
+  "Server (listen for incoming tests on TCP 5201)": "Server (ascolta i test in entrata su TCP 5201)",
+  "Server IP/hostname is correct": "L'IP/nome host del server è corretto",
+  "Server IP:": "IP del server:",
+  "Server is accessible:": "Il server è accessibile:",
+  "Server is online": "Il server è in linea",
+  "Server is running": "Il server è in esecuzione",
+  "Server response:": "Risposta del server:",
+  "Server stopped. Press Enter to return to menu...": "Server arrestato. Premere Invio per tornare al menu...",
+  "Server will listen on TCP port 5201.": "Il server ascolterà sulla porta TCP 5201.",
+  "Server:": "Server:",
+  "Servers": "Server",
+  "Service Status": "Stato del servizio",
+  "Service is active and running": "Il servizio è attivo e funzionante",
+  "Service is inactive": "Il servizio è inattivo",
+  "Service restarted.": "Il servizio è stato riavviato.",
+  "Service restarts:": "Il servizio riparte:",
+  "Service stopped.": "Il servizio è stato interrotto.",
+  "Services failed": "I servizi sono falliti",
+  "Services restarted": "I servizi sono riavviati",
+  "Services:": "Servizi:",
+  "Set Display > Graphic card (VGA, SPICE or VirtIO) to match the guest": "Imposta Display > Scheda grafica (VGA, SPICE o VirtIO) in modo che corrisponda al guest",
+  "Set Hostname": "Imposta il nome host",
+  "Set Interface MTU Size (leave blank for default)": "Imposta la dimensione MTU dell'interfaccia (lascia vuoto per impostazione predefinita)",
+  "Set MAC Address (leave empty for automatic)": "Imposta indirizzo MAC (lascia vuoto per automatico)",
+  "Set MTU (leave empty for default)": "Imposta MTU (lascia vuoto per impostazione predefinita)",
+  "Set VLAN (leave empty for none)": "Imposta VLAN (non lasciare vuoto per nessuno)",
+  "Set VM boot order": "Imposta l'ordine di avvio della VM",
+  "Set Virtual Machine ID": "Imposta l'ID della macchina virtuale",
+  "Set a Bridge": "Imposta un ponte",
+  "Set a MAC Address": "Imposta un indirizzo MAC",
+  "Set a Vlan(leave blank for default)": "Imposta una Vlan (lascia vuoto per impostazione predefinita)",
+  "Set network bridge (default: vmbr0)": "Imposta il bridge di rete (predefinito: vmbr0)",
+  "Set ownership and permissions:": "Imposta proprietà e autorizzazioni:",
+  "Set this disk as the primary boot disk?": "Impostare questo disco come disco di avvio principale?",
+  "Set up custom MOTD banner": "imposta un banner MOTD personalizzato",
+  "Set up the apex group and udev rules": "Imposta il gruppo apex e le regole udev",
+  "Set up time synchronization and entropy generation": "Impostare la sincronizzazione temporale e la generazione di entropia",
+  "Setting APT language configuration...": "Impostazione della configurazione della lingua APT...",
+  "Setting VM description": "Impostazione della descrizione della VM",
+  "Setting boot order...": "Impostazione dell'ordine di avvio...",
+  "Setting directory ownership and permissions...": "Impostazione della proprietà e delle autorizzazioni della directory...",
+  "Setting sharedfiles group with UID remapping...": "Impostazione del gruppo sharedfiles con rimappatura UID...",
+  "Setting systemd ulimits...": "Impostazione dei limiti di systemd...",
+  "Setting ulimit for the shell user...": "Impostazione di ulimit per l'utente shell...",
+  "Setting up persistent network interfaces": "Configurazione di interfacce di rete persistenti",
+  "Setting up persistent network interfaces successfully.": "Configurazione delle interfacce di rete persistenti riuscita.",
+  "Setting up the Google Coral APT repository...": "Configurazione del repository APT di Google Coral in corso...",
+  "Settings": "Impostazioni",
+  "Settings post-install Proxmox": "Impostazioni post-installazione Proxmox",
+  "Setup Persistent Network Names": "imposta nomi di rete persistenti",
+  "Share Access Error": "Errore di accesso alla condivisione",
+  "Share Name": "Condividi nome",
+  "Share Options": "Opzioni di condivisione",
+  "Share added successfully.": "Condividi aggiunta con successo.",
+  "Share deleted and Samba service restarted.": "Condivisione eliminata e servizio Samba riavviato.",
+  "Share exists:": "La condivisione esiste:",
+  "Share name:": "Nome della condivisione:",
+  "Share not found on server:": "Condivisione non trovata sul server:",
+  "Share path:": "Condividi percorso:",
+  "Share updated successfully.": "Condividi aggiornata con successo.",
+  "Share:": "Condividere:",
+  "Shared Directory Ready:": "Directory condivisa pronta:",
+  "Shared Group": "Gruppo condiviso",
+  "Shared group: CONFIGURED": "Gruppo condiviso: CONFIGURATO",
+  "Shared group: sharedfiles (GID:": "Gruppo condiviso: file condivisi (GID:",
+  "Sharedfiles group already exists (GID: 101000)": "Il gruppo Sharedfiles esiste già (GID: 101000)",
+  "Shares found:": "Azioni trovate:",
+  "Shell user ulimit set": "Set ulimit utente shell",
+  "Short self-test started on": "È iniziato il breve test automatico",
+  "Short test            — ~2 minutes, basic surface check": "Test breve: circa 2 minuti, controllo di base della superficie",
+  "Should show 'unprivileged: 0' or no unprivileged line": "Dovrebbe mostrare \"non privilegiato: 0\" o nessuna linea non privilegiata",
+  "Should show 'unprivileged: 1'": "Dovrebbe mostrare \"non privilegiato: 1\"",
+  "Should show 'unprivileged: 1' if it's unprivileged": "Dovrebbe mostrare \"non privilegiato: 1\" se non è privilegiato",
+  "Should show fewer or no issues": "Dovrebbe mostrare meno o nessun problema",
+  "Should show pve-manager/9.x.x": "Dovrebbe mostrare pve-manager/9.x.x",
+  "Show All Scripts": "Mostra tutti gli script",
+  "Show CT users in table format": "Mostra gli utenti CT in formato tabella",
+  "Show Container Privilege Status": "Mostra lo stato dei privilegi del contenitore",
+  "Show DNS resolution status": "Mostra lo stato della risoluzione DNS",
+  "Show Ethernet device info": "Mostra informazioni sul dispositivo Ethernet",
+  "Show GPU frequency": "Mostra la frequenza della GPU",
+  "Show GPU kernel driver in use": "Mostra il driver del kernel GPU in uso",
+  "Show GPU time": "Mostra l'ora della GPU",
+  "Show Monitor Service Status": "Mostra lo stato del servizio di monitoraggio",
+  "Show Network Config File": "Mostra file di configurazione di rete",
+  "Show Proxmox storage configuration": "Mostra la configurazione dello spazio di archiviazione Proxmox",
+  "Show Proxmox version": "Mostra la versione di Proxmox",
+  "Show Routing Table": "mostra tabella di routing",
+  "Show UUID and filesystem type of block devices": "Mostra l'UUID e il tipo di file system dei dispositivi a blocchi",
+  "Show VM configuration. Use the correct <vmid>": "Mostra la configurazione della VM. Utilizzare il <vmid> corretto",
+  "Show Version Information": "Mostra informazioni sulla versione",
+  "Show ZFS pool status": "Mostra lo stato del pool ZFS",
+  "Show active firewall rules (iptables)": "Mostra regole firewall attive (iptables)",
+  "Show all active mounts from the kernel": "Mostra tutti i montaggi attivi dal kernel",
+  "Show available Proxmox upgrades": "Mostra gli aggiornamenti Proxmox disponibili",
+  "Show configured network bridges": "Mostra i bridge di rete configurati",
+  "Show container configuration. Use the correct <ctid>": "Mostra la configurazione del contenitore. Utilizzare il <ctid> corretto",
+  "Show detailed keyfile info": "mostra informazioni dettagliate sul file chiave",
+  "Show disk usage by mount point": "Mostra l'utilizzo del disco per punto di montaggio",
+  "Show jobs and last run status": "Mostra i lavori e lo stato dell'ultima esecuzione",
+  "Show listening ports (TCP/UDP)": "Mostra porte di ascolto (TCP/UDP)",
+  "Show manual repair commands": "Mostra i comandi di riparazione manuale",
+  "Show me the line to paste manually on the server": "mostrami la riga da incollare manualmente sul server",
+  "Show mounted storage devices": "Mostra i dispositivi di archiviazione montati",
+  "Show network interfaces and IPs": "Mostra interfacce di rete e IP",
+  "Show nftables rules": "Mostra le regole di nftables",
+  "Show raw network configuration": "Mostra la configurazione di rete grezza",
+  "Show routing table": "Mostra tabella di routing",
+  "Show size of a directory": "Mostra la dimensione di una directory",
+  "Show standard exclude patterns": "Mostra modelli di esclusione standard",
+  "Show status of all storage pools": "Mostra lo stato di tutti gli storage pool",
+  "Show traffic statistics per interface": "Mostra le statistiche del traffico per interfaccia",
+  "Show vzdump backup configuration": "Mostra la configurazione del backup vzdump",
+  "Shows status and type (nfs/cifs/dir/iscsi...).": "Mostra lo stato e il tipo (nfs/cifs/dir/iscsi...).",
+  "Shutdown timeout": "Timeout di spegnimento",
+  "Signatures removed. Partition table preserved.": "Firme rimosse. Tabella delle partizioni conservata.",
+  "Single GPU Warning": "Avviso GPU singola",
+  "Single target found — selected automatically:": "Target singolo trovato - selezionato automaticamente:",
+  "Size": "Misurare",
+  "Size:": "Misurare:",
+  "Skip downloading additional languages": "salta il download di lingue aggiuntive",
+  "Skip this device": "Salta questo dispositivo",
+  "Skip this step for ZFS/BTRFS": "Salta questo passaggio per ZFS/BTRFS",
+  "Skip this step if using no-subscription repository": "Salta questo passaggio se utilizzi un repository senza abbonamento",
+  "Skip — I will add it as PCIe device": "Salta: lo aggiungerò come dispositivo PCIe",
+  "Skip — leave as-is": "Salta: lascia così com'è",
+  "Skipped device": "Dispositivo saltato",
+  "Skipped to protect target system (would cascade-remove packages)": "Messaggio tecnico per Proxmox e IT.Traduzione: saltato per proteggere il sistema di destinazione (rimuoverebbe i pacchetti a cascata)",
+  "Skipped, not in apt cache:": "Saltato, non nella cache di apt:",
+  "Skipping LXC": "Saltare LXC",
+  "Skipping SR-IOV device": "Saltare il dispositivo SR-IOV",
+  "Skipping installation.": "Saltare l'installazione.",
+  "Skipping manual patches — feranick fork already supports this kernel.": "Saltare le patch manuali: il fork feranick supporta già questo kernel.",
+  "Smart restore plan — hardware compatibility check": "Piano di ripristino intelligente: verifica della compatibilità hardware",
+  "Snippets          — hook scripts / config": "Snippet: script di hook/config",
+  "SoC-integrated GPU: tight coupling with other SoC components": "GPU integrata nel SoC: stretto accoppiamento con altri componenti SoC",
+  "Some changes require a reboot to take effect. Do you want to restart now?": "Alcune modifiche richiedono un riavvio per avere effetto. Vuoi riavviare adesso?",
+  "Some essential Proxmox packages may not have been installed": "Alcuni pacchetti Proxmox essenziali potrebbero non essere stati installati",
+  "Some log2ram files may still exist. Manual cleanup may be required.": "Alcuni file log2ram potrebbero ancora esistere. Potrebbe essere necessaria la pulizia manuale.",
+  "Some old time services could not be removed (not installed)": "Impossibile rimuovere alcuni servizi obsoleti (non installati)",
+  "Some operations failed — review messages above. Press Enter to continue...": "Alcune operazioni non sono riuscite: rivedi i messaggi sopra. Premi Invio per continuare...",
+  "Some repairs failed. Please fix manually and re-run the script.": "Alcune riparazioni sono fallite. Correggi manualmente ed esegui nuovamente lo script.",
+  "Some repositories are not available, continuing with available ones...": "Alcuni repository non sono disponibili, continuando con quelli disponibili...",
+  "Some selected GPUs are already configured in this container.": "Alcune GPU selezionate sono già configurate in questo contenitore.",
+  "Some signatures could not be removed (see warnings above).": "Impossibile rimuovere alcune firme (vedere gli avvisi sopra).",
+  "Something is already mounted at": "Qualcosa è già montato su",
+  "Something is already mounted at:": "Qualcosa è già montato in:",
+  "Source": "Fonte",
+  "Source VM": "Macchina virtuale di origine",
+  "Source patched successfully.": "La sorgente è stata patchata correttamente.",
+  "Source:": "Fonte:",
+  "Sources copied to": "Fonti copiate in",
+  "Spanish": "spagnolo",
+  "Specific host (enter IP)": "Host specifico (inserire IP)",
+  "Specific subnet (enter manually)": "Sottorete specifica (immettere manualmente)",
+  "Stable (main branch)": "Stabile (ramo principale)",
+  "Stable monitor service normalized.": "Servizio di monitoraggio stabile normalizzato.",
+  "Staging directory:": "Directory di staging:",
+  "Staging ready.": "Allestimento pronto.",
+  "Staging source:": "Fonte di stadiazione:",
+  "Standard NAS   (backup, iso, vztmpl)": "NAS standard (backup, iso, vztmpl)",
+  "Start VM": "Avvia la VM",
+  "Start VM after creation": "Avvia la VM dopo la creazione",
+  "Start VM after creation?": "Avviare la VM dopo la creazione?",
+  "Start a container. Use the correct <ctid>": "Avvia un contenitore. Utilizzare il <ctid> corretto",
+  "Start a virtual machine. Use the correct <vmid>": "Avvia una macchina virtuale. Utilizzare il <vmid> corretto",
+  "Start long self-test (hours)": "Avvia autotest lungo (ore)",
+  "Start long test now?": "Iniziare un test lungo adesso?",
+  "Start on boot already disabled for VM": "Avvia all'avvio già disabilitato per la VM",
+  "Start on boot disabled for LXC": "Avvia all'avvio disabilitato per LXC",
+  "Start on boot disabled for VM": "Avvia all'avvio disabilitato per la VM",
+  "Start on boot enabled": "Avvia all'avvio abilitato",
+  "Start on boot enabled (onboot=1)": "Avvia all'avvio abilitato (onboot=1)",
+  "Start on boot will be disabled on source VM only if currently enabled": "L'avvio all'avvio verrà disabilitato sulla VM di origine solo se attualmente abilitato",
+  "Start scrub for a ZFS pool": "Avvia lo scrubbing per un pool ZFS",
+  "Start short self-test (~2 min)": "Avvia un breve test automatico (~2 minuti)",
+  "Start terminal multiplexer (recommended):": "Avviare il multiplexer terminale (consigliato):",
+  "Start the VM": "Avvia la VM",
+  "Start the VM to begin Windows installation from the mounted ISO.": "Avvia la VM per iniziare l'installazione di Windows dall'ISO montato.",
+  "Start the converted container:": "Avvia il contenitore convertito:",
+  "Start the main system upgrade:": "Avvia l'aggiornamento del sistema principale:",
+  "Start uploading to PBS — sets a recovery passphrase": "avvia il caricamento su PBS: imposta una passphrase di ripristino",
+  "Starting Borg backup...": "Avvio del backup Borg...",
+  "Starting CT": "Inizio TAC",
+  "Starting LXC Privileged to Unprivileged conversion process...": "Avvio del processo di conversione da LXC Privileged a Unprivileged...",
+  "Starting LXC Unprivileged to Privileged conversion process...": "Avvio del processo di conversione da LXC Unprivileged a Privileged...",
+  "Starting NVIDIA installer. This may take several minutes...": "Avvio del programma di installazione NVIDIA. L'operazione potrebbe richiedere diversi minuti...",
+  "Starting NVMe long self-test...": "Avvio del test automatico lungo NVMe...",
+  "Starting NVMe short self-test...": "Avvio del breve test automatico NVMe...",
+  "Starting ProxMenux update...": "Avvio dell'aggiornamento di ProxMenux...",
+  "Starting Proxmox storage integration...": "Avvio dell'integrazione dello storage Proxmox in corso...",
+  "Starting Proxmox system repair...": "Avvio della riparazione del sistema Proxmox in corso...",
+  "Starting SMART long self-test...": "Avvio dell'autotest lungo SMART...",
+  "Starting SMART short self-test...": "Avvio dell'autotest breve SMART...",
+  "Starting container": "Contenitore di partenza",
+  "Starting container...": "Contenitore iniziale...",
+  "Starting direct conversion of container": "Avvio della conversione diretta del contenitore",
+  "Starting gateway...": "Avvio del gateway...",
+  "Starting installation...": "Avvio dell'installazione...",
+  "Starting installer...": "Avvio del programma di installazione...",
+  "Starting privileged container...": "Avvio del contenitore privilegiato...",
+  "Starting rpcbind service...": "Avvio del servizio rpcbind in corso...",
+  "Starting unprivileged container...": "Avvio del contenitore non privilegiato...",
+  "Status": "Stato",
+  "Status:": "Stato:",
+  "Step": "Fare un passo",
+  "Step 2: Testing actual share access with guest...": "Passaggio 2: testare l'effettivo accesso alla condivisione con l'ospite...",
+  "Steps that will run:": "Passaggi che verranno eseguiti:",
+  "Still has issues": "Ha ancora problemi",
+  "Stop it first and run this option again.": "Interrompilo prima ed esegui nuovamente questa opzione.",
+  "Stop the CT, unmount the disk on the HOST, and remount with:": "Arrestare il CT, smontare il disco sull'HOST e rimontarlo con:",
+  "Stop the VM/CT before formatting this disk.": "Arrestare il VM/CT prima di formattare questo disco.",
+  "Stop the container if it's running:": "Arresta il contenitore se è in esecuzione:",
+  "Stop them first and run this script again.": "Prima fermali ed esegui nuovamente questo script.",
+  "Stop uploading to PBS": "interrompi il caricamento su PBS",
+  "Stop uploading?": "interrompi il caricamento?",
+  "Stopped": "Fermato",
+  "Stopped and disabled": "Fermato e disabilitato",
+  "Stopping Coral kernel modules...": "Arresto dei moduli del kernel Coral...",
+  "Stopping LXC": "Arresto dell'LXC",
+  "Stopping NFS services...": "Arresto dei servizi NFS in corso...",
+  "Stopping ProxMenux Monitor service...": "Arresto del servizio ProxMenux Monitor in corso...",
+  "Stopping Samba services...": "Arresto dei servizi Samba...",
+  "Stopping VM": "Arresto della VM",
+  "Stopping and disabling NVIDIA services...": "Arresto e disabilitazione dei servizi NVIDIA...",
+  "Stopping container": "Contenitore di arresto",
+  "Stopping gateway...": "Arresto del gateway...",
+  "Stopping the container before applying configuration...": "Arresto del contenitore prima di applicare la configurazione...",
+  "Stopping the container before conversion...": "Arresto del contenitore prima della conversione...",
+  "Storage": "Magazzinaggio",
+  "Storage & Share Manager": "Gestore archiviazione e condivisione",
+  "Storage Added:": "Spazio di archiviazione aggiunto:",
+  "Storage Exists": "Lo spazio di archiviazione esiste",
+  "Storage ID": "ID di archiviazione",
+  "Storage ID already exists. Do you want to remove and recreate it?": "L'ID di archiviazione esiste già. Vuoi rimuoverlo e ricrearlo?",
+  "Storage ID already exists:": "L'ID di archiviazione esiste già:",
+  "Storage ID is available": "L'ID di archiviazione è disponibile",
+  "Storage ID:": "ID di archiviazione:",
+  "Storage and Disks Commands": "Comandi di archiviazione e dischi",
+  "Storage controller: VirtIO SCSI": "Controller di archiviazione: VirtIO SCSI",
+  "Storage disk identifier:": "Identificatore del disco di archiviazione:",
+  "Storage is now available in Proxmox web interface under Datacenter > Storage": "Lo spazio di archiviazione è ora disponibile nell'interfaccia web di Proxmox in Datacenter > Archiviazione",
+  "Storage plan selection cancelled.": "Selezione del piano di archiviazione annullata.",
+  "Storage plan selection failed or cancelled": "La selezione del piano di archiviazione non è riuscita o è stata annullata",
+  "Storage:": "Magazzinaggio:",
+  "Stored Credentials:": "Credenziali archiviate:",
+  "Stored credentials:": "Credenziali archiviate:",
+  "Subnet": "Sottorete",
+  "Subscription banner removed successfully": "Banner di abbonamento rimosso con successo",
+  "Subscription banner restored successfully (desktop and mobile)": "Banner di abbonamento ripristinato correttamente (desktop e mobile)",
+  "Success": "Successo",
+  "Successful": "Riuscito",
+  "Supported formats: .img, .qcow2, .vmdk, .raw": "Formati supportati: .img, .qcow2, .vmdk, .raw",
+  "Swap partition detected": "Partizione di swap rilevata",
+  "Swappiness configuration created successfully": "Configurazione Swappiness creata con successo",
+  "Switch GPU Mode  (VM <-> LXC)": "Cambia modalità GPU (VM <-> LXC)",
+  "Switch Script Not Found": "Script del cambio non trovato",
+  "Switch to GPU -> LXC (native driver mode)": "Passa a GPU -> LXC (modalità driver nativo)",
+  "Switch to GPU -> VM (VFIO passthrough mode)": "Passa a GPU -> VM (modalità passthrough VFIO)",
+  "Switches to the free no-subscription repository": "Passa al repository gratuito senza abbonamento",
+  "Switching to GPU -> LXC mode removes VFIO exclusivity.": "Il passaggio a GPU -> modalità LXC rimuove l'esclusività VFIO.",
+  "Switching to GPU -> VM mode requires exclusive VFIO binding.": "Il passaggio alla modalità GPU -> VM richiede l'associazione VFIO esclusiva.",
+  "Synchronize time automatically": "sincronizza l'ora automaticamente",
+  "System": "Sistema",
+  "System CLI Tools": "Strumenti della CLI di sistema",
+  "System Disk Size (GB)": "Dimensioni del disco di sistema (GB)",
+  "System Update Information": "Informazioni sull'aggiornamento del sistema",
+  "System Utilities Installer": "Programma di installazione delle utilità di sistema",
+  "System disk is SSD or M.2. Proceeding with Log2RAM setup.": "Il disco di sistema è SSD o M.2. Procedere con la configurazione di Log2RAM.",
+  "System errors and logs": "Errori e registri di sistema",
+  "System group apex already exists.": "L'apice del gruppo di sistemi esiste già.",
+  "System group apex created.": "Apice del gruppo di sistema creato.",
+  "System hardening scoring (0-100)": "Punteggio rafforzamento del sistema (0-100)",
+  "System hostname and kernel info": "Nome host del sistema e informazioni sul kernel",
+  "System is already up to date": "Il sistema è già aggiornato",
+  "System is already up to date. No update needed.": "Il sistema è già aggiornato. Nessun aggiornamento necessario.",
+  "System limits increase completed.": "Aumento dei limiti di sistema completato.",
+  "System limits optimizations removed": "Ottimizzazioni dei limiti di sistema rimosse",
+  "System must be updated to latest PVE 8.4+ before starting": "Il sistema deve essere aggiornato all'ultima versione PVE 8.4+ prima di iniziare",
+  "System reboot required": "È necessario il riavvio del sistema",
+  "System upgrade completed": "Aggiornamento del sistema completato",
+  "System uptime": "Tempo di attività del sistema",
+  "Systemd ulimits set": "Limiti di sistema impostati",
+  "TCP BBR configuration created successfully": "Configurazione TCP BBR creata correttamente",
+  "TCP Fast Open configuration created successfully": "Configurazione TCP Fast Open creata correttamente",
+  "TCP optimizations configuration completed": "Configurazione delle ottimizzazioni TCP completata",
+  "TCP optimizations reverted (defaults restored on next reboot)": "Ottimizzazioni TCP ripristinate (valori predefiniti ripristinati al prossimo riavvio)",
+  "TCP port 5201 is reachable (firewall on server)": "La porta TCP 5201 è raggiungibile (firewall sul server)",
+  "TPM device added to VM": "Dispositivo TPM aggiunto alla VM",
+  "TPM storage selection failed or was cancelled. VM creation aborted.": "La selezione dell'archivio TPM non è riuscita o è stata annullata. Creazione della VM interrotta.",
+  "TROUBLESHOOTING:": "RISOLUZIONE DEI PROBLEMI:",
+  "TUI mode": "Modalità TUI",
+  "TUI mode (requires root)": "Modalità TUI (richiede root)",
+  "Target IQN:": "IQN target:",
+  "Target VM": "VM di destinazione",
+  "Target VM validated": "VM di destinazione convalidata",
+  "Target channel:": "Canale di destinazione:",
+  "Target disk": "Disco di destinazione",
+  "Target host runs": "viene eseguito l'host di destinazione",
+  "Target mode": "Modalità bersaglio",
+  "Target server:": "Server di destinazione:",
+  "Target:": "Bersaglio:",
+  "Temporary working directory (if present):": "Directory di lavoro temporanea (se presente):",
+  "Terminal Multiplexers": "Multiplexer terminali",
+  "Terminal multiplexer (Ctrl+b then d to detach, or type exit)": "Multiplexer terminale (Ctrl+b poi d per scollegare o digitare exit)",
+  "Test Connectivity": "Testare la connettività",
+  "Test NFS Connectivity": "Testare la connettività NFS",
+  "Test Samba Connectivity": "Prova la connettività Samba",
+  "Test iSCSI Connectivity": "Testare la connettività iSCSI",
+  "Test in progress:": "Prova in corso:",
+  "Test runs on the drive hardware — safe to close this terminal.": "Il test viene eseguito sull'hardware dell'unità: è sicuro chiudere questo terminale.",
+  "Test share visibility:": "Testare la visibilità della condivisione:",
+  "Test typically completes in ~2 minutes.": "Il test viene generalmente completato in circa 2 minuti.",
+  "Testing": "Test",
+  "Testing NFS connection...": "Test della connessione NFS in corso...",
+  "Testing comprehensive guest access to server": "Test dell'accesso ospite completo al server",
+  "Testing connectivity to portal...": "Test della connettività al portale...",
+  "Testing network connectivity...": "Test della connettività di rete in corso...",
+  "Thank you for using ProxMenux. Goodbye!": "Grazie per aver utilizzato ProxMenux. Arrivederci!",
+  "That VM is currently stopped, so the GPU can be reassigned now.": "La VM è attualmente arrestata, quindi la GPU può essere riassegnata ora.",
+  "That doesn't look like an SSH private key. Pick the private key file (no .pub extension, parseable by ssh-keygen).": "non sembra una chiave privata SSH.Scegli il file della chiave privata (nessuna estensione .pub, analizzabile da ssh-keygen).",
+  "The GPU has been moved out of VM": "La GPU è stata spostata fuori dalla VM",
+  "The GPU is being detached from VM": "La GPU viene scollegata dalla VM",
+  "The NVIDIA installer needs at least": "Il programma di installazione NVIDIA ha bisogno di almeno",
+  "The URL does not contain the required parameters (id, pack, edition).": "L'URL non contiene i parametri richiesti (id, pack, edizione).",
+  "The VM also has these audio devices assigned via PCI passthrough — typically added together with the GPU. Remove them too?": "Alla VM questi dispositivi audio vengono assegnati anche tramite passthrough PCI, in genere aggiunti insieme alla GPU. Eliminare anche quelli?",
+  "The VM guest will have exclusive access to the GPU.": "L'ospite della VM avrà accesso esclusivo alla GPU.",
+  "The VM is powered on. Turn it off before adding disks.": "La VM è accesa. Spegnerlo prima di aggiungere dischi.",
+  "The VM/LXC will lose access to this disk after formatting.": "La VM/LXC perderà l'accesso a questo disco dopo la formattazione.",
+  "The archive could not be extracted.": "Impossibile estrarre l'archivio.",
+  "The archive destination directory is INSIDE one of the paths you are about to back up. Writing the archive there would copy the backup into itself — producing a corrupted archive, or growing without limit until the disk fills up.": "La directory di destinazione dell'archivio è ALL'INTERNO di uno dei percorsi di cui stai per eseguire il backup. Scrivere l'archivio lì copierebbe il backup su se stesso, producendo un archivio danneggiato o crescendo senza limiti finché il disco non si riempie.",
+  "The backup metadata was compared against this host. The following items will be SKIPPED to keep the boot safe:": "i metadati di backup sono stati confrontati con questo host.I seguenti elementi verranno SALTATI per mantenere lo stivale sicuro:",
+  "The backup was taken on a different PVE or kernel major.minor. These paths will be SKIPPED to keep the boot safe:": "il backup è stato eseguito su un PVE o kernel major.minor diverso.Questi percorsi verranno SALTATI per mantenere l'avvio sicuro:",
+  "The compatibility check raised failures that may break the system after restore.": "Il controllo di compatibilità ha rilevato errori che potrebbero danneggiare il sistema dopo il ripristino.",
+  "The container is currently stopped. Do you want to start it now to install the package?": "Il contenitore è attualmente fermo. Vuoi avviarlo adesso per installare il pacchetto?",
+  "The container should now start as privileged": "Il contenitore ora dovrebbe iniziare come privilegiato",
+  "The container should now start as unprivileged": "Il contenitore ora dovrebbe iniziare come senza privilegi",
+  "The current driver will be completely uninstalled before installing the new version. Continue?": "Il driver corrente verrà completamente disinstallato prima di installare la nuova versione. Continuare?",
+  "The directory does not exist in the CT.": "La directory non esiste nel CT.",
+  "The disk": "Il disco",
+  "The file does not exist, is empty or is not readable.": "il file non esiste, è vuoto o non è leggibile.",
+  "The filesystem": "Il file system",
+  "The following LXC containers have NVIDIA passthrough configured:": "I seguenti contenitori LXC hanno il passthrough NVIDIA configurato:",
+  "The following backup paths are kernel-tied and are excluded from the picker to keep the target's boot safe. The operator's own tuning inside these paths (IOMMU cmdline, VFIO IDs, custom quirks) is merged back automatically via kernel-agnostic merge:": "i seguenti percorsi di backup sono legati al kernel e sono esclusi dal selettore per mantenere sicuro l'avvio della destinazione.L'ottimizzazione dell'operatore all'interno di questi percorsi (linea cmd IOMMU, ID VFIO, stranezze personalizzate) viene riunita automaticamente tramite unione indipendente dal kernel:",
+  "The following changes will be applied": "Verranno applicate le seguenti modifiche",
+  "The following devices were excluded because they are part of an SR-IOV configuration:": "I seguenti dispositivi sono stati esclusi perché fanno parte di una configurazione SR-IOV:",
+  "The following devices were excluded from Controller/NVMe passthrough because they are part of an SR-IOV configuration:": "I seguenti dispositivi sono stati esclusi dal passthrough Controller/NVMe perché fanno parte di una configurazione SR-IOV:",
+  "The following entries exist on the host but were NOT in the backup. To make the host EXACTLY match the backup state, they must be removed:": "le seguenti voci esistono sull'host ma NON erano nel backup.Per fare in modo che l'host corrisponda ESATTAMENTE allo stato del backup, è necessario rimuoverli:",
+  "The following selected GPU(s) are currently in GPU -> VM mode (vfio-pci):": "Le seguenti GPU selezionate sono attualmente in modalità GPU -> VM (vfio-pci):",
+  "The following selected device(s) are Physical Functions with active Virtual Functions:": "I seguenti dispositivi selezionati sono funzioni fisiche con funzioni virtuali attive:",
+  "The following selected device(s) are SR-IOV Virtual Functions (VFs):": "I seguenti dispositivi selezionati sono funzioni virtuali SR-IOV (VF):",
+  "The fstab entry will still be removed; reboot or manual umount needed.": "La voce fstab verrà comunque rimossa; è necessario riavviare o eseguire lo smontaggio manuale.",
+  "The gateway should appear in your Tailscale admin console shortly.": "Il gateway dovrebbe apparire a breve nella tua console di amministrazione Tailscale.",
+  "The host directory may not be accessible from an unprivileged container.": "La directory host potrebbe non essere accessibile da un contenitore non privilegiato.",
+  "The installation requires a server restart to apply changes. Do you want to restart now?": "L'installazione richiede il riavvio del server per applicare le modifiche. Vuoi riavviare adesso?",
+  "The installation/changes require a server restart to apply correctly. Do you want to reboot now?": "L'installazione/modifiche richiedono il riavvio del server per essere applicate correttamente. Vuoi riavviare adesso?",
+  "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "la busta locale viene eliminata e i backup futuri non caricano nulla.Le buste caricate già su PBS rimangono intatte e recuperabili con la loro passphrase originale.",
+  "The long test runs directly on the disk hardware.": "Il test lungo viene eseguito direttamente sull'hardware del disco.",
+  "The new SSH key was installed and is now authorized on the server.\nKey file:": "La nuova chiave SSH è stata installata ed è ora autorizzata sul server.\nFascicolo chiave:",
+  "The new SSH key was pushed to the LXC via 'pct exec' on": "la nuova chiave SSH è stata inviata all'LXC tramite 'pct exec'",
+  "The next visit to the dashboard will show the initial setup wizard.": "La successiva visita alla dashboard mostrerà la procedura guidata di configurazione iniziale.",
+  "The passwords do not match. Please try again.": "Le password non corrispondono. Per favore riprova.",
+  "The preselected VMID does not exist on this host:": "Il VMID preselezionato non esiste su questo host:",
+  "The same GPU cannot be used by two VMs at the same time.": "La stessa GPU non può essere utilizzata da due VM contemporaneamente.",
+  "The script clones the osx-proxmox.com repository and once the setup is complete, the server will automatically reboot.": "Lo script clona il repository osx-proxmox.com e una volta completata la configurazione, il server si riavvierà automaticamente.",
+  "The script will continue to restore VM passthrough mode on the host and reuse existing hostpci entries.": "Lo script continuerà a ripristinare la modalità passthrough della VM sull'host e a riutilizzare le voci hostpci esistenti.",
+  "The script will preconfigure the selected GPU now and finalize hardware binding after reboot.": "Lo script preconfigurerà ora la GPU selezionata e finalizzerà il collegamento hardware dopo il riavvio.",
+  "The selected AMD GPU does not report FLR reset support": "La GPU AMD selezionata non riporta il supporto per il ripristino FLR",
+  "The selected AMD GPU is currently in power state D3cold": "La GPU AMD selezionata è attualmente nello stato di alimentazione D3cold",
+  "The selected GPU configuration already exists in this container.": "La configurazione GPU selezionata esiste già in questo contenitore.",
+  "The selected GPU has no dedicated .1 audio sibling function.": "La GPU selezionata non dispone di una funzione di pari livello audio .1 dedicata.",
+  "The selected GPU is already assigned to another VM that is currently running:": "La GPU selezionata è già assegnata a un'altra VM attualmente in esecuzione:",
+  "The selected GPU is already assigned to this VM, but the host is not currently using vfio-pci for this device.": "La GPU selezionata è già assegnata a questa VM, ma l'host attualmente non utilizza vfio-pci per questo dispositivo.",
+  "The selected GPU is already assigned to this VM.": "La GPU selezionata è già assegnata a questa VM.",
+  "The selected GPU is already configured for passthrough to:": "La GPU selezionata è già configurata per il passthrough a:",
+  "The selected GPU is already present in this VM. Select another GPU to continue:": "La GPU selezionata è già presente in questa VM. Seleziona un'altra GPU per continuare:",
+  "The selected GPU is currently used by the following LXC container(s):": "La GPU selezionata è attualmente utilizzata dai seguenti contenitori LXC:",
+  "The selected GPU(s) are configured in these VM(s)": "Le GPU selezionate sono configurate in queste VM",
+  "The selected GPU(s) are configured in these VM(s):": "Le GPU selezionate sono configurate in queste VM:",
+  "The selected GPU(s) are used in these LXC container(s)": "Le GPU selezionate vengono utilizzate in questi contenitori LXC",
+  "The selected GPU(s) are used in these LXC container(s):": "Le GPU selezionate vengono utilizzate in questi contenitori LXC:",
+  "The selected Intel GPU belongs to Apollo Lake generation and is blocked by policy for VM passthrough due to host instability risk.": "La GPU Intel selezionata appartiene alla generazione Apollo Lake ed è bloccata dalla policy per il passthrough delle VM a causa del rischio di instabilità dell'host.",
+  "The selected Intel GPU does not expose a PCI reset interface": "La GPU Intel selezionata non espone un'interfaccia di ripristino PCI",
+  "The selected Intel GPU has non-FLR reset support and unknown subtype": "La GPU Intel selezionata ha il supporto per il ripristino non FLR e un sottotipo sconosciuto",
+  "The selected Intel GPU is currently in power state D3cold": "La GPU Intel selezionata è attualmente nello stato di alimentazione D3cold",
+  "The selected VM": "La VM selezionata",
+  "The selected VM is running.": "La VM selezionata è in esecuzione.",
+  "The selected base folder does not exist and could not be created:": "La cartella di base selezionata non esiste e non può essere creata:",
+  "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "Il contenitore selezionato non è privilegiato. È richiesto un contenitore privilegiato per il passthrough diretto del dispositivo.",
+  "The selected device": "Il dispositivo selezionato",
+  "The selected directory does not exist:": "La directory selezionata non esiste:",
+  "The selected disk has an active swap partition. Aborting.": "Il disco selezionato ha una partizione di swap attiva. Interruzione.",
+  "The selected disk is currently used by a RUNNING VM or CT. Stop it before formatting.": "Il disco selezionato è attualmente utilizzato da una VM o CT IN ESECUZIONE. Interrompilo prima della formattazione.",
+  "The selected disk is now part of the system ZFS pool. Aborting.": "Il disco selezionato fa ora parte del pool ZFS del sistema. Interruzione.",
+  "The selected disk now contains a system-critical mount. Aborting.": "Il disco selezionato ora contiene un montaggio critico per il sistema. Interruzione.",
+  "The selected path does not exist on this host:": "il percorso selezionato non esiste su questo host:",
+  "The selected path is not a valid directory:": "Il percorso selezionato non è una directory valida:",
+  "The server connected you as guest instead of the specified user.": "Il server ti ha connesso come ospite invece dell'utente specificato.",
+  "The server may not have accessible shares.": "Il server potrebbe non avere condivisioni accessibili.",
+  "The server may require authentication for actual share access.": "Il server potrebbe richiedere l'autenticazione per l'effettivo accesso alla condivisione.",
+  "The server refused password authentication for": "il server ha rifiutato l'autenticazione della password per",
+  "The server rejected": "il server ha rifiutato",
+  "The share already exists in smb.conf:": "La condivisione esiste già in smb.conf:",
+  "The source VM also has these audio devices, likely added together with the GPU. Remove them too?": "Anche la VM di origine dispone di questi dispositivi audio, probabilmente aggiunti insieme alla GPU. Eliminare anche quelli?",
+  "The specified directory does not exist:": "La directory specificata non esiste:",
+  "The storage has been removed and the disk unmounted.": "La memoria è stata rimossa e il disco smontato.",
+  "The test will continue even if you close this terminal.": "Il test continuerà anche se chiudi questo terminale.",
+  "Then bind-mount to container": "Quindi associare il montaggio al contenitore",
+  "Then change the VM display to none (vga: none) when the guest is stable.": "Quindi modifica la visualizzazione della VM su none (vga: none) quando il guest è stabile.",
+  "Then change the VM display to none (vga: none) when the system is stable.": "Quindi modificare la visualizzazione della VM su none (vga: none) quando il sistema è stabile.",
+  "Then run this option again:": "Quindi esegui nuovamente questa opzione:",
+  "Then update /etc/fstab on the host with the same options.": "Quindi aggiorna /etc/fstab sull'host con le stesse opzioni.",
+  "These are the changes that will be made": "Queste sono le modifiche che verranno apportate",
+  "These interface configurations will be removed": "Queste configurazioni dell'interfaccia verranno rimosse",
+  "These paths will not be restored live and will be extracted for manual recovery.": "Questi percorsi non verranno ripristinati in tempo reale e verranno estratti per il ripristino manuale.",
+  "This CIFS share is mounted with restrictive permissions.": "Questa condivisione CIFS è montata con autorizzazioni restrittive.",
+  "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Questa GPU è considerata incompatibile con il passthrough GPU a una VM in ProxMenux.",
+  "This NFS share is fully restricted — even the host root cannot write to it.": "Questa condivisione NFS è completamente limitata: anche l'host root non può scrivervi.",
+  "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Questa VM richiede passaggi di installazione aggiuntivi, vedere la guida all'installazione all'indirizzo:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
+  "This action will:": "Questa azione:",
+  "This archive does not contain a recognized backup layout.": "Questo archivio non contiene un layout di backup riconosciuto.",
+  "This backup does not contain any restorable paths.": "questo backup non contiene percorsi ripristinabili.",
+  "This backup includes /etc/zfs/zpool.cache (host-specific ZFS state).": "Questo backup include /etc/zfs/zpool.cache (stato ZFS specifico dell'host).",
+  "This backup is encrypted.": "questo backup è crittografato.",
+  "This backup was taken on kernel": "questo backup è stato eseguito sul kernel",
+  "This container does not have apt-get. NFS client installation only supports Debian/Ubuntu containers.": "Questo contenitore non ha apt-get. L'installazione del client NFS supporta solo i contenitori Debian/Ubuntu.",
+  "This container does not have apt-get. Samba client installation only supports Debian/Ubuntu containers.": "Questo contenitore non ha apt-get. L'installazione del client Samba supporta solo i contenitori Debian/Ubuntu.",
+  "This container has no GPU configured. Coral TPU works best alongside hardware video decoding (Quick Sync, VA-API, NVENC) for apps like Frigate.": "Questo contenitore non ha GPU configurata. Coral TPU funziona meglio insieme alla decodifica video hardware (Quick Sync, VA-API, NVENC) per app come Frigate.",
+  "This converts all directory UIDs/GIDs by adding 100000": "Questo converte tutti gli UID/GID della directory aggiungendo 100000",
+  "This converts all file UIDs/GIDs by adding 100000": "Questo converte tutti gli UID/GID dei file aggiungendo 100000",
+  "This creates a backup in case you need to revert changes": "Questo crea un backup nel caso in cui sia necessario annullare le modifiche",
+  "This erases existing metadata.": "Ciò cancella i metadati esistenti.",
+  "This explicitly marks the container as privileged": "Ciò contrassegna esplicitamente il contenitore come privilegiato",
+  "This guarantees that device nodes are available before applying LXC GPU config.": "Ciò garantisce che i nodi del dispositivo siano disponibili prima di applicare la configurazione della GPU LXC.",
+  "This installation will:": "Questa installazione:",
+  "This installer will:": "Questo programma di installazione:",
+  "This interface is configured but doesn't exist physically": "Questa interfaccia è configurata ma non esiste fisicamente",
+  "This is IRREVERSIBLE.": "questo è IRREVERSIBILE.",
+  "This is a destructive action": "Questa è un'azione distruttiva",
+  "This is a simple configuration change": "Si tratta di una semplice modifica della configurazione",
+  "This is an external community script maintained by": "questo è uno script di una comunità esterna gestito da",
+  "This is an external script that creates a macOS VM in Proxmox VE in just a few steps, whether you are using AMD or Intel hardware.": "Si tratta di uno script esterno che crea in pochi passaggi una VM macOS in Proxmox VE, sia che utilizzi hardware AMD o Intel.",
+  "This is unexpected since credentials were validated.": "Ciò è inaspettato poiché le credenziali sono state convalidate.",
+  "This marks the container as unprivileged": "Ciò contrassegna il contenitore come non privilegiato",
+  "This may be normal for a fresh installation": "Questo potrebbe essere normale per una nuova installazione",
+  "This may take a few seconds...": "L'operazione potrebbe richiedere alcuni secondi...",
+  "This may take several minutes...": "L'operazione potrebbe richiedere diversi minuti...",
+  "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "Ciò significa che Proxmox gestisce il ciclo di vita del montaggio in modo nativo (non è necessario il manuale /etc/fstab per gli archivi host NFS/CIFS).",
+  "This means the credentials are incorrect.": "Ciò significa che le credenziali non sono corrette.",
+  "This might indicate network connectivity issues.": "Ciò potrebbe indicare problemi di connettività di rete.",
+  "This operation may take several minutes and requires internet connectivity.": "Questa operazione potrebbe richiedere diversi minuti e richiede la connettività Internet.",
+  "This passphrase is the ONLY way to access encrypted Borg backups.": "questa passphrase è l'UNICO modo per accedere ai backup Borg crittografati.",
+  "This path is already used as a mount point in this container.": "Questo percorso è già utilizzato come punto di montaggio in questo contenitore.",
+  "This path is not a registered mount point. Use it anyway?": "Questo percorso non è un punto di montaggio registrato. Usarlo comunque?",
+  "This process changes file ownership inside the container": "Questo processo modifica la proprietà del file all'interno del contenitore",
+  "This release channel is already active.": "Questo canale di rilascio è già attivo.",
+  "This removes the 'unprivileged: 1' line from the config": "Ciò rimuove la riga \"non privilegiata: 1\" dal file config",
+  "This removes the storage from Proxmox. The iSCSI target is not affected.": "Ciò rimuove lo spazio di archiviazione da Proxmox. La destinazione iSCSI non è interessata.",
+  "This replaces the currently installed keyfile.": "sostituisce il file di chiavi attualmente installato.",
+  "This returns available IQNs.": "Ciò restituisce gli IQN disponibili.",
+  "This script cannot be executed from the Proxmox web terminal.": "Questo script non può essere eseguito dal terminale web Proxmox.",
+  "This script must be run as root.": "Questo script deve essere eseguito come root.",
+  "This script must be run on a Proxmox host.": "Questo script deve essere eseguito su un host Proxmox.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Questo script applicherà le seguenti ottimizzazioni e regolazioni avanzate al tuo server Proxmox VE",
+  "This script will update your Proxmox VE system with advanced options:": "Questo script aggiornerà il tuo sistema Proxmox VE con opzioni avanzate:",
+  "This shows the storage type and disk identifier": "Mostra il tipo di archiviazione e l'identificatore del disco",
+  "This state has a high probability of VM startup/reset failures.": "Questo stato ha un'alta probabilità di errori di avvio/reimpostazione della VM.",
+  "This state indicates a high risk of passthrough failure due to": "Questo stato indica un rischio elevato di errore passthrough dovuto a",
+  "This tool is designed for systems with AMD GPUs.": "Questo strumento è progettato per sistemi con GPU AMD.",
+  "This tool is designed for systems with Intel GPUs.": "Questo strumento è progettato per sistemi con GPU Intel.",
+  "This will RESET the ProxMenux Monitor login credentials on this host:": "Ciò RIPRISTINERÀ le credenziali di accesso di ProxMenux Monitor su questo host:",
+  "This will add the mount to /etc/fstab so it persists after reboot.": "Questo aggiungerà il montaggio a /etc/fstab in modo che persista dopo il riavvio.",
+  "This will completely remove Fail2Ban and its configuration. Continue?": "Ciò rimuoverà completamente Fail2Ban e la sua configurazione. Continuare?",
+  "This will completely remove Lynis from the system. Continue?": "Ciò rimuoverà completamente Lynis dal sistema. Continuare?",
+  "This will create a new VM": "Questo creerà una nuova VM",
+  "This will deploy a Tailscale VPN gateway for secure remote access.": "Verrà distribuito un gateway VPN Tailscale per l'accesso remoto sicuro.",
+  "This will install and configure Fail2Ban with:": "Questo installerà e configurerà Fail2Ban con:",
+  "This will install the Beta version from the develop branch and enable beta update checks.\n\nBeta builds may contain bugs or incomplete features.\n\nContinue?": "Ciò installerà la versione Beta dal ramo di sviluppo e abiliterà i controlli degli aggiornamenti beta.\n\nLe build beta possono contenere bug o funzionalità incomplete.\n\nContinuare?",
+  "This will launch the GPU assistant after VM creation and may require a host reboot.": "Ciò avvierà l'assistente GPU dopo la creazione della VM e potrebbe richiedere il riavvio dell'host.",
+  "This will reinstall and reconfigure Fail2Ban with the default ProxMenux settings. Continue?": "Questo reinstallerà e riconfigurerà Fail2Ban con le impostazioni predefinite di ProxMenux. Continuare?",
+  "This will reinstall core Proxmox packages and regenerate certificates": "Ciò reinstallerà i pacchetti principali di Proxmox e rigenererà i certificati",
+  "This will reinstall the Stable version from the main branch and disable beta update checks.\n\nContinue?": "Ciò reinstallerà la versione stabile dal ramo principale e disabiliterà i controlli degli aggiornamenti beta.\n\nContinuare?",
+  "This will remove NVIDIA drivers and related configuration. Do you want to continue?": "Ciò rimuoverà i driver NVIDIA e la relativa configurazione. Vuoi continuare?",
+  "This will remove and reinstall Lynis from the latest GitHub source. Continue?": "Ciò rimuoverà e reinstallerà Lynis dall'ultima fonte GitHub. Continuare?",
+  "This will remove the Coral TPU drivers (gasket DKMS + libedgetpu) and related configuration. Any LXC container with apex passthrough will lose access to /dev/apex_* after reboot. Continue?": "Ciò rimuoverà i driver Coral TPU (guarnizione DKMS + libedgetpu) e la relativa configurazione. Qualsiasi contenitore LXC con passthrough apex perderà l'accesso a /dev/apex_* dopo il riavvio. Continuare?",
+  "This will remove the mount from /etc/fstab and delete credentials if present.": "Ciò rimuoverà il montaggio da /etc/fstab ed eliminerà le credenziali se presenti.",
+  "This will remove the mount from /etc/fstab.": "Questo rimuoverà il montaggio da /etc/fstab.",
+  "This will restart the network service and may cause a brief disconnection. Continue?": "Ciò riavvierà il servizio di rete e potrebbe causare una breve disconnessione. Continuare?",
+  "This will take time. Answer prompts carefully - see notes below.": "Ci vorrà del tempo. Rispondi attentamente alle richieste: vedi le note di seguito.",
+  "This will upgrade this node to Proxmox VE 9 on Debian Trixie.": "Ciò aggiornerà questo nodo a Proxmox VE 9 su Debian Trixie.",
+  "Tick the paths to include in this backup. Press \"Add custom path\" to add a folder or file of your own to the list.": "Spunta i percorsi da includere in questo backup. Premi \"Aggiungi percorso personalizzato\" per aggiungere una cartella o un file all'elenco.",
+  "Tick the paths to remove (they will not be deleted from disk — only from this list):": "Seleziona i percorsi da rimuovere (non verranno eliminati dal disco, solo da questo elenco):",
+  "Time settings configured - Timezone:": "Impostazioni dell'ora configurate - Fuso orario:",
+  "Time synchronization reset to UTC": "La sincronizzazione dell'ora è stata reimpostata su UTC",
+  "Tip: Also mount the VirtIO ISO for drivers and guest agent installer": "Suggerimento: montare anche l'ISO VirtIO per i driver e il programma di installazione dell'agente guest",
+  "Tip: You can install the QEMU Guest Agent inside the VM with:": "Suggerimento: puoi installare QEMU Guest Agent all'interno della VM con:",
+  "Tip: zfs set acltype=posixacl xattr=sa <pool>/<dataset> enables full ACL support.": "Suggerimento: zfs set acltype=posixacl xattr=sa <pool>/<dataset> abilita il supporto ACL completo.",
+  "To allow LXC write access, change the NFS export on the server to include:": "Per consentire l'accesso in scrittura LXC, modificare l'esportazione NFS sul server per includere:",
+  "To assign VFs to VMs or LXCs, edit the configuration manually via the Proxmox web interface. The Physical Function will remain bound to the native driver.": "Per assegnare VF a VM o LXC, modificare manualmente la configurazione tramite l'interfaccia web Proxmox. La Funzione Fisica resterà vincolata al pilota nativo.",
+  "To continue with Add GPU to LXC, first switch the host to GPU -> LXC mode and reboot.": "Per continuare con Aggiungi GPU a LXC, imposta prima l'host su GPU -> modalità LXC e riavvia.",
+  "To copy any of these files verbatim, restore this backup on a host with the same kernel major.minor.": "per copiare uno qualsiasi di questi file alla lettera, ripristinare questo backup su un host con lo stesso kernel major.minor.",
+  "To exit iftop, press q": "Per uscire da iftop, premere q",
+  "To exit iptraf-ng, press x": "Per uscire da iptraf-ng, premere x",
+  "To fix this, do ONE of the following:": "Per risolvere questo problema, esegui UNA delle seguenti operazioni:",
+  "To install host drivers, first remove the GPU from VM passthrough configuration and reboot.": "Per installare i driver host, rimuovere prima la GPU dalla configurazione passthrough della VM e riavviare.",
+  "To install the monitor, reinstall ProxMenux with the latest version": "Per installare il monitor, reinstallare ProxMenux con la versione più recente",
+  "To pass SR-IOV Virtual Functions to a VM, edit the VM configuration manually via the Proxmox web interface.": "Per passare le funzioni virtuali SR-IOV a una VM, modificare manualmente la configurazione della VM tramite l'interfaccia web Proxmox.",
+  "To pass SR-IOV Virtual Functions to a container, edit the LXC configuration manually via the Proxmox web interface. The Physical Function will remain bound to the native driver.": "Per passare le funzioni virtuali SR-IOV a un contenitore, modificare manualmente la configurazione LXC tramite l'interfaccia web Proxmox. La Funzione Fisica resterà vincolata al pilota nativo.",
+  "To remove partial VM:": "Per rimuovere la VM parziale:",
+  "To restore": "Per ripristinare",
+  "To revert changes:": "Per annullare le modifiche:",
+  "To start the VM:": "Per avviare la VM:",
+  "To stop:": "Per interrompere:",
+  "To use Coral from a regular app, install the libedgetpu runtime via the usual method for your distro (community package or build from source). The simplest path is to run an app container that bundles the runtime — e.g. the Frigate Docker image — passing the device through with": "Per utilizzare Coral da una normale app, installa il runtime libedgetpu tramite il solito metodo per la tua distribuzione (pacchetto community o build dal sorgente). Il percorso più semplice è eseguire un contenitore di app che raggruppi il runtime, ad es. l'immagine di Frigate Docker - mentre passa il dispositivo",
+  "To use GPU passthrough, please create a new VM configured with:": "Per utilizzare il passthrough GPU, crea una nuova VM configurata con:",
+  "To use a custom Fastfetch logo, place your ASCII logo file in:\n\n/usr/local/share/fastfetch/logos/\n\nThe file should not exceed 35 lines to fit properly in the terminal.\n\nPress OK to continue and select your logo.": "Per utilizzare un logo Fastfetch personalizzato, inserisci il file del logo ASCII in:\n\n/usr/local/condividi/fastfetch/logos/\n\nIl file non deve superare le 35 righe per adattarsi correttamente al terminale.\n\nPremi OK per continuare e seleziona il tuo logo.",
+  "To use the GPU again in LXC, run Add GPU to LXC from GPUs and Coral-TPU Menu": "Per utilizzare nuovamente la GPU in LXC, esegui Aggiungi GPU a LXC da GPU e menu Coral-TPU",
+  "To use the VM without issues, the host must be restarted before starting it.": "Per utilizzare la VM senza problemi, è necessario riavviare l'host prima di avviarlo.",
+  "To use this share from an LXC, bind-mount it via:": "Per utilizzare questa condivisione da un LXC, esegui il bind-mount tramite:",
+  "Tool exit code:": "Codice di uscita dello strumento:",
+  "Tool output:": "Uscita dello strumento:",
+  "Top memory processes in CT": "Principali processi di memoria in CT",
+  "Total": "Totale",
+  "Total members:": "Membri totali:",
+  "Total routes": "Percorsi totali",
+  "Total size:": "Dimensione totale:",
+  "Translation files:": "File di traduzione:",
+  "Tried pvesm path and manual detection methods": "Ho provato il percorso pvesm e i metodi di rilevamento manuale",
+  "Try Again": "Riprova",
+  "Try a different search term.": "Prova un termine di ricerca diverso.",
+  "Try accessing": "Prova ad accedere",
+  "Try another archive": "Prova un altro archivio",
+  "Try automatic repair of detected issues": "Prova la riparazione automatica dei problemi rilevati",
+  "Two-factor authentication and backup codes will be removed.": "L'autenticazione a due fattori e i codici di backup verranno rimossi.",
+  "Type": "Tipo",
+  "Type the device path EXACTLY to confirm formatting:": "Digitare ESATTAMENTE il percorso del dispositivo per confermare la formattazione:",
+  "Type the full disk path to confirm": "Digitare il percorso completo del disco per confermare",
+  "Type:": "Tipo:",
+  "Type: attached to PVE storage": "Tipo: allegato allo storage PVE",
+  "Typed value does not match selected disk. Operation cancelled.": "Il valore digitato non corrisponde al disco selezionato. Operazione annullata.",
+  "UID in CT": "UID nel CT",
+  "UPGRADE PROMPTS - RECOMMENDED ANSWERS:": "RICHIESTE DI AGGIORNAMENTO - RISPOSTE CONSIGLIATE:",
+  "USB Accelerators:": "Acceleratori USB:",
+  "USB disk target": "destinazione del disco USB",
+  "USB drives mounted now:": "unità USB montate ora:",
+  "USB libedgetpu1": "USB libedgetpu1",
+  "UUP Dump script not found.": "Script UUP Dump non trovato.",
+  "UUp Dump ISO creator Custom": "UUp Dump Creatore ISO Personalizzato",
+  "Udev rules for Coral USB devices added and rules reloaded.": "Aggiunte regole Udev per i dispositivi USB Coral e ricaricate.",
+  "Udev rules for Coral USB devices already exist.": "Esistono già regole Udev per i dispositivi USB Coral.",
+  "Udev rules for Coral USB devices appended and rules reloaded.": "Aggiunte regole Udev per i dispositivi USB Coral e ricaricate.",
+  "Umbrel OS installer script by Helper Scripts\n\nVisit the GitHub repo to learn more, contribute, or support the project:\n\nhttps://community-scripts.github.io/ProxmoxVE/scripts?id=umbrel-os-vm": "Script di installazione del sistema operativo Umbrel di Helper Scripts\n\nVisita il repository GitHub per saperne di più, contribuire o supportare il progetto:\n\nhttps://community-scripts.github.io/ProxmoxVE/scripts?id=umbrel-os-vm",
+  "Unable to detect Proxmox version.": "Impossibile rilevare la versione di Proxmox.",
+  "Understand the security implications of privileged containers": "Comprendere le implicazioni sulla sicurezza dei contenitori privilegiati",
+  "Uninstall Coral drivers and configuration": "Disinstallare i driver e la configurazione Coral",
+  "Uninstall Fail2Ban": "Disinstallare Fail2Ban",
+  "Uninstall Lynis": "Disinstallare Lynis",
+  "Uninstall NFS Server": "Disinstallare il server NFS",
+  "Uninstall NVIDIA drivers and configuration": "Disinstallare i driver e la configurazione NVIDIA",
+  "Uninstall Optimizations": "Disinstallare le ottimizzazioni",
+  "Uninstall ProxMenux": "Disinstallare ProxMenux",
+  "Uninstall Samba Server": "Disinstallare il server Samba",
+  "Uninstall optimizations": "disinstalla le ottimizzazioni",
+  "Uninstallation Summary:": "Riepilogo della disinstallazione:",
+  "Uninstallation completed. Press Enter to continue...": "Disinstallazione completata. Premi Invio per continuare...",
+  "Uninstalling Ceph...": "Disinstallazione di Ceph...",
+  "Uninstalling Fastfetch...": "Disinstallazione di Fastfetch in corso...",
+  "Uninstalling Figurine...": "Disinstallazione di Figurina...",
+  "Uninstalling amdgpu_top...": "Disinstallazione di amdgpu_top in corso...",
+  "Uninstalling current NVIDIA driver before installing new version": "Disinstallazione del driver NVIDIA corrente prima di installare la nuova versione",
+  "Uninstalling intel-gpu-tools...": "Disinstallazione di Intel-Gpu-Tools in corso...",
+  "Uninstalling kexec-tools and removing custom service...": "Disinstallazione di kexec-tools e rimozione del servizio personalizzato in corso...",
+  "Uninstalling log2ram (all versions)...": "Disinstallazione di log2ram (tutte le versioni) in corso...",
+  "Universal Group Configuration:": "Configurazione del gruppo universale:",
+  "Universal Group:": "Gruppo universale:",
+  "Universal NFS server has been completely uninstalled!": "Il server NFS universale è stato completamente disinstallato!",
+  "Universal compatibility: ENABLED": "Compatibilità universale: ABILITATA",
+  "Universal group: NOT CONFIGURED": "Gruppo universale: NON CONFIGURATO",
+  "Universal sharedfiles group configured with": "Gruppo di file condivisi universali configurato con",
+  "Unknown": "Sconosciuto",
+  "Unknown CPU type. IOMMU might not be properly enabled.": "Tipo di CPU sconosciuto. IOMMU potrebbe non essere abilitato correttamente.",
+  "Unknown CPU vendor. Cannot determine IOMMU parameter.": "Fornitore di CPU sconosciuto. Impossibile determinare il parametro IOMMU.",
+  "Unknown GPU": "GPU sconosciuta",
+  "Unknown model": "Modello sconosciuto",
+  "Unknown size": "Dimensioni sconosciute",
+  "Unknown storage controller": "Controller di archiviazione sconosciuto",
+  "Unmount NFS Share": "Smonta condivisione NFS",
+  "Unmount Samba Share": "Smonta condivisione Samba",
+  "Unmount USB drive": "Smontare l'unità USB",
+  "Unmount a USB drive": "Smontare un'unità USB",
+  "Unmount and cleanup (LVM only):": "Smontaggio e pulizia (solo LVM):",
+  "Unmount failed": "Smontaggio non riuscito",
+  "Unmount it before proceeding. The script will verify this at execution.": "Smontalo prima di procedere. Lo script lo verificherà durante l'esecuzione.",
+  "Unmounted": "Non montato",
+  "Unmounted successfully": "Smontato con successo",
+  "Unmounted:": "Non montato:",
+  "Unmounting": "Smontaggio",
+  "Unmounting disk...": "Smontaggio disco...",
+  "Unprivileged": "Senza privilegi",
+  "Unprivileged Container Access": "Accesso al contenitore non privilegiato",
+  "Unprivileged container": "Contenitore non privilegiato",
+  "Unprivileged container selected:": "Contenitore senza privilegi selezionato:",
+  "Unprivileged container — UID offset:": "Contenitore non privilegiato: offset UID:",
+  "Unprivileged containers map their UIDs to high host UIDs (e.g. 100000+), which appear as 'others' on the host filesystem.": "I contenitori non privilegiati mappano i loro UID su UID host elevati (ad esempio 100000+), che appaiono come \"altri\" sul filesystem host.",
+  "Unprivileged: Limited access (more secure)": "Non privilegiato: accesso limitato (più sicuro)",
+  "Unreachable": "Irraggiungibile",
+  "Unsupported Terminal": "Terminale non supportato",
+  "Unsupported format. Only .ova and .ovf files are supported.": "Formato non supportato. Sono supportati solo i file .ova e .ovf.",
+  "Unsupported output format:": "Formato di output non supportato:",
+  "Update Available": "aggiornamento disponibile",
+  "Update Ceph repository (Only if using Ceph):": "Aggiorna repository Ceph (solo se si utilizza Ceph):",
+  "Update Debian repositories to Trixie:": "Aggiorna i repository Debian a Trixie:",
+  "Update Export": "Aggiorna esportazione",
+  "Update Lynis to latest version": "Aggiorna Lynis all'ultima versione",
+  "Update NVIDIA in LXC Containers": "Aggiorna NVIDIA nei contenitori LXC",
+  "Update PVE enterprise repository (Only if using enterprise):": "Aggiorna repository aziendale PVE (solo se si utilizza enterprise):",
+  "Update Proxmox VE Appliance Manager": "Aggiorna Proxmox VE Appliance Manager",
+  "Update Proxmox package lists": "Aggiorna gli elenchi dei pacchetti Proxmox",
+  "Update Share": "Aggiorna condivisione",
+  "Update Status": "Aggiorna stato",
+  "Update and upgrade all system packages": "Aggiorna e aggiorna tutti i pacchetti di sistema",
+  "Update and upgrade system": "aggiornamento e aggiornamento del sistema",
+  "Update cancelled by user": "Aggiornamento annullato dall'utente",
+  "Update completed. Press Enter to continue...": "Aggiornamento completato. Premi Invio per continuare...",
+  "Update kernel to compatible version": "Aggiorna il kernel alla versione compatibile",
+  "Update package index:": "Aggiorna l'indice del pacchetto:",
+  "Update system to latest PVE 8.4+ (if not done already):": "Aggiorna il sistema all'ultimo PVE 8.4+ (se non lo hai già fatto):",
+  "Updated": "Aggiornato",
+  "Updated sharedfiles group to GID: 101000": "Gruppo sharedfiles aggiornato a GID: 101000",
+  "Updates all Proxmox and Debian packages": "Aggiorna tutti i pacchetti Proxmox e Debian",
+  "Updates and Packages Commands": "Comandi per aggiornamenti e pacchetti",
+  "Updates file is empty or unreadable.": "Il file degli aggiornamenti è vuoto o illeggibile.",
+  "Updating APT package lists...": "Aggiornamento degli elenchi di pacchetti APT in corso...",
+  "Updating Debian Bookworm → Trixie in sources.list...": "Aggiornamento di Debian Bookworm → Trixie nel file source.list...",
+  "Updating Figurine binary...": "Aggiornamento del binario Figurine in corso...",
+  "Updating Lynis to the latest version...": "Aggiornamento di Lynis all'ultima versione in corso...",
+  "Updating PVE application manager...": "Aggiornamento del gestore applicazioni PVE...",
+  "Updating amdgpu_top...": "Aggiornamento amdgpu_top in corso...",
+  "Updating cluster certificates...": "Aggiornamento dei certificati cluster in corso...",
+  "Updating initramfs (this may take a minute)...": "Aggiornamento di initramfs (l'operazione potrebbe richiedere un minuto)...",
+  "Updating initramfs for all kernels...": "Aggiornamento di initramfs per tutti i kernel...",
+  "Updating initramfs, GRUB, and EFI boot, patience...": "Aggiornamento di initramfs, GRUB e avvio EFI, pazienza...",
+  "Updating journald to store info-level messages...": "Aggiornamento journald per archiviare messaggi a livello di informazioni in corso...",
+  "Updating kernel panic configuration...": "Aggiornamento della configurazione del kernel panico in corso...",
+  "Updating package lists...": "Aggiornamento degli elenchi dei pacchetti in corso...",
+  "Updating pve-enterprise.list (if present) to Trixie...": "Aggiornamento pve-enterprise.list (se presente) a Trixie...",
+  "Updating release channel configuration...": "Aggiornamento della configurazione del canale di rilascio in corso...",
+  "Upgrade Ceph to compatible version": "Aggiorna Ceph alla versione compatibile",
+  "Upgrade PVE 8 to PVE 9": "Aggiorna PVE 8 a PVE 9",
+  "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Assistente all'aggiornamento: Proxmox VE 8 → 9 (Trixie)",
+  "Upgrade canceled by user": "Aggiornamento annullato dall'utente",
+  "Upgrade one node at a time": "Aggiorna un nodo alla volta",
+  "Upgrade to Proxmox VE 9": "Aggiorna a Proxmox VE 9",
+  "Upgrading NVIDIA utils (Arch)...": "Aggiornamento delle utility NVIDIA (Arch) in corso...",
+  "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "caricare una copia crittografata della chiave su PBS in modo da poterla ripristinare su un host reinstallato solo con una passphrase?",
+  "Upload key to PBS?": "Carica la chiave su PBS?",
+  "Upload to PBS disabled.": "caricamento su PBS disabilitato.",
+  "Upload to PBS enabled. The envelope is uploaded on every encrypted backup.": "caricamento su PBS abilitato.La busta viene caricata su ogni backup crittografato.",
+  "Upload to PBS is currently: no. Pick an action:": "Il caricamento su PBS è attualmente: no.Scegli un'azione:",
+  "Upload to PBS is currently: yes. Pick an action:": "Il caricamento su PBS è attualmente: sì.Scegli un'azione:",
+  "Upload to PBS: enable, disable or rotate the recovery passphrase": "Carica su PBS: abilita, disabilita o ruota la passphrase di ripristino",
+  "Uptime and who is logged in": "Uptime e chi ha effettuato l'accesso",
+  "Use \"Check test progress\" to see results.": "Utilizza \"Controlla l'avanzamento del test\" per visualizzare i risultati.",
+  "Use 'Export to file' to save it and inspect manually.": "Utilizza \"Esporta su file\" per salvarlo e controllarlo manualmente.",
+  "Use 'pct restore' / 'qmrestore' to recover their disks from your VM backups.": "Utilizza 'pct Restore' / 'qmrestore' per ripristinare i loro dischi dai backup della tua VM.",
+  "Use Custom backup and uncheck the conflicting path from the list": "Utilizza il backup personalizzato e deseleziona il percorso in conflitto dall'elenco",
+  "Use Default Settings?": "Utilizzare le impostazioni predefinite?",
+  "Use Download first if you want to save a copy of the current key. Continue?": "utilizzare prima Scarica se si desidera salvare una copia della chiave corrente.Continuare?",
+  "Use SPACE to select, ENTER to confirm": "Usa SPAZIO per selezionare, INVIO per confermare",
+  "Use SPACE to select/deselect, ENTER to confirm": "Utilizzare SPAZIO per selezionare/deselezionare, INVIO per confermare",
+  "Use SSH or terminal access (SSH recommended)": "Utilizza SSH o l'accesso al terminale (consigliato SSH)",
+  "Use a USB disk": "utilizza un disco USB",
+  "Use a custom path": "utilizza un percorso personalizzato",
+  "Use a privileged LXC for NFS server/client workflows.": "Utilizza un LXC privilegiato per i flussi di lavoro server/client NFS.",
+  "Use a privileged LXC for Samba client/server workflows.": "Utilizza un LXC privilegiato per i flussi di lavoro client/server Samba.",
+  "Use an existing SSH private key file on this host": "Utilizza un file di chiave privata SSH esistente su questo host",
+  "Use an existing keyfile": "utilizza un file di chiavi esistente",
+  "Use as-is — keep data and filesystem": "Utilizza così com'è: conserva i dati e il file system",
+  "Use content types according to your use case.": "Utilizza i tipi di contenuto in base al tuo caso d'uso.",
+  "Use default": "usa predefinito",
+  "Use default (Yes)": "Utilizza predefinito (Sì)",
+  "Use default group:": "Utilizza il gruppo predefinito:",
+  "Use enterprise URL if you have subscription.": "Utilizza l'URL aziendale se hai un abbonamento.",
+  "Use existing VirtIO ISO from storage": "Utilizza l'ISO VirtIO esistente dallo spazio di archiviazione",
+  "Use existing filesystem": "Utilizza il file system esistente",
+  "Use existing: mount without formatting": "Usa esistente: monta senza formattazione",
+  "Use images only if the directory is on suitable storage.": "Utilizza le immagini solo se la directory si trova su uno spazio di archiviazione adeguato.",
+  "Use mp1/mp2/... for extra mount points.": "Usa mp1/mp2/... per punti di montaggio aggiuntivi.",
+  "Use only when unprivileged containers cannot meet your needs": "Utilizzare solo quando i contenitori non privilegiati non possono soddisfare le proprie esigenze",
+  "Use option 1 to add a local disk (as Proxmox storage and/or as a host mount).": "Utilizza l'opzione 1 per aggiungere un disco locale (come spazio di archiviazione Proxmox e/o come montaggio host).",
+  "Use option 1 to add an iSCSI target as Proxmox storage.": "Utilizzare l'opzione 1 per aggiungere una destinazione iSCSI come spazio di archiviazione Proxmox.",
+  "Use pigz for faster gzip compression": "usa pigz per una compressione gzip più rapida",
+  "Use the Guided Cleanup option to fix issues safely": "Utilizza l'opzione di pulizia guidata per risolvere i problemi in modo sicuro",
+  "Use the Guided Repair option to fix issues safely": "Utilizza l'opzione di riparazione guidata per risolvere i problemi in modo sicuro",
+  "Use these commands on your Proxmox host to access an LXC container's terminal:": "Utilizza questi comandi sul tuo host Proxmox per accedere al terminale di un contenitore LXC:",
+  "Use tmux or screen to avoid interruptions": "Utilizza tmux o screen per evitare interruzioni",
+  "Use:": "Utilizzo:",
+  "Useful System Commands": "Comandi di sistema utili",
+  "Useful to verify options/content after script execution.": "Utile per verificare opzioni/contenuto dopo l'esecuzione dello script.",
+  "User": "Utente",
+  "User account exists on server": "L'account utente esiste sul server",
+  "User activity and uptime": "Attività dell'utente e tempo di attività",
+  "User chose not to remove NetworkManager": "L'utente ha scelto di non rimuovere NetworkManager",
+  "User chose to exit for manual backup creation.": "L'utente ha scelto di uscire per la creazione manuale del backup.",
+  "Username": "Nome utente",
+  "Username (e.g. root@pam or user@pbs!token):": "Nome utente (ad esempio root@pam o utente@pbs!token):",
+  "Username and password": "Nome utente e password",
+  "Username and password will be cleared.": "Nome utente e password verranno cancellati.",
+  "Username cannot be empty.": "Il nome utente non può essere vuoto.",
+  "Username is correct": "Il nome utente è corretto",
+  "Username on the Borg server that runs \"borg serve\" (typically \"borg\"). This is NOT the admin/root user of the server — that one is asked later only if you choose \"Generate a new key and authorize it\".": "nome utente sul server Borg che esegue \"borg serve\" (tipicamente \"borg\").Questo NON è l'utente amministratore/root del server: verrà richiesto in seguito solo se si sceglie \"Genera una nuova chiave e autorizzala\".",
+  "Username:": "Nome utente:",
+  "Users:": "Utenti:",
+  "Using UUID is recommended over /dev/sdX.": "Si consiglia di utilizzare l'UUID su /dev/sdX.",
+  "Using advanced configuration": "Utilizzando la configurazione avanzata",
+  "Using default Proxmox logo...": "Utilizzo del logo Proxmox predefinito...",
+  "Using existing encryption key:": "Utilizzando la chiave di crittografia esistente:",
+  "Utilities Installation Menu": "Menu di installazione delle utilità",
+  "Utilities Menu": "Menù Utilità",
+  "Utilities Verification": "Verifica delle utenze",
+  "Utilities and Tools": "Utilità e strumenti",
+  "Utilities installation completed": "Installazione delle utilità completata",
+  "VFIO device IDs removed from /etc/modprobe.d/vfio.conf": "ID dispositivo VFIO rimossi da /etc/modprobe.d/vfio.conf",
+  "VFIO modules configured in /etc/modules": "Moduli VFIO configurati in /etc/modules",
+  "VFIO modules configured.": "Moduli VFIO configurati.",
+  "VFIO modules in /etc/modules": "Moduli VFIO in /etc/modules",
+  "VFIO modules removed from /etc/modules": "Moduli VFIO rimossi da /etc/modules",
+  "VFIO orphans cleared and initramfs rebuilt — next boot will free the GPU.": "gli orfani VFIO sono stati cancellati e initramfs ricostruito: il prossimo avvio libererà la GPU.",
+  "VFIO orphans cleared but initramfs rebuild failed; check /var/log/proxmenux logs.": "gli orfani VFIO sono stati cancellati ma la ricostruzione di initramfs non è riuscita;controlla i log /var/log/proxmenux.",
+  "VLAN": "VLAN",
+  "VM": "VM",
+  "VM Conflict Policy": "Politica sui conflitti delle VM",
+  "VM ID": "ID della macchina virtuale",
+  "VM ID:": "ID della macchina virtuale:",
+  "VM Must Be Stopped": "La VM deve essere arrestata",
+  "VM Name": "Nome della macchina virtuale",
+  "VM Storage     (images, backup)": "Archiviazione VM (immagini, backup)",
+  "VM and CT Management Commands": "Comandi di gestione VM e CT",
+  "VM creation cancelled before disk planning.": "Creazione della VM annullata prima della pianificazione del disco.",
+  "VM creation cancelled by user.": "Creazione della VM annullata dall'utente.",
+  "VM creation completed": "Creazione della VM completata",
+  "VM creation completed with GPU passthrough configured.": "Creazione della VM completata con il passthrough GPU configurato.",
+  "VM creation completed. GPU passthrough was not applied.": "Creazione della VM completata. Il passthrough GPU non è stato applicato.",
+  "VM creation completed. GPU passthrough was skipped (no compatible GPU detected).": "Creazione della VM completata. Il passthrough della GPU è stato saltato (nessuna GPU compatibile rilevata).",
+  "VM creation failed or was cancelled during storage setup.": "La creazione della macchina virtuale non è riuscita o è stata annullata durante la configurazione dell'archiviazione.",
+  "VM description configured": "Descrizione della VM configurata",
+  "VM imported successfully": "VM importata correttamente",
+  "VM is running": "La macchina virtuale è in esecuzione",
+  "VM is still running. Export cancelled.": "La VM è ancora in esecuzione. Esportazione annullata.",
+  "VM passthrough configuration failed. Review the log and VM config.": "Configurazione passthrough della VM non riuscita. Esaminare il registro e la configurazione della VM.",
+  "VM passthrough requires exclusive VFIO binding of the GPU.": "Il passthrough della VM richiede l'associazione VFIO esclusiva della GPU.",
+  "VM removed:": "VM rimossa:",
+  "VM selected:": "Macchina virtuale selezionata:",
+  "VM shell created:": "Shell della VM creata:",
+  "VM started": "La VM è stata avviata",
+  "VM stopped": "La macchina virtuale si è arrestata",
+  "VM:": "MV:",
+  "VMID in use": "VMID in uso",
+  "VMID must be a number.": "VMID deve essere un numero.",
+  "VMID of the Borg server LXC on": "VMID del server Borg LXC attivo",
+  "VMs to destroy:": "VM da distruggere:",
+  "VMs, LXCs, network, /etc/pve, users, cron, packages, drivers, ProxMenux state, etc.": "VM, LXC, rete, /etc/pve, utenti, cron, pacchetti, driver, stato ProxMenux, ecc.",
+  "Valid backups for all VMs/CTs": "Backup validi per tutte le VM/CT",
+  "Validating Proxmox 9 repositories (checking 'proxmox-ve' candidate)...": "Convalida dei repository Proxmox 9 (controllo del candidato \"proxmox-ve\")...",
+  "Validating credentials with server": "Convalida delle credenziali con il server",
+  "Validating disk safety...": "Convalida della sicurezza del disco in corso...",
+  "Verbose pool status": "Stato del pool dettagliato",
+  "Verification": "Verifica",
+  "Verify IOMMU group for PCI device": "Verificare il gruppo IOMMU per il dispositivo PCI",
+  "Verify Options > OS Type — currently set to:": "Verifica opzioni > Tipo sistema operativo: attualmente impostato su:",
+  "Verify PVE version (must be 8.4.1 or newer):": "Verifica la versione PVE (deve essere 8.4.1 o successiva):",
+  "Verify active exports:": "Verifica le esportazioni attive:",
+  "Verify bridge assignment and NIC model — change to VirtIO if guest drivers are available": "Verifica l'assegnazione del bridge e il modello NIC: passa a VirtIO se i driver guest sono disponibili",
+  "Verify iSCSI sessions and storage status:": "Verificare le sessioni iSCSI e lo stato di archiviazione:",
+  "Verify inside container:": "Verificare all'interno del contenitore:",
+  "Verify installations": "Verificare le installazioni",
+  "Verify mount:": "Verifica montaggio:",
+  "Verify the conversion:": "Verifica la conversione:",
+  "Verify the credentials. Switching to manual paste mode so you can finish the setup without re-typing the password.": "verifica le credenziali.Passaggio alla modalità Incolla manuale in modo da poter completare la configurazione senza digitare nuovamente la password.",
+  "Verifying Ceph installation...": "Verifica dell'installazione di Ceph in corso...",
+  "Verifying Ceph packages availability...": "Verifica della disponibilità dei pacchetti Ceph in corso...",
+  "Verifying all utilities status": "Verifica dello stato di tutte le utenze",
+  "Verifying disk accessibility in CT": "Verifica dell'accessibilità del disco in CT",
+  "Version": "Versione",
+  "Version Change Detected": "Rilevata modifica della versione",
+  "Version info not available": "Informazioni sulla versione non disponibili",
+  "Version:": "Versione:",
+  "Version: Auto-negotiation (NFSv3/NFSv4)": "Versione: negoziazione automatica (NFSv3/NFSv4)",
+  "Versions shown are compatible with your kernel. Latest available is recommended in most cases.": "Le versioni mostrate sono compatibili con il tuo kernel. Nella maggior parte dei casi si consiglia l'ultima versione disponibile.",
+  "View CIFS Mounts (pvesm + fstab)": "Visualizza montaggi CIFS (pvesm + fstab)",
+  "View Current Exports": "Visualizza le esportazioni correnti",
+  "View Current Mounts": "Visualizza i supporti attuali",
+  "View Current Shares": "Visualizza le azioni correnti",
+  "View Disk Storages": "Visualizza archivi su disco",
+  "View Mount Points": "Visualizza punti di montaggio",
+  "View NFS Mounts (pvesm + fstab)": "Visualizza montaggi NFS (pvesm + fstab)",
+  "View backup metadata": "Visualizza i metadati di backup",
+  "View current paths": "visualizza i percorsi correnti",
+  "View existing folders in /mnt": "Visualizza le cartelle esistenti in /mnt",
+  "View iSCSI Storages": "Visualizza archivi iSCSI",
+  "View raw CT configuration file": "Visualizza il file di configurazione CT grezzo",
+  "View raw VM configuration file": "Visualizza il file di configurazione della VM non elaborato",
+  "View restore plan": "Visualizza il piano di ripristino",
+  "View self-test log": "Visualizza il registro dell'autotest",
+  "VirtIO (advanced - high performance)": "VirtIO (avanzato - alte prestazioni)",
+  "VirtIO ISO not found after selection.": "ISO VirtIO non trovato dopo la selezione.",
+  "VirtIO ISO selection cancelled.": "Selezione ISO VirtIO annullata.",
+  "VirtIO driver ISO downloaded successfully.": "ISO del driver VirtIO scaricato correttamente.",
+  "Virtual Disks Created:": "Dischi virtuali creati:",
+  "Virtual Function": "Funzione virtuale",
+  "Virtual Function (parent PF:": "Funzione virtuale (PF genitore:",
+  "Virtual Machine ID": "ID della macchina virtuale",
+  "Virtual disk": "Disco virtuale",
+  "Virtual disks": "Dischi virtuali",
+  "Virtual display already set to": "Display virtuale già impostato su",
+  "Virtual display changed from": "La visualizzazione virtuale è cambiata da",
+  "Virtual display normalized to vga: std (compatibility)": "Display virtuale normalizzato su VGA: std (compatibilità)",
+  "Virtual display set to": "Display virtuale impostato su",
+  "Virtual interface (normal)": "Interfaccia virtuale (normale)",
+  "Virtualization": "virtualizzazione",
+  "Visit https://osx-proxmox.com for more information.": "Visita https://osx-proxmox.com per ulteriori informazioni.",
+  "Visit the website to discover more scripts, stay updated with the latest updates, and support the project:": "Visita il sito web per scoprire altri script, rimanere aggiornato con gli ultimi aggiornamenti e supportare il progetto:",
+  "Visit the website to discover more scripts, stay updated with the latest updates, and support the project:\n\nhttps://community-scripts.github.io/ProxmoxVE": "Visita il sito web per scoprire altri script, rimanere aggiornato con gli ultimi aggiornamenti e supportare il progetto:\n\nhttps://community-scripts.github.io/ProxmoxVE",
+  "Vulnerability detection": "Rilevamento delle vulnerabilità",
+  "WARNING": "AVVERTIMENTO",
+  "WARNING — This backup contains paths that are risky to restore on a running system:": "ATTENZIONE: questo backup contiene percorsi rischiosi da ripristinare su un sistema in esecuzione:",
+  "WARNING — You selected risky paths for live restore:": "ATTENZIONE: hai selezionato percorsi rischiosi per il ripristino in tempo reale:",
+  "WARNING: All data on selected disk will be ERASED if formatted.": "ATTENZIONE: tutti i dati sul disco selezionato verranno CANCELLATI se formattati.",
+  "WARNING: The NFS server is not affected. The mount directory contents are NOT deleted (data stays on the server).": "ATTENZIONE: il server NFS non è interessato. Il contenuto della directory di montaggio NON viene eliminato (i dati rimangono sul server).",
+  "WARNING: The Samba server is not affected. The mount directory contents are NOT deleted.": "ATTENZIONE: il server Samba non è interessato. Il contenuto della directory di montaggio NON viene eliminato.",
+  "WARNING: The selected directory is not empty!": "ATTENZIONE: La directory selezionata non è vuota!",
+  "WARNING: This disk has a mounted partition.": "ATTENZIONE: questo disco ha una partizione montata.",
+  "WARNING: This disk is also assigned to:": "ATTENZIONE: questo disco è assegnato anche a:",
+  "WARNING: This disk is referenced in a stopped VM/LXC config.": "ATTENZIONE: si fa riferimento a questo disco in una configurazione VM/LXC arrestata.",
+  "WARNING: This is a single GPU system": "ATTENZIONE: questo è un sistema a GPU singola",
+  "WARNING: This may cause a brief disconnection.": "ATTENZIONE: Ciò potrebbe causare una breve disconnessione.",
+  "WARNING: This removes the storage from Proxmox. The NFS server is not affected.": "ATTENZIONE: questo rimuove lo spazio di archiviazione da Proxmox. Il server NFS non è interessato.",
+  "WARNING: This removes the storage from Proxmox. The Samba server is not affected.": "ATTENZIONE: questo rimuove lo spazio di archiviazione da Proxmox. Il server Samba non è interessato.",
+  "WARNING: This will ERASE all data on this disk.": "ATTENZIONE: questo CANCELLERA' tutti i dati su questo disco.",
+  "WARNING: This will FORMAT the disk": "ATTENZIONE: questo formatterà il disco",
+  "WARNING: This will completely remove NFS server from the CT.": "ATTENZIONE: questo rimuoverà completamente il server NFS dal CT.",
+  "WARNING: This will completely remove Samba server from the CT.": "ATTENZIONE: questo rimuoverà completamente il server Samba dal CT.",
+  "WARNING: You are about to remove this Proxmox storage:": "ATTENZIONE: stai per rimuovere questo spazio di archiviazione Proxmox:",
+  "WARNING: You are about to remove this disk mount:": "ATTENZIONE: stai per rimuovere questo montaggio del disco:",
+  "WARNING: this will ERASE EVERYTHING on the disk.": "ATTENZIONE: questo CANCELLERA' TUTTO il disco.",
+  "WILL BE PERMANENTLY ERASED.": "VERRÀ CANCELLATO PERMANENTEMENTE.",
+  "Wait for each node to complete before starting next": "Attendi il completamento di ciascun nodo prima di iniziare il successivo",
+  "Warning": "Avvertimento",
+  "Warning: Auth key should start with 'tskey-'": "Avviso: la chiave di autenticazione deve iniziare con \"tskey-\"",
+  "Warning: Disk Images on CIFS": "Avvertenza: immagini disco su CIFS",
+  "Warning: Limited PCI Reset Support": "Avvertenza: supporto limitato per il ripristino PCI",
+  "Warning: both VMs have autostart enabled (onboot=1).": "Attenzione: entrambe le VM hanno l'avvio automatico abilitato (onboot=1).",
+  "Warnings": "Avvertenze",
+  "Website": "Sito web",
+  "What do you want to do?": "Cosa vuoi fare?",
+  "What would you like to do?": "Cosa ti piacerebbe fare?",
+  "When asked to select a disk, click Load Driver and load the VirtIO drivers.": "Quando viene richiesto di selezionare un disco, fare clic su Carica driver e caricare i driver VirtIO.",
+  "When this GPU is passed through to a VM, the Proxmox host will lose all video output on the physical monitor.": "Quando questa GPU viene passata a una VM, l'host Proxmox perderà tutto l'output video sul monitor fisico.",
+  "Where are the backup archives stored?": "Dove sono archiviati gli archivi di backup?",
+  "Where do you want the host folder?": "Dove vuoi la cartella host?",
+  "Where do you want to mount inside container?": "Dove vuoi montare all'interno del contenitore?",
+  "Where do you want to mount the NFS export?": "Dove vuoi montare l'esportazione NFS?",
+  "Where do you want to mount the Samba share?": "Dove vuoi montare la condivisione Samba?",
+  "Where is the OVA/OVF file located?": "Dove si trova il file OVA/OVF?",
+  "Where to mount inside container?": "Dove montare all'interno del contenitore?",
+  "While the server allows guest listing, no shares are actually accessible without authentication.": "Sebbene il server consenta l'elenco degli ospiti, nessuna condivisione è effettivamente accessibile senza autenticazione.",
+  "Will be configured now": "Verrà configurato ora",
+  "Windows Installation Options": "Opzioni di installazione di Windows",
+  "Windows path:": "Percorso di Windows:",
+  "Wipe all          — erase partitions + metadata": "Cancella tutto: cancella partizioni + metadati",
+  "Wipe all — remove partitions + metadata": "Cancella tutto: rimuovi partizioni + metadati",
+  "Wipe old signatures and partition table (DESTRUCTIVE):": "Cancella le vecchie firme e la tabella delle partizioni (DISTRUTTIVO):",
+  "Wiping existing partition table...": "Cancellazione della tabella delle partizioni esistente...",
+  "Wiping partitions and metadata...": "Cancellazione di partizioni e metadati in corso...",
+  "Wired NICs in backup missing on target:": "Schede NIC cablate nel backup mancanti sulla destinazione:",
+  "With warnings": "Con avvertimenti",
+  "Without Function Level Reset (FLR), passthrough is not considered reliable": "Senza Function Level Reset (FLR), il passthrough non è considerato affidabile",
+  "Without a usable reset path, passthrough reliability is poor and VM": "Senza un percorso di ripristino utilizzabile, l'affidabilità passthrough è scarsa e VM",
+  "Working directory:": "Directory di lavoro:",
+  "Works with LVM, ZFS, and BTRFS storage types": "Funziona con i tipi di archiviazione LVM, ZFS e BTRFS",
+  "Would you like to continue in passthrough-only mode? The libedgetpu APT install will be skipped, the Coral device will still be visible inside the container (e.g. /dev/apex_0), and you can install the runtime yourself or use an app container that bundles it (e.g. the Frigate Docker image).": "Vuoi continuare in modalità solo passthrough? L'installazione di APT libedgetpu verrà saltata, il dispositivo Coral sarà ancora visibile all'interno del contenitore (ad esempio /dev/apex_0) e potrai installare tu stesso il runtime o utilizzare un contenitore dell'app che lo raggruppa (ad esempio l'immagine Frigate Docker).",
+  "Would you like to see the current": "Ti piacerebbe vedere la corrente",
+  "Write access confirmed for user:": "Accesso in scrittura confermato per l'utente:",
+  "Write access confirmed.": "Accesso in scrittura confermato.",
+  "Write access test FAILED for user:": "Test di accesso in scrittura NON FALLITO per l'utente:",
+  "Write access verified for user:": "Accesso in scrittura verificato per l'utente:",
+  "Wrong passphrase": "Passphrase errata",
+  "Yes": "SÌ",
+  "Yes, upload": "Sì, carica",
+  "Yes: set a recovery passphrase now; the encrypted key envelope is uploaded with every backup.": "Sì: imposta subito una passphrase di ripristino;la busta della chiave crittografata viene caricata ad ogni backup.",
+  "You are connected via SSH and selected network-related restore paths.": "Sei connesso tramite SSH e percorsi di ripristino relativi alla rete selezionati.",
+  "You can add it manually through:": "Puoi aggiungerlo manualmente tramite:",
+  "You can add servers manually.": "È possibile aggiungere server manualmente.",
+  "You can enter the export path manually.": "È possibile inserire manualmente il percorso di esportazione.",
+  "You can enter the share name manually.": "È possibile immettere manualmente il nome della condivisione.",
+  "You can now monitor your AMD GPU using:": "Ora puoi monitorare la tua GPU AMD utilizzando:",
+  "You can now monitor your Intel GPU using:": "Ora puoi monitorare la tua GPU Intel utilizzando:",
+  "You can now select Controller/NVMe devices in Storage Plan.": "Ora puoi selezionare i dispositivi Controller/NVMe nel Piano di archiviazione.",
+  "You can reboot later manually with: reboot": "Puoi riavviare manualmente in seguito con: reboot",
+  "You can reboot later manually.": "È possibile riavviare manualmente in seguito.",
+  "You can restore it anytime with": "Puoi ripristinarlo in qualsiasi momento con",
+  "You can restore the backup with": "Puoi ripristinare il backup con",
+  "You can run a security audit with:": "Puoi eseguire un controllo di sicurezza con:",
+  "You can still install amdgpu_top if needed.": "Puoi comunque installare amdgpu_top se necessario.",
+  "You can still install intel-gpu-tools if needed.": "Puoi comunque installare intel-gpu-tools se necessario.",
+  "You can still mount this share for READ-ONLY access.": "Puoi comunque montare questa condivisione per l'accesso di SOLA LETTURA.",
+  "You can use the following credentials to login to the Nextcloud vm:": "È possibile utilizzare le seguenti credenziali per accedere alla VM Nextcloud:",
+  "You haven't added any custom paths yet.": "Non hai ancora aggiunto alcun percorso personalizzato.",
+  "You may need to run 'pveceph install' manually": "Potrebbe essere necessario eseguire manualmente 'pveceph install'",
+  "You must select a logo to continue.": "È necessario selezionare un logo per continuare.",
+  "You must select at least one mount method to continue.": "È necessario selezionare almeno un metodo di montaggio per continuare.",
+  "You need to use username and password authentication.": "È necessario utilizzare l'autenticazione con nome utente e password.",
+  "You selected 'Disk image' content on a CIFS/SMB storage.": "Hai selezionato il contenuto \"Immagine disco\" su un archivio CIFS/SMB.",
+  "You should now be able to access the Proxmox web interface.": "Ora dovresti essere in grado di accedere all'interfaccia web di Proxmox.",
+  "You will need a Tailscale auth key from: https://login.tailscale.com/admin/settings/keys": "Avrai bisogno di una chiave di autenticazione Tailscale da: https://login.tailscale.com/admin/settings/keys",
+  "ZFS ARC config removed (kernel defaults will apply on reboot)": "Configurazione ZFS ARC rimossa (le impostazioni predefinite del kernel verranno applicate al riavvio)",
+  "ZFS ARC configuration file created/updated successfully": "File di configurazione ZFS ARC creato/aggiornato correttamente",
+  "ZFS ARC configuration is up to date": "La configurazione di ZFS ARC è aggiornata",
+  "ZFS ARC optimization completed": "Ottimizzazione ZFS ARC completata",
+  "ZFS Management Commands": "Comandi di gestione ZFS",
+  "ZFS Pool Name": "Nome del pool ZFS",
+  "ZFS auto-snapshot installation and configuration completed": "Installazione e configurazione dello snapshot automatico ZFS completate",
+  "ZFS autotrim already enabled for pool:": "Autotrim ZFS già abilitato per il pool:",
+  "ZFS autotrim disabled for pool:": "Taglio automatico ZFS disabilitato per il pool:",
+  "ZFS autotrim enabled for pool:": "Taglio automatico ZFS abilitato per il pool:",
+  "ZFS autotrim is not supported for pool:": "Il taglio automatico ZFS non è supportato per il pool:",
+  "ZFS autotrim setup completed": "Configurazione dell'assetto automatico ZFS completata",
+  "ZFS command history": "Cronologia dei comandi ZFS",
+  "ZFS configuration": "Configurazione ZFS",
+  "ZFS member detected": "Membro ZFS rilevato",
+  "ZFS not detected. Nothing to disable.": "ZFS non rilevato. Niente da disabilitare.",
+  "ZFS not detected. Skipping ZFS ARC optimization.": "ZFS non rilevato. Saltare l'ottimizzazione ZFS ARC.",
+  "ZFS not detected. Skipping ZFS autotrim.": "ZFS non rilevato. Saltare l'autotrim ZFS.",
+  "ZFS pool": "Piscina ZFS",
+  "ZFS pool created": "Pool ZFS creato",
+  "ZFS pool created and mounted at": "Pool ZFS creato e montato in",
+  "ZFS pool exported:": "Pool ZFS esportato:",
+  "ZFS pool is not available after creation:": "Il pool ZFS non è disponibile dopo la creazione:",
+  "ZFS pool not found:": "Pool ZFS non trovato:",
+  "ZFS pool:": "Piscina ZFS:",
+  "ZFS storage added successfully to Proxmox!": "Lo storage ZFS è stato aggiunto con successo a Proxmox!",
+  "ZFS tools not found. Install zfsutils-linux and retry.": "Strumenti ZFS non trovati. Installa zfsutils-linux e riprova.",
+  "ZFS:": "ZFS:",
+  "Zero all data     — partition table preserved, data wiped": "Azzera tutti i dati: tabella delle partizioni conservata, dati cancellati",
+  "Zero all data — partition table preserved": "Azzera tutti i dati: tabella delle partizioni conservata",
+  "Zeroing partition": "Azzeramento della partizione",
+  "active VF(s)": "FV attive",
+  "active VFs": "VF attive",
+  "active Virtual Functions. Changing its driver binding would destroy every VF.": "funzioni virtuali attive. La modifica del collegamento del driver distruggerebbe ogni VF.",
+  "after copy; source tree is incomplete.": "dopo la copia; l'albero dei sorgenti è incompleto.",
+  "after update.": "dopo l'aggiornamento.",
+  "all_squash,anonuid=65534,anongid=65534": "all_squash,anonuid=65534,anongid=65534",
+  "amdgpu_top installed successfully": "amdgpu_top installato correttamente",
+  "amdgpu_top is already installed:": "amdgpu_top è già installato:",
+  "amdgpu_top is not installed": "amdgpu_top non è installato",
+  "amdgpu_top is up to date": "amdgpu_top è aggiornato",
+  "amdgpu_top uninstalled successfully": "amdgpu_top disinstallato correttamente",
+  "amdgpu_top updated to": "amdgpu_top aggiornato a",
+  "and": "E",
+  "and could not be unmounted — disk may be busy.": "e non è stato possibile smontarlo: il disco potrebbe essere occupato.",
+  "and upgrade the system (disables the enterprise repo)": "e aggiornare il sistema (disabilita il repository aziendale)",
+  "apex device node not found yet; a reboot may be required.": "nodo del dispositivo apex non ancora trovato; potrebbe essere necessario un riavvio.",
+  "apex group and udev rules are in place.": "sono in vigore le regole del gruppo apex e di udev.",
+  "apex group removed.": "gruppo apicale rimosso.",
+  "apex group still has members; left in place:": "il gruppo apicale ha ancora membri; lasciato sul posto:",
+  "apex kernel module not loaded on host. Run \"Install Coral on Host\" first or the container will not see /dev/apex_0.": "Modulo del kernel apex non caricato sull'host. Eseguire prima \"Install Coral on Host\" altrimenti il ​​contenitore non vedrà /dev/apex_0.",
+  "appears to be part of a": "sembra far parte di a",
+  "applying minimal banner patch": "applicando una patch minima per il banner",
+  "apt cache refreshed.": "cache apt aggiornata.",
+  "apt-get exited": "apt-esci",
+  "apt-get update returned warnings. Continuing anyway; check": "apt-get update ha restituito avvisi. Continuando comunque; controllo",
+  "as": "COME",
+  "automatically. Install it manually inside the container.": "automaticamente. Installalo manualmente all'interno del contenitore.",
+  "automatically. Reboot LXC to fully release.": "automaticamente. Riavviare LXC per il rilascio completo.",
+  "available for LXC bind-mounts via 'LXC Mount Manager'": "disponibile per i supporti LXC tramite 'LXC Mount Manager'",
+  "available in this same GPU and TPU menu.": "disponibile nello stesso menu GPU e TPU.",
+  "backup at /etc/fstab.proxmenux.bak": "backup su /etc/fstab.proxmenux.bak",
+  "ban": "divieto",
+  "blocking issue(s).": "problemi di blocco.",
+  "btrfs — Proxmox dir storage (snapshots, compression)": "btrfs — Archiviazione delle directory Proxmox (istantanee, compressione)",
+  "btrfs — snapshots and compression": "btrfs: istantanee e compressione",
+  "but it does not match the one used to create the backup. Replace it with the correct keyfile from the source host and retry.": "ma non corrisponde a quello utilizzato per creare il backup.Sostituirlo con il file di chiavi corretto dall'host di origine e riprovare.",
+  "bytes": "byte",
+  "can write to": "può scrivere a",
+  "chmod 1777 + setfacl o::rwx (applied on the NFS share from this host)": "chmod 1777 + setfacl o::rwx (applicato alla condivisione NFS da questo host)",
+  "chmod failed — NFS server may be restricting changes from root": "chmod non riuscito: il server NFS potrebbe limitare le modifiche da root",
+  "chown/chmod failed — likely unprivileged CT against host bind mount. Falling back to ACL.": "chown/chmod non è riuscito: probabilmente CT non privilegiato contro il montaggio del collegamento dell'host. Ritornando all'ACL.",
+  "content:": "contenuto:",
+  "custom path(s) saved.": "percorsi personalizzati salvati.",
+  "default": "predefinito",
+  "delete the credentials file (if any)": "eliminare il file delle credenziali (se presente)",
+  "delete the matching line from /etc/fstab": "elimina la riga corrispondente da /etc/fstab",
+  "descriptor + VMDK files": "descrittore + file VMDK",
+  "device(s) added to VM": "dispositivi aggiunti alla VM",
+  "devices": "dispositivi",
+  "did not become ready. Skipping.": "non è diventato pronto. Saltare.",
+  "disk(s) added to CT": "disco(i) aggiunto(i) a CT",
+  "disk(s) added to VM": "disco/i aggiunto/i alla VM",
+  "dkms.conf generated.": "dkms.conf generato.",
+  "does not exist on this host. Path not added.": "non esiste su questo host. Percorso non aggiunto.",
+  "does not exist. Exiting.": "non esiste. In uscita.",
+  "driver:": "autista:",
+  "exFAT (portable: Windows/Linux/macOS)": "exFAT (portatile: Windows/Linux/macOS)",
+  "exFAT tools installed successfully.": "Strumenti exFAT installati correttamente.",
+  "ext4  — Proxmox dir storage (recommended)": "ext4: archiviazione della directory Proxmox (consigliato)",
+  "ext4  — recommended, most compatible": "ext4: consigliato, più compatibile",
+  "fail2ban-client could not communicate with the server": "fail2ban-client non è riuscito a comunicare con il server",
+  "fail2ban-client successfully communicated with the server": "fail2ban-client ha comunicato con successo con il server",
+  "failed:": "fallito:",
+  "feranick fork unreachable. Falling back to google/gasket-driver...": "Forcella feranick irraggiungibile. Ritornando a google/gasket-driver...",
+  "feranick/gasket-driver cloned (actively maintained, kernel 6.12+ ready).": "feranick/gasket-driver clonato (mantenuto attivamente, kernel 6.12+ pronto).",
+  "file?": "file?",
+  "files": "file",
+  "files/folders": "file/cartelle",
+  "filesystem. Skipping format.": "filesystem. Saltare il formato.",
+  "filesystem...": "file system...",
+  "for better performance and stability": "per migliori prestazioni e stabilità",
+  "for next boot (needs reboot to take effect)": "per l'avvio successivo (è necessario il riavvio per avere effetto)",
+  "for this policy and may fail after first use or on subsequent VM starts.": "per questa policy e potrebbe non riuscire dopo il primo utilizzo o ai successivi avvii della VM.",
+  "formatted as": "formattato come",
+  "found": "trovato",
+  "from Proxmox web interface (you will be asked)": "dall'interfaccia web di Proxmox (ti verrà chiesto)",
+  "from container": "dal contenitore",
+  "from the GPUs and Coral-TPU menu first, then run this option again.": "prima dal menu GPU e Coral-TPU, quindi esegui nuovamente questa opzione.",
+  "fstab entry exists": "esiste la voce fstab",
+  "fstab line:": "riga fstab:",
+  "fstab references UUIDs/devices not present on this host:": "fstab fa riferimento a UUID/dispositivi non presenti su questo host:",
+  "gasket DKMS entries removed.": "voci DKMS della guarnizione rimosse.",
+  "gawk installed": "gawk installato",
+  "google/gasket-driver cloned (fallback — will apply local patches).": "google/gasket-driver clonato (fallback: applicherà le patch locali).",
+  "gpg not found; trying apt-key fallback": "gpg non trovato; provando il fallback con la chiave apt",
+  "gzip replaced with pigz wrapper successfully": "gzip sostituito con successo con il wrapper pigz",
+  "has": "ha",
+  "has a different MAC than the backup — update any DHCP static reservation": "ha un MAC diverso da quello del backup: aggiorna qualsiasi prenotazione statica DHCP",
+  "has a new MAC": "ha un nuovo MAC",
+  "has only": "ha solo",
+  "host fstab only (not registered as Proxmox storage)": "solo host fstab (non registrato come archivio Proxmox)",
+  "hostpci entries for all IOMMU group devices": "voci hostpci per tutti i dispositivi del gruppo IOMMU",
+  "hostpci entries for selected GPU functions (full IOMMU group will be enforced after reboot)": "voci hostpci per le funzioni GPU selezionate (il gruppo IOMMU completo verrà applicato dopo il riavvio)",
+  "hour(s)": "ore)",
+  "iSCSI Content Type": "Tipo di contenuto iSCSI",
+  "iSCSI Daemon (iscsid): RUNNING": "Demone iSCSI (iscsid): IN ESECUZIONE",
+  "iSCSI Daemon (iscsid): STOPPED": "Demone iSCSI (iscsid): ARRESTATO",
+  "iSCSI Host Manager - Proxmox Host": "Gestore host iSCSI - Host Proxmox",
+  "iSCSI Initiator: AVAILABLE": "Iniziatore iSCSI: DISPONIBILE",
+  "iSCSI Initiator: NOT INSTALLED": "Iniziatore iSCSI: NON INSTALLATO",
+  "iSCSI Portal": "Portale iSCSI",
+  "iSCSI Storages in Proxmox": "Archiviazione iSCSI in Proxmox",
+  "iSCSI Storages:": "Archiviazione iSCSI:",
+  "iSCSI discovery failed": "Rilevamento iSCSI non riuscito",
+  "iSCSI port": "porta iSCSI",
+  "iSCSI service is running on the target": "Il servizio iSCSI è in esecuzione sulla destinazione",
+  "iSCSI storage added successfully to Proxmox!": "Spazio di archiviazione iSCSI aggiunto con successo a Proxmox!",
+  "iSCSI storage provides raw block devices for VM disk images.": "Lo storage iSCSI fornisce dispositivi a blocchi grezzi per le immagini del disco della VM.",
+  "iSCSI tools installed": "Strumenti iSCSI installati",
+  "iftop usage": "utilizzo iftop",
+  "imported:": "importato:",
+  "in CT": "nella CT",
+  "initramfs updated": "initramfs aggiornato",
+  "initramfs updated.": "initramfs aggiornato.",
+  "installed but command not immediately available": "installato ma comando non immediatamente disponibile",
+  "installed correctly and available": "installato correttamente e disponibile",
+  "installed in CT": "installato in CT",
+  "installed inside CT": "installato all'interno del CT",
+  "installed successfully.": "installato con successo.",
+  "intel-gpu-tools installed successfully": "intel-gpu-tools installato correttamente",
+  "intel-gpu-tools is already installed:": "intel-gpu-tools è già installato:",
+  "intel-gpu-tools is up to date": "intel-gpu-tools è aggiornato",
+  "intel-gpu-tools uninstalled successfully": "intel-gpu-tools disinstallato correttamente",
+  "intel-gpu-tools updated to": "intel-gpu-tools aggiornato a",
+  "intel_iommu/amd_iommu is set in cmdline but no IOMMU groups exist — IOMMU appears disabled in BIOS. Enable VT-d / AMD-Vi in firmware before continuing.": "intel_iommu/amd_iommu è impostato in cmdline ma non esistono gruppi IOMMU: IOMMU appare disabilitato nel BIOS. Abilita VT-d / AMD-Vi nel firmware prima di continuare.",
+  "interfaces": "interfacce",
+  "into an LXC.": "in un LXC.",
+  "iperf3 - Bandwidth test": "iperf3 - Test della larghezza di banda",
+  "iperf3 - Bandwidth test (Client mode)": "iperf3 - Test della larghezza di banda (modalità client)",
+  "iperf3 - Bandwidth test (Server mode)": "iperf3 - Test della larghezza di banda (modalità Server)",
+  "iperf3 client": "client iperf3",
+  "iperf3 client output": "output del client iperf3",
+  "iperf3 server": "server iperf3",
+  "iperf3 server is running on": "è in esecuzione il server iperf3",
+  "iperf3 server output": "output del server iperf3",
+  "iperf3 test failed": "test iperf3 fallito",
+  "iptraf-ng usage": "utilizzo di iptraf-ng",
+  "is UNPRIVILEGED.": "è SENZA PRIVILEGI.",
+  "is a Physical Function with": "è una funzione fisica con",
+  "is already assigned to the following VM(s) or CT(s):": "è già assegnato alle seguenti VM o CT:",
+  "is already installed. Do you want to reinstall it? This will perform a clean uninstall first.": "è già installato. Vuoi reinstallarlo? Verrà eseguita prima una disinstallazione pulita.",
+  "is already unprivileged.": "è già senza privilegi.",
+  "is an SR-IOV Virtual Function (VF). Its parent Physical Function is": "è una funzione virtuale SR-IOV (VF). La sua funzione fisica principale è",
+  "is in use by running VM": "è in uso eseguendo VM",
+  "is in use by the following running VM(s) or CT(s):": "è utilizzato dalle seguenti VM o CT in esecuzione:",
+  "is mounted at": "è montato a",
+  "is not configured as machine type q35.": "non è configurato come tipo macchina q35.",
+  "is not in the patch.sh supported list. The patch may no-op or fail; review keylase/nvidia-patch README before continuing.": "non è nell'elenco supportato da patch.sh. La patch potrebbe non funzionare o fallire; rivedere il README di keylase/nvidia-patch prima di continuare.",
+  "is not supported by the official Google libedgetpu APT repository.": "non è supportato dal repository APT ufficiale di Google libedgetpu.",
+  "is referenced in the following stopped VM(s)/CT(s):": "viene fatto riferimento nelle seguenti VM/CT arrestati:",
+  "journald MaxLevelStore is adequate for auth logging": "journald MaxLevelStore è adeguato per la registrazione di autenticazione",
+  "journald drop-in created: /etc/systemd/journald.conf.d/proxmenux-loglevel.conf": "drop-in journald creato: /etc/systemd/journald.conf.d/proxmenux-loglevel.conf",
+  "journald log level restored": "livello di registro journald ripristinato",
+  "journald restarted - auth messages will now be stored": "journald riavviato: i messaggi di autenticazione verranno ora archiviati",
+  "jq is required for this operation but is not installed.": "jq è necessario per questa operazione ma non è installato.",
+  "jq is required to apply updates from this menu.": "jq è necessario per applicare gli aggiornamenti da questo menu.",
+  "jq not available — skipping rollback execution": "jq non disponibile: salta l'esecuzione del rollback",
+  "keep-daily (0 disables)": "keep-daily (0 disabilita)",
+  "keep-hourly (0 disables)": "keep-hourly (0 disabilita)",
+  "keep-last (0 disables)": "mantieni ultimo (0 disabilita)",
+  "keep-monthly (0 disables)": "mantieni-mensile (0 disabilita)",
+  "keep-weekly (0 disables)": "mantieni-settimanale (0 disabilita)",
+  "keep-yearly (0 disables)": "mantenimento annuale (0 disabilita)",
+  "keeping current settings": "mantenendo le impostazioni attuali",
+  "kexec configured successfully. Use the command: reboot-quick": "kexec configurato correttamente. Usa il comando: reboot-quick",
+  "kexec-pve service enabled": "Servizio kexec-pve abilitato",
+  "kexec-pve service file created": "File di servizio kexec-pve creato",
+  "kexec-tools and related settings removed": "kexec-tools e impostazioni correlate rimossi",
+  "kexec-tools installed successfully": "kexec-tools è stato installato correttamente",
+  "kexec-tools is not installed or already removed.": "kexec-tools non è installato o è già stato rimosso.",
+  "log2ram completely removed from system": "log2ram completamente rimosso dal sistema",
+  "manually inside the container before starting it.": "manualmente all'interno del contenitore prima di avviarlo.",
+  "manually inside the container.": "manualmente all'interno del contenitore.",
+  "maximum performance": "massime prestazioni",
+  "may be closed — trying discovery anyway...": "potrebbe essere chiuso: prova comunque la scoperta...",
+  "missing": "mancante",
+  "mkfs.btrfs not found. Install btrfs-progs and retry.": "mkfs.btrfs non trovato. Installa btrfs-progs e riprova.",
+  "more": "Di più",
+  "mount.cifs command not found after installation.": "Comando mount.cifs non trovato dopo l'installazione.",
+  "mount.nfs command not found after installation.": "Comando mount.nfs non trovato dopo l'installazione.",
+  "never": "mai",
+  "nftables not available - using iptables ban action": "nftables non disponibile: utilizzo dell'azione di divieto di iptables",
+  "no": "no",
+  "no (kdf=none, not needed)": "no (kdf=none, non necessario)",
+  "no (no escrow blob — set a recovery passphrase to enable recovery)": "no (nessun blob di deposito a garanzia: imposta una passphrase di ripristino per abilitare il ripristino)",
+  "no passphrase": "nessuna passphrase",
+  "no password": "nessuna password",
+  "no_root_squash": "no_root_zucca",
+  "non-ProxMenux .tar archive(s) in this path": "archivi .tar non ProxMenux in questo percorso",
+  "not found.": "non trovato.",
+  "not installed": "non installato",
+  "not reliable on this hardware due to the following limitations": "non affidabile su questo hardware a causa delle seguenti limitazioni",
+  "nouveau driver has been blacklisted.": "nouveau driver è stato inserito nella lista nera.",
+  "nouveau module unloaded after initramfs rebuild.": "nouveau modulo scaricato dopo la ricostruzione di initramfs.",
+  "nouveau module unloaded successfully.": "nouveau modulo scaricato con successo.",
+  "nouveau still active. Proceeding with installation. A reboot will be required for the driver to work.": "nouveau ancora attivo. Procedere con l'installazione. Sarà necessario un riavvio affinché il driver funzioni.",
+  "now": "adesso",
+  "now?": "Ora?",
+  "nvidia-smi not found after install. Check log:": "nvidia-smi non trovato dopo l'installazione. Controlla il registro:",
+  "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi non trovato nel PATH. Verificare l'installazione del driver.",
+  "nvidia-smi not found in container": "nvidia-smi non trovato nel contenitore",
+  "of": "Di",
+  "of free disk space.": "di spazio libero su disco.",
+  "older firmware may increase passthrough instability": "il firmware precedente può aumentare l'instabilità del passthrough",
+  "on SSD/NVMe pools that support discard": "su pool SSD/NVMe che supportano l'eliminazione",
+  "openssl encryption failed.": "La crittografia openssl non è riuscita.",
+  "openssl is not installed — cannot create recovery copy. Install openssl and retry.": "openssl non è installato: impossibile creare una copia di ripristino. Installa openssl e riprova.",
+  "or format it manually using external tools.": "oppure formattarlo manualmente utilizzando strumenti esterni.",
+  "or use the ProxMenux LXC Mount Manager.": "oppure utilizzare ProxMenux LXC Mount Manager.",
+  "orphan iface lines, no impact on restore": "Linee iface orfane, nessun impatto sul ripristino",
+  "other .tar archive(s) — not ProxMenux host backups (e.g. PVE vzdump or unrelated tarballs).": "altri archivi .tar — non backup dell'host ProxMenux (ad esempio PVE vzdump o tarball non correlati).",
+  "packages (this may take a few minutes)...": "pacchetti (l'operazione potrebbe richiedere alcuni minuti)...",
+  "packages.": "pacchetti.",
+  "parent PF:": "PF genitore:",
+  "partition(s). Partition table preserved.": "partizione(i). Tabella delle partizioni conservata.",
+  "paths for next boot (/etc/pve, guests, drivers, ...)": "percorsi per l'avvio successivo (/etc/pve, guest, driver, ...)",
+  "pci_passthrough_helpers.sh missing — SR-IOV / orphan-audio guards will be skipped": "pci_passthrough_helpers.sh mancante: le protezioni SR-IOV/orphan-audio verranno ignorate",
+  "pct exec authorization failed": "autorizzazione pct exec non riuscita",
+  "pct push failed. Check log:": "PCT push non riuscito. Controlla il registro:",
+  "pending (reboot required to enumerate full group)": "in sospeso (riavvio necessario per enumerare il gruppo completo)",
+  "pigz configuration completed": "configurazione pigz completata",
+  "pigz enabled in vzdump configuration": "pigz abilitato nella configurazione vzdump",
+  "pigz installed successfully": "pigz installato con successo",
+  "pigz removed": "maiale rimosso",
+  "pigz wrapper script created": "Script wrapper pigz creato",
+  "port": "porta",
+  "portmapper/rpcbind has been disabled and removed": "portmapper/rpcbind è stato disabilitato e rimosso",
+  "proxmox-backup-client reported:": "proxmox-backup-client segnalato:",
+  "proxmox-boot-tool refreshed": "proxmox-boot-tool aggiornato",
+  "pve-enterprise.list update skipped (no change)": "Aggiornamento pve-enterprise.list saltato (nessuna modifica)",
+  "pve-enterprise.list updated to Trixie": "pve-enterprise.list aggiornato a Trixie",
+  "pvecm command not found (might not be in a cluster)": "Comando pvecm non trovato (potrebbe non essere in un cluster)",
+  "pvesm command found": "trovato il comando pvesm",
+  "pvesm command not found. This should not happen on Proxmox.": "Comando pvesm non trovato. Questo non dovrebbe accadere su Proxmox.",
+  "pvesm not available.": "pvesm non disponibile.",
+  "pvesm not found.": "pvesm non trovato.",
+  "pvesm path failed, trying manual detection...": "Percorso pvesm non riuscito, tentativo di rilevamento manuale...",
+  "pvesm status failed": "stato pvesm non riuscito",
+  "raw USB disk — no filesystem (will be FORMATTED)": "Disco USB grezzo: nessun file system (verrà FORMATTATO)",
+  "reboot-quick alias added": "Aggiunto alias riavvio rapido",
+  "recommended": "raccomandato",
+  "remapped users": "utenti rimappati",
+  "remove the (now-empty) directory if possible": "rimuovere la directory (ora vuota) se possibile",
+  "removed from Proxmox": "rimosso da Proxmox",
+  "removed successfully from Proxmox.": "rimosso con successo da Proxmox.",
+  "requires the package": "richiede il pacchetto",
+  "restarted successfully": "riavviato con successo",
+  "restoring /etc/network would lose connectivity": "il ripristino di /etc/network perderebbe la connettività",
+  "restoring on:": "ripristino il:",
+  "retries": "riprova",
+  "reverse proxy": "procura inversa",
+  "root and real users only": "solo utenti root e reali",
+  "rpcbind service has been disabled and stopped": "Il servizio rpcbind è stato disabilitato e interrotto",
+  "running": "corsa",
+  "safe paths now (configs, packages, /etc, /root, ...)": "percorsi sicuri ora (configurazioni, pacchetti, /etc, /root, ...)",
+  "same MAC": "stesso MAC",
+  "seconds (default)": "secondi (predefinito)",
+  "see log:": "vedi registro:",
+  "selected path(s):": "percorso/i selezionato/i:",
+  "server": "server",
+  "server IP or hostname:": "IP del server o nome host:",
+  "server?": "server?",
+  "servers found on the network.": "server trovati sulla rete.",
+  "servers found.": "server trovati.",
+  "sha256sum not found. Cannot verify Borg binary.": "sha256sum non trovato. Impossibile verificare il binario Borg.",
+  "showmount command is not working properly.": "il comando showmount non funziona correttamente.",
+  "showmount command not found after installation.": "Comando showmount non trovato dopo l'installazione.",
+  "single portable archive": "unico archivio portatile",
+  "skipped (already exist)": "saltato (già esistente)",
+  "smbclient command is not working properly.": "Il comando smbclient non funziona correttamente.",
+  "smbclient command not found after installation.": "Comando smbclient non trovato dopo l'installazione.",
+  "sources.list update skipped (no change)": "Aggiornamento di source.list saltato (nessuna modifica)",
+  "sources.list updated to Trixie": "source.list aggiornato a Trixie",
+  "ssh-keygen failed. Cannot create a new SSH key.": "ssh-keygen non è riuscito. Impossibile creare una nuova chiave SSH.",
+  "standard performance": "prestazione standard",
+  "start/restart failures and reset instability.": "errori di avvio/riavvio e ripristino di instabilità.",
+  "started successfully.": "iniziato con successo.",
+  "started.": "iniziato.",
+  "startup/restart errors are likely.": "sono probabili errori di avvio/riavvio.",
+  "stop source VM first": "arrestare prima la VM di origine",
+  "stopped": "fermato",
+  "storage yet.": "ancora spazio di archiviazione.",
+  "storage(s) from backup exist on target": "sulla destinazione esistono archivi dal backup",
+  "storage.": "conservazione.",
+  "successfully formatted with": "formattato con successo con",
+  "suggested:": "suggerito:",
+  "switch_gpu_mode.sh was not found.": "switch_gpu_mode.sh non è stato trovato.",
+  "sysfs ROM dump failed — trying ACPI VFCT table...": "Il dump della ROM sysfs non è riuscito: provo la tabella ACPI VFCT...",
+  "systemctl restart networking failed:": "systemctl riavvio della rete non riuscito:",
+  "systemd OnCalendar expression": "espressione systemd OnCalendar",
+  "this distribution": "questa distribuzione",
+  "to": "A",
+  "to CT": "alla TC",
+  "to VM": "a VM",
+  "to move the GPU safely.": "per spostare la GPU in sicurezza.",
+  "to run without being killed by the OOM killer.": "correre senza essere ucciso dal killer OOM.",
+  "to sharedfiles group": "al gruppo sharedfiles",
+  "total": "totale",
+  "umount the path if currently mounted": "smontare il percorso se attualmente montato",
+  "updating NVIDIA userspace libs": "aggiornamento delle librerie dello spazio utente NVIDIA",
+  "user packages missing — will be installed automatically:": "pacchetti utente mancanti: verranno installati automaticamente:",
+  "users": "utenti",
+  "users (for unprivileged compatibility)": "utenti (per compatibilità non privilegiata)",
+  "using": "utilizzando",
+  "using direct path (not guaranteed to survive reboots).": "utilizzando il percorso diretto (non è garantito che sopravviva ai riavvii).",
+  "vCPUs:": "vCPU:",
+  "vfio-pci IDs configured": "ID vfio-pci configurati",
+  "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "ID vfio-pci in /etc/modprobe.d/vfio.conf",
+  "vzdump backup speed optimization completed": "Ottimizzazione della velocità di backup di vzdump completata",
+  "was": "era",
+  "wipefs failed on": "wipefs non è riuscito",
+  "with": "con",
+  "with the password you provided.": "con la password che hai fornito.",
+  "xfs   — Proxmox dir storage (large files and VMs)": "xfs: archiviazione di directory Proxmox (file di grandi dimensioni e VM)",
+  "xfs   — better for large files": "xfs: migliore per file di grandi dimensioni",
+  "years old": "anni",
+  "yes": "sì",
+  "yes (scrypt-unlock passphrase stored)": "sì (passphrase di sblocco criptato memorizzata)",
+  "yes (survives reboot)": "sì (sopravvive al riavvio)",
+  "yes (via PBS escrow + recovery passphrase)": "sì (tramite deposito a garanzia PBS + passphrase di ripristino)",
+  "zeroed.": "azzerato.",
+  "zfs   — Proxmox ZFS pool storage": "zfs: spazio di archiviazione del pool Proxmox ZFS",
+  "zfs-auto-snapshot installed successfully": "zfs-auto-snapshot installato correttamente",
+  "zfs-auto-snapshot is already installed": "zfs-auto-snapshot è già installato",
+  "zfs-auto-snapshot removed (existing snapshots preserved on the pool)": "zfs-auto-snapshot rimosso (istantanee esistenti conservate nel pool)",
+  "zpool command not found. Install zfsutils-linux and retry.": "Comando zpool non trovato. Installa zfsutils-linux e riprova.",
+  "zpool not found. Install zfsutils-linux and retry.": "zpool non trovato. Installa zfsutils-linux e riprova.",
+  "— Full/Custom restore will skip kernel-tied paths": "- Il ripristino completo/personalizzato salterà i percorsi legati al kernel",
+  "— disk may be busy. Skipping fstab removal.": "— il disco potrebbe essere occupato. Saltare la rimozione di fstab.",
+  "— restore proceeds as same-version (verified safe)": "- il ripristino procede come se fosse la stessa versione (sicuro verificato)",
+  "— safe restore mode will skip boot/kernel/apt config": "- la modalità di ripristino sicuro salterà la configurazione boot/kernel/apt",
+  "— that part works on any distro and is harmless.": "- quella parte funziona su qualsiasi distribuzione ed è innocua.",
+  "• Both: mounts twice (pvesm + an independent fstab entry)": "• Entrambi: si monta due volte (pvesm + una voce fstab indipendente)",
+  "• Both: registers as Proxmox storage AND keeps the mount available for LXC bind-mounts": "• Entrambi: si registra come memoria Proxmox E mantiene il supporto disponibile per i supporti di collegamento LXC",
+  "• Both: two independent CIFS mounts (one for Proxmox UI, one for LXC bind-mounts with open perms)": "• Entrambi: due montaggi CIFS indipendenti (uno per l'interfaccia utente Proxmox, uno per i montaggi di collegamento LXC con permessi aperti)",
+  "• Clean up remapped users": "• Ripulire gli utenti rimappati",
+  "• Host fstab: mounted at a path you choose, NOT visible as Proxmox storage": "• Host fstab: montato su un percorso scelto, NON visibile come spazio di archiviazione Proxmox",
+  "• Host fstab: mounted at host path only, for LXC bind-mounts (NOT visible as Proxmox storage)": "• Host fstab: montato solo sul percorso host, per montaggi bind LXC (NON visibile come spazio di archiviazione Proxmox)",
+  "• Host fstab: mounted with open uid/gid/file_mode at a path you choose, ideal for LXC bind-mounts": "• Host fstab: montato con open uid/gid/file_mode in un percorso scelto, ideale per i montaggi bind LXC",
+  "• Proxmox storage (pvesm): visible in Datacenter > Storage, mount at /mnt/pve/<id>": "• Archiviazione Proxmox (pvesm): visibile in Datacenter > Archiviazione, montare su /mnt/pve/<id>",
+  "• Proxmox storage (pvesm): visible in Datacenter > Storage, usable for VMs/backups/ISOs": "• Storage Proxmox (pvesm): visibile in Datacenter > Storage, utilizzabile per VM/backup/ISO",
+  "• Remove Samba groups": "• Rimuovere i gruppi Samba",
+  "• Remove all Samba users": "• Rimuovere tutti gli utenti Samba",
+  "• Remove all exports": "• Rimuovere tutte le esportazioni",
+  "• Remove all shares": "• Rimuovere tutte le condivisioni",
+  "• Remove universal sharedfiles group": "• Rimuovere il gruppo file condivisi universale",
+  "• Stop all NFS services": "• Arrestare tutti i servizi NFS",
+  "• Stop all Samba services": "• Interrompere tutti i servizi Samba",
+  "• Uninstall NFS packages": "• Disinstallare i pacchetti NFS",
+  "• Uninstall Samba packages": "• Disinstallare i pacchetti Samba",
+  "← Return": "← Ritorno",
+  "− Remove a path": "− Rimuovere un percorso",
+  "──── [ Finish and continue ] ────": "──── [Finisci e continua] ────",
+  "─────── Custom profile (choose paths manually) ───────": "─────── Profilo personalizzato (scegli i percorsi manualmente) ───────",
+  "────────────────── Default profile ───────────────────": "────────────────── Profilo predefinito───────────────────",
+  "⚠ Disk data will NOT be erased.": "⚠ I dati del disco NON verranno cancellati.",
+  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ Il disco verrà smontato e rimosso da /etc/fstab.",
+  "⚠ The /etc/fstab entry will be removed.": "⚠ La voce /etc/fstab verrà rimossa.",
+  "⚠ The disk will be unmounted.": "⚠ Il disco verrà smontato."
+}
diff --git a/lang/pt.json b/lang/pt.json
new file mode 100644
index 00000000..42f6acf5
--- /dev/null
+++ b/lang/pt.json
@@ -0,0 +1,5231 @@
+{
+  "# Alternative if you prefer screen": "# Alternativa se você preferir tela",
+  "# Recommended: avoids disconnection during upgrade": "# Recomendado: evita desconexão durante a atualização",
+  "(Checked entries will be removed. Uncheck to keep in VM.)": "(As entradas marcadas serão removidas. Desmarque para manter na VM.)",
+  "(Import is selected by default — required for disk image imports)": "(A importação é selecionada por padrão – necessária para importações de imagens de disco)",
+  "(Only the host directory is modified. Nothing inside the container is changed.": "(Apenas o diretório host é modificado. Nada dentro do contêiner é alterado.",
+  "(common default on Debian/LXC: PermitRootLogin prohibit-password).": "(padrão comum no Debian/LXC: PermitRootLogin proíbe-senha).",
+  "(disabled)": "(desativado)",
+  "(e.g.": "(por ex.",
+  "(for unprivileged LXCs)": "(para LXCs sem privilégios)",
+  "(if only privileged LXCs need write access)": "(se apenas LXCs privilegiados precisarem de acesso de gravação)",
+  "(make.log not found — DKMS may have failed before invoking make)": "(make.log não encontrado — DKMS pode ter falhado antes de invocar make)",
+  "(need ≥ 1024MB)": "(precisa de ≥ 1024 MB)",
+  "(no credentials file — guest mode)": "(sem arquivo de credenciais – modo visitante)",
+  "(none)": "(nenhum)",
+  "(not mounted — will be mounted)": "(não montado — será montado)",
+  "(only on SSD/NVMe) to protect your disk": "(somente em SSD/NVMe) para proteger seu disco",
+  "(parent PF:": "(pai PF:",
+  "(recommended)": "(recomendado)",
+  "(same MAC — restored config adjusted automatically)": "(mesmo MAC - configuração restaurada ajustada automaticamente)",
+  ")": ")",
+  "+ Add a path": "+ Adicione um caminho",
+  "+ Add new Borg target": "+ Adicionar novo alvo Borg",
+  "+ Add new PBS manually": "+ Adicione novo PBS manualmente",
+  "- Delete a saved target": "- Excluir um alvo salvo",
+  "/backup": "/backup",
+  "/etc/exports file does not exist.": "O arquivo /etc/exports não existe.",
+  "/etc/fstab updated — permissions will persist after reboot": "/etc/fstab atualizado – as permissões persistirão após a reinicialização",
+  "/etc/network controls active interfaces. Applying may immediately change or drop network connectivity, including active SSH sessions.": "/etc/network controla interfaces ativas. A inscrição pode alterar ou eliminar imediatamente a conectividade de rede, incluindo sessões SSH ativas.",
+  "/etc/network/interfaces uses allow-hotplug. Renaming interfaces via systemd .link can break that flow — review the file after reboot.": "/etc/network/interfaces usa permitir-hotplug. Renomear interfaces via systemd .link pode interromper esse fluxo – revise o arquivo após a reinicialização.",
+  "/etc/pve is managed by pmxcfs (cluster filesystem). Applying this on a running node can corrupt cluster state. Use 'Export to file' and apply it manually during a maintenance window.": "/etc/pve é gerenciado por pmxcfs (sistema de arquivos cluster). Aplicar isso em um nó em execução pode corromper o estado do cluster. Use 'Exportar para arquivo' e aplique-o manualmente durante uma janela de manutenção.",
+  "/etc/samba/smb.conf file does not exist.": "O arquivo /etc/samba/smb.conf não existe.",
+  "/var/lib/pve-cluster is live cluster data. Never restore this while the node is running. Use 'Export to file' for manual recovery only.": "/var/lib/pve-cluster são dados de cluster ativos. Nunca restaure isso enquanto o nó estiver em execução. Use 'Exportar para arquivo' apenas para recuperação manual.",
+  "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump (caminho vzdump padrão do Proxmox)",
+  "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump (padrão Proxmox)",
+  "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = sticky bit + rwx para todos. Nenhum grupo compartilhado é necessário.",
+  "====== PVE UPDATE COMPLETED ======": "====== ATUALIZAÇÃO PVE CONCLUÍDA ======",
+  "A VirtIO ISO already exists. Do you want to overwrite it?": "Já existe uma ISO do VirtIO. Você quer sobrescrevê-lo?",
+  "A ZFS pool with this name already exists.": "Já existe um pool ZFS com esse nome.",
+  "A ZFS pool with this name already exists:": "Já existe um pool ZFS com este nome:",
+  "A complete restore will:": "Uma restauração completa irá:",
+  "A host reboot is required after this change.": "Uma reinicialização do host é necessária após essa alteração.",
+  "A host reboot is required before starting the VM. Reboot now?": "É necessária uma reinicialização do host antes de iniciar a VM. Reiniciar agora?",
+  "A job with this ID already exists.": "Já existe um trabalho com este ID.",
+  "A keyfile is installed at:": "Um arquivo-chave está instalado em:",
+  "A newer version is available:": "Uma versão mais recente está disponível:",
+  "A reboot is required after installation to load the new kernel modules.": "Uma reinicialização é necessária após a instalação para carregar os novos módulos do kernel.",
+  "A reboot is required for VFIO binding to take effect. Do you want to restart now?": "É necessária uma reinicialização para que a ligação VFIO entre em vigor. Quer reiniciar agora?",
+  "A reboot is required to apply the new GPU mode. Do you want to restart now?": "É necessária uma reinicialização para aplicar o novo modo GPU. Quer reiniciar agora?",
+  "A reboot is required to finish the restore.": "Uma reinicialização é necessária para concluir a restauração.",
+  "A reboot will be required to complete the restore.": "Será necessária uma reinicialização para concluir a restauração.",
+  "A server reboot is recommended for all changes to take full effect.": "Uma reinicialização do servidor é recomendada para que todas as alterações tenham efeito total.",
+  "A system reboot is recommended to ensure all changes take effect.": "Recomenda-se uma reinicialização do sistema para garantir que todas as alterações tenham efeito.",
+  "ACL Status:": "Status da ACL:",
+  "ACL permissions applied for local access for user:": "Permissões ACL aplicadas para acesso local do usuário:",
+  "ADVANCED SETTINGS COMPLETE": "CONFIGURAÇÕES AVANÇADAS CONCLUÍDAS",
+  "ALL DATA ON": "TODOS OS DADOS EM",
+  "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "TODOS OS DADOS NESTE DISCO SERÃO PERMANENTEMENTE PERDIDOS!",
+  "ALL Utilities": "TODOS os utilitários",
+  "AMD CPU detected": "CPU AMD detectada",
+  "AMD CPU fixes applied successfully": "Correções de CPU AMD aplicadas com sucesso",
+  "AMD GPU Tools installation completed!": "Instalação das ferramentas AMD GPU concluída!",
+  "AMD GPU passthrough configured.": "Passagem de GPU AMD configurada.",
+  "AMD GPU(s) detected:": "GPU(s) AMD detectada(s):",
+  "AMD fixes have been successfully reverted": "As correções da AMD foram revertidas com sucesso",
+  "AMD mesa drivers installed.": "Drivers AMD mesa instalados.",
+  "AMD softdep configured": "Softdep AMD configurado",
+  "AMD softdep configured in /etc/modprobe.d/vfio.conf": "AMD softdep configurado em /etc/modprobe.d/vfio.conf",
+  "ANALYSIS SUMMARY": "RESUMO DA ANÁLISE",
+  "API returned an invalid timezone": "API retornou um fuso horário inválido",
+  "API tokens (Home Assistant, scripts) will keep working.": "Os tokens de API (Home Assistant, scripts) continuarão funcionando.",
+  "APT IPv4 configuration completed": "Configuração do APT IPv4 concluída",
+  "APT IPv4 configuration removed": "Configuração APT IPv4 removida",
+  "APT and repositories": "APT e repositórios",
+  "APT configured to skip additional languages": "APT configurado para ignorar idiomas adicionais",
+  "APT configured to skip downloading additional languages": "APT configurado para ignorar o download de idiomas adicionais",
+  "APT configured to use IPv4": "APT configurado para usar IPv4",
+  "APT index update failed after switching to no-subscription. See log:": "A atualização do índice APT falhou após mudar para sem assinatura. Veja registro:",
+  "APT index update failed. See log:": "A atualização do índice APT falhou. Veja registro:",
+  "APT indexes updated for Trixie": "Índices APT atualizados para Trixie",
+  "APT indexes updated for Trixie (no-subscription)": "Índices APT atualizados para Trixie (sem assinatura)",
+  "APT language configuration already set": "Configuração de idioma APT já definida",
+  "APT language configuration updated": "Configuração de idioma APT atualizada",
+  "APT language downloads restored": "Downloads de idiomas APT restaurados",
+  "APT package lists updated": "Listas de pacotes APT atualizadas",
+  "Aborted": "Abortado",
+  "About to restore": "Prestes a restaurar",
+  "Absolute directory path to use as backup target:": "caminho absoluto do diretório para usar como destino de backup:",
+  "Absolute path to a file or directory you want backed up:": "Caminho absoluto para um arquivo ou diretório do qual deseja fazer backup:",
+  "Accept routes from other nodes?": "Aceita rotas de outros nós?",
+  "Access Scope:": "Escopo de acesso:",
+  "Access profile:": "Perfil de acesso:",
+  "Account is not locked": "A conta não está bloqueada",
+  "Action cancelled due to previous xshok-proxmox modifications.": "Ação cancelada devido a modificações anteriores do xshok-proxmox.",
+  "Action:": "Ação:",
+  "Activate Monitor": "Ativar monitor",
+  "Activate ProxMenux Monitor": "Ativar Monitor ProxMenux",
+  "Active": "Ativo",
+  "Active Connections": "Conexões Ativas",
+  "Active exports:": "Exportações ativas:",
+  "Active session:": "Sessão ativa:",
+  "Add Audio Passthrough": "Adicionar passagem de áudio",
+  "Add CIFS storage:": "Adicione armazenamento CIFS:",
+  "Add Controller or NVMe (PCI passthrough)": "Adicionar controlador ou NVMe (passagem PCI)",
+  "Add Controller or NVMe PCIe to VM": "Adicionar controlador ou NVMe PCIe à VM",
+  "Add Coral TPU to LXC": "Adicionar Coral TPU ao LXC",
+  "Add GPU to LXC": "Adicionar GPU ao LXC",
+  "Add GPU to LXC   (Intel | AMD | NVIDIA)": "Adicionar GPU ao LXC (Intel | AMD | NVIDIA)",
+  "Add GPU to VM    (Intel | AMD | NVIDIA)": "Adicionar GPU à VM (Intel | AMD | NVIDIA)",
+  "Add Local Disk   as Proxmox Storage": "Adicionar disco local como armazenamento Proxmox",
+  "Add Local Disk (Proxmox storage + host mount)": "Adicionar disco local (armazenamento Proxmox + montagem de host)",
+  "Add Local Disk as Host Mount (for LXC bind-mounts)": "Adicionar disco local como montagem de host (para montagens vinculadas LXC)",
+  "Add Local Disk as Proxmox Storage": "Adicionar disco local como armazenamento Proxmox",
+  "Add NFS Share as Proxmox Storage": "Adicionar compartilhamento NFS como armazenamento Proxmox",
+  "Add NFS share    as Proxmox Storage": "Adicionar compartilhamento NFS como armazenamento Proxmox",
+  "Add NFS storage:": "Adicione armazenamento NFS:",
+  "Add PBS": "Adicionar PBS",
+  "Add Samba Share as Proxmox Storage": "Adicionar compartilhamento Samba como armazenamento Proxmox",
+  "Add Samba share  as Proxmox Storage": "Adicionar compartilhamento Samba como armazenamento Proxmox",
+  "Add as IDE": "Adicionar como IDE",
+  "Add as SATA": "Adicionar como SATA",
+  "Add as SCSI": "Adicionar como SCSI",
+  "Add as VirtIO": "Adicionar como VirtIO",
+  "Add as disk (standard)": "Adicionar como disco (padrão)",
+  "Add bind mount to container:": "Adicione a montagem de ligação ao contêiner:",
+  "Add color prompts and useful aliases to the terminal environment": "Adicione prompts coloridos e aliases úteis ao ambiente do terminal",
+  "Add custom path": "Adicionar caminho personalizado",
+  "Add disk to LXC container": "Adicionar disco ao contêiner LXC",
+  "Add explicit privileged flag (optional but recommended):": "Adicione sinalizador privilegiado explícito (opcional, mas recomendado):",
+  "Add export rule:": "Adicionar regra de exportação:",
+  "Add iSCSI Target as Proxmox Storage": "Adicionar destino iSCSI como armazenamento Proxmox",
+  "Add iSCSI storage in Proxmox Storage": "Adicionar armazenamento iSCSI no armazenamento Proxmox",
+  "Add iSCSI storage in Proxmox:": "Adicione armazenamento iSCSI no Proxmox:",
+  "Add import disk": "Adicionar disco de importação",
+  "Add latest Ceph support": "Adicionar suporte Ceph mais recente",
+  "Add new PVE 9 enterprise repository (deb822 format) (Only if using enterprise):": "Adicione novo repositório corporativo PVE 9 (formato deb822) (somente se estiver usando corporativo):",
+  "Add physical disk to VM via": "Adicione disco físico à VM via",
+  "Add share block in /etc/samba/smb.conf:": "Adicione bloco de compartilhamento em /etc/samba/smb.conf:",
+  "Add unprivileged flag to container configuration:": "Adicione sinalizador sem privilégios à configuração do contêiner:",
+  "Add virtual disk": "Adicionar disco virtual",
+  "Add: Mount Host Directory into LXC": "Adicionar: Monte o diretório Host no LXC",
+  "Added to /etc/fstab": "Adicionado ao /etc/fstab",
+  "Added to /etc/fstab for permanent mounting.": "Adicionado ao /etc/fstab para montagem permanente.",
+  "Added to /etc/fstab using UUID": "Adicionado ao /etc/fstab usando UUID",
+  "Added to /etc/fstab using device path": "Adicionado ao /etc/fstab usando o caminho do dispositivo",
+  "Added to /etc/fstab.": "Adicionado ao /etc/fstab.",
+  "Added user": "Usuário adicionado",
+  "Adding": "Adicionando",
+  "Adding CIFS storage to Proxmox...": "Adicionando armazenamento CIFS ao Proxmox...",
+  "Adding QEMU Guest Agent support...": "Adicionando suporte ao agente convidado QEMU...",
+  "Adding disk using the generated command to the selected VM": "Adicionando disco usando o comando gerado à VM selecionada",
+  "Adding existing users to sharedfiles group...": "Adicionando usuários existentes ao grupo sharedfiles...",
+  "Adding iSCSI storage to Proxmox...": "Adicionando armazenamento iSCSI ao Proxmox...",
+  "Adding new share to smb.conf...": "Adicionando novo compartilhamento ao smb.conf...",
+  "Adding this NVMe as a PCIe device (via 'Add Controller or NVMe PCIe to VM') gives better performance.": "Adicionar este NVMe como um dispositivo PCIe (via 'Adicionar controlador ou NVMe PCIe à VM') oferece melhor desempenho.",
+  "Adding to /etc/fstab for permanent mounting...": "Adicionando ao /etc/fstab para montagem permanente...",
+  "Additional audio function(s) to be added": "Funções de áudio adicionais a serem adicionadas",
+  "Adjust network/CIDR to your environment.": "Ajuste a rede/CIDR ao seu ambiente.",
+  "Adjust options if needed (vers=4,hard,timeo,...).": "Ajuste as opções se necessário (vers=4,hard,timeo,...).",
+  "Adjusting systemd-journald limits to match Log2RAM size...": "Ajustando os limites do systemd-journald para corresponder ao tamanho do Log2RAM...",
+  "Adjusts journald log level if needed (Proxmox defaults may block auth logs)": "Ajusta o nível de log do diário, se necessário (os padrões do Proxmox podem bloquear logs de autenticação)",
+  "Advanced": "Avançado",
+  "Advanced Diagnostics": "Diagnóstico Avançado",
+  "Advanced Network Diagnostics": "Diagnóstico avançado de rede",
+  "Affected LXC containers": "Contêineres LXC afetados",
+  "After completing GPU setup, start the VM manually when the host is ready.": "Depois de concluir a configuração da GPU, inicie a VM manualmente quando o host estiver pronto.",
+  "After confirming, you will be asked to choose the NVIDIA driver version to install.": "Após a confirmação, você será solicitado a escolher a versão do driver NVIDIA para instalar.",
+  "After detailed analysis, no changes are needed.": "Após análise detalhada, nenhuma alteração é necessária.",
+  "After detailed analysis, no cleanup is needed.": "Após análise detalhada, nenhuma limpeza é necessária.",
+  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Após fazer login, execute: ip a para obter o endereço IP.\nEm seguida, insira esse endereço IP em seu navegador assim:\n  http://IP_ADDRESS\n\nIsso abrirá o painel do Umbral OS.",
+  "After pasting on the server, ensure the file is chmod 600 and owned by": "Após colar no servidor, certifique-se de que o arquivo seja chmod 600 e de propriedade de",
+  "After reboot the system will be fully accessible (SSH, web UI, login), but the following components will be reinstalled in BACKGROUND — until they finish, commands like nvidia-smi may not yet be available:": "Após a reinicialização o sistema estará totalmente acessível (SSH, web UI, login), mas os seguintes componentes serão reinstalados em BACKGROUND — até que terminem, comandos como nvidia-smi podem ainda não estar disponíveis:",
+  "After reboot, these components will reinstall in background:": "Após a reinicialização, estes componentes serão reinstalados em segundo plano:",
+  "After reboot, verify PVE version:": "Após a reinicialização, verifique a versão do PVE:",
+  "After switching mode, reboot the host if requested.": "Após alternar o modo, reinicie o host, se solicitado.",
+  "After that, run this script again to add it.": "Depois disso, execute este script novamente para adicioná-lo.",
+  "After the reboot you can follow the post-restore work live from ProxMenux Monitor → Backups tab (estimated time, per-component status, log tail, rollback delta).": "Após a reinicialização, você pode acompanhar o trabalho pós-restauração ao vivo no ProxMenux Monitor → guia Backups (tempo estimado, status por componente, cauda do log, delta de reversão).",
+  "After the reboot, you will only be able to access the Proxmox host via:": "Após a reinicialização, você só poderá acessar o host Proxmox via:",
+  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Após esta opção LXC → VM, reinicialize o host para que o novo estado de ligação seja aplicado de forma limpa.",
+  "Aliases added to .bashrc": "Aliases adicionados a .bashrc",
+  "All": "Todos",
+  "All Available Scripts": "Todos os scripts disponíveis",
+  "All GPUs Already Assigned": "Todas as GPUs já atribuídas",
+  "All ProxMenux optimizations are up to date.": "Todas as otimizações do ProxMenux estão atualizadas.",
+  "All block devices:": "Todos os dispositivos de bloco:",
+  "All changes applied. No reboot required.": "Todas as alterações aplicadas. Não é necessária reinicialização.",
+  "All changes are reversible using the ProxMenux uninstaller.": "Todas as alterações são reversíveis usando o desinstalador ProxMenux.",
+  "All dependencies installed and verified.": "Todas as dependências instaladas e verificadas.",
+  "All detected GPUs are already assigned to this VM.": "Todas as GPUs detectadas já estão atribuídas a esta VM.",
+  "All detected controllers/NVMe are already present in the selected VM.": "Todos os controladores/NVMe detectados já estão presentes na VM selecionada.",
+  "All disks may already be in use or mounted.": "Todos os discos podem já estar em uso ou montados.",
+  "All images imported and configured successfully": "Todas as imagens importadas e configuradas com sucesso",
+  "All imports failed": "Todas as importações falharam",
+  "All partitions and metadata removed.": "Todas as partições e metadados removidos.",
+  "All physical interfaces from backup are present on target": "Todas as interfaces físicas do backup estão presentes no destino",
+  "All types      (images, backup, iso, vztmpl, snippets)": "Todos os tipos (imagens, backup, iso, vztmpl, snippets)",
+  "All user-installed packages from the backup are present on this host": "Todos os pacotes instalados pelo usuário do backup estão presentes neste host",
+  "All users with UID and GID": "Todos os usuários com UID e GID",
+  "Allocate CPU Cores": "Alocar núcleos de CPU",
+  "Allocate RAM in MiB": "Alocar RAM em MiB",
+  "Already Mounted": "Já montado",
+  "Already configured": "Já configurado",
+  "Already installed — skipping": "Já instalado – pulando",
+  "Also comment any remaining 'bookworm' entries in *.list if present.": "Comente também quaisquer entradas restantes de 'bookworm' em *.list, se houver.",
+  "Also install the VirtIO network driver during setup to enable network access.": "Instale também o driver de rede VirtIO durante a configuração para habilitar o acesso à rede.",
+  "Although VFIO can bind to this device, full passthrough to a VM is": "Embora o VFIO possa se vincular a este dispositivo, a passagem completa para uma VM é",
+  "Amount of RAM in MiB (default: 4096)": "Quantidade de RAM em MiB (padrão: 4096)",
+  "An AMD dedicated GPU has been detected without FLR support": "Uma GPU dedicada AMD foi detectada sem suporte FLR",
+  "An AMD integrated GPU (APU) has been detected": "Uma GPU integrada AMD (APU) foi detectada",
+  "An Intel dedicated GPU has been detected without FLR support": "Uma GPU dedicada Intel foi detectada sem suporte FLR",
+  "An fstab entry already exists for:": "Já existe uma entrada fstab para:",
+  "Analysis Tools": "Ferramentas de análise",
+  "Analyze Bridge Configuration": "Analisar configuração da ponte",
+  "Analyze Network Configuration": "Analisar configuração de rede",
+  "Analyzing Bridge Configuration - READ ONLY MODE": "Analisando a configuração da ponte - MODO SOMENTE LEITURA",
+  "Analyzing Network Configuration - READ ONLY MODE": "Analisando a configuração da rede - MODO SOMENTE LEITURA",
+  "Analyzing selected disks...": "Analisando discos selecionados...",
+  "Analyzing system for available PCIe storage devices...": "Analisando sistema para dispositivos de armazenamento PCIe disponíveis...",
+  "Apply": "Aplicar",
+  "Apply AMD CPU fixes": "Aplicar correções de CPU AMD",
+  "Apply Available Updates": "Aplicar atualizações disponíveis",
+  "Apply and restart services:": "Aplique e reinicie os serviços:",
+  "Apply available updates": "Aplicar atualizações disponíveis",
+  "Apply boot/initramfs changes": "Aplicar alterações de boot/initramfs",
+  "Apply fix now?": "Aplicar correção agora?",
+  "Apply fix now? (The share will be briefly remounted)": "Aplicar correção agora? (A ação será brevemente remontada)",
+  "Apply network optimizations": "aplicar otimizações de rede",
+  "Apply read+write access for 'others' on the host directory?": "Aplicar acesso de leitura + gravação para 'outros' no diretório host?",
+  "Applying AMD-specific fixes...": "Aplicando correções específicas da AMD...",
+  "Applying Changes": "Aplicando alterações",
+  "Applying Controller/NVMe passthrough to VM": "Aplicando passagem de controlador/NVMe à VM",
+  "Applying balanced memory optimization settings...": "Aplicando configurações de otimização de memória balanceadas...",
+  "Applying changes safely...": "Aplicando alterações com segurança...",
+  "Applying custom restore": "Aplicando restauração personalizada",
+  "Applying default VM configuration": "Aplicando configuração de VM padrão",
+  "Applying host permissions for unprivileged LXC bind-mounts...": "Aplicando permissões de host para montagens de ligação LXC sem privilégios...",
+  "Applying optimized logrotate configuration...": "Aplicando configuração de logrotate otimizada...",
+  "Applying passthrough to CT": "Aplicando passagem ao CT",
+  "Applying safe paths and preparing pending restore": "Aplicando caminhos seguros e preparando restauração pendente",
+  "Applying selected LXC switch action": "Aplicando ação de switch LXC selecionada",
+  "Archive deleted.": "Arquivo excluído.",
+  "Archive extracted.": "Arquivo extraído.",
+  "Archive format": "Formato de arquivo",
+  "Archive ready": "Arquivo pronto",
+  "Archive size:": "Tamanho do arquivo:",
+  "Archive:": "Arquivo:",
+  "Are you absolutely sure?": "Você tem certeza absoluta?",
+  "Are you sure you want to continue?": "Tem certeza de que deseja continuar?",
+  "Are you sure you want to delete this export?": "Tem certeza de que deseja excluir esta exportação?",
+  "Are you sure you want to delete this share?": "Tem certeza de que deseja excluir este compartilhamento?",
+  "Are you sure you want to remove these configurations?": "Tem certeza de que deseja remover essas configurações?",
+  "Are you sure you want to restore this backup?\nCurrent configuration will be overwritten.": "Tem certeza de que deseja restaurar este backup?\nA configuração atual será substituída.",
+  "Are you sure you want to uninstall ProxMenux?": "Tem certeza de que deseja desinstalar o ProxMenux?",
+  "Are you sure you want to uninstall the selected optimizations.": "Tem certeza de que deseja desinstalar as otimizações selecionadas.",
+  "Are you sure you want to unmount this NFS share?": "Tem certeza de que deseja desmontar este compartilhamento NFS?",
+  "Are you sure you want to unmount this Samba share?": "Tem certeza de que deseja desmontar este compartilhamento do Samba?",
+  "Are you sure?": "Tem certeza?",
+  "As Proxmox storage": "Como armazenamento Proxmox",
+  "As host fstab mount only": "Apenas como host fstab mount",
+  "Assign GPU PCI function to VM": "Atribuir função GPU PCI à VM",
+  "Assign controller/NVMe passthrough": "Atribuir controlador/passagem NVMe",
+  "Assigned to VM": "Atribuído à VM",
+  "Assigned to VM(s)": "Atribuído a VM(s)",
+  "Assigning imported disk to VM using the generated command": "Atribuindo disco importado à VM usando o comando gerado",
+  "Associated Audio Devices": "Dispositivos de áudio associados",
+  "Associated audio removed from VM": "Áudio associado removido da VM",
+  "At least 5GB free space on root filesystem": "Pelo menos 5 GB de espaço livre no sistema de arquivos raiz",
+  "At least one selected GPU is blocked by policy for GPU -> VM mode due to passthrough instability risk.": "Pelo menos uma GPU selecionada está bloqueada pela política do modo GPU -> VM devido ao risco de instabilidade de passagem.",
+  "Attach imported disk to VM": "Anexe o disco importado à VM",
+  "Attach to an existing PVE vzdump job (inherit schedule + retention)": "anexar a um trabalho PVE vzdump existente (herdar cronograma + retenção)",
+  "Attached to PVE job:": "Anexado ao trabalho PVE:",
+  "Attempting automatic repair...": "Tentando reparo automático...",
+  "Attempting passthrough with this GPU typically results in": "A tentativa de passagem com esta GPU normalmente resulta em",
+  "Attention: Removing the subscription banner may cause issues in the web interface after a future update.": "Atenção: A remoção do banner de assinatura pode causar problemas na interface web após uma atualização futura.",
+  "Audit completed. Press Enter to continue...": "Auditoria concluída. Pressione Enter para continuar...",
+  "Auth key is required.": "A chave de autenticação é obrigatória.",
+  "Auth:": "Autenticação:",
+  "Authentication": "Autenticação",
+  "Authentication Error": "Erro de autenticação",
+  "Authentication failed.": "Falha na autenticação.",
+  "Authentication required:": "Autenticação necessária:",
+  "Authentication:": "Autenticação:",
+  "Authorization failed": "Falha na autorização",
+  "Authorization successful": "Autorização bem-sucedida",
+  "Authorize this key on the server": "Autorize esta chave no servidor",
+  "Authorize via 'pct exec' (Borg server is an LXC on a PVE host I can SSH into)": "Autorizar via 'pct exec' (o servidor Borg é um LXC em um host PVE no qual posso usar SSH)",
+  "Authorized": "Autorizado",
+  "Auto-detected firewall backend (nftables/iptables)": "Back-end de firewall detectado automaticamente (nftables/iptables)",
+  "Auto-discover servers on network": "Descoberta automática de servidores na rede",
+  "Auto-negotiate:": "Negociar automaticamente:",
+  "Auto-start was skipped because GPU passthrough setup was requested.": "A inicialização automática foi ignorada porque a configuração de passagem da GPU foi solicitada.",
+  "Auto-sync enabled when /var/log exceeds 80% of": "Sincronização automática ativada quando /var/log excede 80% de",
+  "Auto-sync was not enabled": "A sincronização automática não foi ativada",
+  "Automated Post-Install Script": "Script pós-instalação automatizado",
+  "Automated post-installation script": "script de pós-instalação automatizado",
+  "Automatic/Unattended": "Automático/Autônomo",
+  "Available": "Disponível",
+  "Available Borg archives (newest first):": "Arquivos Borg disponíveis (os mais recentes primeiro):",
+  "Available Borg targets:": "Alvos Borg disponíveis:",
+  "Available Disks on Host": "Discos disponíveis no host",
+  "Available ISO Images": "Imagens ISO disponíveis",
+  "Available PBS repositories:": "Repositórios PBS disponíveis:",
+  "Available PVE Version": "Versão PVE disponível",
+  "Available Shares:": "Ações disponíveis:",
+  "Available action": "Ação disponível",
+  "Available archives:": "Arquivos disponíveis:",
+  "Available disks detected.": "Discos disponíveis detectados.",
+  "Available host backups:": "Backups de host disponíveis:",
+  "Available images in /var/lib/vz/images/:": "Imagens disponíveis em /var/lib/vz/images/:",
+  "Available network interfaces:": "Interfaces de rede disponíveis:",
+  "Available output formats include:": "Os formatos de saída disponíveis incluem:",
+  "Available physical disks for passthrough:": "Discos físicos disponíveis para passagem:",
+  "Available shares for guest access:": "Compartilhamentos disponíveis para acesso de convidados:",
+  "Available space in /mnt:": "Espaço disponível em /mnt:",
+  "Available storage information:": "Informações de armazenamento disponíveis:",
+  "Available storage volumes:": "Volumes de armazenamento disponíveis:",
+  "BIOS TYPE": "TIPO DE BIOS",
+  "BIOS Type": "Tipo de BIOS",
+  "BIOS from": "BIOS de",
+  "BIOS: OVMF (UEFI)": "BIOS: OVMF (UEFI)",
+  "BRIDGE CONFIGURATION ANALYSIS": "ANÁLISE DE CONFIGURAÇÃO DE PONTE",
+  "BTRFS:": "BTRFS:",
+  "Back to previous menu or Esc + Enter": "Voltar ao menu anterior ou Esc + Enter",
+  "Backed up and cleared": "Backup e limpeza",
+  "Backend": "Back-end",
+  "Backend:": "Back-end:",
+  "Backup            — VM and CT backups": "Backup – backups de VM e CT",
+  "Backup Created": "Backup criado",
+  "Backup ID (group name in PBS):": "ID de backup (nome do grupo no PBS):",
+  "Backup ID for this job:": "ID de backup para este trabalho:",
+  "Backup ID:": "ID de backup:",
+  "Backup Preview": "Visualização de backup",
+  "Backup Recommendation": "Recomendação de backup",
+  "Backup Restored": "Backup restaurado",
+  "Backup all VMs and CTs": "Faça backup de todas as VMs e CTs",
+  "Backup and Restore Commands": "Comandos de backup e restauração",
+  "Backup available at": "Backup disponível em",
+  "Backup completed successfully.": "Backup concluído com sucesso.",
+  "Backup completed:": "Backup concluído:",
+  "Backup created:": "Backup criado:",
+  "Backup declares unused NICs that are not on this host:": "O backup declara NICs não utilizados que não estão neste host:",
+  "Backup destination is inside the backup": "O destino do backup está dentro do backup",
+  "Backup failed. See log:": "Falha no backup.Veja registro:",
+  "Backup file appears corrupted, will reinstall packages": "O arquivo de backup parece corrompido, irá reinstalar os pacotes",
+  "Backup host configuration": "Configuração do host de backup",
+  "Backup includes /etc/zfs/zpool.cache. Restore it (same host detected)?": "O backup inclui /etc/zfs/zpool.cache. Restaurá-lo (mesmo host detectado)?",
+  "Backup information": "Informações de backup",
+  "Backup location": "Local de backup",
+  "Backup metadata": "Metadados de backup",
+  "Backup of original MOTD created": "Backup do MOTD original criado",
+  "Backup on newer kernel:": "Backup no kernel mais recente:",
+  "Backup on older kernel:": "Backup no kernel mais antigo:",
+  "Backup origin metadata:": "Metadados de origem do backup:",
+  "Backup path:": "Caminho de backup:",
+  "Backup pools not present on this host:": "Pools de backup não presentes neste host:",
+  "Backup saved to:": "Backup salvo em:",
+  "Backup scheduler and retention": "Agendador e retenção de backup",
+  "Backup to Borg repository": "Backup para repositório Borg",
+  "Backup to Proxmox Backup Server (PBS)": "Backup para servidor de backup Proxmox (PBS)",
+  "Backup to a specific directory": "Backup para um diretório específico",
+  "Backup to local archive  (.tar.zst)": "Backup para arquivo local (.tar.zst)",
+  "Backup:": "Backup:",
+  "Backups already on PBS were encrypted with the current key — downloading them will fail unless you first Download the current keyfile to keep a copy.": "Os backups já no PBS foram criptografados com a chave atual – o download deles falhará, a menos que você primeiro baixe o arquivo de chave atual para manter uma cópia.",
+  "Backups already stored on PBS were encrypted with the current keyfile. After this action:": "Os backups já armazenados no PBS foram criptografados com o arquivo-chave atual.Após esta ação:",
+  "Bandwidth limit configured": "Limite de largura de banda configurado",
+  "Bandwidth test (iperf3)": "teste de largura de banda (iperf3)",
+  "Bandwidth test completed successfully": "Teste de largura de banda concluído com sucesso",
+  "Base VM created with ID": "VM base criada com ID",
+  "Bashrc customization completed": "Personalização do Bashrc concluída",
+  "Basic Settings": "configurações básicas",
+  "Basic Utilities": "Utilitários básicos",
+  "Before making any changes, we'll create a safety backup.": "Antes de fazer qualquer alteração, criaremos um backup de segurança.",
+  "Beta (develop branch)": "Beta (ramo de desenvolvimento)",
+  "Beta version:": "Versão beta:",
+  "Binary not found in extracted content.": "Binário não encontrado no conteúdo extraído.",
+  "Bind mount added:": "Montagem de ligação adicionada:",
+  "Blacklist nouveau driver": "Driver novo da lista negra",
+  "Blacklisting GPU host drivers...": "Colocando drivers de host de GPU na lista negra...",
+  "Blacklisting nouveau driver...": "Colocando novo driver na lista negra...",
+  "Blocked GPU ID": "ID da GPU bloqueada",
+  "Blocked GPU ID for VM Mode": "ID de GPU bloqueado para modo VM",
+  "Blocked device(s)": "Dispositivo(s) bloqueado(s)",
+  "Blocked device(s):": "Dispositivo(s) bloqueado(s):",
+  "Boot Disk": "Disco de inicialização",
+  "Boot artifacts regenerated — reboot the host to activate the merged config.": "Artefatos de inicialização regenerados – reinicie o host para ativar a configuração mesclada.",
+  "Boot disk:": "Disco de inicialização:",
+  "Boot order set to": "Ordem de inicialização definida como",
+  "Boot partition UUIDs from backup not found on this host:": "UUIDs de partição de inicialização do backup não encontrados neste host:",
+  "Boot type (grub/zfs):": "Tipo de inicialização (grub/zfs):",
+  "Borg backup error log": "Registro de erros de backup Borg",
+  "Borg backup failed.": "Falha no backup Borg.",
+  "Borg binary checksum verification failed.": "A verificação da soma de verificação binária Borg falhou.",
+  "Borg encryption": "Criptografia Borg",
+  "Borg extraction failed.": "A extração Borg falhou.",
+  "Borg not found. Downloading borg": "Borg não encontrado. Baixando Borg",
+  "Borg passphrase:": "Senha Borg:",
+  "Borg ready.": "Borg pronto.",
+  "Borg repositories": "Repositórios Borg",
+  "Borg repository location": "Localização do repositório Borg",
+  "Borg repository passphrase": "senha do repositório Borg",
+  "Borg repository path:": "Caminho do repositório Borg:",
+  "Borg restore error log": "Log de erros de restauração do Borg",
+  "Borg server SSH user": "usuário SSH do servidor Borg",
+  "Bridge": "Ponte",
+  "Bridge Analysis": "Análise de ponte",
+  "Bridge Configuration Analysis": "Análise de configuração de ponte",
+  "Bridge:": "Ponte:",
+  "Bridges analyzed": "Pontes analisadas",
+  "Broken gasket-dkms package state recovered.": "Estado quebrado do pacote junta-dkms recuperado.",
+  "Browse manually (advanced)...": "Navegar manualmente (avançado)...",
+  "Build and install the gasket and apex kernel modules (DKMS)": "Construir e instalar os módulos de junta e kernel apex (DKMS)",
+  "Build dependencies installed.": "Construa dependências instaladas.",
+  "CHANGES APPLIED SUCCESSFULLY": "ALTERAÇÕES APLICADAS COM SUCESSO",
+  "CIFS Client Tools: AVAILABLE": "Ferramentas de cliente CIFS: DISPONÍVEIS",
+  "CIFS Client Tools: NOT AVAILABLE - installing...": "Ferramentas cliente CIFS: NÃO DISPONÍVEIS - instalando...",
+  "CIFS Client: INSTALLED": "Cliente CIFS: INSTALADO",
+  "CIFS Client: NOT INSTALLED": "Cliente CIFS: NÃO INSTALADO",
+  "CIFS Mount Not Found": "Montagem CIFS não encontrada",
+  "CIFS Mounts on Host": "CIFS é montado no host",
+  "CIFS Proxmox storages (pvesm):": "Armazenamentos CIFS Proxmox (pvesm):",
+  "CIFS can cause file locking issues with VM disk operations.": "O CIFS pode causar problemas de bloqueio de arquivos nas operações de disco da VM.",
+  "CIFS client tools installed.": "Ferramentas de cliente CIFS instaladas.",
+  "CIFS share mounted at:": "Compartilhamento CIFS montado em:",
+  "CIFS share remounted — LXC containers can now read and write": "Compartilhamento CIFS remontado – contêineres LXC agora podem ler e gravar",
+  "CIFS storage added successfully to Proxmox!": "Armazenamento CIFS adicionado com sucesso ao Proxmox!",
+  "CLEANUP COMPLETED SUCCESSFULLY": "LIMPEZA CONCLUÍDA COM SUCESSO",
+  "CLUSTER UPGRADE NOTES:": "NOTAS DE ATUALIZAÇÃO DO CLUSTER:",
+  "CONFIGURED INTERFACES": "INTERFACES CONFIGURADAS",
+  "CONFIRM FORMAT": "CONFIRMAR FORMATO",
+  "CPU Cores": "Núcleos de CPU",
+  "CPU MODEL": "MODELO DE CPU",
+  "CPU Model": "Modelo de CPU",
+  "CPU set to host,hidden=1,flags=+pcid": "CPU definida como host, oculto=1,flags=+pcid",
+  "CPU vendor (intel/amd):": "Fornecedor de CPU (Intel/AMD):",
+  "CRITICAL: The selected disk is referenced by a RUNNING VM or CT.": "CRÍTICO: O disco selecionado é referenciado por uma VM ou CT em RUNNING.",
+  "CT": "TC",
+  "CT started successfully.": "CT iniciado com sucesso.",
+  "Cancel": "Cancelar",
+  "Cancel restore": "Cancelar restauração",
+  "Cancel this setup": "cancelar esta configuração",
+  "Cancelled by user or empty URL.": "Cancelado pelo usuário ou URL vazio.",
+  "Cancelled by user.": "Cancelado pelo usuário.",
+  "Cannot connect to server": "Não é possível conectar ao servidor",
+  "Cannot continue": "Não é possível continuar",
+  "Cannot create:": "Não é possível criar:",
+  "Cannot detect filesystem on": "Não é possível detectar o sistema de arquivos em",
+  "Cannot find": "Não foi possível encontrar",
+  "Cannot load backup library: lib_host_backup_common.sh": "Não é possível carregar a biblioteca de backup: lib_host_backup_common.sh",
+  "Cannot proceed with invalid export path.": "Não é possível prosseguir com caminho de exportação inválido.",
+  "Cannot proceed with invalid share name.": "Não é possível continuar com um nome de compartilhamento inválido.",
+  "Cannot reach Proxmox repositories": "Não é possível acessar os repositórios Proxmox",
+  "Cannot reach portal:": "Não é possível acessar o portal:",
+  "Cannot reach server": "Sem contato com o servidor",
+  "Cannot validate credentials - no shares available for testing.": "Não é possível validar credenciais – não há compartilhamentos disponíveis para teste.",
+  "Category": "Categoria",
+  "Caution: Maximum mode generates more heat.": "Cuidado: O modo máximo gera mais calor.",
+  "Ceph check skipped by user flag (--ignore-ceph-check)": "Verificação do Ceph ignorada pelo sinalizador do usuário (--ignore-ceph-check)",
+  "Ceph components": "Componentes Ceph",
+  "Ceph detected as hyper-converged on this node. Checking version (require 19.x Squid)...": "Ceph detectado como hiperconvergente neste nó. Verificando versão (requer 19.x Squid)...",
+  "Ceph enterprise repository present": "Repositório empresarial Ceph presente",
+  "Ceph installation check completed": "Verificação de instalação do Ceph concluída",
+  "Ceph installation completed successfully": "Instalação do Ceph concluída com sucesso",
+  "Ceph installation could not be verified": "Não foi possível verificar a instalação do Ceph",
+  "Ceph installation process completed": "Processo de instalação do Ceph concluído",
+  "Ceph installation process finished with warnings": "Processo de instalação do Ceph concluído com avisos",
+  "Ceph installed but integration may need configuration": "Ceph instalado, mas a integração pode precisar de configuração",
+  "Ceph integration with PVE 9 verified": "Integração Ceph com PVE 9 verificada",
+  "Ceph is already installed": "O Ceph já está instalado",
+  "Ceph is not 19.x (Squid). Proceeding due to --warn-ceph-check. Detected:": "Ceph não é 19.x (Squid). Continuando devido a --warn-ceph-check. Detectado:",
+  "Ceph is not 19.x (Squid). Upgrade Ceph first. Detected:": "Ceph não é 19.x (Squid). Atualize o Ceph primeiro. Detectado:",
+  "Ceph no-subscription repository present": "Repositório Ceph sem assinatura presente",
+  "Ceph packages and repository removed": "Pacotes e repositório Ceph removidos",
+  "Ceph packages are available": "Pacotes Ceph estão disponíveis",
+  "Ceph packages installed and verified successfully": "Pacotes Ceph instalados e verificados com sucesso",
+  "Ceph packages installed but service verification failed": "Pacotes Ceph instalados, mas falha na verificação do serviço",
+  "Ceph packages may not be available, but continuing installation...": "Os pacotes Ceph podem não estar disponíveis, mas continuando a instalação...",
+  "Ceph repository configured for PVE 8": "Repositório Ceph configurado para PVE 8",
+  "Ceph repository configured for PVE 9": "Repositório Ceph configurado para PVE 9",
+  "Ceph version OK:": "Versão do Ceph OK:",
+  "Change Language": "Alterar idioma",
+  "Change Release Channel": "Alterar canal de lançamento",
+  "Changes applied. A system reboot is recommended for them to take full effect.": "Alterações aplicadas. Recomenda-se uma reinicialização do sistema para que tenham efeito total.",
+  "Changes detected. Updating ZFS ARC configuration...": "Alterações detectadas. Atualizando configuração do ZFS ARC...",
+  "Changes have been applied to the configuration file.": "As alterações foram aplicadas ao arquivo de configuração.",
+  "Changes will apply after reboot.": "As alterações serão aplicadas após a reinicialização.",
+  "Changing Release Channel": "Alterando o canal de lançamento",
+  "Changing the machine type on an existing installed VM is not safe: it changes the chipset and PCI slot layout, which typically prevents the guest OS from booting.": "Alterar o tipo de máquina em uma VM instalada existente não é seguro: isso altera o layout do chipset e do slot PCI, o que normalmente impede a inicialização do sistema operacional convidado.",
+  "Check": "Verificar",
+  "Check BIOS/UEFI in Hardware > BIOS — must match what the original VM used": "Verifique BIOS/UEFI em Hardware > BIOS — deve corresponder ao que a VM original usou",
+  "Check Coral USB/M.2 detection": "Verifique a detecção Coral USB/M.2",
+  "Check LXC GPU/TPU mapping": "Verifique o mapeamento GPU/TPU LXC",
+  "Check NFS Status": "Verifique o status do NFS",
+  "Check NVIDIA driver and devices": "Verifique o driver e os dispositivos NVIDIA",
+  "Check Proxmox Web UI status": "Verifique o status da interface da Web do Proxmox",
+  "Check Proxmox firewall status": "Verifique o status do firewall Proxmox",
+  "Check Samba Status": "Verifique o status do Samba",
+  "Check VM disk/PCI slots": "Verifique os slots de disco/PCI da VM",
+  "Check VM passthrough settings": "Verifique as configurações de passagem da VM",
+  "Check connectivity with another host": "Verifique a conectividade com outro host",
+  "Check container mount points": "Verifique os pontos de montagem do contêiner",
+  "Check if container is unprivileged:": "Verifique se o contêiner não tem privilégios:",
+  "Check kernel params (IOMMU flags)": "Verifique os parâmetros do kernel (sinalizadores IOMMU)",
+  "Check loaded GPU/TPU modules": "Verifique os módulos GPU/TPU carregados",
+  "Check log:": "Verifique o registro:",
+  "Check resulting config:": "Verifique a configuração resultante:",
+  "Check script not found": "Verifique o script não encontrado",
+  "Check test progress   — show active or last test result": "Verifique o progresso do teste – mostre o resultado do teste ativo ou do último teste",
+  "Check that:": "Verifique isso:",
+  "Check the error messages above for details.": "Verifique as mensagens de erro acima para obter detalhes.",
+  "Check the service status manually if needed.": "Verifique o status do serviço manualmente, se necessário.",
+  "Checking MOTD configuration...": "Verificando a configuração do MOTD...",
+  "Checking NVIDIA driver status with nvidia-smi": "Verificando o status do driver NVIDIA com nvidia-smi",
+  "Checking VFIO modules...": "Verificando módulos VFIO...",
+  "Checking VM virtual display model...": "Verificando o modelo de exibição virtual da VM...",
+  "Checking ZFS autotrim configuration...": "Verificando a configuração do ajuste automático do ZFS...",
+  "Checking and repairing old LVM PV headers (if needed)...": "Verificando e reparando coletores LVM PV antigos (se necessário)...",
+  "Checking conflicting drivers blacklist...": "Verificando a lista negra de drivers conflitantes...",
+  "Checking existing ZFS ARC configuration...": "Verificando a configuração existente do ZFS ARC...",
+  "Checking for updates...": "Verificando atualizações...",
+  "Checking free space in /var/cache/apt/archives...": "Verificando espaço livre em /var/cache/apt/archives...",
+  "Checking if system disk is SSD or M.2...": "Verificando se o disco do sistema é SSD ou M.2...",
+  "Checking if the server belongs to OVH...": "Verificando se o servidor pertence à OVH...",
+  "Checking kernel headers and build tools...": "Verificando cabeçalhos do kernel e ferramentas de construção...",
+  "Checking remaining interfaces": "Verificando interfaces restantes",
+  "Checklist post-upgrade finished. Warnings:": "Lista de verificação pós-atualização concluída. Avisos:",
+  "Checklist pre-check finished. Warnings:": "Pré-verificação da lista de verificação concluída. Avisos:",
+  "Checks for LVM and storage issues": "Verifica problemas de LVM e armazenamento",
+  "Choose BIOS type": "Escolha o tipo de BIOS",
+  "Choose No to abort and roll back to the legacy refuse behaviour.": "Escolha Não para abortar e reverter para o comportamento de recusa herdado.",
+  "Choose ZimaOS image option:": "Escolha a opção de imagem ZimaOS:",
+  "Choose a Samba server:": "Escolha um servidor Samba:",
+  "Choose a Windows ISO to use:": "Escolha um ISO do Windows para usar:",
+  "Choose a ZimaOS image:": "Escolha uma imagem ZimaOS:",
+  "Choose a custom image:": "Escolha uma imagem personalizada:",
+  "Choose a custom logo:": "Escolha um logotipo personalizado:",
+  "Choose a destination directory OUTSIDE of": "Escolha um diretório de destino FORA de",
+  "Choose a different path or unmount it first.": "Escolha um caminho diferente ou desmonte-o primeiro.",
+  "Choose a folder to export:": "Escolha uma pasta para exportar:",
+  "Choose a folder to mount the export:": "Escolha uma pasta para montar a exportação:",
+  "Choose a folder to mount the share:": "Escolha uma pasta para montar o compartilhamento:",
+  "Choose a folder to mount:": "Escolha uma pasta para montar:",
+  "Choose a folder to share:": "Escolha uma pasta para compartilhar:",
+  "Choose a group policy for this shared directory:": "Escolha uma política de grupo para este diretório compartilhado:",
+  "Choose a loader for Synology DSM:": "Escolha um carregador para Synology DSM:",
+  "Choose a logo for Fastfetch:": "Escolha um logotipo para Fastfetch:",
+  "Choose a recent server:": "Escolha um servidor recente:",
+  "Choose a recovery passphrase (write it down somewhere safe):": "Escolha uma senha de recuperação (anote-a em algum lugar seguro):",
+  "Choose a script to execute:": "Escolha um script para executar:",
+  "Choose a server:": "Escolha um servidor:",
+  "Choose a share to mount:": "Escolha um compartilhamento para montar:",
+  "Choose action for this controller/NVMe:": "Escolha a ação para este controlador/NVMe:",
+  "Choose action:": "Escolha a ação:",
+  "Choose an NFS server:": "Escolha um servidor NFS:",
+  "Choose an action:": "Escolha uma ação:",
+  "Choose an export to mount:": "Escolha uma exportação para montar:",
+  "Choose an option:": "Escolha uma opção:",
+  "Choose any host path you want to share with CTs.": "Escolha qualquer caminho de host que você deseja compartilhar com os CTs.",
+  "Choose conflict policy": "Escolha a política de conflito",
+  "Choose conflict policy for the source VM:": "Escolha a política de conflitos para a VM de origem:",
+  "Choose conflict policy:": "Escolha a política de conflito:",
+  "Choose filesystem for the disk:": "Escolha o sistema de arquivos para o disco:",
+  "Choose how this host backup will be triggered:": "Escolha como esse backup do host será acionado:",
+  "Choose how to continue:": "Escolha como continuar:",
+  "Choose how to handle affected LXC containers before switching to VM mode.": "Escolha como lidar com os contêineres LXC afetados antes de mudar para o modo VM.",
+  "Choose how to make the disk available on this host. Mark one or both options:": "Escolha como disponibilizar o disco neste host. Marque uma ou ambas as opções:",
+  "Choose how to mount the NFS share on this host. Mark one or both options:": "Escolha como montar o compartilhamento NFS neste host. Marque uma ou ambas as opções:",
+  "Choose how to mount the Samba share on this host. Mark one or both options:": "Escolha como montar o compartilhamento Samba neste host. Marque uma ou ambas as opções:",
+  "Choose how to perform the upgrade:": "Escolha como realizar a atualização:",
+  "Choose how to run the script:": "Escolha como executar o script:",
+  "Choose iperf3 mode:": "Escolha o modo iperf3:",
+  "Choose options to configure:": "Escolha opções para configurar:",
+  "Choose the driver version for Coral M.2:": "Escolha a versão do driver para Coral M.2:",
+  "Choose the filesystem for the new partition:": "Escolha o sistema de arquivos para a nova partição:",
+  "Choose the release channel to use:": "Escolha o canal de lançamento a ser usado:",
+  "Choose the storage volume for the EFI disk (4MB):\n\nUse Spacebar to select.": "Escolha o volume de armazenamento para o disco EFI (4 MB):\n\nUse a barra de espaço para selecionar.",
+  "Choose the storage volume for the virtual disk:": "Escolha o volume de armazenamento do disco virtual:",
+  "Choose the type of virtual system to install:": "Escolha o tipo de sistema virtual a ser instalado:",
+  "Choose what to do with the selected disk:": "Escolha o que fazer com o disco selecionado:",
+  "Choose where to save the backup:": "Escolha onde salvar o backup:",
+  "Clean disk metadata": "Limpar metadados do disco",
+  "Cleaned up": "Limpo",
+  "Cleaning cached files...": "Limpando arquivos em cache...",
+  "Cleaning disk metadata...": "Limpando metadados do disco...",
+  "Cleaning previous Log2RAM installation...": "Limpando a instalação anterior do Log2RAM...",
+  "Cleaning temporary files...": "Limpando arquivos temporários...",
+  "Cleaning up Samba directories...": "Limpando diretórios do Samba...",
+  "Cleaning up duplicate parameters...": "Limpando parâmetros duplicados...",
+  "Cleaning up duplicate repositories...": "Limpando repositórios duplicados...",
+  "Cleaning up remaining processes...": "Limpando processos restantes...",
+  "Cleaning up unused time synchronization services...": "Limpando serviços de sincronização de horário não utilizados...",
+  "Cleans duplicate or conflicting sources": "Limpa fontes duplicadas ou conflitantes",
+  "Cleanup Complete": "Limpeza concluída",
+  "Cleanup finished": "Limpeza concluída",
+  "Cleanup partial VM?": "Limpar VM parcial?",
+  "Clear configured target": "Limpar destino configurado",
+  "Clear pool error state": "Limpar estado de erro do pool",
+  "Cleared": "Desmarcado",
+  "Clearing login credentials...": "Limpando credenciais de login...",
+  "Client (run a bandwidth test to a server)": "Cliente (execute um teste de largura de banda em um servidor)",
+  "Client determines best version to use": "O cliente determina a melhor versão a ser usada",
+  "Cloning Coral driver repository (feranick fork)...": "Clonando repositório de driver Coral (feranick fork)...",
+  "Cloning Lynis from GitHub...": "Clonando Lynis do GitHub...",
+  "Cloning and applying NVIDIA patch (keylase/nvidia-patch)...": "Clonando e aplicando patch NVIDIA (keylase/nvidia-patch)...",
+  "Closed": "Fechado",
+  "Cloud-Init Automated Installers": "Instaladores automatizados Cloud-Init",
+  "Cluster certificates updated": "Certificados de cluster atualizados",
+  "Cluster configuration (advanced)": "Configuração de cluster (avançado)",
+  "Cluster data will be applied automatically at next boot.": "os dados do cluster serão aplicados automaticamente na próxima inicialização.",
+  "Cluster upgrade mode": "Modo de atualização de cluster",
+  "Command": "Comando",
+  "Commenting any residual Bookworm lines in *.list...": "Comentando quaisquer linhas residuais do Bookworm em *.list...",
+  "Commenting legacy PVE 8 repository .list files (if any)...": "Comentando arquivos .list do repositório PVE 8 legado (se houver)...",
+  "Commenting legacy ceph.list (if present)...": "Comentando legado ceph.list (se presente)...",
+  "Common Issues Check": "Verificação de problemas comuns",
+  "Community Scripts": "Scripts da comunidade",
+  "Compatibility check": "Verificação de compatibilidade",
+  "Compatibility check — OK": "Verificação de compatibilidade – OK",
+  "Compatibility check — issues detected": "Verificação de compatibilidade – problemas detectados",
+  "Compatibility check — review warnings": "Verificação de compatibilidade – revise os avisos",
+  "Compatible with privileged and unprivileged LXC containers": "Compatível com contêineres LXC privilegiados e não privilegiados",
+  "Compatible with:": "Compatível com:",
+  "Compile firewall rules for all nodes": "Compilar regras de firewall para todos os nós",
+  "Compiling Coral TPU drivers for current kernel...": "Compilando drivers Coral TPU para o kernel atual...",
+  "Complete": "Completo",
+  "Complete NVIDIA uninstallation finished.": "Desinstalação completa da NVIDIA concluída.",
+  "Complete post-installation optimization finished!": "Otimização pós-instalação completa concluída!",
+  "Complete restore": "Restauração completa",
+  "Complete the DSM installation wizard": "Conclua o assistente de instalação do DSM",
+  "Complete the ZimaOS installation wizard": "Conclua o assistente de instalação do ZimaOS",
+  "Completed Successfully with GPU passthrough configured!": "Concluído com sucesso com passagem de GPU configurada!",
+  "Completed Successfully!": "Concluído com sucesso!",
+  "Completed with errors —": "Concluído com erros -",
+  "Completed.": "Concluído.",
+  "Completed. Press Enter to return to menu...": "Concluído. Pressione Enter para retornar ao menu...",
+  "Compliance checking (PCI-DSS, HIPAA, etc.)": "Verificação de conformidade (PCI-DSS, HIPAA, etc.)",
+  "Component to uninstall manually (no --auto-uninstall yet):": "Componente a ser desinstalado manualmente (ainda sem --auto-uninstall):",
+  "Component was installed on the backup source but no matching hardware was found on this host.": "O componente foi instalado na origem do backup, mas nenhum hardware correspondente foi encontrado neste host.",
+  "Component:": "Componente:",
+  "Components to uninstall (manual for now):": "Componentes a serem desinstalados (manual por enquanto):",
+  "Compressed size:": "Tamanho compactado:",
+  "Compressing": "Comprimindo",
+  "Compression Tools": "Ferramentas de compressão",
+  "Concise output of logical volumes": "Saída concisa de volumes lógicos",
+  "Concise output of physical volumes": "Saída concisa de volumes físicos",
+  "Concise output of volume groups": "Saída concisa de grupos de volumes",
+  "Configuration Analysis": "Análise de configuração",
+  "Configuration Menu": "Menu de configuração",
+  "Configuration Summary:": "Resumo da configuração:",
+  "Configuration analysis": "Análise de configuração",
+  "Configuration backup created:": "Backup de configuração criado:",
+  "Configuration can continue now and will be effective after reboot.": "A configuração pode continuar agora e entrará em vigor após a reinicialização.",
+  "Configuration completed successfully!": "Configuração concluída com sucesso!",
+  "Configuration file for container": "Arquivo de configuração para contêiner",
+  "Configuration has been stopped due to high reset risk.": "A configuração foi interrompida devido ao alto risco de reinicialização.",
+  "Configuration has been stopped to prevent an unusable VM state.": "A configuração foi interrompida para evitar um estado de VM inutilizável.",
+  "Configuration has been stopped to prevent leaving the VM in an unusable state.": "A configuração foi interrompida para evitar deixar a VM em estado inutilizável.",
+  "Configuration name:": "Nome da configuração:",
+  "Configuration sections that will be REMOVED": "Seções de configuração que serão REMOVIDAS",
+  "Configuration to be Removed": "Configuração a ser removida",
+  "Configuration will continue now and be effective after reboot.": "A configuração continuará agora e entrará em vigor após a reinicialização.",
+  "Configuration:": "Configuração:",
+  "Configure": "Configurar",
+  "Configure GPU passthrough with VFIO": "Configure a passagem de GPU com VFIO",
+  "Configure LXC Mount Points    (Host ↔ Container)": "Configurar pontos de montagem LXC (Host ↔ Container)",
+  "Configure LXC mount points": "Configurar pontos de montagem LXC",
+  "Configure Mount Point inside LXC": "Configure o ponto de montagem dentro do LXC",
+  "Configure NFS   Client in LXC (only privileged)": "Configure o cliente NFS no LXC (apenas privilegiado)",
+  "Configure NFS   Server in LXC (only privileged)": "Configure o servidor NFS no LXC (apenas privilegiado)",
+  "Configure Proxmox APT repositories": "Configurar repositórios Proxmox APT",
+  "Configure Samba Client in LXC (only privileged)": "Configurar o cliente Samba no LXC (apenas privilegiado)",
+  "Configure Samba Server in LXC (only privileged)": "Configure o Samba Server no LXC (apenas privilegiado)",
+  "Configure as guest (no authentication)": "Configurar como convidado (sem autenticação)",
+  "Configure backup destinations": "Configurar destinos de backup",
+  "Configure backup destinations (PBS, Borg, local)": "Configurar destinos de backup (PBS, Borg, local)",
+  "Configure the Google Coral APT repository": "Configure o repositório Google Coral APT",
+  "Configure with username and password": "Configurar com nome de usuário e senha",
+  "Configured Ports": "Portas configuradas",
+  "Configured but doesn't exist": "Configurado mas não existe",
+  "Configuring AMD GPU passthrough...": "Configurando passagem de GPU AMD...",
+  "Configuring AMD softdep...": "Configurando o softdep AMD...",
+  "Configuring APT to skip downloading additional languages": "Configurando o APT para pular o download de idiomas adicionais",
+  "Configuring APT to skip downloading additional languages...": "Configurando o APT para pular o download de idiomas adicionais...",
+  "Configuring APT to use IPv4...": "Configurando o APT para usar IPv4...",
+  "Configuring Ceph repository for PVE": "Configurando o repositório Ceph para PVE",
+  "Configuring Coral USB support...": "Configurando o suporte Coral USB...",
+  "Configuring EFI disk": "Configurando o disco EFI",
+  "Configuring I/O priority for vzdump...": "Configurando prioridade de E/S para vzdump...",
+  "Configuring Intel iGPU passthrough...": "Configurando passagem Intel iGPU...",
+  "Configuring MOTD (Message of the Day) banner...": "Configurando o banner MOTD (Mensagem do Dia)...",
+  "Configuring NVIDIA GPU passthrough...": "Configurando passagem de GPU NVIDIA...",
+  "Configuring NVIDIA KVM hiding...": "Configurando a ocultação do NVIDIA KVM...",
+  "Configuring NVIDIA and VFIO modules...": "Configurando módulos NVIDIA e VFIO...",
+  "Configuring PAM limits...": "Configurando limites do PAM...",
+  "Configuring ProxMenux Monitor filter...": "Configurando o filtro do Monitor ProxMenux...",
+  "Configuring ProxMenux Monitor jail...": "Configurando a prisão do ProxMenux Monitor...",
+  "Configuring Proxmox APT repositories...": "Configurando repositórios Proxmox APT...",
+  "Configuring Proxmox filter...": "Configurando filtro Proxmox...",
+  "Configuring Proxmox jail...": "Configurando a prisão do Proxmox...",
+  "Configuring TCP optimizations...": "Configurando otimizações de TCP...",
+  "Configuring TPM device": "Configurando o dispositivo TPM",
+  "Configuring VFIO modules...": "Configurando módulos VFIO...",
+  "Configuring VM": "Configurando VM",
+  "Configuring bandwidth limit for vzdump...": "Configurando limite de largura de banda para vzdump...",
+  "Configuring boot order...": "Configurando a ordem de inicialização...",
+  "Configuring disk as": "Configurando o disco como",
+  "Configuring global Fail2Ban settings and SSH jail...": "Definindo configurações globais de Fail2Ban e prisão SSH...",
+  "Configuring host for GPU -> VM mode...": "Configurando host para GPU -> modo VM...",
+  "Configuring journald...": "Configurando diário...",
+  "Configuring kernel max Key limit...": "Configurando o limite máximo de chaves do kernel...",
+  "Configuring kernel panic behavior": "Configurando o comportamento do kernel panic",
+  "Configuring kernel swappiness...": "Configurando a troca do kernel...",
+  "Configuring kexec for quick reboots...": "Configurando o kexec para reinicializações rápidas...",
+  "Configuring max FD limit / ulimit...": "Configurando limite máximo de FD/ulimit...",
+  "Configuring max user watches...": "Configurando o máximo de relógios de usuários...",
+  "Configuring pigz as a faster replacement for gzip...": "Configurando o pigz como um substituto mais rápido para o gzip...",
+  "Configuring snapshot schedules...": "Configurando programações de snapshots...",
+  "Configuring system time settings...": "Configurando as configurações de hora do sistema...",
+  "Configuring vfio-pci binding...": "Configurando a ligação vfio-pci...",
+  "Confirm Borg passphrase": "Confirme a senha Borg",
+  "Confirm Borg passphrase:": "Confirme a senha Borg:",
+  "Confirm Controller + NVMe Assignment": "Confirmar atribuição de controlador + NVMe",
+  "Confirm Deletion": "Confirmar exclusão",
+  "Confirm Format": "Confirmar formato",
+  "Confirm GPU Switch Mode": "Confirme o modo de troca de GPU",
+  "Confirm Import": "Confirmar importação",
+  "Confirm Mount": "Confirmar montagem",
+  "Confirm Mount Point Removal": "Confirme a remoção do ponto de montagem",
+  "Confirm Password": "Confirme sua senha",
+  "Confirm Remove": "Confirmar remoção",
+  "Confirm Restore": "Confirmar restauração",
+  "Confirm Uninstallation": "Confirme a desinstalação",
+  "Confirm Unmount": "Confirmar desmontagem",
+  "Confirm complete restore": "Confirme a restauração completa",
+  "Confirm custom restore": "Confirme a restauração personalizada",
+  "Confirm delete": "Confirmar exclusão",
+  "Confirm export": "Confirmar exportação",
+  "Confirm password for": "Confirme a senha para",
+  "Confirm recovery passphrase:": "Confirme a senha de recuperação:",
+  "Confirm the keyfile passphrase:": "Confirme a senha do arquivo-chave:",
+  "Confirm the mount path is visible.": "Confirme se o caminho de montagem está visível.",
+  "Confirm the password:": "Confirme a senha:",
+  "Confirmation": "Confirmação",
+  "Confirmation Failed": "Falha na confirmação",
+  "Conflicting drivers blacklisted successfully.": "Drivers conflitantes colocados na lista negra com sucesso.",
+  "Conflicting path included in backup:": "Caminho conflitante incluído no backup:",
+  "Conflicting utilities removed": "Utilitários conflitantes removidos",
+  "Connect a Coral Accelerator and try again.": "Conecte um Coral Accelerator e tente novamente.",
+  "Connected": "Conectado",
+  "Connecting to PBS and starting backup...": "Conectando ao PBS e iniciando o backup...",
+  "Connection Details:": "Detalhes de conexão:",
+  "Connection Error": "Erro de conexão",
+  "Connection details:": "Detalhes da conexão:",
+  "Connectivity Test": "Teste de conectividade",
+  "Connectivity Test Results": "Resultados do teste de conectividade",
+  "Consider adding physical interface": "Considere adicionar interface física",
+  "Consider removing its configuration": "Considere remover sua configuração",
+  "Consider security implications for production environments": "Considere as implicações de segurança para ambientes de produção",
+  "Consider visiting the repository and supporting the project.": "Considere visitar o repositório e apoiar o projeto.",
+  "Container": "Recipiente",
+  "Container         — LXC root directories": "Container - diretórios raiz LXC",
+  "Container ID": "ID do contêiner",
+  "Container ID not defined. Make sure to select a container first.": "ID do contêiner não definido. Certifique-se de selecionar um contêiner primeiro.",
+  "Container Mount Point": "Ponto de montagem do contêiner",
+  "Container OS:": "SO do contêiner:",
+  "Container Path": "Caminho do contêiner",
+  "Container Path:": "Caminho do contêiner:",
+  "Container Status": "Status do contêiner",
+  "Container configuration not found": "Configuração do contêiner não encontrada",
+  "Container did not become ready in time. Skipping driver installation.": "O contêiner não ficou pronto a tempo. Ignorando a instalação do driver.",
+  "Container did not start in time.": "O contêiner não começou a tempo.",
+  "Container distro": "Distribuição de contêiner",
+  "Container does not have apt-get available. Coral driver installation only supports Debian/Ubuntu containers.": "O contêiner não tem o apt-get disponível. A instalação do driver Coral suporta apenas contêineres Debian/Ubuntu.",
+  "Container is already stopped.": "O contêiner já está parado.",
+  "Container is running. Restart to apply changes?": "O contêiner está em execução. Reiniciar para aplicar as alterações?",
+  "Container is stopped. Start it now to verify the mount works?": "O contêiner está parado. Iniciá-lo agora para verificar se a montagem funciona?",
+  "Container mount point:": "Ponto de montagem do contêiner:",
+  "Container must be stopped before conversion": "O contêiner deve ser parado antes da conversão",
+  "Container restarted successfully": "Contêiner reiniciado com sucesso",
+  "Container started successfully": "Contêiner iniciado com sucesso",
+  "Container started successfully.": "O contêiner foi iniciado com sucesso.",
+  "Container started.": "Contêiner iniciado.",
+  "Container stopped.": "Contêiner parado.",
+  "Container successfully converted to privileged.": "Contêiner convertido com sucesso em privilegiado.",
+  "Container template— LXC templates": "Modelo de contêiner - modelos LXC",
+  "Container will pick up the mount on next start": "O contêiner pegará a montagem na próxima partida",
+  "Container with ID": "Contêiner com ID",
+  "Container:": "Recipiente:",
+  "Contains files": "Contém arquivos",
+  "Contains:": "Contém:",
+  "Content Types": "Tipos de conteúdo",
+  "Content Types:": "Tipos de conteúdo:",
+  "Content is usually images for VM block devices.": "O conteúdo geralmente consiste em imagens para dispositivos de bloco VM.",
+  "Content type is fixed to:": "O tipo de conteúdo é fixado em:",
+  "Content:": "Contente:",
+  "Continue": "Continuar",
+  "Continue anyway?": "Continuar mesmo assim?",
+  "Continue despite failures?": "Continuar apesar das falhas?",
+  "Continue the VM wizard and reboot the host at the end.": "Continue o assistente de VM e reinicialize o host no final.",
+  "Continue the Windows installation as usual.": "Continue a instalação do Windows normalmente.",
+  "Continue with Coral TPU configuration only?": "Continuar apenas com a configuração do Coral TPU?",
+  "Continue with live apply now? SSH may disconnect immediately.": "Continuar com a inscrição ao vivo agora? O SSH pode ser desconectado imediatamente.",
+  "Continue with the import?": "Continuar com a importação?",
+  "Continue: Proceed with conversion": "Continuar: Prossiga com a conversão",
+  "Continue?": "Continuar?",
+  "Continuing with your selection.": "Continuando com sua seleção.",
+  "Controller": "Controlador",
+  "Controller + NVMe": "Controlador + NVMe",
+  "Controller + NVMe assignment will be written now and become active after host reboot.": "A atribuição de controlador + NVMe será gravada agora e se tornará ativa após a reinicialização do host.",
+  "Controller + NVMe passthrough requires machine type q35. Skipping controller assignment.": "A passagem Controlador + NVMe requer tipo de máquina q35. Ignorando atribuição do controlador.",
+  "Controller/NVMe Conflict Policy": "Política de Conflito Controlador/NVMe",
+  "Controller/NVMe already present in VM config": "Controlador/NVMe já presente na configuração da VM",
+  "Controller/NVMe assigned": "Controlador/NVMe atribuído",
+  "Controller/NVMe is in use by running VM": "Controlador/NVMe está em uso executando VM",
+  "Controller/NVMe passthrough requires IOMMU enabled in BIOS/UEFI and kernel.": "A passagem do controlador/NVMe requer IOMMU habilitado no BIOS/UEFI e no kernel.",
+  "Controller/NVMe passthrough requires machine type q35.": "A passagem do controlador/NVMe requer o tipo de máquina q35.",
+  "Controller/NVMe passthrough to VMs requires IOMMU enabled in BIOS/UEFI and kernel.": "A passagem do controlador/NVMe para VMs requer IOMMU habilitado no BIOS/UEFI e no kernel.",
+  "Controller/NVMe passthrough to VMs requires IOMMU to be enabled in the kernel.": "A passagem do controlador/NVMe para VMs requer que o IOMMU esteja habilitado no kernel.",
+  "Controller/NVMe passthrough — compatibility notice": "Passagem de controlador/NVMe — aviso de compatibilidade",
+  "Controller/NVMe removed from source VM": "Controlador/NVMe removido da VM de origem",
+  "Controllers + NVMe": "Controladores + NVMe",
+  "Controllers + NVMe Selected:": "Controladores + NVMe selecionados:",
+  "Convert Privileged to Unprivileged": "Converter privilegiado em não privilegiado",
+  "Convert Unprivileged to Privileged": "Converter não privilegiado em privilegiado",
+  "Convert directory ownership:": "Converter propriedade do diretório:",
+  "Convert disk image format": "Converter formato de imagem de disco",
+  "Convert disk image format using QEMU-IMG": "Converta o formato de imagem de disco usando QEMU-IMG",
+  "Convert file ownership (this takes time):": "Converta a propriedade do arquivo (isso leva tempo):",
+  "Converted + verified:": "Convertido + verificado:",
+  "Converted container ID:": "ID do contêiner convertido:",
+  "Converting container to privileged...": "Convertendo contêiner em privilegiado...",
+  "Converting disk": "Convertendo disco",
+  "Converting file ownership (this may take several minutes)...": "Convertendo a propriedade do arquivo (isso pode levar alguns minutos)...",
+  "Converting image using command:": "Convertendo imagem usando o comando:",
+  "Converts to deb822; keeps .list backups as .bak": "Converte para deb822; mantém backups .list como .bak",
+  "Copy failed": "Falha na cópia",
+  "Copy that file offsite yourself, or download it from the Monitor.": "Copie você mesmo esse arquivo fora do local ou baixe-o do Monitor.",
+  "Copy the correct keyfile to this host and rerun Restore — or pick an unencrypted backup.": "Copie o arquivo-chave correto para este host e execute novamente a Restauração – ou escolha um backup não criptografado.",
+  "Copy the keyfile to a path for offsite backup": "Copie o arquivo-chave para um caminho para backup externo",
+  "Copy your PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to": "Copie seu arquivo-chave PBS para este host primeiro (via scp, USB, sftp, etc.) e insira seu caminho absoluto abaixo.O arquivo será copiado para",
+  "Copy your existing PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to": "primeiro copie seu arquivo de chave PBS existente para este host (via scp, USB, sftp, etc.) e insira seu caminho absoluto abaixo.O arquivo será copiado para",
+  "Copying installer to container": "Copiando o instalador para o contêiner",
+  "Copying sources to": "Copiando fontes para",
+  "Coral APT repository ready.": "Repositório Coral APT pronto.",
+  "Coral Actions": "Ações Corais",
+  "Coral M.2 / PCIe detected — installing gasket and apex kernel modules...": "Coral M.2 / PCIe detectado – instalando módulos de junta e kernel apex...",
+  "Coral M.2 Apex configuration added - device ready": "Configuração Coral M.2 Apex adicionada - dispositivo pronto",
+  "Coral M.2 Apex configuration added - device will be available after reboot": "Configuração Coral M.2 Apex adicionada - o dispositivo estará disponível após a reinicialização",
+  "Coral M.2 Apex detected, configuring...": "Coral M.2 Apex detectado, configurando...",
+  "Coral TPU Installation": "Instalação Coral TPU",
+  "Coral TPU Uninstall": "Desinstalação do Coral TPU",
+  "Coral TPU device nodes detected with correct group (apex).": "Nós do dispositivo Coral TPU detectados com o grupo correto (apex).",
+  "Coral TPU driver installed successfully inside the container.": "Driver Coral TPU instalado com sucesso dentro do contêiner.",
+  "Coral TPU drivers installed and loaded successfully.": "Drivers Coral TPU instalados e carregados com sucesso.",
+  "Coral TPU is already installed on this host:": "Coral TPU já está instalado neste host:",
+  "Coral TPU is already installed:": "Coral TPU já está instalado:",
+  "Coral USB Accelerator detected — installing Edge TPU runtime...": "Coral USB Accelerator detectado – instalando o tempo de execução do Edge TPU...",
+  "Coral USB configuration added - device detected": "Configuração Coral USB adicionada - dispositivo detectado",
+  "Coral USB configured but device not currently connected": "Coral USB configurado, mas o dispositivo não está conectado no momento",
+  "Coral USB runtime installed. No reboot required.": "Tempo de execução Coral USB instalado. Não é necessária reinicialização.",
+  "Coral hardware configuration completed for container": "Configuração de hardware Coral concluída para contêiner",
+  "Coral kernel modules unloaded.": "Módulos do kernel Coral descarregados.",
+  "Coral packages purged.": "Pacotes de coral eliminados.",
+  "Coral uninstallation completed.": "Desinstalação do Coral concluída.",
+  "Core Proxmox packages reinstalled successfully": "Pacotes principais do Proxmox reinstalados com sucesso",
+  "Core packages": "Pacotes principais",
+  "Could not add": "Não foi possível adicionar",
+  "Could not add disk": "Não foi possível adicionar o disco",
+  "Could not assign disk": "Não foi possível atribuir o disco",
+  "Could not authorize the key via 'pct exec' on": "Não foi possível autorizar a chave via 'pct exec' em",
+  "Could not back up the existing auth.json": "Não foi possível fazer backup do auth.json existente",
+  "Could not change VM virtual display to vga: std": "Não foi possível alterar a exibição virtual da VM para vga: std",
+  "Could not clone any gasket-driver repository. Check your internet connection and": "Não foi possível clonar nenhum repositório de driver de junta. Verifique sua conexão com a internet e",
+  "Could not configure IOMMU kernel parameters automatically. Configure manually and reboot.": "Não foi possível configurar os parâmetros do kernel IOMMU automaticamente. Configure manualmente e reinicie.",
+  "Could not copy the PVE keyfile into place. Check permissions on:": "Não foi possível copiar o arquivo-chave PVE no lugar.Verifique as permissões em:",
+  "Could not copy the keyfile into place.": "Não foi possível copiar o arquivo-chave no lugar.",
+  "Could not copy the keyfile into place. Check permissions on:": "Não foi possível copiar o arquivo-chave no lugar.Verifique as permissões em:",
+  "Could not create converter directory:": "Não foi possível criar o diretório do conversor:",
+  "Could not create destination directory:": "Não foi possível criar o diretório de destino:",
+  "Could not create or access directory:": "Não foi possível criar ou acessar o diretório:",
+  "Could not create temporary directory:": "Não foi possível criar o diretório temporário:",
+  "Could not create temporary working directory.": "Não foi possível criar um diretório de trabalho temporário.",
+  "Could not detect apex major number from /proc/devices. Load the apex module first: modprobe apex": "Não foi possível detectar o número principal do ápice em /proc/devices. Carregue o módulo apex primeiro: modprobe apex",
+  "Could not detect the CIFS mount for this directory. Try accessing it manually.": "Não foi possível detectar a montagem CIFS para este diretório. Tente acessá-lo manualmente.",
+  "Could not determine a valid ISO storage directory.": "Não foi possível determinar um diretório de armazenamento ISO válido.",
+  "Could not determine disk path for:": "Não foi possível determinar o caminho do disco para:",
+  "Could not determine the IOMMU group for the selected GPU.": "Não foi possível determinar o grupo IOMMU para a GPU selecionada.",
+  "Could not download recovery blob from PBS.": "Não foi possível baixar o blob de recuperação do PBS.",
+  "Could not download the installer.": "Não foi possível baixar o instalador.",
+  "Could not enable on-boot restore service.": "Não foi possível ativar o serviço de restauração na inicialização.",
+  "Could not export ZFS pool": "Não foi possível exportar o pool ZFS",
+  "Could not extract from PBS.": "Não foi possível extrair do PBS.",
+  "Could not fetch keylase/nvidia-patch supported list — patch reapply compatibility is not verified.": "Não foi possível buscar a lista compatível com keylase/nvidia-patch — a compatibilidade de reaplicação do patch não foi verificada.",
+  "Could not find a valid 'proxmox-ve' 9.x candidate after switching to no-subscription. Please verify your repository configuration and network, then retry.": "Não foi possível encontrar um candidato 'proxmox-ve' 9.x válido após mudar para sem assinatura. Verifique a configuração e a rede do seu repositório e tente novamente.",
+  "Could not find rootfs configuration for container.": "Não foi possível encontrar a configuração rootfs para o contêiner.",
+  "Could not format the disk.": "Não foi possível formatar o disco.",
+  "Could not fully zero": "Não foi possível zerar totalmente",
+  "Could not identify the imported disk in VM config": "Não foi possível identificar o disco importado na configuração da VM",
+  "Could not install": "Não foi possível instalar",
+  "Could not install Git — Lynis cannot be cloned. Run 'apt-get install git' manually.": "Não foi possível instalar o Git — Lynis não pode ser clonado. Execute 'apt-get install git' manualmente.",
+  "Could not install exFAT tools automatically.": "Não foi possível instalar as ferramentas exFAT automaticamente.",
+  "Could not install sshpass automatically (no internet?). Falling back to manual paste mode — you'll see the line to copy onto the server next.": "Não foi possível instalar o sshpass automaticamente (sem internet?).Voltando ao modo de colagem manual - você verá a próxima linha para copiar no servidor.",
+  "Could not install vzdump hook in /etc/vzdump.conf": "Não foi possível instalar o gancho vzdump em /etc/vzdump.conf",
+  "Could not load shared functions. Script cannot continue.": "Não foi possível carregar funções compartilhadas. O script não pode continuar.",
+  "Could not locate imported disk in VM config.": "Não foi possível localizar o disco importado na configuração da VM.",
+  "Could not mount": "Não foi possível montar",
+  "Could not mount ISO on device": "Não foi possível montar o ISO no dispositivo",
+  "Could not parse OVF file, or no disk image references found.": "Não foi possível analisar o arquivo OVF ou nenhuma referência de imagem de disco foi encontrada.",
+  "Could not push the key. Check the password and that": "Não foi possível pressionar a chave. Verifique a senha e isso",
+  "Could not read SMART data from": "Não foi possível ler os dados SMART de",
+  "Could not read VM configuration.": "Não foi possível ler a configuração da VM.",
+  "Could not remount automatically. Try manually or check credentials.": "Não foi possível remontar automaticamente. Tente manualmente ou verifique as credenciais.",
+  "Could not remove VM automatically. Run manually:": "Não foi possível remover a VM automaticamente. Execute manualmente:",
+  "Could not remove previous DKMS tree at": "Não foi possível remover a árvore DKMS anterior em",
+  "Could not restart ProxMenux Monitor service.": "Não foi possível reiniciar o serviço ProxMenux Monitor.",
+  "Could not restart the service — start it manually with systemctl start": "Não foi possível reiniciar o serviço – inicie-o manualmente com systemctl start",
+  "Could not retrieve versions list from NVIDIA. Please check your internet connection.": "Não foi possível recuperar a lista de versões da NVIDIA. Verifique sua conexão com a Internet.",
+  "Could not run NVIDIA patch script. Please verify repository and driver version.": "Não foi possível executar o script de patch da NVIDIA. Verifique o repositório e a versão do driver.",
+  "Could not set VM virtual display to vga: std": "Não foi possível definir a exibição virtual da VM como vga: std",
+  "Could not set boot order for": "Não foi possível definir a ordem de inicialização para",
+  "Could not stop LXC": "Não foi possível parar o LXC",
+  "Could not unload nouveau module (may be in use). The blacklist will take effect after reboot. Installation will continue but a reboot will be required.": "Não foi possível descarregar o módulo nouveau (pode estar em uso). A lista negra entrará em vigor após a reinicialização. A instalação continuará, mas será necessária uma reinicialização.",
+  "Could not unmount": "Não foi possível desmontar",
+  "Could not unmount — disk may be busy. Removing fstab entry anyway.": "Não foi possível desmontar — o disco pode estar ocupado. Removendo a entrada fstab de qualquer maneira.",
+  "Could not update config file.": "Não foi possível atualizar o arquivo de configuração.",
+  "Could not write to:": "Não foi possível escrever para:",
+  "Create": "Criar",
+  "Create Directory": "Criar diretório",
+  "Create GPT and one partition:": "Crie GPT e uma partição:",
+  "Create GPT partition": "Criar partição GPT",
+  "Create LXC server NFS": "Criar servidor LXC NFS",
+  "Create Network Backup": "Criar backup de rede",
+  "Create Samba server service": "Criar serviço de servidor Samba",
+  "Create Samba user:": "Criar usuário Samba:",
+  "Create Shared Directory": "Criar diretório compartilhado",
+  "Create Shared Directory on Host": "Crie um diretório compartilhado no host",
+  "Create Universal NFS Export": "Criar exportação NFS universal",
+  "Create VM from template or script": "Crie VM a partir de modelo ou script",
+  "Create a VM first (machine type q35 + UEFI BIOS), then run this option again.": "Crie primeiro uma VM (tipo de máquina q35 + UEFI BIOS) e, em seguida, execute esta opção novamente.",
+  "Create a backup of the container configuration:": "Crie um backup da configuração do contêiner:",
+  "Create a backup of your container before proceeding": "Crie um backup do seu contêiner antes de continuar",
+  "Create a fresh GPT + ext4 partition and mount it?": "Criar uma nova partição GPT + ext4 e montá-la?",
+  "Create a new dataset in a ZFS pool": "Crie um novo conjunto de dados em um pool ZFS",
+  "Create a new group for isolation": "Crie um novo grupo para isolamento",
+  "Create credentials file (recommended):": "Crie um arquivo de credenciais (recomendado):",
+  "Create directory": "Criar diretório",
+  "Create export directory:": "Crie o diretório de exportação:",
+  "Create mount point:": "Criar ponto de montagem:",
+  "Create new directory in /mnt": "Crie um novo diretório em /mnt",
+  "Create new folder in /mnt": "Crie uma nova pasta em /mnt",
+  "Create one first in Datacenter → Backup, then return here to attach.": "Crie um primeiro em Datacenter → Backup e depois retorne aqui para anexar.",
+  "Create persistent network interface names?": "Criar nomes de interface de rede persistentes?",
+  "Create scheduled backup job": "Criar tarefa de backup agendada",
+  "Create share directory:": "Crie um diretório de compartilhamento:",
+  "Create shared directory:": "Crie um diretório compartilhado:",
+  "Created common remapped user": "Usuário remapeado comum criado",
+  "Created directory on host:": "Diretório criado no host:",
+  "Created persistent names for": "Nomes persistentes criados para",
+  "Created remapped user": "Usuário remapeado criado",
+  "Created sharedfiles group (GID: 101000)": "Grupo de arquivos compartilhados criado (GID: 101000)",
+  "Creating APT configuration to force IPv4...": "Criando configuração do APT para forçar IPv4...",
+  "Creating Ceph repository for PVE 8 (legacy format)...": "Criando repositório Ceph para PVE 8 (formato legado)...",
+  "Creating Ceph repository for PVE 9 (deb822 format)...": "Criando repositório Ceph para PVE 9 (formato deb822)...",
+  "Creating Proxmox VE 9.x no-subscription repository...": "Criando repositório sem assinatura Proxmox VE 9.x...",
+  "Creating Proxmox auth logger service...": "Criando serviço de registrador de autenticação Proxmox...",
+  "Creating SSH auth logger service...": "Criando serviço de registro de autenticação SSH...",
+  "Creating UID remapping for unprivileged container compatibility...": "Criando remapeamento de UID para compatibilidade de contêiner sem privilégios...",
+  "Creating VM with the above configuration": "Criando VM com a configuração acima",
+  "Creating VM...": "Criando VM...",
+  "Creating backup of configuration file...": "Criando backup do arquivo de configuração...",
+  "Creating backup of network interfaces configuration...": "Criando backup da configuração das interfaces de rede...",
+  "Creating compressed archive...": "Criando arquivo compactado...",
+  "Creating export archive...": "Criando arquivo de exportação...",
+  "Creating local archive...": "Criando arquivo local...",
+  "Creating mount point...": "Criando ponto de montagem...",
+  "Creating new ZFS ARC configuration...": "Criando nova configuração ZFS ARC...",
+  "Creating partition table and partition...": "Criando tabela de partição e partição...",
+  "Creating partition...": "Criando partição...",
+  "Creating pigz wrapper script...": "Criando script wrapper pigz...",
+  "Credentials are correct": "As credenciais estão corretas",
+  "Credentials cleared. jwt_secret and API tokens preserved.": "Credenciais apagadas. jwt_secret e tokens de API preservados.",
+  "Credentials file created securely.": "Arquivo de credenciais criado com segurança.",
+  "Credentials file removed.": "Arquivo de credenciais removido.",
+  "Credentials file:": "Arquivo de credenciais:",
+  "Credentials validated successfully": "Credenciais validadas com sucesso",
+  "Cross-host restore: guest IDs in backup overlap live IDs on target:": "Restauração entre hosts: os IDs de convidados no backup se sobrepõem aos Live IDs no destino:",
+  "Cross-kernel restore — kernel-tied paths merged, not copied": "Restauração entre kernels – caminhos vinculados ao kernel mesclados, não copiados",
+  "Cross-kernel — paths hidden from picker": "Cross-kernel – caminhos ocultos do seletor",
+  "Cross-version detected — safe restore mode": "Versão cruzada detectada – modo de restauração seguro",
+  "Current": "Atual",
+  "Current CIFS mounts:": "Montagens CIFS atuais:",
+  "Current Configuration": "Configuração atual",
+  "Current LXC Mount Points": "Pontos de montagem LXC atuais",
+  "Current NFS Mounts": "Montagens NFS atuais",
+  "Current NFS client script supports privileged LXC only.": "O script do cliente NFS atual suporta apenas LXC privilegiado.",
+  "Current NFS exports in CT": "Exportações atuais de NFS em CT",
+  "Current NFS mounts:": "Montagens NFS atuais:",
+  "Current Network Configuration": "Configuração de rede atual",
+  "Current PVE Version": "Versão atual do PVE",
+  "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Os scripts atuais do host ProxMenux registram compartilhamentos remotos como armazenamentos Proxmox usando pvesm.",
+  "Current ProxMenux version:": "Versão atual do ProxMenux:",
+  "Current Samba Mounts": "Montagens atuais do Samba",
+  "Current Samba client script supports privileged LXC only.": "O script do cliente Samba atual suporta apenas LXC privilegiado.",
+  "Current Samba shares in CT": "Ações atuais do Samba no CT",
+  "Current channel:": "Canal atual:",
+  "Current driver": "Motorista atual",
+  "Current free space:": "Espaço livre atual:",
+  "Current language:": "Idioma atual:",
+  "Current mode": "Modo atual",
+  "Current mount options:": "Opções de montagem atuais:",
+  "Current permissions:": "Permissões atuais:",
+  "Current power state: D3cold (device currently inaccessible)": "Estado de energia atual: D3cold (dispositivo atualmente inacessível)",
+  "Current script uses native bind mounts with pct set -mpX.": "O script atual usa montagens de ligação nativas com pct set -mpX.",
+  "Current selection:": "Seleção atual:",
+  "Current status:": "Situação atual:",
+  "Current user": "Usuário atual",
+  "Current user UID, GID and groups": "UID, GID e grupos do usuário atual",
+  "Current version:": "Versão atual:",
+  "Currently": "Atualmente",
+  "Currently Mounted:": "Atualmente montado:",
+  "Currently configured target:": "destino atualmente configurado:",
+  "Currently mounted:": "Atualmente montado:",
+  "Custom": "Personalizado",
+  "Custom Configuration": "Configuração personalizada",
+  "Custom Content": "Conteúdo personalizado",
+  "Custom Directory": "Diretório personalizado",
+  "Custom Logo Instructions": "Instruções para logotipo personalizado",
+  "Custom Options": "Opções personalizadas",
+  "Custom Path": "Caminho personalizado",
+  "Custom backup paths": "caminhos de backup personalizados",
+  "Custom backup profile": "Perfil de backup personalizado",
+  "Custom backup to Borg": "Backup personalizado para Borg",
+  "Custom backup to PBS": "Backup personalizado para PBS",
+  "Custom backup to local archive": "Backup personalizado para arquivo local",
+  "Custom local directory": "Diretório local personalizado",
+  "Custom message added to MOTD": "Mensagem personalizada adicionada ao MOTD",
+  "Custom options": "Opções personalizadas",
+  "Custom path": "Caminho personalizado",
+  "Custom path...": "Caminho personalizado...",
+  "Custom paths are included in BOTH default and custom backup profiles.": "Os caminhos personalizados estão incluídos em AMBOS os perfis de backup padrão e personalizados.",
+  "Custom restore by components": "Restauração personalizada por componentes",
+  "Custom restore by paths": "restauração personalizada por caminhos",
+  "Custom scripts and ProxMenux files": "Scripts personalizados e arquivos ProxMenux",
+  "Custom selection": "Seleção personalizada",
+  "Custom systemd units": "Unidades systemd personalizadas",
+  "Customizable post-installation script": "script pós-instalação personalizável",
+  "Customization": "Personalização",
+  "Customize bashrc": "Personalizar bashrc",
+  "Customizing bashrc for root user...": "Personalizando o bashrc para usuário root...",
+  "DISABLED unless you enable it": "DESATIVADO, a menos que você o habilite",
+  "DKMS add failed. Check": "Falha na adição do DKMS. Verificar",
+  "DKMS build failed.": "Falha na compilação do DKMS.",
+  "DKMS build failed. Last lines of make.log:": "Falha na compilação do DKMS. Últimas linhas do make.log:",
+  "DKMS install failed.": "Falha na instalação do DKMS.",
+  "DKMS module registered.": "Módulo DKMS registrado.",
+  "DNS Resolution": "Resolução DNS",
+  "DNS lookup for a domain": "Pesquisa de DNS para um domínio",
+  "Data size:": "Tamanho dos dados:",
+  "Data wipe complete.": "Limpeza de dados concluída.",
+  "Data wiped from": "Dados apagados de",
+  "Datastore name:": "Nome do armazenamento de dados:",
+  "Deactivate Monitor": "Desativar monitor",
+  "Deactivate ProxMenux Monitor": "Desativar monitor ProxMenux",
+  "Debian repositories missing; creating default source file": "Repositórios Debian ausentes; criando arquivo fonte padrão",
+  "Decompress backup manually": "Descompacte o backup manualmente",
+  "Decryption failed. The passphrase may be wrong, or the blob is corrupt. Try again?": "A descriptografia falhou. A senha pode estar errada ou o blob está corrompido. Tentar novamente?",
+  "Default ACLs applied for group inheritance.": "ACLs padrão aplicadas para herança de grupo.",
+  "Default Credentials": "Credenciais padrão",
+  "Default Gateway": "Gateway padrão",
+  "Default ISO directory": "Diretório ISO padrão",
+  "Default Login Credentials:": "Credenciais de login padrão:",
+  "Default Port": "Porta padrão",
+  "Default Proxmox logo applied": "Logotipo padrão do Proxmox aplicado",
+  "Default is none (video-only passthrough). Use SPACE to toggle selections.": "O padrão é nenhum (passagem somente de vídeo). Use ESPAÇO para alternar as seleções.",
+  "Default journald configuration restored": "Configuração padrão do diário restaurada",
+  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "O local padrão é /mnt/<nome>. O compartilhamento será montado aqui no host com permissões abertas para que um LXC sem privilégios possa montar e gravar nele. Para acesso LXC, monte este caminho com o LXC Mount Manager.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "O local padrão é /mnt/<nome>. O compartilhamento será montado aqui no host. Use este caminho em /etc/fstab. Para acesso LXC, monte este caminho com o LXC Mount Manager.",
+  "Default options": "Opções padrão",
+  "Default options read/write": "Opções padrão leitura/gravação",
+  "Default will be used:": "O padrão será usado:",
+  "Default:": "Padrão:",
+  "Delete Borg target": "Excluir alvo Borg",
+  "Delete Export": "Excluir exportação",
+  "Delete Share": "Excluir compartilhamento",
+  "Delete a CT (irreversible). Use the correct <ctid>": "Excluir um CT (irreversível). Use o <ctid> correto",
+  "Delete a VM (irreversible). Use the correct <vmid>": "Exclua uma VM (irreversível). Use o <vmid> correto",
+  "Delete archive": "Excluir arquivo",
+  "Delete job": "Excluir trabalho",
+  "Delete scheduled backup job?": "Excluir tarefa de backup agendada?",
+  "Delete this corrupt archive and pick another": "Exclua este arquivo corrompido e escolha outro",
+  "Dependencies installed successfully": "Dependências instaladas com sucesso",
+  "Deploy with this configuration?": "Implantar com esta configuração?",
+  "Deploying Secure Gateway...": "Implantando gateway seguro...",
+  "Deployment cancelled.": "Implantação cancelada.",
+  "Deployment failed": "Falha na implantação",
+  "Description": "Descrição",
+  "Desktop UI backup created": "Backup da IU do desktop criado",
+  "Desktop and Mobile UI patched": "Interface de desktop e móvel corrigida",
+  "Destination Directory": "Diretório de destino",
+  "Destination directory does not exist:": "O diretório de destino não existe:",
+  "Destination directory is not writable:": "O diretório de destino não é gravável:",
+  "Destination path for the copy (typically outside ProxMenux state):": "Caminho de destino para a cópia (normalmente fora do estado ProxMenux):",
+  "Destination:": "Destino:",
+  "Destroy a ZFS dataset (irreversible)": "Destruir um conjunto de dados ZFS (irreversível)",
+  "Destructive rollback": "reversão destrutiva",
+  "Detailed Proxmox version info": "Informações detalhadas da versão do Proxmox",
+  "Detailed partition layout with GPT info": "Layout detalhado da partição com informações GPT",
+  "Detailed service information": "Informações detalhadas do serviço",
+  "Details": "Detalhes",
+  "Detect GPUs in host": "Detectar GPUs no host",
+  "Detect controller/NVMe BDF": "Detectar controlador/NVMe BDF",
+  "Detected": "Detectado",
+  "Detected AMD CPU": "CPU AMD detectada",
+  "Detected Coral hardware:": "Hardware Coral detectado:",
+  "Detected GPU(s):": "GPU(s) detectada(s):",
+  "Detected Intel CPU": "CPU Intel detectada",
+  "Detected Proxmox VE": "Proxmox VE detectado",
+  "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Detectado Proxmox VE 8.x - Instalando Ceph Squid para Debian",
+  "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Detectado Proxmox VE 9.x - Instalando Ceph Squid para Debian Trixie",
+  "Detected RAM:": "RAM detectada:",
+  "Detected a mounted directory from host. Setting up shared group...": "Detectou um diretório montado do host. Configurando grupo compartilhado...",
+  "Detected backups — newest first:": "Backups detectados – os mais recentes primeiro:",
+  "Detected broken gasket-dkms package state:": "Estado quebrado do pacote junta-dkms detectado:",
+  "Detected existing Samba user:": "Usuário existente do Samba detectado:",
+  "Detected filesystem:": "Sistema de arquivos detectado:",
+  "Detected nftables - using nftables ban action": "Nftables detectados - usando ação de banimento de nftables",
+  "Detected paths in this backup:": "Caminhos detectados neste backup:",
+  "Detected power state": "Estado de energia detectado",
+  "Detected reset method": "Método de redefinição detectado",
+  "Detected risk factor": "Fator de risco detectado",
+  "Detected subtype": "Subtipo detectado",
+  "Detected:": "Detectado:",
+  "Detecting AMD CPU and applying fixes if necessary...": "Detectando CPU AMD e aplicando correções, se necessário...",
+  "Detecting PCI storage controllers and NVMe devices...": "Detectando controladores de armazenamento PCI e dispositivos NVMe...",
+  "Detecting available disks...": "Detectando discos disponíveis...",
+  "Detecting container OS...": "Detectando SO de contêiner...",
+  "Detecting if this is an OVH server and installing OVH RTM if necessary...": "Detectar se se trata de um servidor OVH e instalar OVH RTM se necessário...",
+  "Detecting previous optimizations...": "Detectando otimizações anteriores...",
+  "Detecting virtualization and installing  guest agent...": "Detectando virtualização e instalando agente convidado...",
+  "Development Tools": "Ferramentas de desenvolvimento",
+  "Device In Use": "Dispositivo em uso",
+  "Device added": "Dispositivo adicionado",
+  "Device already present in target VM — existing hostpci entry reused": "Dispositivo já presente na VM de destino – entrada hostpci existente reutilizada",
+  "Device assignments will be written now and become active after reboot.": "As atribuições de dispositivos serão gravadas agora e ficarão ativas após a reinicialização.",
+  "Device hostname": "Nome de host do dispositivo",
+  "Device path mismatch. Format cancelled.": "Incompatibilidade de caminho do dispositivo. Formato cancelado.",
+  "Device:": "Dispositivo:",
+  "Devices to add to VM": "Dispositivos para adicionar à VM",
+  "Diff: current system vs backup (--- system  +++ backup)": "Diferença: sistema atual vs backup (--- backup do sistema +++)",
+  "Different host. Backup from:": "Anfitrião diferente. Backup de:",
+  "Direct conversion completed for container": "Conversão direta concluída para contêiner",
+  "Directory Exists": "O diretório existe",
+  "Directory Not Empty": "Diretório não vazio",
+  "Directory Not Found": "Diretório não encontrado",
+  "Directory already exists. Continue with permission setup?": "O diretório já existe. Continuar com a configuração de permissão?",
+  "Directory configured for sharedfiles group access on:": "Diretório configurado para acesso do grupo sharedfiles em:",
+  "Directory configured with sharedfiles group ownership": "Diretório configurado com propriedade do grupo sharedfiles",
+  "Directory created successfully.": "Diretório criado com sucesso.",
+  "Directory created successfully:": "Diretório criado com sucesso:",
+  "Directory created:": "Diretório criado:",
+  "Directory does not exist and was not created.": "O diretório não existe e não foi criado.",
+  "Directory does not exist:": "O diretório não existe:",
+  "Directory error": "Erro de diretório",
+  "Directory not found": "Diretório não encontrado",
+  "Directory storage added successfully to Proxmox!": "Armazenamento de diretório adicionado com sucesso ao Proxmox!",
+  "Directory successfully.": "Diretório com sucesso.",
+  "Directory:": "Diretório:",
+  "Disable NIC Offloading (Intel e1000e)": "Desativar descarregamento de NIC (Intel e1000e)",
+  "Disable autostart on conflicting VM": "Desative a inicialização automática em VM conflitante",
+  "Disable autostart on one VM to avoid startup conflicts.": "Desative a inicialização automática em uma VM para evitar conflitos de inicialização.",
+  "Disable kernel audit messages (optional but recommended):": "Desative as mensagens de auditoria do kernel (opcional, mas recomendado):",
+  "Disable onboot on affected VM(s)/CT(s)": "Desativar inicialização em VM(s)/CT(s) afetados",
+  "Disable portmapper/rpcbind": "Desativar portmapper/rpcbind",
+  "Disabled": "Desabilitado",
+  "Disabling High Availability services...": "Desativando serviços de alta disponibilidade...",
+  "Disabling ZFS autotrim applied by ProxMenux...": "Desativando o ajuste automático do ZFS aplicado pelo ProxMenux...",
+  "Disabling and removing NetworkManager...": "Desativando e removendo o NetworkManager...",
+  "Disabling and stopping rpcbind service...": "Desativando e parando o serviço rpcbind...",
+  "Disabling non-free firmware warnings...": "Desativando avisos de firmware não-livre...",
+  "Disabling portmapper/rpcbind for security...": "Desativando portmapper/rpcbind por segurança...",
+  "Discover targets on portal:": "Descubra alvos no portal:",
+  "Discovering iSCSI targets...": "Descobrindo alvos iSCSI...",
+  "Discovery successful": "Descoberta bem-sucedida",
+  "Disk": "Disco",
+  "Disk Already Assigned": "Disco já atribuído",
+  "Disk In Use": "Disco em uso",
+  "Disk In Use by Running VM": "Disco em uso executando VM",
+  "Disk Manager": "Gerenciador de disco",
+  "Disk Reference Conflict": "Conflito de referência de disco",
+  "Disk Setup": "Configuração de disco",
+  "Disk added as": "Disco adicionado como",
+  "Disk already has": "O disco já tem",
+  "Disk and Storage Manager - Manual CLI Guide": "Gerenciador de disco e armazenamento - Guia CLI manual",
+  "Disk appears empty. It will be formatted.": "O disco parece vazio. Ele será formatado.",
+  "Disk assigned at": "Disco atribuído em",
+  "Disk attached as:": "Disco anexado como:",
+  "Disk configured as": "Disco configurado como",
+  "Disk conversion failed for": "A conversão do disco falhou para",
+  "Disk file not found:": "Arquivo de disco não encontrado:",
+  "Disk formatted as": "Disco formatado como",
+  "Disk formatted successfully.": "Disco formatado com sucesso.",
+  "Disk image        — VM disk images": "Imagem de disco — imagens de disco VM",
+  "Disk interface is required to continue VM creation.": "A interface de disco é necessária para continuar a criação da VM.",
+  "Disk interface selected:": "Interface de disco selecionada:",
+  "Disk interface selection cancelled.": "Seleção de interface de disco cancelada.",
+  "Disk is part of a host ZFS pool": "O disco faz parte de um pool ZFS de host",
+  "Disk is part of host LVM": "O disco faz parte do host LVM",
+  "Disk is ready for VM passthrough.": "O disco está pronto para passagem de VM.",
+  "Disk is ready to be added to Proxmox storage.": "O disco está pronto para ser adicionado ao armazenamento Proxmox.",
+  "Disk metadata cleaned.": "Metadados do disco limpos.",
+  "Disk mounted at": "Disco montado em",
+  "Disk path resolved via pvesm:": "Caminho do disco resolvido via pvesm:",
+  "Disk path:": "Caminho do disco:",
+  "Disk safety revalidation failed.": "Falha na revalidação da segurança do disco.",
+  "Disk safety validation passed.": "A validação de segurança do disco foi aprovada.",
+  "Disk unmounted from": "Disco desmontado de",
+  "Disk verified and accessible inside CT at": "Disco verificado e acessível dentro do CT em",
+  "Disk:": "Disco:",
+  "Disks exported:": "Discos exportados:",
+  "Disks to export:": "Discos para exportar:",
+  "Disks to import:": "Discos para importar:",
+  "Disks to process:": "Discos para processar:",
+  "Disks:": "Discos:",
+  "Display  :": "Mostrar  :",
+  "Display logical volumes (LVM)": "Exibir volumes lógicos (LVM)",
+  "Display physical volumes (LVM)": "Exibir volumes físicos (LVM)",
+  "Display system summary in ASCII format": "Exibir resumo do sistema em formato ASCII",
+  "Display volume groups (LVM)": "Exibir grupos de volumes (LVM)",
+  "Do not run the upgrade from the Web UI virtual console (it will disconnect)": "Não execute a atualização no console virtual da Web UI (ele será desconectado)",
+  "Do not start the VM until the system has been rebooted.": "Não inicie a VM até que o sistema seja reinicializado.",
+  "Do you want ProxMenux to stop it now?": "Você quer que o ProxMenux pare com isso agora?",
+  "Do you want to activate ProxMenux Monitor?": "Deseja ativar o ProxMenux Monitor?",
+  "Do you want to apply the optional NVIDIA patch to remove some GPU limitations?": "Deseja aplicar o patch opcional da NVIDIA para remover algumas limitações da GPU?",
+  "Do you want to apply these optimizations now?": "Quer aplicar essas otimizações agora?",
+  "Do you want to configure GPU passthrough for this VM now?": "Quer configurar a passagem de GPU para esta VM agora?",
+  "Do you want to continue anyway?": "Você quer continuar mesmo assim?",
+  "Do you want to continue with the conversion now, or exit to create a backup first?": "Deseja continuar com a conversão agora ou sair para criar um backup primeiro?",
+  "Do you want to continue?": "Você quer continuar?",
+  "Do you want to convert it to a privileged container now?": "Você deseja convertê-lo em um contêiner privilegiado agora?",
+  "Do you want to create it now?": "Você quer criá-lo agora?",
+  "Do you want to create it?": "Você quer criá-lo?",
+  "Do you want to deactivate ProxMenux Monitor?": "Deseja desativar o ProxMenux Monitor?",
+  "Do you want to disable and remove it now?": "Deseja desativá-lo e removê-lo agora?",
+  "Do you want to enable IOMMU now?": "Deseja ativar o IOMMU agora?",
+  "Do you want to enable the serial port": "Você deseja habilitar a porta serial",
+  "Do you want to encrypt this backup?": "deseja criptografar este backup?",
+  "Do you want to install Log2RAM anyway to reduce log write load?": "Você deseja instalar o Log2RAM mesmo assim para reduzir a carga de gravação do log?",
+  "Do you want to make this mount permanent?": "Você quer tornar esta montagem permanente?",
+  "Do you want to open Switch GPU Mode now?": "Você deseja abrir o modo Switch GPU agora?",
+  "Do you want to proceed and run the Proxmox System Update?": "Deseja prosseguir e executar a atualização do sistema Proxmox?",
+  "Do you want to proceed with the system update?": "Deseja prosseguir com a atualização do sistema?",
+  "Do you want to proceed?": "Você quer prosseguir?",
+  "Do you want to reboot now?": "Você quer reiniciar agora?",
+  "Do you want to restart the network service now to apply changes?": "Deseja reiniciar o serviço de rede agora para aplicar as alterações?",
+  "Do you want to restart the network service to apply changes?": "Deseja reiniciar o serviço de rede para aplicar as alterações?",
+  "Do you want to run the network script from": "Você deseja executar o script de rede de",
+  "Do you want to run the post-installation script from": "Você deseja executar o script de pós-instalação em",
+  "Do you want to run the script now?": "Deseja executar o script agora?",
+  "Do you want to schedule selected paths for next boot now?": "Deseja agendar caminhos selecionados para a próxima inicialização agora?",
+  "Do you want to start the converted unprivileged container": "Você deseja iniciar o contêiner convertido sem privilégios",
+  "Do you want to start the privileged container": "Você deseja iniciar o contêiner privilegiado",
+  "Do you want to try different credentials or authentication method?": "Quer experimentar diferentes credenciais ou métodos de autenticação?",
+  "Do you want to unmount it first?": "Quer desmontá-lo primeiro?",
+  "Do you want to update now?": "Deseja atualizar agora?",
+  "Do you want to update the NVIDIA userspace libraries inside these containers to match the host?": "Você deseja atualizar as bibliotecas do espaço do usuário NVIDIA dentro desses contêineres para corresponder ao host?",
+  "Do you want to update the existing export?": "Deseja atualizar a exportação existente?",
+  "Do you want to update the existing share?": "Deseja atualizar o compartilhamento existente?",
+  "Do you want to view the selected backup before restoring?": "Deseja visualizar o backup selecionado antes de restaurá-lo?",
+  "Download failed for all attempted URLs": "Falha no download de todas as tentativas de URL",
+  "Download keyfile": "Baixar arquivo-chave",
+  "Download latest VirtIO ISO automatically": "Baixe o VirtIO ISO mais recente automaticamente",
+  "Downloaded amdgpu_top": "baixado amdgpu_top",
+  "Downloading": "Baixando",
+  "Downloading Helper-Scripts logo...": "Baixando o logotipo do Helper-Scripts...",
+  "Downloading Home-Labs-Club logo...": "Baixando o logotipo do Home-Labs-Club...",
+  "Downloading JC Channel logo...": "Baixando o logotipo do canal JC...",
+  "Downloading ProxMenux logo...": "Baixando o logotipo do ProxMenux...",
+  "Downloading Proxmology logo...": "Baixando o logotipo da Proxmologia...",
+  "Downloading UUP converter...": "Baixando o conversor UUP...",
+  "Downloading amdgpu_top": "Baixando amdgpu_top",
+  "Downloading official installer...": "Baixando o instalador oficial...",
+  "Downloading pre-existing encrypted backups from this host will fail unless you kept a copy of the current key.": "O download de backups criptografados pré-existentes deste host falhará, a menos que você mantenha uma cópia da chave atual.",
+  "Downloading the latest Fastfetch release...": "Baixando a versão mais recente do Fastfetch...",
+  "Driver blacklist entries removed": "Entradas da lista negra de drivers removidas",
+  "Driver blacklist removed for": "Lista negra de drivers removida para",
+  "Driver installed successfully. Press Enter to continue...": "Driver instalado com sucesso. Pressione Enter para continuar...",
+  "Drivers  :": "Motoristas:",
+  "Drivers compiled and installed via DKMS.": "Drivers compilados e instalados via DKMS.",
+  "Dumping AMD GPU ROM BIOS via sysfs...": "Despejando BIOS da ROM da GPU AMD via sysfs...",
+  "Duplicate IP addresses found": "Endereços IP duplicados encontrados",
+  "Duplicate parameters cleaned": "Parâmetros duplicados limpos",
+  "Duration": "Duração",
+  "Duration:": "Duração:",
+  "EFI disk created and configured on": "Disco EFI criado e configurado em",
+  "EFI storage selection cancelled.": "Seleção de armazenamento EFI cancelada.",
+  "EFI storage selection failed or was cancelled. VM creation aborted.": "A seleção de armazenamento EFI falhou ou foi cancelada. Criação de VM abortada.",
+  "EMERGENCY PROXMOX SYSTEM REPAIR": "REPARO DE EMERGÊNCIA DO SISTEMA PROXMOX",
+  "ENABLED for restore": "HABILITADO para restauração",
+  "EXISTS": "EXISTE",
+  "Each LUN will appear as a block device assignable to VMs.": "Cada LUN aparecerá como um dispositivo de bloco atribuível às VMs.",
+  "Edge TPU runtime installed.": "Tempo de execução do Edge TPU instalado.",
+  "Edit raw CT configuration file": "Editar arquivo de configuração CT bruto",
+  "Edit raw VM configuration file": "Editar arquivo de configuração bruto da VM",
+  "Edit the VM machine type to q35 and try again.": "Edite o tipo de máquina VM para q35 e tente novamente.",
+  "Emergency Proxmox System Repair": "Reparo de emergência do sistema Proxmox",
+  "Emergency recovery:": "Recuperação de emergência:",
+  "Empty": "Vazio",
+  "Enable": "Habilitar",
+  "Enable / disable job timer": "Ativar/desativar temporizador de trabalho",
+  "Enable High Availability services": "Habilitar serviços de alta disponibilidade",
+  "Enable IOMMU in GRUB or ZFS boot": "Habilite IOMMU na inicialização GRUB ou ZFS",
+  "Enable IOMMU support if not enabled": "Habilite o suporte IOMMU se não estiver habilitado",
+  "Enable IOMMU, reboot the host, and try again.": "Habilite o IOMMU, reinicie o host e tente novamente.",
+  "Enable Remote Desktop (RDP) before disabling the virtual display.": "Habilite a Área de Trabalho Remota (RDP) antes de desabilitar a exibição virtual.",
+  "Enable SSD emulation for this disk?": "Ativar emulação SSD para este disco?",
+  "Enable TCP BBR/Fast Open control": "Habilitar controle TCP BBR/Fast Open",
+  "Enable VFIO IOMMU support": "Habilitar suporte VFIO IOMMU",
+  "Enable ZFS autotrim (SSD/NVMe pools)": "Habilitar ajuste automático ZFS (pools SSD/NVMe)",
+  "Enable auto-sync if /var/log exceeds 90% of its size?": "Ativar a sincronização automática se /var/log exceder 90% do seu tamanho?",
+  "Enable fast reboots": "Habilite reinicializações rápidas",
+  "Enable restart on kernel panic": "Habilite a reinicialização no kernel panic",
+  "Enable/Disable job": "Habilitar/Desabilitar trabalho",
+  "Enabled": "Habilitado",
+  "Enabled (device pending — load apex module or reboot)": "Ativado (dispositivo pendente – carregar módulo apex ou reinicializar)",
+  "Enabled (repokey)": "Habilitado (repokey)",
+  "Enabled and detected": "Ativado e detectado",
+  "Enabled and ready": "Habilitado e pronto",
+  "Enabled but not connected": "Ativado, mas não conectado",
+  "Enabled memory compaction proactiveness": "Proatividade de compactação de memória habilitada",
+  "Enabling Google TCP BBR congestion control...": "Ativando o controle de congestionamento TCP BBR do Google...",
+  "Enabling High Availability (HA) services...": "Habilitando serviços de alta disponibilidade (HA)...",
+  "Enabling IOMMU": "Habilitando IOMMU",
+  "Enabling IOMMU and configuring VFIO for PCI passthrough...": "Habilitando IOMMU e configurando VFIO para passagem PCI...",
+  "Enabling TCP Fast Open...": "Ativando a abertura rápida do TCP...",
+  "Enabling pigz in vzdump configuration...": "Ativando o pigz na configuração do vzdump...",
+  "Encrypt this Borg repository?": "Criptografar este repositório Borg?",
+  "Encryption": "Criptografia",
+  "Encryption key": "chave de criptografia",
+  "Encryption key creation failed": "Falha na criação da chave de criptografia",
+  "Encryption:": "Criptografia:",
+  "English": "Inglês",
+  "Ensure there are no errors and that proxmox-ve candidate shows 9.x": "Certifique-se de que não haja erros e que o candidato proxmox-ve mostre 9.x",
+  "Ensuring apex group and udev rules...": "Garantindo grupo apex e regras do udev...",
+  "Ensuring ceph.sources (enterprise, Trixie) is present...": "Garantir que ceph.sources (empresa, Trixie) esteja presente...",
+  "Ensuring ceph.sources (no-subscription, Trixie) is present...": "Garantir que ceph.sources (sem assinatura, Trixie) esteja presente...",
+  "Ensuring proxmox.sources (PVE 9, no-subscription, deb822) is present...": "Garantir que proxmox.sources (PVE 9, sem assinatura, deb822) esteja presente...",
+  "Ensuring pve-enterprise.sources (PVE 9, deb822) is present...": "Garantir que pve-enterprise.sources (PVE 9, deb822) esteja presente...",
+  "Enter": "Digitar",
+  "Enter CT ID:": "Insira o ID do CT:",
+  "Enter MSR register (e.g. 0x10):": "Insira o registro MSR (por exemplo, 0x10):",
+  "Enter NFS export path (e.g., /mnt/shared):": "Insira o caminho de exportação NFS (por exemplo, /mnt/shared):",
+  "Enter NFS server IP or hostname:": "Insira o IP ou nome do host do servidor NFS:",
+  "Enter NVMe device (e.g., nvme0):": "Insira o dispositivo NVMe (por exemplo, nvme0):",
+  "Enter PCI BDF (e.g. 0000:01:00.0):": "Insira PCI BDF (por exemplo, 0000:01:00.0):",
+  "Enter PCI BDF (e.g. 0000:04:00.0):": "Digite PCI BDF (por exemplo, 0000:04:00.0):",
+  "Enter Path": "Insira o caminho",
+  "Enter Samba server IP:": "Digite o IP do servidor Samba:",
+  "Enter Samba share name:": "Digite o nome do compartilhamento do Samba:",
+  "Enter Tailscale Auth Key": "Insira a chave de autenticação Tailscale",
+  "Enter VM ID:": "Insira o ID da VM:",
+  "Enter VM/CT ID:": "Insira o ID da VM/CT:",
+  "Enter ZFS pool name for the selected disk:": "Insira o nome do pool ZFS para o disco selecionado:",
+  "Enter a name for the mount point (used as /mnt/<name>):": "Insira um nome para o ponto de montagem (usado como /mnt/<nome>):",
+  "Enter a name for the new virtual machine:": "Insira um nome para a nova máquina virtual:",
+  "Enter a number, or write or paste a command:": "Digite um número ou escreva ou cole um comando:",
+  "Enter backup file (.zst):": "Insira o arquivo de backup (.zst):",
+  "Enter backup path (.tar.zst):": "Insira o caminho de backup (.tar.zst):",
+  "Enter backup path (.vma.zst):": "Insira o caminho de backup (.vma.zst):",
+  "Enter base folder for temporary files and converter (default:": "Insira a pasta base para arquivos temporários e conversor (padrão:",
+  "Enter boot target (e.g. scsi0, sata0, ide0):": "Insira o destino de inicialização (por exemplo, scsi0, sata0, ide0):",
+  "Enter content types (comma-separated):": "Insira os tipos de conteúdo (separados por vírgula):",
+  "Enter custom CIFS mount options (open uid/gid/file_mode strongly recommended for LXC bind-mounts):": "Insira opções de montagem CIFS personalizadas (open uid/gid/file_mode altamente recomendado para montagens de ligação LXC):",
+  "Enter custom NFS mount options:": "Insira as opções de montagem NFS personalizadas:",
+  "Enter custom NFS options:": "Insira opções personalizadas de NFS:",
+  "Enter custom Samba configuration for this share:": "Insira a configuração personalizada do Samba para este compartilhamento:",
+  "Enter custom mount options:": "Insira opções de montagem personalizadas:",
+  "Enter custom path": "Insira o caminho personalizado",
+  "Enter custom pathr": "Insira o caminho personalizado",
+  "Enter destination directory for exported file(s):": "Insira o diretório de destino para os arquivos exportados:",
+  "Enter destination path for ISO file": "Insira o caminho de destino para o arquivo ISO",
+  "Enter destination path:": "Insira o caminho de destino:",
+  "Enter device (e.g., sda or nvme0):": "Insira o dispositivo (por exemplo, sda ou nvme0):",
+  "Enter directory containing OVA/OVF files:": "Digite o diretório que contém os arquivos OVA/OVF:",
+  "Enter directory path:": "Insira o caminho do diretório:",
+  "Enter disk image path:": "Insira o caminho da imagem do disco:",
+  "Enter disk or partition path (prefer /dev/disk/by-id/...):": "Insira o caminho do disco ou partição (prefira /dev/disk/by-id/...):",
+  "Enter domain name:": "Insira o nome do domínio:",
+  "Enter domain:": "Insira o domínio:",
+  "Enter filesystem (ext4/xfs/btrfs):": "Entre no sistema de arquivos (ext4/xfs/btrfs):",
+  "Enter folder name for /mnt:": "Digite o nome da pasta para /mnt:",
+  "Enter full disk path as shown above (starting with /dev/disk/by-id/xxx...):": "Insira o caminho completo do disco conforme mostrado acima (começando com /dev/disk/by-id/xxx...):",
+  "Enter full path for mount point:": "Insira o caminho completo para o ponto de montagem:",
+  "Enter full path to the disk image (e.g., /var/lib/vz/images/xyz.img):": "Insira o caminho completo para a imagem do disco (por exemplo, /var/lib/vz/images/xyz.img):",
+  "Enter full path to the input image (e.g., /var/lib/vz/images/disk.vmdk):": "Insira o caminho completo para a imagem de entrada (por exemplo, /var/lib/vz/images/disk.vmdk):",
+  "Enter full path:": "Insira o caminho completo:",
+  "Enter host IP (e.g., 192.168.0.100):": "Insira o IP do host (por exemplo, 192.168.0.100):",
+  "Enter host or IP:": "Insira o host ou IP:",
+  "Enter hostpci slot (e.g. 0):": "Insira o slot hostpci (por exemplo, 0):",
+  "Enter hostpci slot number (e.g. 0):": "Insira o número do slot hostpci (por exemplo, 0):",
+  "Enter iSCSI target portal IP or hostname:": "Insira o IP ou nome do host do portal de destino iSCSI:",
+  "Enter image full path:": "Insira o caminho completo da imagem:",
+  "Enter imported disk reference (e.g. local-lvm:vm-100-disk-0):": "Insira a referência do disco importado (por exemplo, local-lvm:vm-100-disk-0):",
+  "Enter interface (sata/scsi/virtio/ide):": "Entre na interface (sata/scsi/virtio/ide):",
+  "Enter interface name (e.g. eth0):": "Insira o nome da interface (por exemplo, eth0):",
+  "Enter mount path on host:": "Insira o caminho de montagem no host:",
+  "Enter mount point in CT (e.g. /mnt/data):": "Insira o ponto de montagem no CT (por exemplo, /mnt/data):",
+  "Enter mp slot number (e.g. 0):": "Insira o número do slot mp (por exemplo, 0):",
+  "Enter name for the imported VM:": "Insira o nome da VM importada:",
+  "Enter networks to advertise (comma-separated CIDR):": "Insira as redes para anunciar (CIDR separado por vírgula):",
+  "Enter new folder name:": "Digite o novo nome da pasta:",
+  "Enter new group name:": "Insira o novo nome do grupo:",
+  "Enter partition path (e.g. /dev/sdX1):": "Insira o caminho da partição (por exemplo, /dev/sdX1):",
+  "Enter password for": "Digite a senha para",
+  "Enter password:": "Digite a senha:",
+  "Enter path manually": "Insira o caminho manualmente",
+  "Enter path to analyze:": "Insira o caminho para analisar:",
+  "Enter path:": "Insira o caminho:",
+  "Enter pool name to clear errors:": "Insira o nome do pool para limpar os erros:",
+  "Enter pool name to export:": "Insira o nome do pool para exportar:",
+  "Enter pool name to import:": "Insira o nome do pool para importar:",
+  "Enter pool name:": "Insira o nome do pool:",
+  "Enter pool/dataset name:": "Insira o nome do pool/conjunto de dados:",
+  "Enter pool/dataset to destroy:": "Insira pool/conjunto de dados para destruir:",
+  "Enter pool/dataset to mount:": "Insira pool/conjunto de dados para montar:",
+  "Enter search term (leave empty to show all scripts):": "Insira o termo de pesquisa (deixe em branco para mostrar todos os scripts):",
+  "Enter server IP": "Digite o IP do servidor",
+  "Enter server IP/hostname manually": "Insira o IP/nome do host do servidor manualmente",
+  "Enter server IP:": "Digite o IP do servidor:",
+  "Enter slot number (e.g. 0):": "Insira o número do slot (por exemplo, 0):",
+  "Enter storage ID for Proxmox:": "Insira o ID de armazenamento para Proxmox:",
+  "Enter storage ID:": "Insira o ID de armazenamento:",
+  "Enter storage name:": "Insira o nome do armazenamento:",
+  "Enter subnet (e.g., 192.168.0.0/24):": "Insira a sub-rede (por exemplo, 192.168.0.0/24):",
+  "Enter target disk (e.g. /dev/sdX):": "Insira o disco de destino (por exemplo, /dev/sdX):",
+  "Enter target storage name (e.g., local-lvm):": "Insira o nome do armazenamento de destino (por exemplo, local-lvm):",
+  "Enter target storage:": "Insira o armazenamento de destino:",
+  "Enter the BORG REPOKEY passphrase for target:": "Digite a senha do BORG REPOKEY para o destino:",
+  "Enter the Samba username:": "Digite o nome de usuário do Samba:",
+  "Enter the VMID for the new VM:": "Insira o VMID da nova VM:",
+  "Enter the container terminal:": "Entre no terminal de contêineres:",
+  "Enter the full path to the directory containing disk images:": "Digite o caminho completo para o diretório que contém as imagens de disco:",
+  "Enter the full path to the host directory:": "Digite o caminho completo para o diretório host:",
+  "Enter the full path to the host folder:": "Digite o caminho completo para a pasta host:",
+  "Enter the full path to the output image (e.g., /var/lib/vz/images/output.qcow2):": "Insira o caminho completo para a imagem de saída (por exemplo, /var/lib/vz/images/output.qcow2):",
+  "Enter the host mount path:": "Insira o caminho de montagem do host:",
+  "Enter the iperf3 server IP or hostname:": "Insira o IP ou nome do host do servidor iperf3:",
+  "Enter the maximum size (in MB) to allocate for /var/log in RAM (e.g. 128, 256, 512):": "Insira o tamanho máximo (em MB) a ser alocado para /var/log na RAM (por exemplo, 128, 256, 512):",
+  "Enter the mount point for the NFS export (e.g., /mnt/mynfs):": "Insira o ponto de montagem para a exportação NFS (por exemplo, /mnt/mynfs):",
+  "Enter the mount point for the shared folder (e.g., /mnt/myshare):": "Insira o ponto de montagem da pasta compartilhada (por exemplo, /mnt/myshare):",
+  "Enter the mount point inside the CT for": "Insira o ponto de montagem dentro do CT para",
+  "Enter the number or type the interface name:": "Digite o número ou digite o nome da interface:",
+  "Enter the password for Samba user:": "Digite a senha do usuário Samba:",
+  "Enter the recovery passphrase set when the keyfile was created:": "Insira a senha de recuperação definida quando o arquivo-chave foi criado:",
+  "Enter username for Samba server:": "Digite o nome de usuário do servidor Samba:",
+  "Enter username:": "Digite o nome de usuário:",
+  "Enterprise Proxmox Ceph repository disabled": "Repositório Enterprise Proxmox Ceph desativado",
+  "Enterprise Proxmox repository disabled": "Repositório Enterprise Proxmox desativado",
+  "Enterprise repositories restored": "Repositórios corporativos restaurados",
+  "Enterprise repository present": "Repositório corporativo presente",
+  "Enterprise repository returned 401 Unauthorized (no valid subscription). Switch to the no-subscription repository and retry?": "O repositório corporativo retornou 401 Não autorizado (sem assinatura válida). Mudar para o repositório sem assinatura e tentar novamente?",
+  "Enterprise repository unauthorized and fallback declined by user": "Repositório corporativo não autorizado e substituto recusado pelo usuário",
+  "Entropy generation optimization removed": "Otimização de geração de entropia removida",
+  "Equivalent manual flow of disk_host.sh: partition, format, mount, persist, register in Proxmox.": "Fluxo manual equivalente a disk_host.sh: particionar, formatar, montar, persistir, registrar no Proxmox.",
+  "Equivalent manual flow of iscsi_host.sh.": "Fluxo manual equivalente de iscsi_host.sh.",
+  "Equivalent manual flow used by Local Shared Manager.": "Fluxo manual equivalente usado pelo Local Shared Manager.",
+  "Error": "Erro",
+  "Error applying patch. Backups preserved at": "Erro ao aplicar patch. Backups preservados em",
+  "Error details:": "Detalhes do erro:",
+  "Error installing": "Erro ao instalar",
+  "Error installing build dependencies. Check": "Erro ao instalar dependências de build. Verificar",
+  "Error:": "Erro:",
+  "Error: Cannot create directory": "Erro: não é possível criar o diretório",
+  "Error: Failed to download the script.": "Erro: Falha ao baixar o script.",
+  "Error: No script data found for slug:": "Erro: Nenhum dado de script encontrado para o slug:",
+  "Error: No write permissions in directory": "Erro: Sem permissões de gravação no diretório",
+  "Essential Proxmox packages installed": "Pacotes essenciais do Proxmox instalados",
+  "Estimated required free space:": "Espaço livre necessário estimado:",
+  "Every 12 hours": "A cada 12 horas",
+  "Every 3 hours": "A cada 3 horas",
+  "Every 6 hours": "A cada 6 horas",
+  "Every hour": "A cada hora",
+  "Every path in this backup is kernel-tied: the restore applies these paths automatically via the safe-subset filter and re-merges the operator's tuning.": "Cada caminho neste backup está vinculado ao kernel: a restauração aplica esses caminhos automaticamente por meio do filtro de subconjunto seguro e mescla novamente o ajuste do operador.",
+  "Everything restorable in this backup will be restored": "tudo o que for restaurável neste backup será restaurado",
+  "Example output: rootfs: local-lvm:vm-114-disk-0,size=8G": "Exemplo de saída: rootfs: local-lvm:vm-114-disk-0,size=8G",
+  "Example target: /dev/sdb": "Destino de exemplo: /dev/sdb",
+  "Example: /dev/pve/vm-114-disk-0": "Exemplo: /dev/pve/vm-114-disk-0",
+  "Example: /rpool/data/subvol-114-disk-0": "Exemplo: /rpool/data/subvol-114-disk-0",
+  "Example: MOUNT_PATH=\"/rpool/data/subvol-114-disk-0\"": "Exemplo: MOUNT_PATH=\"/rpool/data/subvol-114-disk-0\"",
+  "Example: cp /etc/pve/lxc/110.conf /etc/pve/lxc/110.conf.bak": "Exemplo: cp /etc/pve/lxc/110.conf /etc/pve/lxc/110.conf.bak",
+  "Example: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak": "Exemplo: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak",
+  "Example: daily or Mon..Fri 03:00": "Exemplo: diariamente ou Seg..Sex 03:00",
+  "Example: mkdir -p /tmp/lxc_convert_114": "Exemplo: mkdir -p /tmp/lxc_convert_114",
+  "Example: pct config 110 | grep unprivileged": "Exemplo: configuração pct 110 | grep sem privilégios",
+  "Example: pct stop 110": "Exemplo: pct stop 110",
+  "Example: pct stop 114": "Exemplo: parada pct 114",
+  "Example: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup": "Exemplo: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup",
+  "Example: pvesm path local-lvm:vm-114-disk-0": "Exemplo: caminho pvesm local-lvm:vm-114-disk-0",
+  "Example: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf": "Exemplo: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf",
+  "Examples:": "Exemplos:",
+  "Execute destructive rollback?": "Executar reversão destrutiva?",
+  "Executing destructive rollback (operator confirmed) ...": "Executando reversão destrutiva (operador confirmado) ...",
+  "Executing:": "Executando:",
+  "Existing Groups": "Grupos Existentes",
+  "Existing file, re-downloading...": "Arquivo existente, baixando novamente...",
+  "Existing filesystem:": "Sistema de arquivos existente:",
+  "Existing hostpci entries detected — they will be reused": "Entradas hostpci existentes detectadas – elas serão reutilizadas",
+  "Existing key is at:": "a chave existente está em:",
+  "Existing recovery envelopes already on PBS stay intact — they still recover the old key with its original passphrase.": "Os envelopes de recuperação existentes já no PBS permanecem intactos – eles ainda recuperam a chave antiga com sua senha original.",
+  "Exit": "Saída",
+  "Exit and repair manually": "Sair e reparar manualmente",
+  "Exit the container terminal:": "Saia do terminal de contêineres:",
+  "Exit: Stop to create backup manually": "Sair: Pare para criar backup manualmente",
+  "Exiting for manual repair...": "Saindo para reparo manual...",
+  "Expected /tmp/gasket-driver/src not found. The clone seems incomplete or uses an unknown layout.": "Esperado /tmp/gasket-driver/src não encontrado. O clone parece incompleto ou usa um layout desconhecido.",
+  "Expected Makefile not found in /tmp/gasket-driver/src. Source tree is incomplete.": "Makefile esperado não encontrado em /tmp/gasket-driver/src. A árvore de origem está incompleta.",
+  "Expected path:": "Caminho esperado:",
+  "Expected: rootfs/ directory, or /etc /var /root at archive root.": "Esperado: diretório rootfs/ ou /etc /var /root na raiz do arquivo.",
+  "Export Format": "Formato de exportação",
+  "Export Options": "Opções de exportação",
+  "Export Path": "Caminho de exportação",
+  "Export Summary": "Resumo de exportação",
+  "Export VM to OVA or OVF": "Exportar VM para OVA ou OVF",
+  "Export a ZFS pool": "Exportar um pool ZFS",
+  "Export added successfully.": "Exportação adicionada com sucesso.",
+  "Export backup data to file": "Exportar dados de backup para arquivo",
+  "Export completed. The running system has not been modified.": "Exportação concluída. O sistema em execução não foi modificado.",
+  "Export completed:": "Exportação concluída:",
+  "Export deleted and NFS service restarted.": "Exportação excluída e serviço NFS reiniciado.",
+  "Export error log": "Exportar log de erros",
+  "Export exists:": "Existe exportação:",
+  "Export failed.": "Falha na exportação.",
+  "Export list test": "Teste de lista de exportação",
+  "Export list:": "Lista de exportação:",
+  "Export mode:": "Modo de exportação:",
+  "Export not found on server:": "Exportação não encontrada no servidor:",
+  "Export path:": "Caminho de exportação:",
+  "Export permissions allow access": "Permissões de exportação permitem acesso",
+  "Export to file (no system changes)": "Exportar para arquivo (sem alterações no sistema)",
+  "Export updated successfully.": "Exportação atualizada com sucesso.",
+  "Export:": "Exportar:",
+  "Exporting ZFS pool...": "Exportando pool ZFS...",
+  "Exports cleared.": "Exportações liberadas.",
+  "Exports:": "Exportações:",
+  "Extended Filesystem 4 (recommended)": "Sistema de arquivos estendido 4 (recomendado)",
+  "External disk for backup": "Disco externo para backup",
+  "Extracting NVIDIA installer on host...": "Extraindo o instalador NVIDIA no host...",
+  "Extracting OVA archive...": "Extraindo arquivo OVA...",
+  "Extracting archive...": "Extraindo arquivo...",
+  "Extracting data from Borg...": "Extraindo dados do Borg...",
+  "Extracting data from PBS...": "Extraindo dados do PBS...",
+  "Extraction completed.": "Extração concluída.",
+  "Extraction failed.": "Falha na extração.",
+  "Extraction failed. Check log:": "Falha na extração. Verifique o registro:",
+  "Extraction successful": "Extração bem-sucedida",
+  "FAILED": "FRACASSADO",
+  "FINAL CONFIRMATION — DATA WILL BE ERASED": "CONFIRMAÇÃO FINAL — OS DADOS SERÃO APAGADOS",
+  "Fail2Ban - Intrusion Prevention": "Fail2Ban - Prevenção de Intrusões",
+  "Fail2Ban Management": "Gerenciamento Fail2Ban",
+  "Fail2Ban has been removed": "Fail2Ban foi removido",
+  "Fail2Ban installation and configuration completed successfully!": "Instalação e configuração do Fail2Ban concluídas com sucesso!",
+  "Fail2Ban installed successfully": "Fail2Ban instalado com sucesso",
+  "Fail2Ban is NOT running!": "Fail2Ban NÃO está em execução!",
+  "Fail2Ban is currently installed.": "Fail2Ban está instalado atualmente.",
+  "Fail2Ban is not installed on this system.": "Fail2Ban não está instalado neste sistema.",
+  "Fail2Ban is running correctly": "Fail2Ban está funcionando corretamente",
+  "Failed": "Fracassado",
+  "Failed to access log2ram directory": "Falha ao acessar o diretório log2ram",
+  "Failed to access share with provided credentials.": "Falha ao acessar o compartilhamento com as credenciais fornecidas.",
+  "Failed to access:": "Falha ao acessar:",
+  "Failed to add CIFS storage to Proxmox.": "Falha ao adicionar armazenamento CIFS ao Proxmox.",
+  "Failed to add GPU audio function": "Falha ao adicionar função de áudio GPU",
+  "Failed to add GPU to target VM": "Falha ao adicionar GPU à VM de destino",
+  "Failed to add IOMMU group device": "Falha ao adicionar dispositivo do grupo IOMMU",
+  "Failed to add NFS storage to Proxmox.": "Falha ao adicionar armazenamento NFS ao Proxmox.",
+  "Failed to add bind mount:": "Falha ao adicionar montagem de ligação:",
+  "Failed to add iSCSI storage to Proxmox.": "Falha ao adicionar armazenamento iSCSI ao Proxmox.",
+  "Failed to add storage to Proxmox.": "Falha ao adicionar armazenamento ao Proxmox.",
+  "Failed to assign Controller/NVMe": "Falha ao atribuir controlador/NVMe",
+  "Failed to assign virtual disk": "Falha ao atribuir disco virtual",
+  "Failed to clone Lynis from GitHub": "Falha ao clonar Lynis do GitHub",
+  "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "Falha ao clonar o repositório log2ram. Verifique /tmp/log2ram_install.log",
+  "Failed to configure EFI disk": "Falha ao configurar o disco EFI",
+  "Failed to configure IOMMU automatically.": "Falha ao configurar o IOMMU automaticamente.",
+  "Failed to configure Proxmox repositories": "Falha ao configurar repositórios Proxmox",
+  "Failed to configure TPM device in VM": "Falha ao configurar o dispositivo TPM na VM",
+  "Failed to configure repositories.": "Falha ao configurar repositórios.",
+  "Failed to configure repositories. Installation aborted.": "Falha ao configurar repositórios. Instalação abortada.",
+  "Failed to connect to": "Falha ao conectar-se a",
+  "Failed to connect to server.": "Falha ao conectar ao servidor.",
+  "Failed to copy sources into": "Falha ao copiar fontes para",
+  "Failed to create EFI disk": "Falha ao criar disco EFI",
+  "Failed to create OVA archive.": "Falha ao criar arquivo OVA.",
+  "Failed to create TPM state disk": "Falha ao criar disco de estado TPM",
+  "Failed to create VM": "Falha ao criar VM",
+  "Failed to create base VM. Check VM ID and host configuration.": "Falha ao criar VM base. Verifique o ID da VM e a configuração do host.",
+  "Failed to create directory on host:": "Falha ao criar diretório no host:",
+  "Failed to create directory:": "Falha ao criar diretório:",
+  "Failed to create disk": "Falha ao criar disco",
+  "Failed to create encryption key. Backup cancelled — fix the underlying issue and retry.": "Falha ao criar chave de criptografia.Backup cancelado — corrija o problema subjacente e tente novamente.",
+  "Failed to create group:": "Falha ao criar grupo:",
+  "Failed to create mount point.": "Falha ao criar ponto de montagem.",
+  "Failed to create mount point:": "Falha ao criar ponto de montagem:",
+  "Failed to create partition table": "Falha ao criar tabela de partições",
+  "Failed to create partition table on disk": "Falha ao criar tabela de partição no disco",
+  "Failed to create partition.": "Falha ao criar partição.",
+  "Failed to create temporary directory:": "Falha ao criar diretório temporário:",
+  "Failed to create/update ZFS ARC configuration file": "Falha ao criar/atualizar arquivo de configuração ARC do ZFS",
+  "Failed to destroy LXC:": "Falha ao destruir LXC:",
+  "Failed to destroy VM:": "Falha ao destruir VM:",
+  "Failed to detect RAM size. Using default value of 16GB for ZFS ARC optimization.": "Falha ao detectar o tamanho da RAM. Usando o valor padrão de 16 GB para otimização ZFS ARC.",
+  "Failed to detect installed NVIDIA driver version.": "Falha ao detectar a versão do driver NVIDIA instalada.",
+  "Failed to detect partition on disk": "Falha ao detectar partição no disco",
+  "Failed to determine timezone from IP address - keeping current timezone settings": "Falha ao determinar o fuso horário a partir do endereço IP – mantendo as configurações atuais de fuso horário",
+  "Failed to disable Start on boot for LXC": "Falha ao desativar o início na inicialização do LXC",
+  "Failed to disable Start on boot for VM": "Falha ao desativar Iniciar na inicialização da VM",
+  "Failed to disable ZFS autotrim for pool:": "Falha ao desativar o ajuste automático do ZFS para pool:",
+  "Failed to download Borg.": "Falha ao baixar Borg.",
+  "Failed to download Figurine": "Falha ao baixar a estatueta",
+  "Failed to download Helper-Scripts logo": "Falha ao baixar o logotipo do Helper-Scripts",
+  "Failed to download Home-Lab-Club logo": "Falha ao baixar o logotipo do Home-Lab-Club",
+  "Failed to download ISO image": "Falha ao baixar a imagem ISO",
+  "Failed to download JC Channel logo": "Falha ao baixar o logotipo do canal JC",
+  "Failed to download NVIDIA installer": "Falha ao baixar o instalador NVIDIA",
+  "Failed to download ProxMenux logo": "Falha ao baixar o logotipo do ProxMenux",
+  "Failed to download Proxmology logo": "Falha ao baixar o logotipo da Proxmology",
+  "Failed to download VirtIO driver ISO.": "Falha ao baixar o ISO do driver VirtIO.",
+  "Failed to download amdgpu_top": "Falha ao baixar amdgpu_top",
+  "Failed to edit /etc/fstab — remove the line manually.": "Falha ao editar /etc/fstab — remova a linha manualmente.",
+  "Failed to enable ZFS autotrim for pool:": "Falha ao ativar o ajuste automático do ZFS para pool:",
+  "Failed to enable automatic time synchronization": "Falha ao ativar a sincronização automática de horário",
+  "Failed to extract OVA file:": "Falha ao extrair o arquivo OVA:",
+  "Failed to extract package": "Falha ao extrair o pacote",
+  "Failed to fetch the Google Coral GPG key. Check": "Falha ao buscar a chave GPG do Google Coral. Verificar",
+  "Failed to format disk as": "Falha ao formatar o disco como",
+  "Failed to format partition": "Falha ao formatar partição",
+  "Failed to format the partition.": "Falha ao formatar a partição.",
+  "Failed to get .deb download URL": "Falha ao obter URL de download .deb",
+  "Failed to get latest version from GitHub": "Falha ao obter a versão mais recente do GitHub",
+  "Failed to get release information from GitHub": "Falha ao obter informações de lançamento do GitHub",
+  "Failed to get shares": "Falha ao obter compartilhamentos",
+  "Failed to get shares from": "Falha ao obter compartilhamentos de",
+  "Failed to import": "Falha ao importar",
+  "Failed to initialize Borg repository at:": "Falha ao inicializar o repositório Borg em:",
+  "Failed to install Coral TPU driver inside the container.": "Falha ao instalar o driver Coral TPU dentro do contêiner.",
+  "Failed to install Fail2Ban": "Falha ao instalar Fail2Ban",
+  "Failed to install Fastfetch.": "Falha ao instalar o Fastfetch.",
+  "Failed to install NFS client packages.": "Falha ao instalar pacotes do cliente NFS.",
+  "Failed to install OVH RTM": "Falha ao instalar OVH RTM",
+  "Failed to install OpenVSwitch": "Falha ao instalar o OpenVSwitch",
+  "Failed to install Samba client packages.": "Falha ao instalar pacotes do cliente Samba.",
+  "Failed to install amdgpu_top": "Falha ao instalar amdgpu_top",
+  "Failed to install dependencies": "Falha ao instalar dependências",
+  "Failed to install gawk": "Falha ao instalar o gawk",
+  "Failed to install intel-gpu-tools": "Falha ao instalar ferramentas Intel-GPU",
+  "Failed to install libedgetpu1-std. Check": "Falha ao instalar libedgetpu1-std. Verificar",
+  "Failed to install pigz": "Falha ao instalar o pigz",
+  "Failed to install zfs-auto-snapshot": "Falha ao instalar o zfs-auto-snapshot",
+  "Failed to mount CIFS share on host.": "Falha ao montar o compartilhamento CIFS no host.",
+  "Failed to mount NFS share on host.": "Falha ao montar o compartilhamento NFS no host.",
+  "Failed to mount NFS share.": "Falha ao montar o compartilhamento NFS.",
+  "Failed to mount Samba share.": "Falha ao montar o compartilhamento do Samba.",
+  "Failed to mount container filesystem.": "Falha ao montar o sistema de arquivos do contêiner.",
+  "Failed to mount disk": "Falha ao montar o disco",
+  "Failed to obtain public IP address - keeping current timezone settings": "Falha ao obter o endereço IP público – mantendo as configurações atuais de fuso horário",
+  "Failed to refresh boot configuration": "Falha ao atualizar a configuração de inicialização",
+  "Failed to refresh proxmox-boot-tool": "Falha ao atualizar proxmox-boot-tool",
+  "Failed to reinstall Proxmox packages": "Falha ao reinstalar os pacotes Proxmox",
+  "Failed to reinstall packages": "Falha ao reinstalar pacotes",
+  "Failed to remove gateway.": "Falha ao remover o gateway.",
+  "Failed to remove mount point": "Falha ao remover o ponto de montagem",
+  "Failed to remove storage from Proxmox.": "Falha ao remover o armazenamento do Proxmox.",
+  "Failed to remove storage.": "Falha ao remover o armazenamento.",
+  "Failed to resolve group GID for": "Falha ao resolver o GID do grupo para",
+  "Failed to restart": "Falha ao reiniciar",
+  "Failed to restart container — restart manually": "Falha ao reiniciar o contêiner – reinicie manualmente",
+  "Failed to restart gateway.": "Falha ao reiniciar o gateway.",
+  "Failed to restart network service": "Falha ao reiniciar o serviço de rede",
+  "Failed to restart — restart manually to activate mount": "Falha ao reiniciar — reinicie manualmente para ativar a montagem",
+  "Failed to restore subscription banner completely": "Falha ao restaurar completamente o banner de assinatura",
+  "Failed to retrieve Fastfetch download URL.": "Falha ao recuperar o URL de download do Fastfetch.",
+  "Failed to run log2ram installer. Check /tmp/log2ram_install.log": "Falha ao executar o instalador log2ram. Verifique /tmp/log2ram_install.log",
+  "Failed to set VM description": "Falha ao definir a descrição da VM",
+  "Failed to set timezone - keeping current settings": "Falha ao definir o fuso horário – mantendo as configurações atuais",
+  "Failed to start CT": "Falha ao iniciar CT",
+  "Failed to start container — start manually and check the mount": "Falha ao iniciar o contêiner — inicie manualmente e verifique a montagem",
+  "Failed to start gateway.": "Falha ao iniciar o gateway.",
+  "Failed to start long self-test on": "Falha ao iniciar o autoteste longo em",
+  "Failed to start self-test on": "Falha ao iniciar o autoteste em",
+  "Failed to start the CT.": "Falha ao iniciar o CT.",
+  "Failed to start the container.": "Falha ao iniciar o contêiner.",
+  "Failed to stop gateway.": "Falha ao parar o gateway.",
+  "Failed to stop the container.": "Falha ao parar o contêiner.",
+  "Failed to uninstall amdgpu_top": "Falha ao desinstalar amdgpu_top",
+  "Failed to uninstall intel-gpu-tools": "Falha ao desinstalar ferramentas intel-gpu",
+  "Failed to update GRUB": "Falha ao atualizar o GRUB",
+  "Failed to update GRUB configuration": "Falha ao atualizar a configuração do GRUB",
+  "Failed to update Lynis": "Falha ao atualizar Lynis",
+  "Failed to update amdgpu_top": "Falha ao atualizar amdgpu_top",
+  "Failed to update auth.json — restoring backup.": "Falha ao atualizar auth.json – restaurando o backup.",
+  "Failed to update cluster certificates (might not be in a cluster)": "Falha ao atualizar certificados de cluster (pode não estar em um cluster)",
+  "Failed to update intel-gpu-tools": "Falha ao atualizar ferramentas Intel-GPU",
+  "Failed to update package list.": "Falha ao atualizar a lista de pacotes.",
+  "Failed to update package lists": "Falha ao atualizar listas de pacotes",
+  "Failed to write": "Falha ao escrever",
+  "Failed transitions from D3cold to D0": "Falha nas transições de D3cold para D0",
+  "Failed. See log:": "Fracassado. Veja registro:",
+  "Falling back to manual paste mode.": "voltando ao modo de colagem manual.",
+  "Fastfetch Logo Selection": "Seleção de logotipo Fastfetch",
+  "Fastfetch configuration updated": "Configuração do Fastfetch atualizada",
+  "Fastfetch download URL retrieved successfully.": "URL de download do Fastfetch recuperado com sucesso.",
+  "Fastfetch installation and configuration completed": "Instalação e configuração do Fastfetch concluídas",
+  "Fastfetch installed successfully": "Fastfetch instalado com sucesso",
+  "Fastfetch is not installed correctly.": "Fastfetch não está instalado corretamente.",
+  "Fastfetch is not installed.": "Fastfetch não está instalado.",
+  "Fastfetch is not installed. Run: apt install fastfetch": "Fastfetch não está instalado. Execute: apt install fastfetch",
+  "Fastfetch now displays: System optimised by: ProxMenux": "Fastfetch agora exibe: Sistema otimizado por: ProxMenux",
+  "Fastfetch removed from system": "Fastfetch removido do sistema",
+  "Fastfetch will start automatically in the console": "Fastfetch será iniciado automaticamente no console",
+  "Figurine installation and configuration completed successfully.": "Instalação e configuração da estatueta concluídas com sucesso.",
+  "Figurine is not installed.": "A estatueta não está instalada.",
+  "Figurine removed from system": "Estatueta removida do sistema",
+  "File:": "Arquivo:",
+  "Filesystem": "Sistema de arquivos",
+  "Filesystem Tools Required": "Ferramentas de sistema de arquivos necessárias",
+  "Filesystem:": "Sistema de arquivos:",
+  "Final Confirmation": "Confirmação Final",
+  "Final confirmation": "Confirmação final",
+  "Final storage health/status check": "Verificação final de integridade/status do armazenamento",
+  "Find your device using https://finds.synology.com": "Encontre o seu dispositivo usando https://finds.synology.com",
+  "Fingerprint:": "Impressão digital:",
+  "Firewall allows port": "Firewall permite porta",
+  "Firewall settings": "Configurações de firewall",
+  "Firmware :": "Firmware:",
+  "First complete DSM setup and verify Web UI/SSH access.": "Primeiro, conclua a configuração do DSM e verifique o acesso Web UI/SSH.",
+  "First complete ZimaOS setup and verify remote access (web/SSH).": "Primeiro conclua a configuração do ZimaOS e verifique o acesso remoto (web/SSH).",
+  "First install the GPU drivers inside the guest and verify remote access (RDP/SSH).": "Primeiro instale os drivers GPU dentro do convidado e verifique o acesso remoto (RDP/SSH).",
+  "Fix CIFS Permissions": "Corrigir permissões CIFS",
+  "Fix Ceph version:": "Corrija a versão do Ceph:",
+  "Fix NFS Access for Unprivileged LXC": "Corrigir acesso NFS para LXC sem privilégios",
+  "Fix disk space:": "Corrija o espaço em disco:",
+  "Fix kernel version:": "Corrija a versão do kernel:",
+  "Fix network connectivity": "Corrigir conectividade de rede",
+  "Fix network:": "Corrigir rede:",
+  "Fix package conflicts:": "Corrija conflitos de pacote:",
+  "Fix repositories:": "Corrigir repositórios:",
+  "Fix repository configuration": "Corrigir configuração do repositório",
+  "Fix systemd-boot meta-package conflict": "Corrigir conflito de meta-pacote systemd-boot",
+  "Fix systemd-boot:": "Corrija a inicialização do systemd:",
+  "Fix: on the host, run": "Correção: no host, execute",
+  "Fixing GPG key issues...": "Corrigindo problemas principais do GPG...",
+  "Folder Name": "Nome da pasta",
+  "Folders in /mnt": "Pastas em /mnt",
+  "Follow post-restore progress live from ProxMenux Monitor → Backups tab after the reboot.": "Acompanhe o progresso pós-restauração ao vivo no ProxMenux Monitor → guia Backups após a reinicialização.",
+  "For LVM - Create mount directory and mount:": "Para LVM - Crie o diretório de montagem e monte:",
+  "For ZFS, storage ID must start with a letter and use only letters, numbers, dot, dash, underscore or colon.": "Para ZFS, o ID de armazenamento deve começar com uma letra e usar apenas letras, números, ponto, traço, sublinhado ou dois pontos.",
+  "For ZFS/BTRFS - Set the mount path:": "Para ZFS/BTRFS - Defina o caminho de montagem:",
+  "For a consistent export, the VM should be stopped.": "Para uma exportação consistente, a VM deve ser interrompida.",
+  "For any question, issue or bug report, please use the official repository": "Para qualquer dúvida, problema ou relatório de bug, use o repositório oficial",
+  "For dedicated GPUs, FLR is required by this policy to reduce VM": "Para GPUs dedicadas, o FLR é exigido por esta política para reduzir VM",
+  "For example: pct enter 101": "Por exemplo: pct digite 101",
+  "For guest shares add: --options guest": "Para compartilhamentos de convidados, adicione: --options guest",
+  "For security reasons, the system cannot format it.": "Por motivos de segurança, o sistema não pode formatá-lo.",
+  "For unprivileged containers, use instead:": "Para contêineres sem privilégios, use:",
+  "For your safety, a backup of the current configuration will be created automatically before restoring.": "Para sua segurança, um backup da configuração atual será criado automaticamente antes da restauração.",
+  "Force APT to use IPv4": "Forçar o APT a usar IPv4",
+  "Force NFSv3:": "Forçar NFSv3:",
+  "Force NFSv4:": "Forçar NFSv4:",
+  "Force stop VM now?": "Forçar a parada da VM agora?",
+  "Force stop a container. Use the correct <ctid>": "Forçar a parada de um contêiner. Use o <ctid> correto",
+  "Force stop a virtual machine. Use the correct <vmid>": "Forçar a parada de uma máquina virtual. Use o <vmid> correto",
+  "Forcing removal...": "Forçando a remoção...",
+  "Format / Wipe Physical Disk (Safe)": "Formatar/limpar disco físico (seguro)",
+  "Format Mode": "Modo de formato",
+  "Format USB disk?": "Formatar disco USB?",
+  "Format disk (ERASE all data)": "Formatar disco (APAGAR todos os dados)",
+  "Format failed": "Falha na formatação",
+  "Format filesystem": "Formatar sistema de arquivos",
+  "Format partition:": "Formatar partição:",
+  "Format — erase and create new filesystem": "Formatar — apague e crie um novo sistema de arquivos",
+  "Format:": "Formatar:",
+  "Format: ERASE all data and create new filesystem": "Formato: APAGAR todos os dados e criar um novo sistema de arquivos",
+  "Formatted and mounted": "Formatado e montado",
+  "Formatting": "Formatação",
+  "Formatting as": "Formatando como",
+  "Formatting partition": "Formatando partição",
+  "Found": "Encontrado",
+  "Found guest-accessible shares:": "Compartilhamentos acessíveis para convidados encontrados:",
+  "Free public Proxmox repository enabled": "Repositório Proxmox público gratuito habilitado",
+  "Free space OK:": "Espaço livre OK:",
+  "Free up disk space": "Libere espaço em disco",
+  "Free:": "Livre:",
+  "French": "Francês",
+  "Full SMART Report": "Relatório SMART completo",
+  "Full SMART info and attributes": "Informações e atributos SMART completos",
+  "Full format       — new GPT partition + filesystem": "Formato completo – nova partição GPT + sistema de arquivos",
+  "Full format — new GPT partition + filesystem": "Formato completo – nova partição GPT + sistema de arquivos",
+  "Full format: clean + new GPT partition + filesystem": "Formato completo: limpo + nova partição GPT + sistema de arquivos",
+  "Full log:": "Registro completo:",
+  "Full report           — complete SMART data (scrollable)": "Relatório completo – dados SMART completos (rolável)",
+  "Full system upgrade, including dependencies": "Atualização completa do sistema, incluindo dependências",
+  "Function Level Reset (FLR) not available": "Redefinição de nível de função (FLR) não disponível",
+  "GID already in use:": "GID já em uso:",
+  "GID in CT": "GID em TC",
+  "GPU": "GPU",
+  "GPU -> VM Mode Detected": "GPU -> Modo VM detectado",
+  "GPU Already Added": "GPU já adicionada",
+  "GPU Already Assigned to Another VM": "GPU já atribuída a outra VM",
+  "GPU Already Assigned to This VM": "GPU já atribuída a esta VM",
+  "GPU Busy in Running VM": "GPU ocupada na execução da VM",
+  "GPU Not Available for Reliable VM Passthrough": "GPU não disponível para passagem confiável de VM",
+  "GPU Not Compatible with VM Passthrough": "GPU não compatível com passagem de VM",
+  "GPU Passthrough Commands": "Comandos de passagem de GPU",
+  "GPU Passthrough Not Configured": "Passagem de GPU não configurada",
+  "GPU Passthrough to VM": "Passagem de GPU para VM",
+  "GPU Passthrough to VM (from LXC)": "Passagem de GPU para VM (de LXC)",
+  "GPU Passthrough to VM (reassign from LXC and another VM)": "Passagem de GPU para VM (reatribuir de LXC e outra VM)",
+  "GPU Passthrough to VM (reassign from another VM)": "Passagem de GPU para VM (reatribuir de outra VM)",
+  "GPU ROM dump to /usr/share/kvm/": "Despejo de ROM da GPU em /usr/share/kvm/",
+  "GPU ROM dumped to": "ROM da GPU despejada em",
+  "GPU ROM extracted from ACPI VFCT table to": "ROM GPU extraída da tabela ACPI VFCT para",
+  "GPU Switch Mode": "Modo de troca de GPU",
+  "GPU Switch Mode Blocked": "Modo de troca de GPU bloqueado",
+  "GPU Used in LXC Containers": "GPU usada em contêineres LXC",
+  "GPU access removed from LXC": "Acesso à GPU removido do LXC",
+  "GPU added": "GPU adicionada",
+  "GPU already present in target VM — existing hostpci entry reused": "GPU já presente na VM de destino – entrada hostpci existente reutilizada",
+  "GPU audio added": "Áudio GPU adicionado",
+  "GPU audio already present in target VM — existing hostpci entry reused": "Áudio da GPU já presente na VM de destino – entrada hostpci existente reutilizada",
+  "GPU driver blacklisted": "Driver de GPU na lista negra",
+  "GPU guard hook will block concurrent start when another VM is already using this GPU": "O gancho de proteção da GPU bloqueará o início simultâneo quando outra VM já estiver usando esta GPU",
+  "GPU host driver blacklisted in /etc/modprobe.d/blacklist.conf": "Driver host GPU na lista negra em /etc/modprobe.d/blacklist.conf",
+  "GPU in VM Passthrough Mode": "GPU no modo de passagem de VM",
+  "GPU kept in source VM config": "GPU mantida na configuração da VM de origem",
+  "GPU not found with slot": "GPU não encontrada com slot",
+  "GPU passthrough assistant not found. You can run it later from Hardware Graphics.": "Assistente de passagem de GPU não encontrado. Você pode executá-lo mais tarde em Hardware Graphics.",
+  "GPU passthrough changes require a host reboot.": "As alterações de passagem da GPU exigem uma reinicialização do host.",
+  "GPU passthrough configuration will continue now and will become effective after host reboot.": "A configuração de passagem de GPU continuará agora e entrará em vigor após a reinicialização do host.",
+  "GPU passthrough configured for LXC": "Passagem de GPU configurada para LXC",
+  "GPU passthrough configured for VM": "Passagem de GPU configurada para VM",
+  "GPU passthrough to VMs requires IOMMU to be enabled in the kernel.": "A passagem de GPU para VMs requer que o IOMMU esteja habilitado no kernel.",
+  "GPU passthrough was not applied.": "A passagem de GPU não foi aplicada.",
+  "GPU passthrough was skipped (no compatible GPU detected).": "A passagem da GPU foi ignorada (nenhuma GPU compatível detectada).",
+  "GPU removed from VM": "GPU removida da VM",
+  "GPU removed from VM config": "GPU removida da configuração da VM",
+  "GPU switch complete: LXC mode prepared.": "Troca de GPU concluída: modo LXC preparado.",
+  "GPU switch complete: VM mode prepared.": "Troca de GPU concluída: modo VM preparado.",
+  "GPU switch mode completed. No reboot required.": "Modo de troca de GPU concluído. Não é necessária reinicialização.",
+  "GPU will be removed from source VM config": "A GPU será removida da configuração da VM de origem",
+  "GPU will remain configured in source VM": "A GPU permanecerá configurada na VM de origem",
+  "GPU/TPU - Manual CLI Guide": "GPU/TPU - Guia CLI manual",
+  "GPU/TPU Passthrough Commands": "Comandos de passagem GPU/TPU",
+  "GPUs and Coral-TPU Menu": "Menu GPUs e Coral-TPU",
+  "GRUB config file not found; skipping GRUB changes": "Arquivo de configuração GRUB não encontrado; ignorando alterações no GRUB",
+  "GRUB configuration updated": "Configuração do GRUB atualizada",
+  "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT não encontrado na configuração do GRUB",
+  "GUI mode (if available)": "Modo GUI (se disponível)",
+  "Gateway is not installed.": "O gateway não está instalado.",
+  "Gateway removed.": "Gateway removido.",
+  "Gateway restarted.": "Gateway reiniciado.",
+  "Gateway started.": "Gateway iniciado.",
+  "Gateway stopped.": "Gateway parou.",
+  "Gathering container privilege information...": "Coletando informações de privilégio do contêiner...",
+  "Generate a new key and authorize it on the server automatically (recommended)": "Gere uma nova chave e autorize-a automaticamente no servidor (recomendado)",
+  "Generate a new key, show me the line to paste manually": "Gere uma nova chave, mostre-me a linha para colar manualmente",
+  "Generate a new keyfile": "Gere um novo arquivo-chave",
+  "Generating OVF descriptor...": "Gerando descritor OVF...",
+  "Generating dkms.conf...": "Gerando dkms.conf...",
+  "Generating manifest...": "Gerando manifesto...",
+  "Generating missing locale:": "Gerando localidade ausente:",
+  "German": "Alemão",
+  "Get a list of all your containers:": "Obtenha uma lista de todos os seus contêineres:",
+  "Get the actual disk path:": "Obtenha o caminho real do disco:",
+  "Get the container's storage information:": "Obtenha as informações de armazenamento do contêiner:",
+  "Git installed": "Git instalado",
+  "Global settings and SSH jail configured": "Configurações globais e prisão SSH configuradas",
+  "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "Vá para \"Gerenciar caminhos personalizados\" e remova sua entrada personalizada que inclui o destino",
+  "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "O Google envia apenas um repositório oficial libedgetpu APT para Debian/Ubuntu. A passagem de hardware já está gravada em",
+  "Graceful shutdown timed out.": "O desligamento normal expirou.",
+  "Group": "Grupo",
+  "Group 'sharedfiles' already exists inside the CT": "O grupo ‘sharedfiles’ já existe dentro do CT",
+  "Group GID:": "GID do grupo:",
+  "Group created:": "Grupo criado:",
+  "Group name cannot be empty.": "O nome do grupo não pode ficar vazio.",
+  "Group:": "Grupo:",
+  "Groups": "Grupos",
+  "Groups:": "Grupos:",
+  "Guest Access Denied": "Acesso de convidado negado",
+  "Guest Access Error": "Erro de acesso de convidado",
+  "Guest Access Failed": "Falha no acesso de convidado",
+  "Guest Access Validation Results:": "Resultados da validação de acesso de convidado:",
+  "Guest Agent configuration applied": "Configuração do agente convidado aplicada",
+  "Guest access (no authentication)": "Acesso de convidado (sem autenticação)",
+  "Guest access confirmed for share:": "Acesso de convidado confirmado para compartilhamento:",
+  "Guest access denied for share:": "Acesso de convidado negado para compartilhamento:",
+  "Guest access failed.": "Falha no acesso de convidado.",
+  "Guest access is not allowed on this server.": "O acesso de convidados não é permitido neste servidor.",
+  "Guest access test:": "Teste de acesso de convidado:",
+  "Guest access validated successfully!": "Acesso de convidado validado com sucesso!",
+  "Guest access works for listing, but no shares are available.": "O acesso de convidado funciona para listagem, mas não há compartilhamentos disponíveis.",
+  "Guest accessible share": "Compartilhamento acessível aos convidados",
+  "Guest accessible:": "Acessível aos visitantes:",
+  "Guest agent detection completed": "Detecção de agente convidado concluída",
+  "Guest agent installation process completed": "Processo de instalação do agente convidado concluído",
+  "Guest agent packages removed": "Pacotes de agentes convidados removidos",
+  "Guest configs restored:": "Configurações de convidado restauradas:",
+  "Guest share listing successful": "Listagem de compartilhamento de convidados bem-sucedida",
+  "Guided Cleanup Available": "Limpeza guiada disponível",
+  "Guided Repair Available": "Reparo guiado disponível",
+  "HA groups will be migrated to HA rules automatically": "Os grupos de HA serão migrados para regras de HA automaticamente",
+  "HA services disabled (configs preserved)": "Serviços HA desativados (configurações preservadas)",
+  "Hardening SSH: setting MaxAuthTries to 3...": "Endurecimento SSH: configurando MaxAuthTries para 3...",
+  "Hardware": "Hardware",
+  "Hardware compatibility — these items will be skipped to keep the boot safe:": "Compatibilidade de hardware — estes itens serão ignorados para manter a inicialização segura:",
+  "Hardware passthrough is already configured — the Coral device is visible inside the container as /dev/apex_0 (M.2) and/or /dev/bus/usb (USB).": "A passagem de hardware já está configurada — o dispositivo Coral é visível dentro do contêiner como /dev/apex_0 (M.2) e/ou /dev/bus/usb (USB).",
+  "Hardware: GPUs and Coral-TPU": "Hardware: GPUs e Coral-TPU",
+  "Have valid backups of all VMs and containers": "Tenha backups válidos de todas as VMs e contêineres",
+  "Help & Info (commands)": "Ajuda e informações (comandos)",
+  "Help & Information": "Ajuda e informações",
+  "Help and Info": "Ajuda e informações",
+  "Help and Info Commands": "Comandos de ajuda e informações",
+  "Helper-Scripts logo applied": "Logotipo Helper-Scripts aplicado",
+  "Hidden for safety": "Escondido por segurança",
+  "Hidden:": "Escondido:",
+  "High Availability services have been enabled successfully": "Os serviços de alta disponibilidade foram ativados com sucesso",
+  "High Availability setup completed": "Configuração de alta disponibilidade concluída",
+  "High risk confirmation": "Confirmação de alto risco",
+  "High-Risk GPU Power State": "Estado de energia da GPU de alto risco",
+  "Home-Lab-Club logo applied": "Logotipo Home-Lab-Club aplicado",
+  "Host": "Hospedar",
+  "Host Backup  →  Borg": "Backup de host → Borg",
+  "Host Backup  →  Local archive": "Backup do host → Arquivo local",
+  "Host Backup  →  PBS": "Backup de host → PBS",
+  "Host Backup & Restore": "Backup e restauração de host",
+  "Host Config Backup": "Backup de configuração do host",
+  "Host Config Backup / Restore": "Backup/restauração de configuração do host",
+  "Host Config Restore": "Restauração de configuração do host",
+  "Host Directory": "Diretório de host",
+  "Host Directory to LXC Mount Point": "Diretório de host para ponto de montagem LXC",
+  "Host Directory:": "Diretório de host:",
+  "Host GPU binding changed — reboot required.": "A vinculação da GPU do host foi alterada – é necessária reinicialização.",
+  "Host GPU detected": "GPU host detectada",
+  "Host GPU is already bound to vfio-pci. Host reconfiguration/reboot should not be required for this VM-to-VM reassignment.": "A GPU host já está vinculada ao vfio-pci. A reconfiguração/reinicialização do host não deve ser necessária para esta reatribuição de VM para VM.",
+  "Host IP": "IP do host",
+  "Host Mount Path": "Caminho de montagem do host",
+  "Host NFS/Samba as Proxmox Storage (pvesm)": "Hospedar NFS/Samba como armazenamento Proxmox (pvesm)",
+  "Host Path": "Caminho do host",
+  "Host Path:": "Caminho do host:",
+  "Host Storage (NFS / Samba via Proxmox)": "Armazenamento de host (NFS/Samba via Proxmox)",
+  "Host VFIO config was already up to date — no reboot needed.": "A configuração do Host VFIO já estava atualizada – não é necessária reinicialização.",
+  "Host VFIO configuration already up to date": "Configuração do host VFIO já atualizada",
+  "Host VFIO configuration changed (initramfs updated). Reboot required before starting the VM.": "Configuração do host VFIO alterada (initramfs atualizado). Reinicialização necessária antes de iniciar a VM.",
+  "Host VFIO configuration changed — reboot required before starting the VM.": "Configuração do host VFIO alterada — reinicialização necessária antes de iniciar a VM.",
+  "Host already in VFIO mode — skipping host reconfiguration for VM reassignment": "Host já no modo VFIO — ignorando a reconfiguração do host para reatribuição de VM",
+  "Host backup attached to PVE job": "Backup do host anexado ao trabalho PVE",
+  "Host directory access for unprivileged containers has been prepared above": "O acesso ao diretório de host para contêineres sem privilégios foi preparado acima",
+  "Host directory permissions updated — unprivileged containers can now access it": "Permissões do diretório de host atualizadas – contêineres sem privilégios agora podem acessá-lo",
+  "Host directory:": "Diretório de host:",
+  "Host fstab CIFS Mounts:": "Host fstab montagens CIFS:",
+  "Host fstab CIFS mounts (not registered with pvesm):": "Host fstab montagens CIFS (não registradas no pvesm):",
+  "Host fstab CIFS mounts:": "Host fstab montagens CIFS:",
+  "Host fstab Mount:": "Montagem fstab do host:",
+  "Host fstab NFS Mounts:": "Host fstab montagens NFS:",
+  "Host fstab NFS mounts (not registered with pvesm):": "Host fstab montagens NFS (não registradas com pvesm):",
+  "Host fstab NFS mounts:": "Host fstab montagens NFS:",
+  "Host fstab mounts (not registered as Proxmox storage):": "Host fstab montagens (não registradas como armazenamento Proxmox):",
+  "Host identity (hostname, hosts)": "Identidade do host (nome do host, hosts)",
+  "Host permissions applied (o+rwx + default ACL) — unprivileged LXCs can read/write through bind-mounts": "Permissões de host aplicadas (o+rwx + ACL padrão) — LXCs sem privilégios podem ler/gravar por meio de montagens de ligação",
+  "Host write access confirmed.": "Acesso de gravação do host confirmado.",
+  "Hostname": "Nome do host",
+  "Hot changes applied. No reboot needed for these paths.": "Mudanças importantes aplicadas. Não é necessária reinicialização para esses caminhos.",
+  "How do you want to add it?": "Como você deseja adicioná-lo?",
+  "How do you want to authenticate this backup target?": "Como você deseja autenticar este destino de backup?",
+  "How do you want to select the": "Como você deseja selecionar o",
+  "How do you want to select the HOST folder to mount?": "Como você deseja selecionar a pasta HOST para montar?",
+  "How do you want to select the NFS server?": "Como você deseja selecionar o servidor NFS?",
+  "How do you want to select the Samba server?": "Como você deseja selecionar o servidor Samba?",
+  "How do you want to select the folder to export?": "Como você deseja selecionar a pasta para exportar?",
+  "How do you want to select the folder to share?": "Como você deseja selecionar a pasta para compartilhar?",
+  "How to Access an LXC Terminal": "Como acessar um terminal LXC",
+  "How to Access an LXC Terminal from Proxmox Host": "Como acessar um terminal LXC do Proxmox Host",
+  "How to schedule": "Como agendar",
+  "I have read this": "eu li isso",
+  "I/O priority configured": "Prioridade de E/S configurada",
+  "ID already in use. Please choose another.": "ID já em uso. Por favor escolha outro.",
+  "IMPORTANT": "IMPORTANTE",
+  "IMPORTANT NOTES:": "NOTAS IMPORTANTES:",
+  "IMPORTANT PREREQUISITES:": "PRÉ-REQUISITOS IMPORTANTES:",
+  "IMPORTANT — Save this passphrase": "IMPORTANTE — Salve esta senha",
+  "IOMMU Group": "Grupo IOMMU",
+  "IOMMU Group Error": "Erro de grupo IOMMU",
+  "IOMMU Group Pending": "Grupo IOMMU pendente",
+  "IOMMU Pending Reboot": "IOMMU pendente de reinicialização",
+  "IOMMU Required": "IOMMU obrigatório",
+  "IOMMU already configured in /etc/kernel/cmdline": "IOMMU já configurado em /etc/kernel/cmdline",
+  "IOMMU already configured in GRUB": "IOMMU já configurado no GRUB",
+  "IOMMU already configured in kernel parameters": "IOMMU já configurado nos parâmetros do kernel",
+  "IOMMU already enabled in GRUB configuration": "IOMMU já habilitado na configuração do GRUB",
+  "IOMMU and VFIO setup completed": "Configuração IOMMU e VFIO concluída",
+  "IOMMU configured successfully.": "IOMMU configurado com sucesso.",
+  "IOMMU configured. GPU passthrough setup will continue now and will be effective after reboot.": "IOMMU configurado. A configuração de passagem de GPU continuará agora e entrará em vigor após a reinicialização.",
+  "IOMMU enabled in GRUB configuration": "IOMMU habilitado na configuração do GRUB",
+  "IOMMU groups are not available yet because reboot is pending.": "Os grupos IOMMU ainda não estão disponíveis porque a reinicialização está pendente.",
+  "IOMMU has been enabled on this system.": "IOMMU foi habilitado neste sistema.",
+  "IOMMU has been enabled on this system. A reboot is required to apply the changes. Reboot now?": "IOMMU foi habilitado neste sistema. É necessária uma reinicialização para aplicar as alterações. Reiniciar agora?",
+  "IOMMU has been enabled — a system reboot is required": "O IOMMU foi ativado — é necessária uma reinicialização do sistema",
+  "IOMMU interrupt remapping configured": "Remapeamento de interrupção IOMMU configurado",
+  "IOMMU is already active on this system": "IOMMU já está ativo neste sistema",
+  "IOMMU is already configured for next boot, but it is not active yet.": "O IOMMU já está configurado para a próxima inicialização, mas ainda não está ativo.",
+  "IOMMU is enabled on the system": "IOMMU está habilitado no sistema",
+  "IOMMU is not active on this host.": "IOMMU não está ativo neste host.",
+  "IOMMU is not active on this system.": "A IOMMU não está ativa neste sistema.",
+  "IOMMU is not active. Skipping Controller + NVMe assignment.": "A IOMMU não está ativa. Ignorando atribuição de controlador + NVMe.",
+  "IOMMU kernel parameters configured": "Parâmetros do kernel IOMMU configurados",
+  "IOMMU parameters added to /etc/kernel/cmdline": "Parâmetros IOMMU adicionados a /etc/kernel/cmdline",
+  "IOMMU parameters added to GRUB": "Parâmetros IOMMU adicionados ao GRUB",
+  "IOMMU parameters removed from /etc/kernel/cmdline": "Parâmetros IOMMU removidos de /etc/kernel/cmdline",
+  "IOMMU parameters removed from GRUB": "Parâmetros IOMMU removidos do GRUB",
+  "IOMMU was configured during this wizard and a reboot is pending.": "O IOMMU foi configurado durante este assistente e uma reinicialização está pendente.",
+  "IOMMU/VFIO configuration reverted": "Configuração IOMMU/VFIO revertida",
+  "IP": "PI",
+  "IP or hostname of the PVE node hosting the Borg server LXC:": "IP ou nome do host do nó PVE que hospeda o servidor Borg LXC:",
+  "ISO": "ISO",
+  "ISO created successfully:": "ISO criado com sucesso:",
+  "ISO image         — installation images": "Imagem ISO – imagens de instalação",
+  "ISO image downloaded": "Imagem ISO baixada",
+  "ISO not found to mount on device": "ISO não encontrado para montagem no dispositivo",
+  "Identical:": "Idêntico:",
+  "Identify candidate disk (never use system disk):": "Identifique o disco candidato (nunca use o disco do sistema):",
+  "Identify persistent disk paths": "Identifique caminhos de disco permanente",
+  "If 'proxmox-ve' removal warning:": "Se o aviso de remoção 'proxmox-ve':",
+  "If Code 43 error appears, KVM hiding is already configured.": "Se o erro do Código 43 aparecer, a ocultação do KVM já está configurada.",
+  "If GUI does not load:": "Se a GUI não carregar:",
+  "If ZFS errors occur:": "Se ocorrerem erros do ZFS:",
+  "If booting in EFI mode with root on LVM: install GRUB for EFI": "Se inicializar no modo EFI com root no LVM: instale o GRUB para EFI",
+  "If config issues occur:": "Se ocorrerem problemas de configuração:",
+  "If container won't start:": "Se o contêiner não iniciar:",
+  "If imported from ESXi: install qemu-guest-agent inside the guest OS": "Se importado do ESXi: instale qemu-guest-agent dentro do sistema operacional convidado",
+  "If it still fails, the NFS server export options must be changed on the server.": "Se ainda falhar, as opções de exportação do servidor NFS deverão ser alteradas no servidor.",
+  "If it warns about 'systemd-boot' meta-package, remove it:": "Se avisar sobre o metapacote 'systemd-boot', remova-o:",
+  "If mount fails (LVM):": "Se a montagem falhar (LVM):",
+  "If needed again, re-add GPU to LXC from GPUs and Coral-TPU Menu → Add GPU to LXC.": "Se necessário novamente, adicione novamente GPU ao LXC em GPUs e Coral-TPU Menu → Adicionar GPU ao LXC.",
+  "If network does not work:": "Se a rede não funcionar:",
+  "If not 19.x, upgrade Ceph (Reef→Squid) first per the official guide:": "Se não for 19.x, atualize o Ceph (Reef→Squid) primeiro de acordo com o guia oficial:",
+  "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.": "Se as notificações estiverem habilitadas (Telegram/Discord/ntfy/...), você receberá uma mensagem \"Restauração do host concluída\" quando todas as tarefas em segundo plano forem concluídas.",
+  "If passthrough fails on Windows: install RadeonResetBugFix.": "Se a passagem falhar no Windows: instale RadeonResetBugFix.",
+  "If path not accessible (ZFS/BTRFS):": "Se o caminho não estiver acessível (ZFS/BTRFS):",
+  "If pvesm path returned a DEVICE (LVM):": "Se o caminho pvesm retornou um DEVICE (LVM):",
+  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Se o caminho pvesm retornou um DIRETÓRIO (ZFS/BTRFS):",
+  "If repositories error:": "Se houver erro nos repositórios:",
+  "If the host freezes, remove hostpci entries from": "Se o host congelar, remova as entradas hostpci de",
+  "If this happens, you can restore the backup from the 'Subscription Banner Removal' option in 'Uninstall optimizations'.": "Se isso acontecer, você pode restaurar o backup a partir da opção ‘Remoção de Banner de Assinatura’ em ‘Otimizações de desinstalação’.",
+  "If this node runs hyper-converged Ceph: ensure Ceph is 19.x (Squid) BEFORE upgrading PVE.": "Se este nó executar o Ceph hiperconvergente: certifique-se de que o Ceph seja 19.x (Squid) ANTES de atualizar o PVE.",
+  "If upgrade fails:": "Se a atualização falhar:",
+  "If you are sure you want to use it, please remove the": "Se você tem certeza de que deseja usá-lo, remova o",
+  "If you choose No, install": "Se você escolher Não, instale",
+  "If you continue, some adjustments may be duplicated or conflict with those already made by xshok.": "Se você continuar, alguns ajustes poderão ser duplicados ou entrar em conflito com aqueles já feitos pelo xshok.",
+  "If you lose connectivity, you can restore from backup using the console.": "Se você perder a conectividade, poderá restaurar a partir do backup usando o console.",
+  "If you lose or reinstall this host without a copy of the passphrase somewhere else (password manager, offline note, another host, USB stick...), every encrypted archive in this Borg repository becomes UNRECOVERABLE.": "Se você perder ou reinstalar este host sem uma cópia da senha em outro lugar (gerenciador de senhas, nota offline, outro host, pendrive...), cada arquivo criptografado neste repositório Borg se tornará irrecuperável.",
+  "If you want HDMI/analog audio inside the VM, select the audio controller(s) to pass through along with the GPU.": "Se você deseja áudio HDMI/analógico dentro da VM, selecione o(s) controlador(es) de áudio para passar junto com a GPU.",
+  "If you want to use a physical monitor on the passthrough GPU:": "Se você quiser usar um monitor físico na GPU de passagem:",
+  "If your DHCP has a static reservation for the old MAC, update it.": "Se o seu DHCP tiver uma reserva estática para o MAC antigo, atualize-o.",
+  "Image Source Directory": "Diretório de origem da imagem",
+  "Image directory:": "Diretório de imagens:",
+  "Image file not found:": "Arquivo de imagem não encontrado:",
+  "Image imported:": "Imagem importada:",
+  "Images to import:": "Imagens para importar:",
+  "Import            — disk image imports": "Importar — importações de imagens de disco",
+  "Import Disk Image to VM": "Importar imagem de disco para VM",
+  "Import Disk to LXC": "Importar disco para LXC",
+  "Import Disk to VM": "Importar disco para VM",
+  "Import Disks Selected:": "Importar discos selecionados:",
+  "Import PBS keyfile": "Importar arquivo-chave PBS",
+  "Import Summary": "Resumo de importação",
+  "Import VM from OVA or OVF": "Importar VM de OVA ou OVF",
+  "Import a ZFS pool": "Importar um pool ZFS",
+  "Import a keyfile from an absolute path (replaces the current one)": "importe um arquivo-chave de um caminho absoluto (substitui o atual)",
+  "Import disk assigned": "Disco de importação atribuído",
+  "Import disk image to VM": "Importar imagem de disco para VM",
+  "Import disks": "Importar discos",
+  "Import encryption keyfile": "Importar arquivo de chave de criptografia",
+  "Import failed": "Falha na importação",
+  "Import failed for:": "Falha na importação para:",
+  "Important: both VMs cannot be running at the same time with the same GPU.": "Importante: ambas as VMs não podem estar em execução ao mesmo tempo com a mesma GPU.",
+  "Important: some GPUs may still fail in passthrough and can affect host stability or overall performance depending on hardware/firmware quality.": "Importante: algumas GPUs ainda podem falhar na passagem e afetar a estabilidade do host ou o desempenho geral, dependendo da qualidade do hardware/firmware.",
+  "Importing": "Importando",
+  "Importing disk": "Importando disco",
+  "Importing:": "Importando:",
+  "Improve log rotation and limit log size to save space and extend disk life": "Melhore a rotação do log e limite o tamanho do log para economizar espaço e prolongar a vida útil do disco",
+  "In the loader interface, follow the instructions to select your Synology model": "Na interface do carregador, siga as instruções para selecionar seu modelo Synology",
+  "In use": "Em uso",
+  "In use by VM/LXC config": "Em uso pela configuração VM/LXC",
+  "In use by running VM/LXC — stop it first": "Em uso executando VM/LXC – pare primeiro",
+  "Inaccessible device during VM startup": "Dispositivo inacessível durante a inicialização da VM",
+  "Inactive": "Inativo",
+  "Inactive (entry in fstab, not currently mounted)": "Inativo (entrada no fstab, não montada no momento)",
+  "Includes /etc/network (may drop SSH immediately)": "Inclui /etc/network (pode descartar o SSH imediatamente)",
+  "Includes /etc/zfs": "Inclui /etc/zfs",
+  "Includes cluster data (/etc/pve, /var/lib/pve-cluster)": "Inclui dados do cluster (/etc/pve, /var/lib/pve-cluster)",
+  "Incompatible GPU for VM Passthrough": "GPU incompatível para passagem de VM",
+  "Incompatible Machine Type": "Tipo de máquina incompatível",
+  "Incompatible Reset Capability for AMD dGPU": "Capacidade de reinicialização incompatível para AMD dGPU",
+  "Incompatible Reset Capability for Intel GPU": "Capacidade de reinicialização incompatível para GPU Intel",
+  "Incompatible Reset Capability for Intel dGPU": "Capacidade de reinicialização incompatível para Intel dGPU",
+  "Incompatible archive": "Arquivo incompatível",
+  "Increase container RAM temporarily to": "Aumente temporariamente a RAM do contêiner para",
+  "Increase file and process limits for advanced workloads": "Aumente os limites de arquivos e processos para cargas de trabalho avançadas",
+  "Increase various system limits": "Aumentar vários limites do sistema",
+  "Increase vzdump backup speed": "Aumentar a velocidade de backup do vzdump",
+  "Increasing maximum file system open files...": "Aumentando o máximo de arquivos abertos do sistema de arquivos...",
+  "Increasing various system limits...": "Aumentando vários limites do sistema...",
+  "Inherited retention:": "retenção herdada:",
+  "Inherited schedule:": "Cronograma herdado:",
+  "Initializing Borg repository if needed...": "Inicializando o repositório Borg, se necessário...",
+  "Initiator IQN is authorised on the target": "O iniciador IQN está autorizado no alvo",
+  "Initiator IQN:": "IQN do iniciador:",
+  "Inspect disks before any action": "Inspecione os discos antes de qualquer ação",
+  "Inspect host device nodes": "Inspecione os nós do dispositivo host",
+  "Inspect passthrough/kernel events": "Inspecionar eventos de passagem/kernel",
+  "Inspect storage config block:": "Inspecione o bloco de configuração de armazenamento:",
+  "Inspection commands run directly. Template commands [T] require parameter substitution.": "Os comandos de inspeção são executados diretamente. Comandos de modelo [T] requerem substituição de parâmetro.",
+  "Install": "Instalar",
+  "Install ALL utilities": "Instale TODOS os utilitários",
+  "Install AMD GPU drivers inside the guest.": "Instale os drivers da GPU AMD dentro do convidado.",
+  "Install CIFS client packages inside CT:": "Instale os pacotes do cliente CIFS dentro do CT:",
+  "Install Coral TPU in LXC": "Instale Coral TPU no LXC",
+  "Install Fail2Ban": "Instale Fail2Ban",
+  "Install Figurine": "Instalar estatueta",
+  "Install Intel Graphics Driver inside the guest.": "Instale o driver de gráficos Intel dentro do convidado.",
+  "Install Lynis": "Instale o Lynis",
+  "Install NFS client packages inside CT:": "Instale os pacotes do cliente NFS dentro do CT:",
+  "Install NVIDIA Drivers on Host": "Instale drivers NVIDIA no host",
+  "Install NVIDIA drivers from nvidia.com inside the guest.": "Instale os drivers NVIDIA de nvidia.com dentro do convidado.",
+  "Install NVIDIA proprietary drivers": "Instale drivers proprietários da NVIDIA",
+  "Install OVH Real Time Monitoring": "Instalar Monitorização em Tempo Real OVH",
+  "Install Open vSwitch": "Instalar Open vSwitch",
+  "Install Samba inside CT:": "Instale o Samba dentro do CT:",
+  "Install ZFS auto-snapshot": "Instale o instantâneo automático do ZFS",
+  "Install analysis tools": "Instale ferramentas de análise",
+  "Install and configure": "Instalar e configurar",
+  "Install and configure Fastfetch": "Instalar e configurar o Fastfetch",
+  "Install and configure Log2RAM": "Instalar e configurar Log2RAM",
+  "Install and start iSCSI initiator:": "Instale e inicie o iniciador iSCSI:",
+  "Install basic utilities": "Instale utilitários básicos",
+  "Install common system utilities": "Instale utilitários comuns do sistema",
+  "Install compression tools": "Instale ferramentas de compactação",
+  "Install development tools": "Instale ferramentas de desenvolvimento",
+  "Install maintainer's version (Y)": "Instale a versão do mantenedor (Y)",
+  "Install manually and retry: apt-get install -y exfatprogs": "Instale manualmente e tente novamente: apt-get install -y exfatprogs",
+  "Install manually with:": "Instale manualmente com:",
+  "Install network tools": "Instale ferramentas de rede",
+  "Install podman or docker to continue.": "Instale podman ou docker para continuar.",
+  "Install relevant guest agent": "Instale o agente convidado relevante",
+  "Install server packages inside CT:": "Instale pacotes de servidores dentro do CT:",
+  "Install terminal multiplexers": "Instale multiplexadores de terminal",
+  "Install the Edge TPU runtime (libedgetpu1-std)": "Instale o tempo de execução do Edge TPU (libedgetpu1-std)",
+  "Install with Cloud-Init script": "Instalar com script Cloud-Init",
+  "Install with ISO from UUP Dump": "Instalar com ISO do UUP Dump",
+  "Install with personal ISO": "Instalar com ISO pessoal",
+  "Install with traditional method": "Instale com método tradicional",
+  "Install with: apt-get install open-iscsi": "Instale com: apt-get install open-iscsi",
+  "Install/Update Coral TPU on Host": "Instalar/atualizar Coral TPU no host",
+  "Install/Update NVIDIA Drivers (Host + LXC)": "Instalar/atualizar drivers NVIDIA (Host + LXC)",
+  "Installation Complete": "Instalação concluída",
+  "Installation completed.": "Instalação concluída.",
+  "Installation completed. Please reboot the server manually as soon as possible.": "Instalação concluída. Reinicie o servidor manualmente o mais rápido possível.",
+  "Installation completed. Press Enter to continue...": "Instalação concluída. Pressione Enter para continuar...",
+  "Installation failed": "Falha na instalação",
+  "Installation finished but drivers are not loaded. A reboot may be required.": "A instalação foi concluída, mas os drivers não foram carregados. Uma reinicialização pode ser necessária.",
+  "Installation log:": "Registro de instalação:",
+  "Installation summary": "Resumo da instalação",
+  "Installed": "Instalado",
+  "Installed at:": "Instalado em:",
+  "Installed components:": "Componentes instalados:",
+  "Installed:": "Instalado:",
+  "Installer already downloaded and verified.": "Instalador já baixado e verificado.",
+  "Installer copied to container.": "Instalador copiado para contêiner.",
+  "Installer downloaded.": "Instalador baixado.",
+  "Installer finished with errors.": "O instalador terminou com erros.",
+  "Installer not found:": "Instalador não encontrado:",
+  "Installing": "Instalando",
+  "Installing AMD mesa drivers in container...": "Instalando drivers AMD mesa no contêiner...",
+  "Installing Ceph packages...": "Instalando pacotes do Ceph...",
+  "Installing Ceph support...": "Instalando o suporte Ceph...",
+  "Installing Coral TPU driver inside the container...": "Instalando o driver Coral TPU dentro do contêiner...",
+  "Installing Edge TPU runtime (libedgetpu1-std)...": "Instalando o tempo de execução do Edge TPU (libedgetpu1-std)...",
+  "Installing Fail2Ban...": "Instalando Fail2Ban...",
+  "Installing Git as a prerequisite...": "Instalando o Git como pré-requisito...",
+  "Installing Intel VA-API drivers in container...": "Instalando drivers Intel VA-API no contêiner...",
+  "Installing Log2RAM from GitHub...": "Instalando Log2RAM do GitHub...",
+  "Installing Log2RAM from source...": "Instalando Log2RAM da fonte...",
+  "Installing NFS Client in LXC": "Instalando o cliente NFS no LXC",
+  "Installing NFS client packages...": "Instalando pacotes do cliente NFS...",
+  "Installing NFS client tools...": "Instalando ferramentas de cliente NFS...",
+  "Installing NFS server packages inside the CT...": "Instalando pacotes do servidor NFS dentro do CT...",
+  "Installing NVIDIA drivers in container. This may take several minutes...": "Instalando drivers NVIDIA em contêiner. Isso pode levar vários minutos...",
+  "Installing NVIDIA udev rules and persistence service...": "Instalando regras NVIDIA udev e serviço de persistência...",
+  "Installing NVIDIA utils (Alpine)...": "Instalando utilitários NVIDIA (Alpine)...",
+  "Installing NVIDIA utils (Arch)...": "Instalando utilitários NVIDIA (Arch)...",
+  "Installing OVH RTM (Real Time Monitoring)...": "Instalando OVH RTM (Monitorização em Tempo Real)...",
+  "Installing OpenVSwitch for virtual internal network...": "Instalando OpenVSwitch para rede interna virtual...",
+  "Installing OpenVSwitch packages...": "Instalando pacotes OpenVSwitch...",
+  "Installing Samba Client": "Instalando o cliente Samba",
+  "Installing Samba Client in LXC": "Instalando o cliente Samba no LXC",
+  "Installing Samba client tools...": "Instalando ferramentas do cliente Samba...",
+  "Installing Samba server packages inside the CT...": "Instalando pacotes do servidor Samba dentro do CT...",
+  "Installing Samba/CIFS client packages...": "Instalando pacotes do cliente Samba/CIFS...",
+  "Installing amdgpu_top...": "Instalando amdgpu_top...",
+  "Installing and configuring Fail2Ban to protect Proxmox web interface and SSH...": "Instalando e configurando Fail2Ban para proteger a interface web Proxmox e SSH...",
+  "Installing and configuring Fastfetch...": "Instalando e configurando Fastfetch...",
+  "Installing and configuring Figurine...": "Instalando e configurando o Figurine...",
+  "Installing and configuring ZFS auto-snapshot...": "Instalando e configurando o instantâneo automático do ZFS...",
+  "Installing build dependencies...": "Instalando dependências de compilação...",
+  "Installing dependency:": "Instalando dependência:",
+  "Installing essential Proxmox packages...": "Instalando pacotes essenciais do Proxmox...",
+  "Installing gawk (required for OVF parsing)...": "Instalando o gawk (necessário para análise de OVF)...",
+  "Installing group": "Instalando grupo",
+  "Installing host drivers while the GPU is assigned to a VM could break passthrough and destabilize the system.": "Instalar drivers de host enquanto a GPU está atribuída a uma VM pode interromper a passagem e desestabilizar o sistema.",
+  "Installing iSCSI initiator tools...": "Instalando ferramentas do iniciador iSCSI...",
+  "Installing intel-gpu-tools...": "Instalando ferramentas Intel-GPU...",
+  "Installing kexec-tools...": "Instalando ferramentas kexec...",
+  "Installing latest Lynis security scan tool...": "Instalando a ferramenta de verificação de segurança Lynis mais recente...",
+  "Installing packages...": "Instalando pacotes...",
+  "Installing pigz...": "Instalando o pigz...",
+  "Installing required dependencies...": "Instalando dependências necessárias...",
+  "Installing required package: git": "Instalando o pacote necessário: git",
+  "Installing required tools...": "Instalando as ferramentas necessárias...",
+  "Installing selected utilities": "Instalando utilitários selecionados",
+  "Installing system utilities...": "Instalando utilitários do sistema...",
+  "Installing zfs-auto-snapshot package...": "Instalando o pacote zfs-auto-snapshot...",
+  "Installs essential packages if missing": "Instala pacotes essenciais se estiverem faltando",
+  "Insufficient Disk Space": "Espaço em disco insuficiente",
+  "Insufficient disk space. Skipping LXC": "Espaço em disco insuficiente. Ignorando LXC",
+  "Insufficient memory. NVIDIA install aborted.": "Memória insuficiente. Instalação da NVIDIA abortada.",
+  "Insufficient memory. Skipping LXC": "Memória insuficiente. Ignorando LXC",
+  "Insufficient space:": "Espaço insuficiente:",
+  "Integrity check failed on": "Falha na verificação de integridade ativada",
+  "Intel CPU detected": "CPU Intel detectada",
+  "Intel GPU Tools installation completed!": "Instalação das ferramentas Intel GPU concluída!",
+  "Intel GPU(s) detected:": "GPU(s) Intel detectada(s):",
+  "Intel VA-API drivers installed.": "Drivers Intel VA-API instalados.",
+  "Intel iGPU passthrough configured.": "Passagem Intel iGPU configurada.",
+  "Interactive (guided, prompts visible)": "Interativo (guiado, avisos visíveis)",
+  "Interactive process viewer (press q to exit)": "Visualizador de processo interativo (pressione q para sair)",
+  "Interface": "Interface",
+  "Interface MTU": "Interface MTU",
+  "Interface Names (persistent)": "Nomes de Interface (persistente)",
+  "Interface Type": "Tipo de interface",
+  "Interface names will return to default systemd behavior.": "Os nomes das interfaces retornarão ao comportamento padrão do systemd.",
+  "Interface type:": "Tipo de interface:",
+  "Interfaces configured": "Interfaces configuradas",
+  "Interfaces defined with 'auto' but no 'iface' block": "Interfaces definidas com 'auto', mas sem bloco 'iface'",
+  "Interfaces to Remove": "Interfaces para remover",
+  "Internal error: NVIDIA installer path is empty or file not found.": "Erro interno: o caminho do instalador NVIDIA está vazio ou o arquivo não foi encontrado.",
+  "Internal error: missing arguments in pmx_prepare_host_shared_dir": "Erro interno: argumentos ausentes em pmx_prepare_host_shared_dir",
+  "Invalid 'proxmox-ve' candidate (not 9.x or none). Please verify your repository configuration and network, then retry.": "Candidato 'proxmox-ve' inválido (não 9.x ou nenhum). Verifique a configuração e a rede do seu repositório e tente novamente.",
+  "Invalid ID": "ID inválido",
+  "Invalid Option": "Opção inválida",
+  "Invalid Path": "Caminho inválido",
+  "Invalid VMID": "IDVM inválido",
+  "Invalid ZFS pool name.": "Nome de pool ZFS inválido.",
+  "Invalid group name. Use letters, digits, underscore or hyphen, and start with a letter or underscore.": "Nome de grupo inválido. Use letras, dígitos, sublinhado ou hífen e comece com uma letra ou sublinhado.",
+  "Invalid input": "Entrada inválida",
+  "Invalid name": "Nome inválido",
+  "Invalid name. Use only letters, numbers, hyphens and underscores.": "Nome inválido. Use apenas letras, números, hífens e sublinhados.",
+  "Invalid option": "Opção inválida",
+  "Invalid option, please try again.": "Opção inválida. Tente novamente.",
+  "Invalid option. Skipping.": "Opção inválida. Pulando.",
+  "Invalid parameters for bind mount": "Parâmetros inválidos para montagem vinculada",
+  "Invalid selection": "Seleção inválida",
+  "Invalid size. Please enter a number in MB (e.g., 128, 256, 512).": "Tamanho inválido. Insira um número em MB (por exemplo, 128, 256, 512).",
+  "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "ID de armazenamento inválido. Use apenas letras, números, hífens e sublinhados.",
+  "Invalid username or password.": "Nome de usuário ou senha inválidos.",
+  "Issue": "Emitir",
+  "Issues found": "Problemas encontrados",
+  "Issues were found. Would you like to use the Guided Cleanup Assistant?": "Problemas foram encontrados. Gostaria de usar o Assistente de limpeza guiada?",
+  "Issues were found. Would you like to use the Guided Repair Assistant?": "Problemas foram encontrados. Gostaria de usar o Assistente de reparo guiado?",
+  "It appears that you have already executed the xshok-proxmox post-install script on this system.": "Parece que você já executou o script pós-instalação xshok-proxmox neste sistema.",
+  "It is recommended to create a backup before continuing.": "Recomenda-se criar um backup antes de continuar.",
+  "It is strongly recommended to create a backup of your container before proceeding with the conversion.": "É altamente recomendável criar um backup do seu contêiner antes de prosseguir com a conversão.",
+  "It will be installed from the official GitHub repository.": "Ele será instalado a partir do repositório oficial do GitHub.",
+  "Italian": "italiano",
+  "JC Channel logo applied": "Logotipo do canal JC aplicado",
+  "JSON output for scripts": "Saída JSON para scripts",
+  "Job ID (letters, numbers, - _)": "ID do trabalho (letras, números, - _)",
+  "Job ID:": "ID do trabalho:",
+  "Job deleted:": "Trabalho excluído:",
+  "Job disabled:": "Trabalho desativado:",
+  "Job enabled:": "Trabalho habilitado:",
+  "Job selection returned empty id — aborting.": "A seleção do trabalho retornou um ID vazio – anulado.",
+  "Journald configuration adjusted to": "Configuração do diário ajustada para",
+  "Journald configuration is already optimized": "A configuração do Journald já está otimizada",
+  "Journald configuration updated and service restarted": "Configuração do Journald atualizada e serviço reiniciado",
+  "Journald optimization completed": "Otimização do diário concluída",
+  "Journald optimized - Max size: 64M": "Diário otimizado - Tamanho máximo: 64M",
+  "KDF:": "KDF:",
+  "KVM MSR options added to /etc/modprobe.d/kvm.conf": "Opções KVM MSR adicionadas a /etc/modprobe.d/kvm.conf",
+  "KVM MSR options ensured in /etc/modprobe.d/kvm.conf": "Opções KVM MSR garantidas em /etc/modprobe.d/kvm.conf",
+  "KVM MSR options not present, nothing to revert": "Opções KVM MSR não presentes, nada para reverter",
+  "Keep GPU in LXC config (disable Start on boot)": "Mantenha a GPU na configuração LXC (desative Iniciar na inicialização)",
+  "Keep GPU in LXC config + disable Start on boot": "Mantenha a GPU na configuração LXC + desative Iniciar na inicialização",
+  "Keep GPU in VM config (disable Start on boot)": "Mantenha a GPU na configuração da VM (desative Iniciar na inicialização)",
+  "Keep GPU in source VM config (disable Start on boot if enabled)": "Mantenha a GPU na configuração da VM de origem (desative Iniciar na inicialização, se ativado)",
+  "Keep GPU in source VM config + disable Start on boot if enabled": "Manter a GPU na configuração da VM de origem + desativar Iniciar na inicialização, se ativado",
+  "Keep current version (N)": "Manter a versão atual (N)",
+  "Keep current version (N) if modified": "Manter a versão atual (N) se modificada",
+  "Keep in source VM(s) + disable onboot + add to target VM": "Manter na(s) VM(s) de origem + desativar onboot + adicionar à VM de destino",
+  "Keeping GPU in source VM config": "Mantendo a GPU na configuração da VM de origem",
+  "Kept sharedfiles group (has regular users assigned).": "Manteve o grupo sharedfiles (tem usuários regulares atribuídos).",
+  "Kernel and architecture info": "Informações sobre kernel e arquitetura",
+  "Kernel headers and build tools verified.": "Cabeçalhos de kernel e ferramentas de construção verificadas.",
+  "Kernel max Key limit configured": "Limite máximo de chaves do kernel configurado",
+  "Kernel panic behavior configuration completed": "Configuração do comportamento de pânico do kernel concluída",
+  "Kernel panic configuration removed": "Configuração de pânico do kernel removida",
+  "Kernel panic configuration updated and applied": "Configuração de pânico do kernel atualizada e aplicada",
+  "Kernel, modules and boot config": "Kernel, módulos e configuração de inicialização",
+  "Kernel/boot-tied files (boot config, /etc/systemd/system, initramfs config, apt sources, ZFS state, ...) are NOT copied verbatim to keep the target's boot safe. The operator's own tuning inside them (IOMMU cmdline, VFIO IDs, custom quirks, GRUB timeout, ...) is merged into the target's fresh copies automatically via kernel-agnostic merge.": "arquivos vinculados ao kernel/inicialização (configuração de inicialização, /etc/systemd/system, configuração initramfs, fontes apt, estado ZFS, ...) NÃO são copiados literalmente para manter a inicialização do destino segura.O próprio ajuste do operador dentro deles (cmdline IOMMU, IDs VFIO, peculiaridades personalizadas, tempo limite do GRUB, ...) é mesclado nas novas cópias do destino automaticamente por meio de mesclagem independente do kernel.",
+  "Keyfile copied": "arquivo-chave copiado",
+  "Keyfile copied to:": "arquivo-chave copiado para:",
+  "Keyfile passphrase": "senha do arquivo-chave",
+  "Keyfile passphrase stored:": "senha do arquivo-chave armazenada:",
+  "Keyfile recovered": "Arquivo-chave recuperado",
+  "Keyfile recovered successfully.": "Arquivo-chave recuperado com sucesso.",
+  "Keyfile recovery available": "Recuperação de arquivo-chave disponível",
+  "Keyfile recovery — pick source host": "Recuperação de arquivo-chave – escolha o host de origem",
+  "Keyfile removed.": "arquivo-chave removido.",
+  "Keyrings method failed; trying apt-key fallback": "O método dos chaveiros falhou; tentando substituto do apt-key",
+  "LUNs appear as block devices assignable to VMs": "LUNs aparecem como dispositivos de bloco atribuíveis a VMs",
+  "LVM PV headers check completed": "Verificação dos cabeçalhos LVM PV concluída",
+  "LVM physical volume detected": "Volume físico LVM detectado",
+  "LVM tools not available, skipping LVM check": "Ferramentas LVM não disponíveis, ignorando a verificação do LVM",
+  "LVM:": "LVM:",
+  "LXC Conflict Policy": "Política de Conflitos LXC",
+  "LXC Container Privilege Status": "Status de privilégio do contêiner LXC",
+  "LXC Conversion Manual Guides": "Guias manuais de conversão LXC",
+  "LXC Management": "Gestão LXC",
+  "LXC Mount Manager": "Gerenciador de montagem LXC",
+  "LXC Privileged to Unprivileged conversion": "Conversão LXC privilegiada para não privilegiada",
+  "LXC Unprivileged to Privileged conversion": "Conversão LXC sem privilégios para privilegiados",
+  "LXC already stopped": "LXC já parou",
+  "LXC containers with NVIDIA passthrough:": "Contêineres LXC com passagem NVIDIA:",
+  "LXC conversion from privileged to unprivileged completed successfully!": "Conversão LXC de privilegiado para não privilegiado concluída com sucesso!",
+  "LXC conversion from unprivileged to privileged completed successfully!": "Conversão LXC de não privilegiado para privilegiado concluída com sucesso!",
+  "LXC removed:": "LXC removido:",
+  "LXC stopped": "LXC parou",
+  "LXC update skipped by user.": "Atualização do LXC ignorada pelo usuário.",
+  "LXCs to destroy:": "LXCs para destruir:",
+  "Label:": "Rótulo:",
+  "Language Change": "Mudança de idioma",
+  "Language changed to": "Idioma alterado para",
+  "Last 50 kernel log lines": "Últimas 50 linhas de log do kernel",
+  "Last run:": "Última execução:",
+  "Last system boot time": "Hora da última inicialização do sistema",
+  "Latest available": "Último disponível",
+  "Latest version:": "Versão mais recente:",
+  "Launching GPU passthrough assistant for VM": "Lançamento do assistente de passagem de GPU para VM",
+  "Legacy PVE 8 .list files commented or not present": "Arquivos .list PVE 8 legados comentados ou não presentes",
+  "Legacy ceph.list commented or not present": "Ceph.list legado comentado ou não presente",
+  "Legacy network tools (e.g., ifconfig)": "Ferramentas de rede legadas (por exemplo, ifconfig)",
+  "Legend:": "Lenda:",
+  "Let's review your current network configuration.": "Vamos revisar sua configuração de rede atual.",
+  "Likely cause: host directory permissions deny the container's mapped UID.": "Causa provável: as permissões do diretório host negam o UID mapeado do contêiner.",
+  "Limiting size and optimizing journald": "Limitando o tamanho e otimizando o diário",
+  "Limiting size and optimizing journald...": "Limitando o tamanho e otimizando o diário...",
+  "Line to paste (single line, including \"command=...\" prefix):": "Linha a ser colada (linha única, incluindo o prefixo \"command=...\"):",
+  "Linux Installation Options": "Opções de instalação do Linux",
+  "Linux/Mac path:": "Caminho Linux/Mac:",
+  "List Available Disks": "Listar discos disponíveis",
+  "List IOMMU group mapping": "Listar mapeamento de grupo IOMMU",
+  "List NVMe devices": "Listar dispositivos NVMe",
+  "List SMART-capable devices": "Listar dispositivos compatíveis com SMART",
+  "List VM/CT IDs to operate on": "Listar IDs de VM/CT para operar",
+  "List ZFS datasets and snapshots": "Listar conjuntos de dados e instantâneos do ZFS",
+  "List all LXC containers": "Listar todos os contêineres LXC",
+  "List all ZFS pools": "Listar todos os pools ZFS",
+  "List all containers to identify the privileged one:": "Liste todos os contêineres para identificar o privilegiado:",
+  "List all containers to identify the unprivileged one:": "Liste todos os contêineres para identificar aquele sem privilégios:",
+  "List all virtual machines": "Listar todas as máquinas virtuais",
+  "List backups in a specific storage": "Listar backups em um armazenamento específico",
+  "List block devices and partitions": "Listar dispositivos e partições de bloco",
+  "List configured storages:": "Listar armazenamentos configurados:",
+  "List containers:": "Listar contêineres:",
+  "List content of specific storage": "Listar o conteúdo do armazenamento específico",
+  "List disk persistent identifiers": "Listar identificadores persistentes de disco",
+  "List disks with detailed info": "Listar discos com informações detalhadas",
+  "List importable ZFS pools": "Listar pools ZFS importáveis",
+  "List local backups": "Listar backups locais",
+  "List storages valid for image import": "Listar armazenamentos válidos para importação de imagens",
+  "Listening Ports": "Portas de escuta",
+  "Listening on:": "Ouvindo em:",
+  "Listening ports:": "Portas de escuta:",
+  "Listing relevant CT users and their mapped UID/GID on host...": "Listando usuários CT relevantes e seu UID/GID mapeado no host...",
+  "Loading modules...": "Carregando módulos...",
+  "Local Disk Manager - Proxmox Host": "Gerenciador de disco local - Host Proxmox",
+  "Local Disk Storages": "Armazenamentos em disco local",
+  "Local Shared Directory on Host": "Diretório compartilhado local no host",
+  "Local archive targets (paths + USB mount/unmount)": "destinos de arquivo local (caminhos + montagem/desmontagem USB)",
+  "Local backup error log": "Log de erros de backup local",
+  "Local backup failed.": "Falha no backup local.",
+  "Local directory  (single-machine — only use if it is a SEPARATE disk)": "Diretório local (máquina única — use apenas se for um disco SEPARADO)",
+  "Local keyfile is missing but a recovery copy was found in PBS.": "O arquivo-chave local está faltando, mas uma cópia de recuperação foi encontrada no PBS.",
+  "Local network only (192.168.0.0/16)": "Somente rede local (192.168.0.0/16)",
+  "Local restore error log": "Log de erros de restauração local",
+  "Locale generated": "Local gerado",
+  "Location:": "Localização:",
+  "Log": "Registro",
+  "Log file": "Arquivo de registro",
+  "Log2RAM already registered — updating to latest configuration": "Log2RAM já registrado — atualizando para a configuração mais recente",
+  "Log2RAM installation and configuration completed successfully.": "Instalação e configuração do Log2RAM concluídas com sucesso.",
+  "Log2RAM installation cancelled by user": "Instalação do Log2RAM cancelada pelo usuário",
+  "Log2RAM installation verification failed. Check /tmp/log2ram_install.log": "A verificação da instalação do Log2RAM falhou. Verifique /tmp/log2ram_install.log",
+  "Log2RAM installed successfully": "Log2RAM instalado com sucesso",
+  "Log2RAM size set to:": "Tamanho do Log2RAM definido como:",
+  "Log2RAM write scheduled every": "Gravação Log2RAM agendada a cada",
+  "Log:": "Registro:",
+  "Logged-in users": "Usuários logados",
+  "Logrotate optimization completed": "Otimização do Logrotate concluída",
+  "Logrotate service restarted successfully": "Serviço Logrotate reiniciado com sucesso",
+  "Long Test — Background": "Teste Longo - Antecedentes",
+  "Long self-test started on": "Autoteste longo iniciado em",
+  "Long test             — full scan, runs in background if closed": "Teste longo – verificação completa, executado em segundo plano se fechado",
+  "Look for containers with 'unprivileged: 1' in their config": "Procure contêineres com ‘unprivileged: 1’ em sua configuração",
+  "Look for containers without 'unprivileged: 1' in their config": "Procure contêineres sem 'unprivileged: 1' em sua configuração",
+  "Lookup domain registration info": "Pesquisar informações de registro de domínio",
+  "Low Container Memory": "Memória baixa do contêiner",
+  "Low free space warning": "Aviso de pouco espaço livre",
+  "Low-power CPU platform": "Plataforma de CPU de baixo consumo",
+  "Lynis - Security Audit": "Lynis - Auditoria de Segurança",
+  "Lynis Management": "Gestão Lynis",
+  "Lynis command not found": "Comando Lynis não encontrado",
+  "Lynis has been removed": "Lynis foi removida",
+  "Lynis installation could not be verified": "A instalação do Lynis não pôde ser verificada",
+  "Lynis installed successfully from GitHub": "Lynis instalado com sucesso do GitHub",
+  "Lynis is a security auditing tool that performs comprehensive system scans including:": "Lynis é uma ferramenta de auditoria de segurança que realiza verificações abrangentes do sistema, incluindo:",
+  "Lynis is currently installed.": "Lynis está instalado atualmente.",
+  "Lynis is not installed on this system.": "Lynis não está instalado neste sistema.",
+  "Lynis is not installed. Run: apt install lynis": "Lynis não está instalado. Execute: apt install lynis",
+  "Lynis is ready to use": "Lynis está pronto para usar",
+  "Lynis updated to version:": "Lynis atualizado para a versão:",
+  "Lynis version:": "Versão Lynis:",
+  "Lynis was not installed from Git. Reinstalling...": "Lynis não foi instalado a partir do Git. Reinstalando...",
+  "M.2 / PCIe devices:": "Dispositivos M.2/PCIe:",
+  "MAC Address": "Endereço MAC",
+  "MACHINE TYPE": "TIPO DE MÁQUINA",
+  "MOTD configuration updated successfully": "Configuração MOTD atualizada com sucesso",
+  "Machine Type": "Tipo de máquina",
+  "Machine type: q35": "Tipo de máquina: q35",
+  "Machine: q35": "Máquina: q35",
+  "Major version differs:": "A versão principal é diferente:",
+  "Make sure IOMMU is properly enabled and the system has been rebooted after activation.": "Certifique-se de que o IOMMU esteja habilitado corretamente e que o sistema tenha sido reinicializado após a ativação.",
+  "Make sure there are no critical services running as they will be interrupted. Ensure your server can be safely rebooted.": "Certifique-se de que não haja serviços críticos em execução, pois eles serão interrompidos. Certifique-se de que seu servidor possa ser reinicializado com segurança.",
+  "Make sure you have SSH or Web UI access before rebooting.": "Certifique-se de ter acesso SSH ou Web UI antes de reiniciar.",
+  "Makefile missing in": "Makefile faltando em",
+  "Malformed repository entries cleaned": "Entradas de repositório malformadas limpas",
+  "Manage PBS encryption keyfile": "Gerenciar arquivo de chave de criptografia PBS",
+  "Manage Secure Gateway": "Gerenciar gateway seguro",
+  "Manage and inspect VM disk images": "Gerenciar e inspecionar imagens de disco de VM",
+  "Manage custom backup paths": "Gerencie caminhos de backup personalizados",
+  "Manage custom paths (add / remove your folders)": "Gerencie caminhos personalizados (adicione/remova suas pastas)",
+  "Manage local backup target": "Gerenciar destino de backup local",
+  "Manual CLI Guide (Disk and Storage Manager)": "Guia CLI manual (Gerenciador de disco e armazenamento)",
+  "Manual CLI Guide (GPU/TPU)": "Guia CLI manual (GPU/TPU)",
+  "Manual Guide: Convert LXC Privileged to Unprivileged": "Guia manual: converter LXC privilegiado em não privilegiado",
+  "Manual Guide: Convert LXC Unprivileged to Privileged": "Guia manual: converter LXC sem privilégios em privilegiado",
+  "Manual Path Entry": "Entrada manual de caminho",
+  "Manual backup of a VM or CT": "Backup manual de uma VM ou CT",
+  "Manual command template (copy/paste):": "Modelo de comando manual (copiar/colar):",
+  "Manual destination path": "Caminho de destino manual",
+  "Manual guide script not found": "Script do guia manual não encontrado",
+  "Manual install required inside CT": "Instalação manual necessária dentro do CT",
+  "Manual path entry": "Entrada manual de caminho",
+  "Manual steps recommended after import": "Etapas manuais recomendadas após a importação",
+  "Manual upgrade guide step by step": "Guia de atualização manual passo a passo",
+  "Mapped GID on host": "GID mapeado no host",
+  "Mapped UID on host": "UID mapeado no host",
+  "Max FD limit / ulimit configured": "Limite máximo de FD/ulimit configurado",
+  "Max FS open files configuration created successfully": "Configuração de arquivos abertos Max FS criada com sucesso",
+  "Max user watches configured": "Máximo de visualizações do usuário configuradas",
+  "Maximum auto-repair attempts reached (3). Please review the log and run any remaining commands manually.": "Máximo de tentativas de reparo automático atingido (3). Revise o log e execute quaisquer comandos restantes manualmente.",
+  "May need to restart terminal": "Pode ser necessário reiniciar o terminal",
+  "Memory optimization completed.": "Otimização de memória concluída.",
+  "Memory optimizations removed": "Otimizações de memória removidas",
+  "Memory restored.": "Memória restaurada.",
+  "Memory settings optimized successfully": "Configurações de memória otimizadas com sucesso",
+  "Memory:": "Memória:",
+  "Method:": "Método:",
+  "Migrate VMs away from node being upgraded": "Migrar VMs para fora do nó que está sendo atualizado",
+  "Migrate away any guests that must keep running": "Migre todos os convidados que precisam continuar em execução",
+  "Migrated legacy ProxMenux NVIDIA blacklist state — module will reload after reboot": "Estado de lista negra legado ProxMenux NVIDIA migrado – o módulo será recarregado após a reinicialização",
+  "Mirror URL not available for this script.": "URL espelhado não disponível para este script.",
+  "Missing": "Ausente",
+  "Missing commands after installation:": "Comandos ausentes após a instalação:",
+  "Missing dependency": "Dependência ausente",
+  "Missing on target:": "Faltando no alvo:",
+  "Missing or invalid parameter": "Parâmetro ausente ou inválido",
+  "Missing required parameter": "Parâmetro obrigatório ausente",
+  "Mixed GPU Modes": "Modos GPU mistos",
+  "Mixed current mode detected in selected GPU(s).": "Modo atual misto detectado em GPU(s) selecionada(s).",
+  "Mobile UI backup created": "Backup da IU móvel criado",
+  "Mode": "Modo",
+  "Model": "Modelo",
+  "Modern resource monitor (press q to exit)": "Monitor de recursos moderno (pressione q para sair)",
+  "Modifying Fastfetch configuration...": "Modificando a configuração do Fastfetch...",
+  "Modules configuration updated.": "Configuração dos módulos atualizada.",
+  "Modules loaded.": "Módulos carregados.",
+  "Monitor Activated": "Monitor ativado",
+  "Monitor Deactivated": "Monitor desativado",
+  "Monitor URL": "Monitorar URL",
+  "Monitor disk I/O usage (press q to exit)": "Monitore o uso de E/S do disco (pressione q para sair)",
+  "Monitor progress:": "Monitore o progresso:",
+  "Monitoring": "Monitoramento",
+  "Most common cause: the archive is corrupted (interrupted write, partial copy, or storage issue).": "Causa mais comum: o arquivo está corrompido (gravação interrompida, cópia parcial ou problema de armazenamento).",
+  "Mount Added Successfully:": "Montagem adicionada com sucesso:",
+  "Mount CIFS share:": "Monte o compartilhamento CIFS:",
+  "Mount Configuration Summary:": "Resumo da configuração de montagem:",
+  "Mount Details:": "Detalhes de montagem:",
+  "Mount Examples:": "Exemplos de montagem:",
+  "Mount Host Directory to LXC": "Monte o diretório de host no LXC",
+  "Mount Host Directory to LXC Container": "Monte o diretório de host no contêiner LXC",
+  "Mount Information:": "Informações de montagem:",
+  "Mount Method": "Método de montagem",
+  "Mount NFS Client in LXC": "Monte o cliente NFS no LXC",
+  "Mount NFS Share": "Montar compartilhamento NFS",
+  "Mount NFS Share on Host": "Monte o compartilhamento NFS no host",
+  "Mount NFS share:": "Monte o compartilhamento NFS:",
+  "Mount Name": "Nome da montagem",
+  "Mount Name:": "Nome da montagem:",
+  "Mount Options": "Opções de montagem",
+  "Mount Path": "Caminho de montagem",
+  "Mount Path:": "Caminho de montagem:",
+  "Mount Point": "Ponto de montagem",
+  "Mount Point ID": "ID do ponto de montagem",
+  "Mount Point Removal Summary:": "Resumo de remoção do ponto de montagem:",
+  "Mount Point:": "Ponto de montagem:",
+  "Mount Samba Share": "Monte Samba Compartilhar",
+  "Mount Samba Share on Host": "Monte o compartilhamento do Samba no host",
+  "Mount USB disk?": "Montar disco USB?",
+  "Mount a USB drive now": "Monte uma unidade USB agora",
+  "Mount all datasets": "Monte todos os conjuntos de dados",
+  "Mount already exists for this path in container": "A montagem já existe para este caminho no contêiner",
+  "Mount and persist with UUID:": "Monte e persista com UUID:",
+  "Mount failed": "Falha na montagem",
+  "Mount options:": "Opções de montagem:",
+  "Mount path must be an absolute path starting with /": "O caminho de montagem deve ser um caminho absoluto começando com /",
+  "Mount path:": "Caminho de montagem:",
+  "Mount point created": "Ponto de montagem criado",
+  "Mount point created.": "Ponto de montagem criado.",
+  "Mount point is visible but NOT writable from inside the container": "O ponto de montagem é visível, mas NÃO pode ser gravado de dentro do contêiner",
+  "Mount point is writable from inside the container": "O ponto de montagem pode ser gravado de dentro do contêiner",
+  "Mount point not visible inside the container yet": "Ponto de montagem ainda não visível dentro do contêiner",
+  "Mount point ready:": "Ponto de montagem pronto:",
+  "Mount point removed successfully": "Ponto de montagem removido com sucesso",
+  "Mount point:": "Ponto de montagem:",
+  "Mount shares on HOST first": "Monte compartilhamentos no HOST primeiro",
+  "Mount specific dataset": "Monte conjunto de dados específico",
+  "Mount status:": "Status da montagem:",
+  "Mount this device and use it as the backup destination?": "Montar este dispositivo e usá-lo como destino de backup?",
+  "Mount was busy — performed lazy unmount": "A montagem estava ocupada - executou a desmontagem preguiçosa",
+  "Mounted": "Montado",
+  "Mounted ISO on device": "ISO montado no dispositivo",
+  "Mounted at": "Montado em",
+  "Mounted external disk": "Disco externo montado",
+  "Mounted external disk  (offline-safe, single-machine dedup)": "Disco externo montado (desduplicação segura offline e de máquina única)",
+  "Mounted filesystem detected": "Sistema de arquivos montado detectado",
+  "Mounting CIFS share...": "Montando compartilhamento CIFS...",
+  "Mounting NFS share...": "Montando compartilhamento NFS...",
+  "Mounting container filesystem": "Montando sistema de arquivos contêiner",
+  "Mounting disk...": "Montando disco...",
+  "Mounting existing": "Montagem existente",
+  "Mounting here will hide existing files until unmounted.": "A montagem aqui ocultará os arquivos existentes até serem desmontados.",
+  "Move that copy offsite (USB, password manager, another host). Delete it from this path when done.": "Mova essa cópia para fora do local (USB, gerenciador de senhas, outro host).Exclua-o deste caminho quando terminar.",
+  "Move to target VM (remove from source VM config)": "Mover para a VM de destino (remover da configuração da VM de origem)",
+  "Multiple recovery groups found in PBS. Pick the one that originally created the keyfile:": "Vários grupos de recuperação encontrados no PBS. Escolha aquele que originalmente criou o arquivo-chave:",
+  "Multiple rootfs directories were found in this archive. Restore cannot continue automatically.": "Vários diretórios rootfs foram encontrados neste arquivo. A restauração não pode continuar automaticamente.",
+  "NAS Systems": "Sistemas NAS",
+  "NETWORK CONFIGURATION ANALYSIS": "ANÁLISE DE CONFIGURAÇÃO DE REDE",
+  "NFS Access Restricted": "Acesso NFS restrito",
+  "NFS Client Error": "Erro do cliente NFS",
+  "NFS Client Manager - CT": "Gerente de Cliente NFS - CT",
+  "NFS Client Status in CT": "Status do cliente NFS no CT",
+  "NFS Client Tools: AVAILABLE": "Ferramentas de cliente NFS: DISPONÍVEIS",
+  "NFS Client Tools: NOT AVAILABLE": "Ferramentas cliente NFS: NÃO DISPONÍVEIS",
+  "NFS Client in LXC (Privileged)": "Cliente NFS em LXC (privilegiado)",
+  "NFS Client in LXC (privileged)": "Cliente NFS em LXC (privilegiado)",
+  "NFS Client: INSTALLED": "Cliente NFS: INSTALADO",
+  "NFS Client: NOT INSTALLED": "Cliente NFS: NÃO INSTALADO",
+  "NFS Error": "Erro NFS",
+  "NFS Host Manager - Proxmox Host": "Gerenciador de host NFS - Host Proxmox",
+  "NFS LXC Manager - CT": "Gerenciador NFS LXC - CT",
+  "NFS Mounts on Host": "Montagens NFS no host",
+  "NFS Not Installed": "NFS não instalado",
+  "NFS Port Error": "Erro na porta NFS",
+  "NFS Proxmox storages (pvesm):": "Armazenamentos NFS Proxmox (pvesm):",
+  "NFS Server": "Servidor NFS",
+  "NFS Server Selection": "Seleção de servidor NFS",
+  "NFS Server in LXC (Privileged)": "Servidor NFS em LXC (privilegiado)",
+  "NFS Server in LXC (privileged)": "Servidor NFS em LXC (privilegiado)",
+  "NFS Server: INSTALLED": "Servidor NFS: INSTALADO",
+  "NFS Server: NOT INSTALLED": "Servidor NFS: NÃO INSTALADO",
+  "NFS Service Status in CT": "Status do serviço NFS em CT",
+  "NFS Service: RUNNING": "Serviço NFS: EM EXECUÇÃO",
+  "NFS Service: STOPPED": "Serviço NFS: PARADO",
+  "NFS Version Configuration:": "Configuração da versão NFS:",
+  "NFS Version:": "Versão NFS:",
+  "NFS Version: Auto-negotiation (NFSv3/NFSv4)": "Versão NFS: negociação automática (NFSv3/NFSv4)",
+  "NFS client installed successfully.": "Cliente NFS instalado com sucesso.",
+  "NFS client tools installed": "Ferramentas de cliente NFS instaladas",
+  "NFS directory permissions set — containers should now be able to write": "Conjunto de permissões de diretório NFS – os contêineres agora devem ser capazes de gravar",
+  "NFS export": "Exportação NFS",
+  "NFS export Selected": "Exportação NFS selecionada",
+  "NFS export created successfully!": "Exportação NFS criada com sucesso!",
+  "NFS export:": "Exportação NFS:",
+  "NFS is recommended for VM disk image storage.": "O NFS é recomendado para armazenamento de imagens de disco de VM.",
+  "NFS mounts in CT": "Montagens NFS em CT",
+  "NFS packages removed.": "Pacotes NFS removidos.",
+  "NFS port (2049) is not accessible on": "A porta NFS (2049) não está acessível em",
+  "NFS port 2049": "Porta NFS 2049",
+  "NFS server Selected": "Servidor NFS selecionado",
+  "NFS server installed successfully.": "Servidor NFS instalado com sucesso.",
+  "NFS server is already installed.": "O servidor NFS já está instalado.",
+  "NFS server is not installed in this CT.": "O servidor NFS não está instalado neste CT.",
+  "NFS server is running": "O servidor NFS está em execução",
+  "NFS server:": "Servidor NFS:",
+  "NFS servers detected": "Servidores NFS detectados",
+  "NFS service is enabled": "O serviço NFS está ativado",
+  "NFS services stopped and disabled.": "Os serviços NFS foram interrompidos e desativados.",
+  "NFS share mounted at:": "Compartilhamento NFS montado em:",
+  "NFS share mounted successfully!": "Compartilhamento NFS montado com sucesso!",
+  "NFS share unmount completed.": "Desmontagem do compartilhamento NFS concluída.",
+  "NFS storage added successfully!": "Armazenamento NFS adicionado com sucesso!",
+  "NFS storage adding in progress...": "Adição de armazenamento NFS em andamento...",
+  "NIC": "NIC",
+  "NIC changes detected — adjusted automatically": "alterações de NIC detectadas – ajustadas automaticamente",
+  "NICs:": "Placas de rede:",
+  "NOT FOUND": "NÃO ENCONTRADO",
+  "NOTE: The host directory and its contents will remain unchanged.": "NOTA: O diretório host e seu conteúdo permanecerão inalterados.",
+  "NVENC patch detected — list narrowed to versions supported by keylase/nvidia-patch.": "Patch NVENC detectado — lista reduzida às versões suportadas por keylase/nvidia-patch.",
+  "NVIDIA Actions": "Ações NVIDIA",
+  "NVIDIA CPU hiding already configured": "Ocultação de CPU NVIDIA já configurada",
+  "NVIDIA DKMS entries removed.": "Entradas NVIDIA DKMS removidas.",
+  "NVIDIA Driver Uninstall": "Desinstalação do driver NVIDIA",
+  "NVIDIA Driver Version": "Versão do driver NVIDIA",
+  "NVIDIA Drivers": "Controladores NVIDIA",
+  "NVIDIA Drivers Not Found": "Drivers NVIDIA não encontrados",
+  "NVIDIA GPU Driver Installation": "Instalação do driver da GPU NVIDIA",
+  "NVIDIA GPU passthrough configured.": "Passagem de GPU NVIDIA configurada.",
+  "NVIDIA KVM args configured (kvm=off, vendor_id spoof)": "Argumentos NVIDIA KVM configurados (kvm=off, vendor_id spoof)",
+  "NVIDIA KVM hiding (cpu hidden=1)": "Ocultação NVIDIA KVM (cpu oculta = 1)",
+  "NVIDIA KVM hiding already configured": "Ocultação NVIDIA KVM já configurada",
+  "NVIDIA Patch": "Atualização NVIDIA",
+  "NVIDIA driver": "Controlador NVIDIA",
+  "NVIDIA driver installed successfully.": "Driver NVIDIA instalado com sucesso.",
+  "NVIDIA driver installed:": "Driver NVIDIA instalado:",
+  "NVIDIA driver verification in container:": "Verificação do driver NVIDIA no contêiner:",
+  "NVIDIA drivers are not installed or not loaded on this host.": "Os drivers NVIDIA não estão instalados ou não carregados neste host.",
+  "NVIDIA host services already aligned for VFIO mode": "Serviços de host NVIDIA já alinhados para o modo VFIO",
+  "NVIDIA host services disabled for VFIO mode": "Serviços de host NVIDIA desativados para modo VFIO",
+  "NVIDIA host services/autoload already aligned for VFIO mode": "Serviços de host/autoload NVIDIA já alinhados para o modo VFIO",
+  "NVIDIA host services/autoload already aligned for native mode": "Serviços de host/autoload NVIDIA já alinhados para o modo nativo",
+  "NVIDIA host services/autoload disabled for VFIO mode": "Serviços de host/autoload NVIDIA desativados para modo VFIO",
+  "NVIDIA host services/autoload restored for native mode": "Serviços de host/autoload NVIDIA restaurados para modo nativo",
+  "NVIDIA install incomplete. Check log:": "Instalação da NVIDIA incompleta. Verifique o registro:",
+  "NVIDIA installer downloaded successfully": "Instalador NVIDIA baixado com sucesso",
+  "NVIDIA installer extracted.": "Instalador NVIDIA extraído.",
+  "NVIDIA installer not found at": "Instalador NVIDIA não encontrado em",
+  "NVIDIA installer reported an error. Check /tmp/nvidia_install.log": "O instalador da NVIDIA relatou um erro. Verifique /tmp/nvidia_install.log",
+  "NVIDIA installer returned error": "O instalador NVIDIA retornou erro",
+  "NVIDIA kernel modules unloaded successfully.": "Módulos do kernel NVIDIA descarregados com sucesso.",
+  "NVIDIA libs require approximately 1.5GB of free space.": "As bibliotecas NVIDIA requerem aproximadamente 1,5 GB de espaço livre.",
+  "NVIDIA patch applied - check README for supported versions.": "Patch NVIDIA aplicado - verifique o README para versões suportadas.",
+  "NVIDIA patch not applied.": "Patch NVIDIA não aplicado.",
+  "NVIDIA per-BDF VFIO binding configured": "Ligação NVIDIA per-BDF VFIO configurada",
+  "NVIDIA services stopped and disabled.": "Os serviços NVIDIA foram interrompidos e desativados.",
+  "NVIDIA udev rules and persistence service installed.": "Regras NVIDIA udev e serviço de persistência instalados.",
+  "NVIDIA uninstallation steps completed.": "Etapas de desinstalação da NVIDIA concluídas.",
+  "NVIDIA uninstaller completed.": "Desinstalador da NVIDIA concluído.",
+  "NVIDIA update failed for LXC": "A atualização da NVIDIA falhou para LXC",
+  "NVIDIA userspace libraries installed.": "Bibliotecas de espaço de usuário NVIDIA instaladas.",
+  "NVMe Disk Detected": "Disco NVMe detectado",
+  "NVMe health status: PASSED": "Status de integridade do NVMe: APROVADO",
+  "NVMe health status: WARNING (critical_warning =": "Status de integridade do NVMe: AVISO (critical_warning =",
+  "NVMe skipped (to add as PCIe use 'Add Controller or NVMe PCIe to VM'):": "NVMe ignorado (para adicionar como PCIe, use 'Adicionar controlador ou NVMe PCIe à VM'):",
+  "NVMe-specific SMART log": "Registro SMART específico do NVMe",
+  "Name for this target:": "Nome para este alvo:",
+  "Name:": "Nome:",
+  "Neither /etc/kernel/cmdline nor /etc/default/grub found.": "Nem /etc/kernel/cmdline nem /etc/default/grub foram encontrados.",
+  "Nesting feature enabled": "Recurso de aninhamento ativado",
+  "NetBIOS Service: RUNNING": "Serviço NetBIOS: EM EXECUÇÃO",
+  "NetBIOS Service: STOPPED": "Serviço NetBIOS: PARADO",
+  "NetBIOS port 139:": "Porta NetBIOS 139:",
+  "Network": "Rede",
+  "Network  :": "Rede  :",
+  "Network (interfaces, DNS)": "Rede (interfaces, DNS)",
+  "Network Bridge": "Ponte de rede",
+  "Network Commands": "Comandos de rede",
+  "Network Configuration": "Configuração de rede",
+  "Network Configuration Analysis": "Análise de configuração de rede",
+  "Network Configuration File": "Arquivo de configuração de rede",
+  "Network Diagnostics": "Diagnóstico de rede",
+  "Network Error": "Erro de rede",
+  "Network Interface Setup": "Configuração da interface de rede",
+  "Network Interfaces": "Interfaces de rede",
+  "Network Management": "Gerenciamento de rede",
+  "Network Management - SAFE MODE": "Gerenciamento de Rede - MODO SEGURO",
+  "Network Restart": "Reinicialização da rede",
+  "Network Restart Failed": "Falha ao reiniciar a rede",
+  "Network Restarted": "Rede reiniciada",
+  "Network Tools": "Ferramentas de rede",
+  "Network access:": "Acesso à rede:",
+  "Network configuration backed up": "Configuração de rede com backup",
+  "Network configuration has been restored from backup.": "A configuração de rede foi restaurada do backup.",
+  "Network connection failed to": "Falha na conexão de rede",
+  "Network connectivity": "Conectividade de rede",
+  "Network connectivity to": "Conectividade de rede para",
+  "Network interfaces added:": "Interfaces de rede adicionadas:",
+  "Network monitoring tool (iptraf-ng)": "ferramenta de monitoramento de rede (iptraf-ng)",
+  "Network optimization completed": "Otimização de rede concluída",
+  "Network optimizations removed": "Otimizações de rede removidas",
+  "Network service restarted successfully": "Serviço de rede reiniciado com sucesso",
+  "Network service restarted successfully.": "Serviço de rede reiniciado com sucesso.",
+  "Network share mounting (NFS/Samba) requires a PRIVILEGED container.": "A montagem de compartilhamento de rede (NFS/Samba) requer um contêiner PRIVILEGADO.",
+  "Network throughput test (client/server)": "Teste de rendimento de rede (cliente/servidor)",
+  "NetworkManager Detected": "NetworkManager detectado",
+  "NetworkManager has been removed successfully": "NetworkManager foi removido com sucesso",
+  "NetworkManager is running (may cause conflicts)": "NetworkManager está em execução (pode causar conflitos)",
+  "NetworkManager is running, which may conflict with Proxmox.": "O NetworkManager está em execução, o que pode entrar em conflito com o Proxmox.",
+  "NetworkManager not running": "NetworkManager não está em execução",
+  "New Folder in /mnt": "Nova pasta em /mnt",
+  "New Group": "Novo grupo",
+  "New Search": "Nova pesquisa",
+  "New VM:": "Nova VM:",
+  "New Virtual Machine": "Nova máquina virtual",
+  "New backup job": "Nova tarefa de backup",
+  "New backups on this host will be unencrypted until a new keyfile is set up.": "Novos backups neste host serão descriptografados até que um novo arquivo-chave seja configurado.",
+  "New mount options to apply:": "Novas opções de montagem para aplicar:",
+  "New scheduled job (own timer + retention)": "Novo trabalho agendado (cronômetro próprio + retenção)",
+  "New version available": "Nova versão disponível",
+  "New version:": "Nova versão:",
+  "Next Step Required": "Próxima etapa obrigatória",
+  "Next Steps:": "Próximas etapas:",
+  "Next step: stop that VM first, then run": "Próxima etapa: pare a VM primeiro e depois execute",
+  "No": "Não",
+  "No .link files found in": "Nenhum arquivo .link encontrado em",
+  "No .ova or .ovf files found in:": "Nenhum arquivo .ova ou .ovf encontrado em:",
+  "No .ovf descriptor found inside OVA.": "Nenhum descritor .ovf encontrado dentro do OVA.",
+  "No .pxar archives were found in this backup:": "Nenhum arquivo .pxar foi encontrado neste backup:",
+  "No AMD CPU detected. Skipping AMD fixes.": "Nenhuma CPU AMD detectada. Ignorando as correções da AMD.",
+  "No AMD GPU detected on this system.": "Nenhuma GPU AMD detectada neste sistema.",
+  "No Available Exports": "Nenhuma exportação disponível",
+  "No Available Shares": "Não há compartilhamentos disponíveis",
+  "No Backups": "Sem backups",
+  "No CIFS Proxmox storage and no CIFS fstab mount found on this host.": "Nenhum armazenamento CIFS Proxmox e nenhuma montagem CIFS fstab encontrada neste host.",
+  "No CIFS Proxmox storage configured.": "Nenhum armazenamento CIFS Proxmox configurado.",
+  "No CIFS Proxmox storages configured.": "Nenhum armazenamento CIFS Proxmox configurado.",
+  "No CIFS mounts active.": "Nenhuma montagem CIFS ativa.",
+  "No CT was selected.": "Nenhum CT foi selecionado.",
+  "No CTs available in the system.": "Não há CTs disponíveis no sistema.",
+  "No Changes Needed": "Nenhuma alteração necessária",
+  "No Cleanup Needed": "Nenhuma limpeza necessária",
+  "No Controller/NVMe selected for now.": "Nenhum controlador/NVMe selecionado no momento.",
+  "No Coral Detected": "Nenhum coral detectado",
+  "No Coral TPU device was found on this host (neither PCIe/M.2 nor USB).": "Nenhum dispositivo Coral TPU foi encontrado neste host (nem PCIe/M.2 nem USB).",
+  "No Custom Logos Found": "Nenhum logotipo personalizado encontrado",
+  "No Disk Images Found": "Nenhuma imagem de disco encontrada",
+  "No Disk Storage": "Sem armazenamento em disco",
+  "No Disks Available": "Nenhum disco disponível",
+  "No Disks Found": "Nenhum disco encontrado",
+  "No Exports": "Sem exportações",
+  "No Exports Found": "Nenhuma exportação encontrada",
+  "No Folders": "Sem pastas",
+  "No GPU Detected": "Nenhuma GPU detectada",
+  "No GPU selected.": "Nenhuma GPU selecionada.",
+  "No GPU selected. Please select at least one GPU to continue.": "Nenhuma GPU selecionada. Selecione pelo menos uma GPU para continuar.",
+  "No GPUs detected on this host.": "Nenhuma GPU detectada neste host.",
+  "No Guest Shares": "Sem compartilhamentos de convidados",
+  "No IP": "Sem IP",
+  "No IP assigned": "Nenhum IP atribuído",
+  "No ISO file detected after UUP Dump process.": "Nenhum arquivo ISO detectado após o processo UUP Dump.",
+  "No ISO images found in Proxmox ISO storages.": "Nenhuma imagem ISO encontrada nos armazenamentos ISO do Proxmox.",
+  "No ISO selected.": "Nenhum ISO selecionado.",
+  "No ISO was generated.": "Nenhum ISO foi gerado.",
+  "No Images Found": "Nenhuma imagem encontrada",
+  "No Intel GPU detected on this system.": "Nenhuma GPU Intel detectada neste sistema.",
+  "No LXC containers available": "Nenhum contêiner LXC disponível",
+  "No LXC containers found": "Nenhum contêiner LXC encontrado",
+  "No LXC containers found on this system.": "Nenhum contêiner LXC encontrado neste sistema.",
+  "No MAC": "Sem MAC",
+  "No Method Selected": "Nenhum método selecionado",
+  "No Mounts": "Sem montagens",
+  "No NFS Proxmox storage and no NFS fstab mount found on this host.": "Nenhum armazenamento NFS Proxmox e nenhuma montagem NFS fstab encontrada neste host.",
+  "No NFS Proxmox storage configured.": "Nenhum armazenamento NFS Proxmox configurado.",
+  "No NFS Proxmox storages configured.": "Nenhum armazenamento NFS Proxmox configurado.",
+  "No NFS mounts active.": "Nenhuma montagem NFS ativa.",
+  "No NFS mounts found.": "Nenhuma montagem NFS encontrada.",
+  "No NFS ports found": "Nenhuma porta NFS encontrada",
+  "No NFS servers configured to test.": "Nenhum servidor NFS configurado para teste.",
+  "No NFS servers found on the network.": "Nenhum servidor NFS encontrado na rede.",
+  "No NFS shares currently mounted.": "Nenhum compartilhamento NFS montado atualmente.",
+  "No NVIDIA GPU detected on this system.": "Nenhuma GPU NVIDIA detectada neste sistema.",
+  "No NVIDIA GPU has been detected on this system. The installer will now exit.": "Nenhuma GPU NVIDIA foi detectada neste sistema. O instalador será encerrado agora.",
+  "No NVIDIA driver installed.": "Nenhum driver NVIDIA instalado.",
+  "No PBS keyfile is installed on this host and no automatic recovery was possible.": "Nenhum arquivo-chave PBS está instalado neste host e nenhuma recuperação automática foi possível.",
+  "No PVE vzdump job uses a": "Nenhum trabalho PVE vzdump usa um",
+  "No PVs with old headers found.": "Nenhum PV com cabeçalhos antigos encontrados.",
+  "No ProxMenux ZFS autotrim state file found.": "Nenhum arquivo de estado de ajuste automático do ProxMenux ZFS foi encontrado.",
+  "No ProxMenux host-backup archives were found in:": "Nenhum arquivo de backup de host ProxMenux foi encontrado em:",
+  "No Recent Servers": "Nenhum servidor recente",
+  "No Samba mounts found.": "Nenhuma montagem do Samba encontrada.",
+  "No Samba ports found": "Nenhuma porta Samba encontrada",
+  "No Samba servers configured to test.": "Nenhum servidor Samba configurado para teste.",
+  "No Samba servers found on the network.": "Nenhum servidor Samba encontrado na rede.",
+  "No Samba shares currently mounted.": "Nenhum compartilhamento Samba montado atualmente.",
+  "No Samba users found": "Nenhum usuário do Samba encontrado",
+  "No Selection": "Sem seleção",
+  "No Servers Found": "Nenhum servidor encontrado",
+  "No Shares": "Sem compartilhamentos",
+  "No Shares Available": "Nenhum compartilhamento disponível",
+  "No Shares Found": "Nenhum compartilhamento encontrado",
+  "No Storage Found": "Nenhum armazenamento encontrado",
+  "No USB drives detected. Enter the mountpoint path manually:": "Nenhuma unidade USB detectada. Insira o caminho do ponto de montagem manualmente:",
+  "No USB drives mounted by ProxMenux yet. Mount one first to use it as a target.": "Ainda não há unidades USB montadas pelo ProxMenux.Monte um primeiro para usá-lo como alvo.",
+  "No UUP folder found.": "Nenhuma pasta UUP encontrada.",
+  "No VM was selected.": "Nenhuma VM foi selecionada.",
+  "No VMID defined. Cannot apply guest agent config.": "Nenhum VMID definido. Não é possível aplicar a configuração do agente convidado.",
+  "No VMs Found": "Nenhuma VM encontrada",
+  "No VMs available in the system.": "Nenhuma VM disponível no sistema.",
+  "No VMs available on this host.": "Nenhuma VM disponível neste host.",
+  "No VMs found": "Nenhuma VM encontrada",
+  "No Valid Servers": "Nenhum servidor válido",
+  "No VirtIO ISO found. Please download one.": "Nenhum ISO do VirtIO encontrado. Por favor baixe um.",
+  "No VirtIO ISO selected. Please choose again.": "Nenhum VirtIO ISO selecionado. Por favor, escolha novamente.",
+  "No Virtual Machines found on this system.": "Nenhuma máquina virtual encontrada neste sistema.",
+  "No ZFS pools detected. Skipping ZFS autotrim.": "Nenhum pool ZFS detectado. Ignorando o ajuste automático do ZFS.",
+  "No accessible": "Não acessível",
+  "No accessible NFS servers found.": "Nenhum servidor NFS acessível encontrado.",
+  "No accessible Samba servers found.": "Nenhum servidor Samba acessível encontrado.",
+  "No accessible exports found.": "Nenhuma exportação acessível encontrada.",
+  "No accessible shares found.": "Nenhum compartilhamento acessível encontrado.",
+  "No active exports or showmount not available": "Nenhuma exportação ativa ou showmount não disponível",
+  "No active session": "Nenhuma sessão ativa",
+  "No additional GPU can be added.": "Nenhuma GPU adicional pode ser adicionada.",
+  "No additional device needs to be added.": "Nenhum dispositivo adicional precisa ser adicionado.",
+  "No archives": "Sem arquivos",
+  "No archives found in this Borg repository.": "Nenhum arquivo encontrado neste repositório Borg.",
+  "No available Controllers/NVMe devices were found.": "Nenhum controlador/dispositivo NVMe disponível foi encontrado.",
+  "No available disks found.": "Nenhum disco disponível encontrado.",
+  "No backup found, logrotate configuration not changed": "Nenhum backup encontrado, configuração do logrotate não alterada",
+  "No backups": "sem backups",
+  "No backups found": "Nenhum backup encontrado",
+  "No bridge configuration issues found": "Nenhum problema de configuração de ponte encontrado",
+  "No bridges found in system": "Nenhuma ponte encontrada no sistema",
+  "No changes are required for": "Não são necessárias alterações para",
+  "No changes are required.": "Nenhuma alteração é necessária.",
+  "No changes have been made to your system": "Nenhuma alteração foi feita em seu sistema",
+  "No changes will be made to the running system.": "Nenhuma alteração será feita no sistema em execução.",
+  "No compatible GPU detected for VM passthrough. Skipping GPU wizard option.": "Nenhuma GPU compatível detectada para passagem de VM. Ignorando a opção do assistente de GPU.",
+  "No compatible GPU was detected on this host.": "Nenhuma GPU compatível foi detectada neste host.",
+  "No compatible GPUs detected on this host.": "Nenhuma GPU compatível detectada neste host.",
+  "No compatible GPUs were detected on this host.": "Nenhuma GPU compatível foi detectada neste host.",
+  "No compatible PVE jobs": "Nenhum trabalho PVE compatível",
+  "No compatible disk images found in:": "Nenhuma imagem de disco compatível encontrada em:",
+  "No compatible versions found for your kernel": "Nenhuma versão compatível encontrada para o seu kernel",
+  "No configuration issues found": "Nenhum problema de configuração encontrado",
+  "No container runtime available.": "Nenhum tempo de execução do contêiner disponível.",
+  "No container selected. Exiting.": "Nenhum contêiner selecionado. Saindo.",
+  "No controller/NVMe selected.": "Nenhum controlador/NVMe selecionado.",
+  "No controllers remaining after conflict resolution.": "Nenhum controlador restante após a resolução do conflito.",
+  "No custom key (rely on default SSH config)": "Nenhuma chave personalizada (depende da configuração SSH padrão)",
+  "No custom logos were found in /usr/local/share/fastfetch/logos/.\n\nPlease add a logo and try again.": "Nenhum logotipo personalizado foi encontrado em /usr/local/share/fastfetch/logos/.\n\nAdicione um logotipo e tente novamente.",
+  "No desktop UI backup found, will reinstall packages": "Nenhum backup da UI do desktop encontrado, os pacotes serão reinstalados",
+  "No directories found in": "Nenhum diretório encontrado em",
+  "No disk images found in /var/lib/vz/images/. Please add an image first.": "Nenhuma imagem de disco encontrada em /var/lib/vz/images/. Adicione uma imagem primeiro.",
+  "No disks available for this CT.": "Não há discos disponíveis para este CT.",
+  "No disks available for this VM.": "Nenhum disco disponível para esta VM.",
+  "No disks were added.": "Nenhum disco foi adicionado.",
+  "No disks were configured for processing.": "Nenhum disco foi configurado para processamento.",
+  "No disks were selected.": "Nenhum disco foi selecionado.",
+  "No duplicate IP addresses": "Nenhum endereço IP duplicado",
+  "No duplicate repositories found": "Nenhum repositório duplicado encontrado",
+  "No eligible Controller/NVMe devices remain after SR-IOV filtering. Skipping.": "Nenhum dispositivo Controlador/NVMe qualificado permanece após a filtragem SR-IOV. Pulando.",
+  "No eligible controllers remain after SR-IOV filtering.": "Nenhum controlador elegível permanece após a filtragem SR-IOV.",
+  "No encryption key is stored on this host. Choose how to set one up:": "Nenhuma chave de criptografia é armazenada neste host.Escolha como configurar um:",
+  "No exportable VM disks were found (CD-ROM/cloud-init are excluded).": "Nenhum disco VM exportável foi encontrado (CD-ROM/cloud-init foram excluídos).",
+  "No exportable disks": "Nenhum disco exportável",
+  "No exports configured.": "Nenhuma exportação configurada.",
+  "No exports file found.": "Nenhum arquivo de exportação encontrado.",
+  "No exports found in /etc/exports.": "Nenhuma exportação encontrada em /etc/exports.",
+  "No exports found on server": "Nenhuma exportação encontrada no servidor",
+  "No files found": "Nenhum arquivo encontrado",
+  "No folders found in /mnt.": "Nenhuma pasta encontrada em /mnt.",
+  "No folders found in /mnt. Please create a new folder.": "Nenhuma pasta encontrada em /mnt. Por favor, crie uma nova pasta.",
+  "No folders found inside /mnt in the CT.": "Nenhuma pasta encontrada dentro de /mnt no CT.",
+  "No format-safe disks are available.": "Nenhum disco de formato seguro está disponível.",
+  "No group creation required — uses world-writable sticky bit permissions.": "Não é necessária a criação de grupos — usa permissões de sticky bit graváveis ​​mundialmente.",
+  "No host VFIO reconfiguration expected": "Nenhuma reconfiguração VFIO do host é esperada",
+  "No host VFIO/native binding changes were required.": "Nenhuma alteração de ligação VFIO/nativa do host foi necessária.",
+  "No host backups were found in this PBS repository:": "Nenhum backup de host foi encontrado neste repositório PBS:",
+  "No host reboot expected": "Nenhuma reinicialização do host é esperada",
+  "No host write access — server-side ACL or root_squash. Continuing anyway.": "Sem acesso de gravação no host — ACL do lado do servidor ou root_squash. Continuando de qualquer maneira.",
+  "No host write access — server-side ACL. Continuing anyway.": "Sem acesso de gravação no host — ACL do lado do servidor. Continuando de qualquer maneira.",
+  "No iSCSI Storage": "Sem armazenamento iSCSI",
+  "No iSCSI storage configured in Proxmox.": "Nenhum armazenamento iSCSI configurado no Proxmox.",
+  "No iSCSI storage configured.": "Nenhum armazenamento iSCSI configurado.",
+  "No iSCSI storage found in Proxmox.": "Nenhum armazenamento iSCSI encontrado no Proxmox.",
+  "No iSCSI targets found on portal": "Nenhum destino iSCSI encontrado no portal",
+  "No import disks selected for now.": "Nenhum disco de importação selecionado no momento.",
+  "No importable disks available. System disks and protected disks are hidden.": "Nenhum disco importável disponível. Os discos do sistema e os discos protegidos ficam ocultos.",
+  "No installation information available.": "Nenhuma informação de instalação disponível.",
+  "No interface type was selected for the disks.": "Nenhum tipo de interface foi selecionado para os discos.",
+  "No jobs": "Sem empregos",
+  "No language selected.": "Nenhum idioma selecionado.",
+  "No local disk storage configured.": "Nenhum armazenamento em disco local configurado.",
+  "No main sources.list present (skipped)": "Nenhuma fonte principal.list presente (ignorada)",
+  "No mount point was specified.": "Nenhum ponto de montagem foi especificado.",
+  "No mount points found in any container": "Nenhum ponto de montagem encontrado em nenhum contêiner",
+  "No mount points found in container": "Nenhum ponto de montagem encontrado no contêiner",
+  "No network configuration backups found.": "Nenhum backup de configuração de rede encontrado.",
+  "No network interfaces configured (besides loopback)": "Nenhuma interface de rede configurada (além de loopback)",
+  "No new Controller/NVMe entries were added.": "Nenhuma nova entrada de Controlador/NVMe foi adicionada.",
+  "No optimizations detected to uninstall.": "Nenhuma otimização detectada para desinstalar.",
+  "No partitions found on disk. Nothing was wiped.": "Nenhuma partição encontrada no disco. Nada foi apagado.",
+  "No password provided.": "Nenhuma senha fornecida.",
+  "No paths available": "Nenhum caminho disponível",
+  "No paths selected. Select at least one path.": "Nenhum caminho selecionado. Selecione pelo menos um caminho.",
+  "No pending paths to schedule for reboot.": "Não há caminhos pendentes para agendar a reinicialização.",
+  "No permanent NFS mounts configured.": "Nenhuma montagem NFS permanente configurada.",
+  "No permanent Samba mounts configured.": "Nenhuma montagem permanente do Samba configurada.",
+  "No persistent path found for": "Nenhum caminho persistente encontrado para",
+  "No physical disks detected for SMART testing.": "Nenhum disco físico detectado para testes SMART.",
+  "No physical interfaces found": "Nenhuma interface física encontrada",
+  "No ports configured": "Nenhuma porta configurada",
+  "No privileged containers available in Proxmox.": "Nenhum contêiner privilegiado disponível no Proxmox.",
+  "No pve-enterprise.list present (skipped)": "Nenhum pve-enterprise.list presente (ignorado)",
+  "No recent": "Nenhum recente",
+  "No recent Samba servers found.": "Nenhum servidor Samba recente encontrado.",
+  "No routing information found.": "Nenhuma informação de roteamento encontrada.",
+  "No scheduled backup jobs configured.": "Nenhuma tarefa de backup agendada configurada.",
+  "No scheduled backup jobs found.": "Nenhum trabalho de backup agendado foi encontrado.",
+  "No scripts found for:": "Nenhum script encontrado para:",
+  "No self-test history found for": "Nenhum histórico de autoteste encontrado para",
+  "No self-test log available for": "Nenhum registro de autoteste disponível para",
+  "No server IP or hostname provided.": "Nenhum IP do servidor ou nome de host fornecido.",
+  "No shared mount detected. Applying standard local access.": "Nenhuma montagem compartilhada detectada. Aplicando acesso local padrão.",
+  "No shares configured.": "Nenhum compartilhamento configurado.",
+  "No shares found in smb.conf.": "Nenhum compartilhamento encontrado em smb.conf.",
+  "No shares found on server": "Nenhum compartilhamento encontrado no servidor",
+  "No smb.conf file found.": "Nenhum arquivo smb.conf encontrado.",
+  "No specific LXC action selected": "Nenhuma ação específica do LXC selecionada",
+  "No specific VM action selected": "Nenhuma ação específica da VM selecionada",
+  "No storage": "Sem armazenamento",
+  "No storage volumes available for VM images.": "Nenhum volume de armazenamento disponível para imagens de VM.",
+  "No storage volumes available for disk images.": "Nenhum volume de armazenamento disponível para imagens de disco.",
+  "No stored credentials found.": "Nenhuma credencial armazenada encontrada.",
+  "No suitable disks found.": "Nenhum disco adequado encontrado.",
+  "No sysfs ROM entry — trying ACPI VFCT table...": "Nenhuma entrada ROM sysfs - tentando tabela ACPI VFCT...",
+  "No target configured.": "Nenhum destino configurado.",
+  "No test currently running": "Nenhum teste em execução no momento",
+  "No uninstaller found for:": "Nenhum desinstalador encontrado para:",
+  "No unprivileged containers available in Proxmox.": "Nenhum contêiner sem privilégios disponível no Proxmox.",
+  "No updates available — run a scan first or wait for the Monitor to refresh.": "Nenhuma atualização disponível – execute uma verificação primeiro ou aguarde a atualização do monitor.",
+  "No updates or failed to fetch templates": "Nenhuma atualização ou falha ao buscar modelos",
+  "No user groups found.": "Nenhum grupo de usuários encontrado.",
+  "No user-created disk storage or fstab mount found.": "Nenhum armazenamento em disco criado pelo usuário ou montagem fstab encontrado.",
+  "No username provided.": "Nenhum nome de usuário fornecido.",
+  "No utilities selected": "Nenhum utilitário selecionado",
+  "No utilities were selected": "Nenhum utilitário foi selecionado",
+  "No valid containers found": "Nenhum contêiner válido encontrado",
+  "No valid mount points found": "Nenhum ponto de montagem válido encontrado",
+  "No version in this branch is currently supported by keylase/nvidia-patch — the NVENC patch will not reapply after reinstall.": "Nenhuma versão nesta ramificação é atualmente suportada por keylase/nvidia-patch — o patch NVENC não será reaplicado após a reinstalação.",
+  "No virtual machines were found on this host.": "Nenhuma máquina virtual foi encontrada neste host.",
+  "No write permissions on:": "Sem permissões de gravação em:",
+  "No, keep local only": "Não, mantenha apenas local",
+  "No-subscription repository present": "Repositório sem assinatura presente",
+  "No: the key stays only at": "Não: a chave fica apenas em",
+  "Non-Debian container detected": "Contêiner não-Debian detectado",
+  "Non-free firmware warnings disabled": "Avisos de firmware não-livre desativados",
+  "None": "Nenhum",
+  "Normalizing stable monitor service...": "Normalizando serviço de monitor estável...",
+  "Not Mounted": "Não montado",
+  "Not all platforms support Controller/NVMe passthrough reliably.": "Nem todas as plataformas oferecem suporte à passagem de controlador/NVMe de maneira confiável.",
+  "Not an OVH server, skipping RTM installation": "Não é um servidor OVH, ignorando a instalação do RTM",
+  "Not currently mounted": "Atualmente não montado",
+  "Not currently mounted — skipping umount.": "Atualmente não montado – ignorando umount.",
+  "Not found": "Não encontrado",
+  "Not imported:": "Não importado:",
+  "Not mounted": "Não montado",
+  "Not portable:": "Não portátil:",
+  "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "Não registrado como armazenamento Proxmox - use 'LXC Mount Manager' para vincular a montagem",
+  "Note: A system reboot will be required after enabling IOMMU.": "Nota: Será necessária uma reinicialização do sistema após ativar o IOMMU.",
+  "Note: this only works if the NFS server does NOT use 'all_squash' for root.": "Nota: isso só funciona se o servidor NFS NÃO usar 'all_squash' para root.",
+  "Notes": "Notas",
+  "Nothing inside the container is modified": "Nada dentro do contêiner é modificado",
+  "Nothing selectable": "Nada selecionável",
+  "Nothing selected": "Nada selecionado",
+  "Nothing to apply — none of the selected updates have a runnable function on disk.": "Nada a aplicar – nenhuma das atualizações selecionadas possui uma função executável no disco.",
+  "Nothing to remove": "Nada para remover",
+  "Nothing to restore": "Nada para restaurar",
+  "Nothing to schedule for reboot from selected paths.": "Nada para agendar a reinicialização dos caminhos selecionados.",
+  "Nouveau module is loaded, attempting to unload...": "O módulo Nouveau está carregado, tentando descarregar...",
+  "Number of CPU cores (default: 2)": "Número de núcleos de CPU (padrão: 2)",
+  "OCI containers require Proxmox VE 9.1 or later.": "Os contêineres OCI requerem Proxmox VE 9.1 ou posterior.",
+  "OK": "OK",
+  "OR add new PVE 9 no-subscription repository:": "OU adicione novo repositório PVE 9 sem assinatura:",
+  "OS hint:": "Dica do sistema operacional:",
+  "OS release details": "Detalhes da versão do sistema operacional",
+  "OS type  :": "Tipo de sistema operacional:",
+  "OS type:": "Tipo de sistema operacional:",
+  "OS:": "SO:",
+  "OVA (single portable file)": "OVA (arquivo portátil único)",
+  "OVF (descriptor + VMDK files)": "OVF (descritor + arquivos VMDK)",
+  "OVF parsed:": "OVF analisado:",
+  "OVH RTM installed successfully": "OVH RTM instalado com sucesso",
+  "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM removido (artefatos de marionetes podem precisar de limpeza manual)",
+  "OVH server detected": "Servidor OVH detectado",
+  "OVH server detection and RTM installation process completed": "Processo de detecção do servidor OVH e instalação RTM concluído",
+  "Offer as exit node?": "Oferecer como nó de saída?",
+  "Official Linux Distributions": "Distribuições oficiais do Linux",
+  "Old debian.sources file removed to prevent duplication": "Arquivo debian.sources antigo removido para evitar duplicação",
+  "Old memory configuration detected. Replacing with balanced optimization...": "Configuração de memória antiga detectada. Substituindo por otimização balanceada...",
+  "Old time services removed successfully": "Serviços antigos removidos com sucesso",
+  "On a privileged CT the mount options carry the only permissions.": "Em um CT privilegiado, as opções de montagem possuem as únicas permissões.",
+  "On some systems, when starting the VM the host may slow down for several minutes until it stabilizes, or freeze completely.": "Em alguns sistemas, ao iniciar a VM, o host pode ficar lento por vários minutos até se estabilizar ou congelar completamente.",
+  "On the Borg server, append the following line to:": "No servidor Borg, anexe a seguinte linha a:",
+  "Once finished, re-run 'PVE 8 to 9 check' to verify that all issues are resolved \n    before executing the PVE 8 → PVE 9 upgrade.": "Quando terminar, execute novamente a 'verificação PVE 8 a 9' para verificar se todos os problemas foram resolvidos \n    antes de executar a atualização PVE 8 → PVE 9.",
+  "Once finished, re-run the script 'PVE 8 to 9 check' to verify that all issues are resolved \n   before rebooting.": "Quando terminar, execute novamente o script 'PVE 8 to 9 check' para verificar se todos os problemas foram resolvidos \n   antes de reiniciar.",
+  "Once finished, re-run the script 'PVE 8 to 9 check' to verify that all issues.": "Quando terminar, execute novamente o script 'PVE 8 to 9 check' para verificar todos os problemas.",
+  "Once installed, open the VirtIO ISO and run the installer to complete driver setup.": "Depois de instalado, abra o VirtIO ISO e execute o instalador para concluir a configuração do driver.",
+  "One or more NVIDIA GPUs are currently configured for VM passthrough (vfio-pci):": "Uma ou mais GPUs NVIDIA estão atualmente configuradas para passagem de VM (vfio-pci):",
+  "Only convert to privileged if absolutely necessary for your use case.": "Converta para privilegiado apenas se for absolutamente necessário para o seu caso de uso.",
+  "Only fully free disks are shown (not system-used and not referenced by VM/LXC).": "Somente discos totalmente livres são mostrados (não usados ​​pelo sistema e não referenciados pelo VM/LXC).",
+  "Only if using enterprise subscription": "Somente se estiver usando assinatura corporativa",
+  "Only if using no-subscription repository": "Somente se estiver usando repositório sem assinatura",
+  "Only needed if you mounted the filesystem in step 6b": "Necessário apenas se você montou o sistema de arquivos na etapa 6b",
+  "Only removes storage definition, not remote data.": "Remove apenas a definição de armazenamento, não os dados remotos.",
+  "Only run this if you used LVM (step 6b):": "Execute isso apenas se você usou LVM (etapa 6b):",
+  "Only the host backup hook is removed — PVE vzdump jobs targeting this storage stay intact.": "apenas o gancho de backup do host é removido – as tarefas PVE vzdump direcionadas a esse armazenamento permanecem intactas.",
+  "Open": "Abrir",
+  "Open rwx + default inheritance for new files": "Abra rwx + herança padrão para novos arquivos",
+  "Open the VM console and wait for the installer to boot": "Abra o console da VM e espere o instalador inicializar",
+  "Open the VM console and wait for the loader to boot": "Abra o console da VM e espere o carregador inicializar",
+  "Open the dashboard from this host on port 8008 to create a new admin account.": "Abra o painel deste host na porta 8008 para criar uma nova conta de administrador.",
+  "Open the dashboard to create a new admin account:": "Abra o painel para criar uma nova conta de administrador:",
+  "OpenVSwitch installation could not be verified": "A instalação do OpenVSwitch não pôde ser verificada",
+  "OpenVSwitch installed successfully": "OpenVSwitch instalado com sucesso",
+  "OpenVSwitch is ready to use": "OpenVSwitch está pronto para uso",
+  "OpenVSwitch removed": "OpenVSwitch removido",
+  "Operation": "Operação",
+  "Operation cancelled by user": "Operação cancelada pelo usuário",
+  "Operation cancelled by user to create backup.": "Operação cancelada pelo usuário para criar backup.",
+  "Operation cancelled by user.": "Operação cancelada pelo usuário.",
+  "Operation cancelled. Cannot continue with an unprivileged container.": "Operação cancelada. Não é possível continuar com um contêiner sem privilégios.",
+  "Operation log": "Registro de operação",
+  "Operator config re-applied via kernel-agnostic merge": "configuração do operador reaplicada por meio de mesclagem independente de kernel",
+  "Operator config that WILL be re-applied via kernel-agnostic merge": "configuração do operador que SERÁ reaplicada por meio de mesclagem independente de kernel",
+  "Optimizations detected and ready to revert.": "Otimizações detectadas e prontas para serem revertidas.",
+  "Optimize": "Otimizar",
+  "Optimize Memory": "Otimizar Memória",
+  "Optimize ZFS ARC size": "otimizar o tamanho do ZFS ARC",
+  "Optimize journald": "Otimizar diário",
+  "Optimize logrotate": "Otimizar logrotate",
+  "Optimizing ZFS ARC size according to available memory...": "Otimizando o tamanho do ZFS ARC de acordo com a memória disponível...",
+  "Optimizing logrotate configuration...": "Otimizando a configuração do logrotate...",
+  "Optimizing memory settings...": "Otimizando configurações de memória...",
+  "Optimizing network settings...": "Otimizando configurações de rede...",
+  "Optimizing vzdump backup speed...": "Otimizando a velocidade de backup do vzdump...",
+  "Optional": "Opcional",
+  "Optional GPU Passthrough": "Passagem de GPU opcional",
+  "Optional safety helper if you ever need to re-apply manually:": "Auxiliar de segurança opcional se você precisar se inscrever novamente manualmente:",
+  "Optional: Modernize repository sources:": "Opcional: Modernize as fontes do repositório:",
+  "Optional: apply default ACL so new files inherit permissions:": "Opcional: aplique a ACL padrão para que novos arquivos herdem permissões:",
+  "Optional: register this path as Proxmox dir storage:": "Opcional: registre este caminho como armazenamento dir Proxmox:",
+  "Optionally remove": "Opcionalmente, remova",
+  "Optionally update NVIDIA libs in LXC containers with passthrough": "Opcionalmente, atualize bibliotecas NVIDIA em contêineres LXC com passagem",
+  "Options:": "Opções:",
+  "Or press CTRL + D": "Ou pressione CTRL + D",
+  "Or re-run this script and accept the 'apply host permissions' prompt.": "Ou execute novamente este script e aceite o prompt 'aplicar permissões de host'.",
+  "Or use ProxMenux update function": "Ou use a função de atualização do ProxMenux",
+  "Or, if your terminal can't select text, copy it from:": "Ou, se o seu terminal não conseguir selecionar texto, copie-o de:",
+  "Original ZFS ARC config restored from .bak": "Configuração original do ZFS ARC restaurada de .bak",
+  "Original bashrc restored": "Bashrc original restaurado",
+  "Original logrotate configuration restored": "Configuração original do logrotate restaurada",
+  "Other Prebuilt Linux VMs": "Outras VMs Linux pré-construídas",
+  "Output archive:": "Arquivo de saída:",
+  "Owner:": "Proprietário:",
+  "Ownership set to root:sharedfiles with 2775 on:": "Propriedade definida como root:sharedfiles com 2775 em:",
+  "PAM limits configured": "Limites PAM configurados",
+  "PBS backup error log": "Log de erros de backup do PBS",
+  "PBS backup failed.": "Falha no backup do PBS.",
+  "PBS encryption keyfile (show / replace / remove)": "arquivo-chave de criptografia PBS (mostrar/substituir/remover)",
+  "PBS encryption keyfile — detailed info": "arquivo-chave de criptografia PBS – informações detalhadas",
+  "PBS extraction failed": "Falha na extração de PBS",
+  "PBS host or IP address:": "Host PBS ou endereço IP:",
+  "PBS upload": "upload PBS",
+  "PCI Address": "Endereço PCI",
+  "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "Passagem PCI, estado TPM, configuração de inicialização em nuvem, ganchos Proxmox",
+  "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "Passagem PCI, estado TPM, inicialização em nuvem, snapshots, ganchos específicos do Proxmox",
+  "PCI reset method": "Método de redefinição PCI",
+  "PCIe GPU passthrough requires:": "A passagem de GPU PCIe requer:",
+  "PCIe/M.2 gasket-dkms": "Junta PCIe/M.2-dkms",
+  "POSIX ACLs applied (access + default for inheritance).": "ACLs POSIX aplicadas (acesso + padrão para herança).",
+  "PVE application manager updated": "Gerenciador de aplicativos PVE atualizado",
+  "PVE cache regenerated": "Cache PVE regenerado",
+  "PVE host (where the Borg LXC lives)": "Host PVE (onde mora o Borg LXC)",
+  "PVE host, VMID and password are all required for this mode.": "Host PVE, VMID e senha são necessários para este modo.",
+  "PVE9: udev rules reloaded — new interfaces will get correct names without reboot": "PVE9: regras do udev recarregadas – novas interfaces receberão nomes corretos sem reinicialização",
+  "Package Updates Available": "Atualizações de pacote disponíveis",
+  "Package lists": "Listas de pacotes",
+  "Package lists updated after GPG fix": "Listas de pacotes atualizadas após correção do GPG",
+  "Package lists updated successfully": "Listas de pacotes atualizadas com sucesso",
+  "Package update completed with warnings, continuing...": "Atualização do pacote concluída com avisos, continuando...",
+  "Package update had issues, checking details...": "A atualização do pacote teve problemas, verificando detalhes...",
+  "Package update still has issues, continuing anyway...": "A atualização do pacote ainda apresenta problemas, continuando mesmo assim...",
+  "Packages from backup to install:": "Pacotes do backup para instalação:",
+  "Packages upgrade successfull": "Atualização de pacotes bem-sucedida",
+  "Packages upgraded": "Pacotes atualizados",
+  "Packages:": "Pacotes:",
+  "Packaging OVA file...": "Empacotando arquivo OVA...",
+  "Packing installer archive...": "Empacotando o arquivo do instalador...",
+  "Parsing OVF descriptor...": "Analisando descritor OVF...",
+  "Partial VM removed": "VM parcial removida",
+  "Partition": "Partição",
+  "Partition created": "Partição criada",
+  "Partition created:": "Partição criada:",
+  "Partition table wiped": "Tabela de partição apagada",
+  "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "Senha usada para desbloquear o arquivo-chave importado (deixe em branco se o arquivo-chave não estiver criptografado / kdf=none):",
+  "Passphrases do not match.": "As senhas não correspondem.",
+  "Passphrases do not match. Try again.": "As senhas não correspondem. Tente novamente.",
+  "Passthrough may fail depending on hardware/firmware implementation.": "A passagem pode falhar dependendo da implementação de hardware/firmware.",
+  "Passthrough may still work without a ROM file.": "Passthrough ainda pode funcionar sem um arquivo ROM.",
+  "Passthrough may work, but startup/restart reliability is not guaranteed.": "A passagem pode funcionar, mas a confiabilidade de inicialização/reinício não é garantida.",
+  "Password": "Senha",
+  "Password Mismatch": "Incompatibilidade de senha",
+  "Password cannot be empty.": "A senha não pode ficar vazia.",
+  "Password confirmation cannot be empty.": "A confirmação da senha não pode ficar vazia.",
+  "Password confirmation is required.": "A confirmação da senha é necessária.",
+  "Password for": "Senha para",
+  "Password for:": "Senha para:",
+  "Password is correct": "A senha está correta",
+  "Password or API token secret:": "Senha ou token secreto da API:",
+  "Password reset completed.": "Redefinição de senha concluída.",
+  "Passwords do not match. Please try again.": "As senhas não coincidem. Por favor, tente novamente.",
+  "Paste the UUP Dump URL here": "Cole o URL de despejo UUP aqui",
+  "Patching source for kernel compatibility...": "Fonte de patch para compatibilidade do kernel...",
+  "Path does not exist.": "Caminho não existe.",
+  "Path must be absolute (start with /)": "O caminho deve ser absoluto (comece com /)",
+  "Path must be absolute (start with /).": "O caminho deve ser absoluto (começar com /).",
+  "Path not found": "Caminho não encontrado",
+  "Path:": "Caminho:",
+  "Paths applied:": "Caminhos aplicados:",
+  "Paths included in backup": "Caminhos incluídos no backup",
+  "Paths not found at backup time": "Caminhos não encontrados no momento do backup",
+  "Paths skipped:": "Caminhos ignorados:",
+  "Paths to back up:": "Caminhos para fazer backup:",
+  "Paths:": "Caminhos:",
+  "Pending restore ID:": "ID de restauração pendente:",
+  "Pending restore dir:": "Diretório de restauração pendente:",
+  "Pending restore prepared. A reboot is required to complete it.": "Restauração pendente preparada. Uma reinicialização é necessária para concluí-lo.",
+  "Pending restore prepared. It will run automatically at next boot.": "Restauração pendente preparada. Ele será executado automaticamente na próxima inicialização.",
+  "Pending restore script not found or not executable:": "Script de restauração pendente não encontrado ou não executável:",
+  "Pending upgrades detected on a clustered node.\n\nTo proceed safely, update this node to the latest Proxmox VE 8.x before switching to Trixie/PVE 9.\n\nSelect Yes for AUTOMATIC upgrade (recommended), or No for MANUAL instructions.": "Atualizações pendentes detectadas em um nó clusterizado.\n\nPara prosseguir com segurança, atualize este nó para o Proxmox VE 8.x mais recente antes de mudar para Trixie/PVE 9.\n\nSelecione Sim para atualização AUTOMÁTICA (recomendado) ou Não para instruções MANUAIS.",
+  "Pending upgrades detected on a clustered node. Perform AUTOMATIC upgrade now? (y = automatic, n = manual):": "Atualizações pendentes detectadas em um nó clusterizado. Realizar atualização AUTOMÁTICA agora? (y = automático, n = manual):",
+  "Per official known issues; ensures proper boot after upgrade": "Por problemas oficiais conhecidos; garante inicialização adequada após a atualização",
+  "Performance": "Desempenho",
+  "Performance optimized": "Desempenho otimizado",
+  "Performing complete package reinstallation...": "Executando a reinstalação completa do pacote...",
+  "Performing packages upgrade...": "Executando atualização de pacotes...",
+  "Performing system cleanup...": "Executando limpeza do sistema...",
+  "Performs automatic cleanup after updating": "Executa limpeza automática após atualização",
+  "Permanent Mount": "Montagem Permanente",
+  "Permanent Mounts (fstab):": "Montagens Permanentes (fstab):",
+  "Permanent:": "Permanente:",
+  "Permanently delete saved target:": "Excluir permanentemente o alvo salvo:",
+  "Permanently delete this archive and its sidecar?": "Excluir permanentemente este arquivo e seu arquivo secundário?",
+  "Permission error": "Erro de permissão",
+  "Permissions:": "Permissões:",
+  "Persist mount in CT /etc/fstab (optional):": "Persista a montagem em CT /etc/fstab (opcional):",
+  "Persistent:": "Persistente:",
+  "Physical Function with": "Função Física com",
+  "Physical interface": "Interface física",
+  "Physical interfaces available": "Interfaces físicas disponíveis",
+  "Pick PVE vzdump job": "Escolha o trabalho PVE vzdump",
+  "Pick USB target": "Escolha o destino USB",
+  "Pick Yes to destroy them now (before reboot). Pick No to keep the additive restore and clean up manually later.": "Escolha Sim para destruí-los agora (antes de reiniciar).Escolha Não para manter a restauração aditiva e limpar manualmente mais tarde.",
+  "Pick a USB disk:": "Escolha um disco USB:",
+  "Pick a drive to unmount:": "Escolha uma unidade para desmontar:",
+  "Pick a mounted USB as target": "Escolha um USB montado como destino",
+  "Pick a target to remove:": "Escolha um alvo para remover:",
+  "Pick an SSH private key (auto-detected on this host):": "Escolha uma chave privada SSH (detectada automaticamente neste host):",
+  "Pick an alternative way to authorize the new key:": "Escolha uma forma alternativa de autorizar a nova chave:",
+  "Please check network connectivity.": "Verifique a conectividade da rede.",
+  "Please check permissions and try again.": "Verifique as permissões e tente novamente.",
+  "Please check the installation.": "Por favor, verifique a instalação.",
+  "Please check:": "Por favor, verifique:",
+  "Please choose another path.": "Por favor, escolha outro caminho.",
+  "Please configure it manually and reboot.": "Configure-o manualmente e reinicie.",
+  "Please expand the container disk and run this option again.": "Expanda o disco contêiner e execute esta opção novamente.",
+  "Please install the NVIDIA drivers first using the option:": "Instale os drivers NVIDIA primeiro usando a opção:",
+  "Please mark at least one option, or press Cancel to exit.": "Marque pelo menos uma opção ou pressione Cancelar para sair.",
+  "Please reboot manually and run the passthrough step again.": "Reinicie manualmente e execute a etapa de passagem novamente.",
+  "Please reboot manually to complete the switch.": "Reinicie manualmente para concluir a troca.",
+  "Please reboot the system manually to complete the GPU switch.": "Reinicie o sistema manualmente para concluir a troca de GPU.",
+  "Please reselect GPU(s) and choose only compatible devices for VM mode.": "Selecione novamente GPU(s) e escolha apenas dispositivos compatíveis para o modo VM.",
+  "Please resolve the problem(s) as described above, then re-run the upgrade script.": "Resolva o(s) problema(s) conforme descrito acima e execute novamente o script de atualização.",
+  "Please select GPU(s) that are currently in the same mode and try again.": "Selecione GPU(s) que estão atualmente no mesmo modo e tente novamente.",
+  "Please select a valid option": "Selecione uma opção válida",
+  "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Use uma sessão SSH (Linux, macOS, Windows/PuTTY) ou um console físico para realizar a atualização.",
+  "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "O pool não parece usar dispositivos SSD/NVMe com suporte para descarte. Ignorando o ajuste automático do ZFS para pool:",
+  "Pool exists": "O pool existe",
+  "Pool name matches but GUID differs (fresh ZFS install):": "o nome do pool corresponde, mas o GUID é diferente (nova instalação do ZFS):",
+  "Pool:": "Piscina:",
+  "Port": "Porta",
+  "Port:": "Porta:",
+  "Portal IP and port are correct": "O IP e a porta do portal estão corretos",
+  "Portal is reachable": "O portal está acessível",
+  "Portal:": "Portal:",
+  "Portuguese": "Português",
+  "Post-Installation Options": "Opções pós-instalação",
+  "Post-Installation Scripts": "Scripts pós-instalação",
+  "Postfix configuration": "Configuração Postfix",
+  "Potential QEMU startup/assertion failures": "Possíveis falhas de inicialização/afirmação do QEMU",
+  "Power state D3cold/D0 transitions may be inaccessible": "As transições do estado de energia D3cold/D0 podem estar inacessíveis",
+  "Pre-check found": "Pré-verificação encontrada",
+  "Pre-configure destinations so you don't have to enter them every time you back up.": "Pré-configure destinos para que você não precise inseri-los sempre que fizer backup.",
+  "Pre-existing gasket-dkms package removed.": "Pacote de junta-dkms pré-existente removido.",
+  "Pre-restore backup:": "Backup pré-restauração:",
+  "Pre-upgrade check FAILED: the simulation shows that 'proxmox-ve' would be REMOVED.\n    This indicates a repository or dependency issue and upgrading now could break your Proxmox installation.": "Verificação de pré-atualização FALHOU: a simulação mostra que 'proxmox-ve' seria REMOVIDO.\n    Isso indica um problema de repositório ou dependência e a atualização agora pode interromper a instalação do Proxmox.",
+  "Pre-upgrade simulation passed: 'proxmox-ve' will be kept or upgraded safely.": "Simulação de pré-atualização aprovada: 'proxmox-ve' será mantido ou atualizado com segurança.",
+  "Preparing Log2RAM configuration": "Preparando a configuração do Log2RAM",
+  "Preparing files for backup...": "Preparando arquivos para backup...",
+  "Preparing host mount...": "Preparando montagem do host...",
+  "Preparing pending restore (network-safe)": "Preparando restauração pendente (seguro para rede)",
+  "Preparing staging area...": "Preparando área de preparação...",
+  "Preserving logs to /var/log.hdd before unmounting...": "Preservando logs em /var/log.hdd antes de desmontar...",
+  "Press 'q' to exit": "Pressione 'q' para sair",
+  "Press Ctrl+C to stop the server and return to menu.": "Pressione Ctrl+C para parar o servidor e retornar ao menu.",
+  "Press ENTER to continue...": "Pressione ENTER para continuar...",
+  "Press ENTER to return to the menu...": "Pressione ENTER para retornar ao menu...",
+  "Press ENTER to return...": "Pressione ENTER para retornar...",
+  "Press Enter to close...": "pressione Enter para fechar...",
+  "Press Enter to continue": "Pressione Enter para continuar",
+  "Press Enter to continue...": "Pressione Enter para continuar...",
+  "Press Enter to exit and repair": "Pressione Enter para sair e reparar",
+  "Press Enter to exit the script after reading instructions...": "Pressione Enter para sair do script após ler as instruções...",
+  "Press Enter to exit...": "Pressione Enter para sair...",
+  "Press Enter to return": "Pressione Enter para retornar",
+  "Press Enter to return to menu...": "Pressione Enter para retornar ao menu...",
+  "Press Enter to return to the main menu...": "Pressione Enter para retornar ao menu principal...",
+  "Press Enter to return...": "Pressione Enter para retornar...",
+  "Press Enter when the line has been pasted on the server...": "Pressione Enter quando a linha for colada no servidor...",
+  "Press OK to see the preview, then confirm": "Pressione OK para ver a visualização e confirme",
+  "Pretty uptime format": "Formato de tempo de atividade bonito",
+  "Preview Backup": "Visualizar backup",
+  "Preview Changes": "Visualizar alterações",
+  "Preview changes (diff)": "Visualizar alterações (diferenças)",
+  "Preview: changes that would be applied": "Pré-visualização: alterações que seriam aplicadas",
+  "Previous DKMS tree cleared.": "Árvore DKMS anterior limpa.",
+  "Previous installation cleaned": "Instalação anterior limpa",
+  "Previous installation removed": "Instalação anterior removida",
+  "Previous shutdowns": "Paralisações anteriores",
+  "Privileged": "Privilegiado",
+  "Privileged Container": "Contêiner Privilegiado",
+  "Privileged Container Required": "Requer contêiner privilegiado",
+  "Privileged container": "Contêiner privilegiado",
+  "Privileged container selected:": "Contêiner privilegiado selecionado:",
+  "Privileged container — UID-shift remapping skipped (not applicable)": "Contêiner privilegiado — remapeamento de mudança de UID ignorado (não aplicável)",
+  "Privileged container — direct root access": "Contêiner privilegiado — acesso root direto",
+  "Privileged container — host root maps directly, no permission changes needed": "Contêiner privilegiado — hospede mapas raiz diretamente, sem necessidade de alterações de permissão",
+  "Privileged containers can access host devices directly": "Contêineres privilegiados podem acessar dispositivos host diretamente",
+  "Privileged containers have full root access to the host system!": "Contêineres privilegiados têm acesso root total ao sistema host!",
+  "Privileged: Full host access (less secure)": "Privilegiado: acesso total ao host (menos seguro)",
+  "Proceed": "Prosseguir",
+  "Proceed with removal": "Prossiga com a remoção",
+  "Proceed?": "Continuar?",
+  "Proceeding with Log2RAM setup on non-SSD disk as requested by user.": "Prosseguindo com a configuração do Log2RAM em disco não SSD conforme solicitado pelo usuário.",
+  "Process may take several minutes depending on container size": "O processo pode levar vários minutos dependendo do tamanho do recipiente",
+  "Process may take several minutes for large containers": "O processo pode levar vários minutos para contêineres grandes",
+  "Processes using NVIDIA:": "Processos usando NVIDIA:",
+  "Profile": "Perfil",
+  "Profile:": "Perfil:",
+  "Proposed Changes": "Mudanças propostas",
+  "Provided by newer version — skipping": "Fornecido pela versão mais recente — ignorando",
+  "ProxMenux Information": "Informações do ProxMenux",
+  "ProxMenux Monitor": "Monitor ProxMenux",
+  "ProxMenux Monitor Service Verification": "Verificação de serviço do monitor ProxMenux",
+  "ProxMenux Monitor authentication is not configured on this host — there is no password to reset.": "A autenticação do ProxMenux Monitor não está configurada neste host — não há senha para redefinir.",
+  "ProxMenux Monitor filter configured": "Filtro do Monitor ProxMenux configurado",
+  "ProxMenux Monitor has been activated.": "O Monitor ProxMenux foi ativado.",
+  "ProxMenux Monitor has been deactivated.": "O Monitor ProxMenux foi desativado.",
+  "ProxMenux Monitor is not installed": "O Monitor ProxMenux não está instalado",
+  "ProxMenux Monitor is not installed.": "O Monitor ProxMenux não está instalado.",
+  "ProxMenux Monitor jail configured": "Prisão do ProxMenux Monitor configurada",
+  "ProxMenux Monitor protection": "Proteção do monitor ProxMenux",
+  "ProxMenux Monitor unit repaired and restarted": "Unidade ProxMenux Monitor reparada e reiniciada",
+  "ProxMenux Monitor → Backups tab (live progress card with estimated time, logs, rollback delta)": "ProxMenux Monitor → guia Backups (cartão de progresso ao vivo com tempo estimado, logs, delta de reversão)",
+  "ProxMenux can apply open permissions on this NFS directory from the host so the container can read and write:": "ProxMenux pode aplicar permissões abertas neste diretório NFS do host para que o contêiner possa ler e escrever:",
+  "ProxMenux can remount it with open permissions so any LXC can read and write.": "ProxMenux pode remontá-lo com permissões abertas para que qualquer LXC possa ler e escrever.",
+  "ProxMenux cannot override NFS server-side permissions from the host.": "ProxMenux não pode substituir as permissões do servidor NFS do host.",
+  "ProxMenux customizations removed from bashrc": "Personalizações do ProxMenux removidas do bashrc",
+  "ProxMenux does not validate the contents; any keyfile your PBS accepts is accepted here.": "ProxMenux não valida o conteúdo;qualquer arquivo-chave que seu PBS aceita é aceito aqui.",
+  "ProxMenux files:": "Arquivos ProxMenux:",
+  "ProxMenux logo applied": "Logotipo ProxMenux aplicado",
+  "ProxMenux only acts as a launcher — once the script starts, control leaves ProxMenux.": "ProxMenux atua apenas como um iniciador – assim que o script é iniciado, o controle sai do ProxMenux.",
+  "ProxMenux saved it locally at:": "ProxMenux salvou localmente em:",
+  "Proxmology logo applied": "Logotipo da Proxmologia aplicado",
+  "Proxmox 9 system update allready": "Atualização do sistema Proxmox 9 já",
+  "Proxmox APT repositories configured": "repositórios Proxmox APT configurados",
+  "Proxmox Backup Server (PBS) destinations": "Destinos do servidor de backup Proxmox (PBS)",
+  "Proxmox CIFS Storage Status:": "Status de armazenamento CIFS do Proxmox:",
+  "Proxmox NFS Storage Status:": "Status de armazenamento NFS do Proxmox:",
+  "Proxmox System Update": "Atualização do sistema Proxmox",
+  "Proxmox Update": "Atualização Proxmox",
+  "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 system update completed successfully": "Atualização do sistema Proxmox VE 8 concluída com sucesso",
+  "Proxmox VE 8 to 9 Manual Upgrade Guide": "Guia de atualização manual do Proxmox VE 8 a 9",
+  "Proxmox VE 9.x no-subscription repository created": "Repositório sem assinatura Proxmox VE 9.x criado",
+  "Proxmox VE Helper Scripts": "Scripts auxiliares do Proxmox VE",
+  "Proxmox VE configuration completed.": "Configuração do Proxmox VE concluída.",
+  "Proxmox auth logger service created and started": "Serviço de registrador de autenticação Proxmox criado e iniciado",
+  "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "O repositório corporativo Proxmox pode estar ausente ou inacessível. Tentando mudar para sem assinatura...",
+  "Proxmox filter configured": "Filtro Proxmox configurado",
+  "Proxmox iSCSI Storage Status:": "Status de armazenamento iSCSI do Proxmox:",
+  "Proxmox jail configured": "Prisão Proxmox configurada",
+  "Proxmox local storages:": "Armazenamentos locais Proxmox:",
+  "Proxmox repository OK (candidate is 9.x)": "Repositório Proxmox OK (o candidato é 9.x)",
+  "Proxmox repository configuration completed": "Configuração do repositório Proxmox concluída",
+  "Proxmox repository fixed (no-subscription, candidate is 9.x)": "Repositório Proxmox corrigido (sem assinatura, o candidato é 9.x)",
+  "Proxmox status:": "Status do Proxmox:",
+  "Proxmox storages:": "Armazenamentos Proxmox:",
+  "Proxmox system repair completed successfully!": "Reparo do sistema Proxmox concluído com sucesso!",
+  "Proxmox system repair completed with some issues.": "Reparo do sistema Proxmox concluído com alguns problemas.",
+  "Proxmox system update": "Atualização do sistema Proxmox",
+  "Proxmox web interface protection": "Proteção da interface web Proxmox",
+  "Proxmox web interface: Datacenter > Storage > Add > Directory": "Interface web Proxmox: Datacenter > Armazenamento > Adicionar > Diretório",
+  "Proxmox web interface: Datacenter > Storage > Add > NFS": "Interface web Proxmox: Datacenter > Armazenamento > Adicionar > NFS",
+  "Proxmox web interface: Datacenter > Storage > Add > SMB/CIFS": "Interface web Proxmox: Datacenter > Armazenamento > Adicionar > SMB/CIFS",
+  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Interface web Proxmox: Datacenter > Armazenamento > Adicionar > ZFS",
+  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Interface web Proxmox: Datacenter > Armazenamento > Adicionar > iSCSI",
+  "Pulling latest changes from GitHub...": "Extraindo as alterações mais recentes do GitHub...",
+  "Purging log2ram apt package...": "Expurgando pacote log2ram apt...",
+  "Quick health check (PASSED / FAILED)": "Verificação rápida de integridade (APROVADO/FALHA)",
+  "Quick health status   — overall SMART result + key attributes": "Status de saúde rápido – resultado SMART geral + atributos principais",
+  "RAID Detected": "RAID detectado",
+  "RAID member detected": "Membro RAID detectado",
+  "RAM Size": "Tamanho da RAM",
+  "RAM and swap usage": "RAM e uso de swap",
+  "REPAIR SUMMARY": "RESUMO DO REPARO",
+  "REQUIREMENTS:": "REQUISITOS:",
+  "ROM dump not available — configuring without romfile.": "Despejo de ROM não disponível — configurando sem romfile.",
+  "ROM file used": "Arquivo ROM usado",
+  "RPC Bind Service: RUNNING": "Serviço de ligação RPC: EM EXECUÇÃO",
+  "RPC Bind Service: STOPPED": "Serviço de ligação RPC: PARADO",
+  "RPC Bind Service: STOPPED - starting...": "Serviço de ligação RPC: PARADO - iniciando...",
+  "Re-enter the BORG REPOKEY passphrase to confirm:": "Digite novamente a senha do BORG REPOKEY para confirmar:",
+  "Re-running pre-check after repairs...": "Executando novamente a pré-verificação após os reparos...",
+  "Reachable": "Acessível",
+  "Read-Only": "Somente leitura",
+  "Read-Only access": "Acesso somente leitura",
+  "Read-Write (universal)": "Leitura-Escrita (universal)",
+  "Read-Write access": "Acesso de leitura e gravação",
+  "Read-only": "Somente leitura",
+  "Read-only access (or no write permissions).": "Acesso somente leitura (ou sem permissões de gravação).",
+  "Read-only mount": "Montagem somente leitura",
+  "Read/Write (default)": "Ler/gravar (padrão)",
+  "Read/write CPU model-specific registers": "Ler/gravar registros específicos do modelo de CPU",
+  "Readable user table (UID, shell, etc.)": "Tabela de usuário legível (UID, shell, etc.)",
+  "Reading NVMe SMART data...": "Lendo dados SMART do NVMe...",
+  "Reading NVMe self-test log...": "Lendo o log de autoteste NVMe...",
+  "Reading SMART data...": "Lendo dados SMART...",
+  "Reading SMART self-test log...": "Lendo o registro de autoteste SMART...",
+  "Reading full SMART report...": "Lendo o relatório SMART completo...",
+  "Real-time bandwidth usage (press q to exit)": "Uso de largura de banda em tempo real (pressione q para sair)",
+  "Real-time network monitoring (press q to exit)": "Monitoramento de rede em tempo real (pressione q para sair)",
+  "Real-time network usage (iftop)": "uso de rede em tempo real (iftop)",
+  "Reason: Access denied": "Motivo: acesso negado",
+  "Reason: Authentication required": "Razão: Autenticação necessária",
+  "Reason: Permission denied": "Razão: Permissão negada",
+  "Reboot Recommended": "Reinicializar recomendado",
+  "Reboot Required": "Reinicialização necessária",
+  "Reboot is required to apply the scheduled restore.": "A reinicialização é necessária para aplicar a restauração agendada.",
+  "Reboot is required to complete the pending restore.": "A reinicialização é necessária para concluir a restauração pendente.",
+  "Reboot now?": "Reiniciar agora?",
+  "Reboot pending — changes will take full effect after the next restart.": "Reinicialização pendente – as alterações entrarão em vigor após a próxima reinicialização.",
+  "Reboot the VM to complete the driver installation.": "Reinicie a VM para concluir a instalação do driver.",
+  "Reboot the system:": "Reinicie o sistema:",
+  "Rebooting the system...": "Reiniciando o sistema...",
+  "Rebuilding initramfs to apply nouveau blacklist before installation...": "Reconstruindo o initramfs para aplicar a lista negra do nouveau antes da instalação...",
+  "Recent": "Recente",
+  "Recent Samba Servers": "Servidores Samba recentes",
+  "Recent Samba server": "Servidor Samba recente",
+  "Recent logs:": "Registros recentes:",
+  "Recent test results:": "Resultados de testes recentes:",
+  "Recommendation: reformat the disk to ext4 for a robust setup — see docs.": "Recomendação: reformate o disco para ext4 para uma configuração robusta – consulte a documentação.",
+  "Recommendation: start with Complete restore.": "Recomendação: comece com a restauração completa.",
+  "Recommendation: use 'Export to file' for these paths and apply manually during a maintenance window.": "Recomendação: use 'Exportar para arquivo' para esses caminhos e aplique manualmente durante uma janela de manutenção.",
+  "Recommended diagnostic commands": "Comandos de diagnóstico recomendados",
+  "Recommended: Install the QEMU Guest Agent in the VM": "Recomendado: Instale o agente convidado QEMU na VM",
+  "Recommended: run": "Recomendado: executar",
+  "Recommended: schedule these paths for next boot to avoid immediate SSH disconnection.": "Recomendado: agende esses caminhos para a próxima inicialização para evitar a desconexão imediata do SSH.",
+  "Recommended: use GPU -> LXC mode for these devices.": "Recomendado: use o modo GPU -> LXC para esses dispositivos.",
+  "Recommended: use GPU with LXC workloads instead of VM passthrough on this hardware.": "Recomendado: use GPU com cargas de trabalho LXC em vez de passagem de VM neste hardware.",
+  "Recover the keyfile using your recovery passphrase?": "Recuperar o arquivo-chave usando sua senha de recuperação?",
+  "Recoverable:": "Recuperável:",
+  "Recovery blob upload failed — main backup is OK, but keyfile recovery from PBS will not be available for this backup.": "falha no upload do blob de recuperação – o backup principal está OK, mas a recuperação do arquivo-chave do PBS não estará disponível para este backup.",
+  "Recovery blob:": "blob de recuperação:",
+  "Recovery failed": "Falha na recuperação",
+  "Recovery passphrase": "Senha de recuperação",
+  "Recovery setup failed": "Falha na configuração de recuperação",
+  "Refresh APT index and verify repositories:": "Atualize o índice APT e verifique os repositórios:",
+  "Refresh your browser (Ctrl+Shift+R) to see changes": "Atualize seu navegador (Ctrl+Shift+R) para ver as alterações",
+  "Refresh your browser to see changes (server restart may be required)": "Atualize seu navegador para ver as alterações (pode ser necessário reiniciar o servidor)",
+  "Refreshing apt cache...": "Atualizando o cache do apt...",
+  "Regenerating PVE package cache...": "Regenerando cache de pacotes PVE...",
+  "Regenerating boot artifacts for the merged kernel-agnostic changes...": "Regenerando artefatos de inicialização para as alterações independentes do kernel mescladas...",
+  "Regenerating certificates and restarting services...": "Gerando novamente certificados e reiniciando serviços...",
+  "Register mount path in Proxmox:": "Registre o caminho de montagem no Proxmox:",
+  "Registering disk as Proxmox storage...": "Registrando disco como armazenamento Proxmox...",
+  "Registering module with DKMS...": "Registrando módulo com DKMS...",
+  "Reinstall / update Coral drivers": "Reinstale / atualize os drivers Coral",
+  "Reinstall Fail2Ban": "Reinstale o Fail2Ban",
+  "Reinstall Lynis": "Reinstale o Lynis",
+  "Reinstall and reconfigure Fail2Ban": "Reinstale e reconfigure Fail2Ban",
+  "Reinstall/Update NVIDIA drivers": "Reinstale/atualize drivers NVIDIA",
+  "Reinstalled": "Reinstalado",
+  "Reinstalled Proxmox packages successfully": "Pacotes Proxmox reinstalados com sucesso",
+  "Reinstalling core Proxmox packages...": "Reinstalando pacotes principais do Proxmox...",
+  "Release Channel": "Canal de lançamento",
+  "Release channel set to Beta.": "Canal de lançamento definido como Beta.",
+  "Release channel set to Stable.": "Canal de lançamento definido como Estável.",
+  "Release channel:": "Canal de lançamento:",
+  "Reload Proxmox firewall rules": "Recarregar regras de firewall Proxmox",
+  "Reload network configuration (ifupdown2)": "Recarregar configuração de rede (ifupdown2)",
+  "Remapped Users:": "Usuários remapeados:",
+  "Remapped users:": "Usuários remapeados:",
+  "Reminder: You must install the QEMU Guest Agent inside the Windows VM": "Lembrete: você deve instalar o agente convidado QEMU dentro da VM do Windows",
+  "Remote repository path:": "Caminho do repositório remoto:",
+  "Remote server via SSH  (recommended — off-host, dedup across machines)": "Servidor remoto via SSH (recomendado — fora do host, desduplicação entre máquinas)",
+  "Remounting CIFS share with open permissions...": "Remontando o compartilhamento CIFS com permissões abertas...",
+  "Remove CIFS Mount": "Remover montagem CIFS",
+  "Remove CIFS Mount (pvesm or fstab)": "Remover montagem CIFS (pvesm ou fstab)",
+  "Remove CIFS Storage": "Remover armazenamento CIFS",
+  "Remove CIFS fstab Mount": "Remover montagem CIFS fstab",
+  "Remove CIFS fstab mount:": "Remova a montagem CIFS fstab:",
+  "Remove CIFS storage:": "Remova o armazenamento CIFS:",
+  "Remove Disk Storage": "Remover armazenamento em disco",
+  "Remove Disk from fstab": "Remover disco do fstab",
+  "Remove FS labels  — partitions and data preserved": "Remova rótulos FS – partições e dados preservados",
+  "Remove FS labels — partitions and data preserved": "Remova rótulos FS – partições e dados preservados",
+  "Remove Fail2Ban": "Remover Fail2Ban",
+  "Remove GPU from LXC config (keep Start on boot)": "Remova a GPU da configuração LXC (mantenha Iniciar na inicialização)",
+  "Remove GPU from LXC config + keep Start on boot unchanged": "Remova a GPU da configuração do LXC + mantenha o início na inicialização inalterado",
+  "Remove GPU from VM config (keep Start on boot)": "Remova a GPU da configuração da VM (mantenha Iniciar na inicialização)",
+  "Remove GPU from source VM config (keep Start on boot)": "Remova a GPU da configuração da VM de origem (mantenha Iniciar na inicialização)",
+  "Remove GPU from source VM config + keep Start on boot unchanged": "Remover GPU da configuração da VM de origem + manter o início na inicialização inalterado",
+  "Remove LXC Mount Point": "Remover ponto de montagem LXC",
+  "Remove Lynis": "Remover Lynis",
+  "Remove Mount Point": "Remover ponto de montagem",
+  "Remove Mount Point Confirmation:": "Confirmação de remoção do ponto de montagem:",
+  "Remove NFS Mount": "Remover montagem NFS",
+  "Remove NFS Mount (pvesm or fstab)": "Remover montagem NFS (pvesm ou fstab)",
+  "Remove NFS Storage": "Remover armazenamento NFS",
+  "Remove NFS fstab Mount": "Remover montagem fstab do NFS",
+  "Remove NFS fstab mount:": "Remova a montagem fstab do NFS:",
+  "Remove NFS storage:": "Remova o armazenamento NFS:",
+  "Remove Proxmox CIFS storage:": "Remova o armazenamento Proxmox CIFS:",
+  "Remove Proxmox NFS storage:": "Remova o armazenamento Proxmox NFS:",
+  "Remove Proxmox iSCSI storage:": "Remova o armazenamento iSCSI Proxmox:",
+  "Remove Secure Gateway? State will be preserved.": "Remover gateway seguro? O estado será preservado.",
+  "Remove custom paths": "Remover caminhos personalizados",
+  "Remove disk references from affected VM(s)/CT(s) config": "Remover referências de disco da configuração de VM(s)/CT(s) afetadas",
+  "Remove iSCSI Storage": "Remover armazenamento iSCSI",
+  "Remove iSCSI storage definition:": "Remova a definição de armazenamento iSCSI:",
+  "Remove invalid port": "Remover porta inválida",
+  "Remove invalid port(s)": "Remover portas inválidas",
+  "Remove keyfile from this host": "Remover arquivo-chave deste host",
+  "Remove mount point:": "Remover ponto de montagem:",
+  "Remove obsolete systemd-boot meta-package": "Remover meta-pacote obsoleto systemd-boot",
+  "Remove old repository files:": "Remova arquivos antigos do repositório:",
+  "Remove passthrough device from VM": "Remover dispositivo de passagem da VM",
+  "Remove subscription banner": "Remover banner de assinatura",
+  "Remove the unprivileged flag from configuration:": "Remova o sinalizador sem privilégios da configuração:",
+  "Remove unused packages and their config": "Remova pacotes não utilizados e suas configurações",
+  "Removed": "Removido",
+  "Removed KVM MSR options from configuration": "Opções KVM MSR removidas da configuração",
+  "Removed Mount:": "Montagem removida:",
+  "Removed all .link files from": "Removidos todos os arquivos .link de",
+  "Removed bwlimit/ionice tuning (no .bak found)": "Ajuste de bwlimit/ionice removido (nenhum .bak encontrado)",
+  "Removed configurations for": "Configurações removidas para",
+  "Removed credentials file:": "Arquivo de credenciais removido:",
+  "Removed empty KVM configuration file": "Arquivo de configuração KVM vazio removido",
+  "Removed empty mount directory:": "Diretório de montagem vazio removido:",
+  "Removed entry from /etc/fstab": "Entrada removida de /etc/fstab",
+  "Removed from /etc/fstab": "Removido de /etc/fstab",
+  "Removed from /etc/fstab.": "Removido de /etc/fstab.",
+  "Removed idle=nomwait from /etc/kernel/cmdline (ZFS)": "Idle=nomwait removido de /etc/kernel/cmdline (ZFS)",
+  "Removed idle=nomwait from GRUB configuration": "Idle=nomwait removido da configuração do GRUB",
+  "Removed remapped user:": "Usuário remapeado removido:",
+  "Removed sharedfiles group.": "Grupo de arquivos compartilhados removido.",
+  "Removed:": "Removido:",
+  "Removing APT IPv4 configuration...": "Removendo a configuração do APT IPv4...",
+  "Removing Coral packages...": "Removendo pacotes Coral...",
+  "Removing Fail2Ban...": "Removendo Fail2Ban...",
+  "Removing GPU from VM": "Removendo GPU da VM",
+  "Removing Lynis...": "Removendo Lynis...",
+  "Removing NVIDIA DKMS entries...": "Removendo entradas NVIDIA DKMS...",
+  "Removing NVIDIA packages...": "Removendo pacotes NVIDIA...",
+  "Removing OVH RTM...": "Removendo OVH RTM...",
+  "Removing OpenVSwitch...": "Removendo OpenVSwitch...",
+  "Removing VFIO ownership for selected GPU(s)...": "Removendo propriedade de VFIO para GPU(s) selecionada(s)...",
+  "Removing all .link files from": "Removendo todos os arquivos .link de",
+  "Removing any pre-existing gasket-dkms package...": "Removendo qualquer pacote de junta-dkms pré-existente...",
+  "Removing conflicting utilities...": "Removendo utilitários conflitantes...",
+  "Removing entropy generation optimization...": "Removendo otimização de geração de entropia...",
+  "Removing filesystem signatures...": "Removendo assinaturas do sistema de arquivos...",
+  "Removing from /etc/fstab...": "Removendo de /etc/fstab...",
+  "Removing gasket DKMS modules...": "Removendo a junta dos módulos DKMS...",
+  "Removing gateway...": "Removendo gateway...",
+  "Removing guest agent...": "Removendo agente convidado...",
+  "Removing invalid configurations...": "Removendo configurações inválidas...",
+  "Removing invalid existing file...": "Removendo arquivo existente inválido...",
+  "Removing kernel panic configuration...": "Removendo a configuração do kernel panic...",
+  "Removing memory optimizations...": "Removendo otimizações de memória...",
+  "Removing mount point": "Removendo ponto de montagem",
+  "Removing network optimizations...": "Removendo otimizações de rede...",
+  "Removing no longer required packages and purging old cached updates...": "Removendo pacotes que não são mais necessários e limpando atualizações antigas em cache...",
+  "Removing partial VM": "Removendo VM parcial",
+  "Removing previous DKMS source tree...": "Removendo a árvore de origem DKMS anterior...",
+  "Removing previous Lynis installation...": "Removendo a instalação anterior do Lynis...",
+  "Removing remapped users...": "Removendo usuários remapeados...",
+  "Removing storage from Proxmox...": "Removendo armazenamento do Proxmox...",
+  "Removing system limits optimizations...": "Removendo otimizações de limites do sistema...",
+  "Removing zfs-auto-snapshot...": "Removendo instantâneo zfs-auto...",
+  "Renamed": "Renomeado",
+  "Renamed NIC:": "NIC renomeada:",
+  "Repair Complete": "Reparo concluído",
+  "Repair Options:": "Opções de reparo:",
+  "Repairs and optimizes repositories": "Repara e otimiza repositórios",
+  "Replace": "Substituir",
+  "Replace <container-id> with the actual ID.": "Substitua <container-id> pelo ID real.",
+  "Replace <container-id> with your actual container ID": "Substitua <container-id> pelo ID real do contêiner",
+  "Replace <storage-identifier> with the value from step 4": "Substitua <storage-identifier> pelo valor da etapa 4",
+  "Replace invalid port(s)": "Substitua as portas inválidas",
+  "Replace it?": "Substituí-lo?",
+  "Replace paths with your actual values from step 5": "Substitua os caminhos pelos valores reais da etapa 5",
+  "Replace with your actual path from step 5": "Substitua pelo caminho real da etapa 5",
+  "Replacing gzip with pigz wrapper...": "Substituindo o gzip pelo wrapper pigz...",
+  "Repositories switched to no-subscription": "Repositórios alterados para sem assinatura",
+  "Repository ready.": "Repositório pronto.",
+  "Repository:": "Repositório:",
+  "Require reboot": "Exigir reinicialização",
+  "Required command not found:": "Comando necessário não encontrado:",
+  "Required if using a VirtIO or SCSI disk.": "Obrigatório se estiver usando um disco VirtIO ou SCSI.",
+  "Required install helpers not available.": "Auxiliares de instalação necessários não disponíveis.",
+  "Requires acl package. Skip if setfacl is not available.": "Requer pacote acl. Ignore se setfacl não estiver disponível.",
+  "Requires authentication": "Requer autenticação",
+  "Reset Capability Blocked": "Capacidade de redefinição bloqueada",
+  "Reset Capability Warning": "Aviso de capacidade de redefinição",
+  "Reset Monitor Password": "Redefinir senha do monitor",
+  "Reset ProxMenux Monitor Password": "Redefinir senha do monitor ProxMenux",
+  "Reset current storage selection": "Redefinir a seleção de armazenamento atual",
+  "Resetting time synchronization...": "Redefinindo a sincronização de horário...",
+  "Residual Bookworm entries commented where applicable": "Entradas residuais do Bookworm comentadas quando aplicável",
+  "Resolve package conflicts": "Resolver conflitos de pacotes",
+  "Restart Network": "Reiniciar rede",
+  "Restart Network Service": "Reinicie o serviço de rede",
+  "Restart Web UI proxy": "Reinicie o proxy da IU da Web",
+  "Restart and enable Samba:": "Reinicie e habilite o Samba:",
+  "Restart container to activate mount?": "Reiniciar o contêiner para ativar a montagem?",
+  "Restarting ProxMenux Monitor service...": "Reiniciando o serviço ProxMenux Monitor...",
+  "Restarting Proxmox services...": "Reiniciando os serviços Proxmox...",
+  "Restarting container...": "Reiniciando o contêiner...",
+  "Restarting gateway...": "Reiniciando o gateway...",
+  "Restarting network service...": "Reiniciando o serviço de rede...",
+  "Restarting the server...": "Reiniciando o servidor...",
+  "Restore Backup": "Restaurar backup",
+  "Restore Network Backup": "Restaurar backup de rede",
+  "Restore a CT from backup": "Restaurar um CT do backup",
+  "Restore a VM from backup": "Restaurar uma VM do backup",
+  "Restore actions": "Restaurar ações",
+  "Restore applied:": "Restauração aplicada:",
+  "Restore can now proceed.": "A restauração agora pode prosseguir.",
+  "Restore failed": "Falha na restauração",
+  "Restore from Borg  →  staging": "Restaurar do Borg → teste",
+  "Restore from Borg repository": "Restaurar do repositório Borg",
+  "Restore from PBS  →  staging": "Restaurar do PBS → teste",
+  "Restore from Proxmox Backup Server (PBS)": "Restaurar do servidor de backup Proxmox (PBS)",
+  "Restore from local archive  (.tar.gz / .tar.zst)": "Restaurar do arquivo local (.tar.gz / .tar.zst)",
+  "Restore from local archive  →  staging": "Restaurar do arquivo local → teste",
+  "Restore host configuration": "Restaurar configuração do host",
+  "Restore it ONLY if the target host has the same pools and disks as the source. Otherwise Proxmox may try to import non-existent pools at next boot.": "Restaure-o SOMENTE se o host de destino tiver os mesmos pools e discos que o de origem. Caso contrário, o Proxmox poderá tentar importar pools inexistentes na próxima inicialização.",
+  "Restore plan": "Plano de restauração",
+  "Restore plan summary": "Resumo do plano de restauração",
+  "Restore source location": "Restaurar local de origem",
+  "Restored config is on disk; reboot the host to apply.": "A configuração restaurada está no disco; reinicie o host para aplicar.",
+  "Restored original /bin/gzip": "Original restaurado /bin/gzip",
+  "Restored original /etc/vzdump.conf from .bak": "/etc/vzdump.conf original restaurado de .bak",
+  "Restoring APT language downloads...": "Restaurando downloads de idiomas APT...",
+  "Restoring container memory to": "Restaurando a memória do contêiner para",
+  "Restoring default journald configuration...": "Restaurando a configuração padrão do journald...",
+  "Restoring enterprise repositories...": "Restaurando repositórios corporativos...",
+  "Restoring guest configs (LXC + QEMU)...": "Restaurando configurações de convidados (LXC + QEMU)...",
+  "Restoring original bashrc...": "Restaurando o bashrc original...",
+  "Restoring original logrotate configuration...": "Restaurando a configuração original do logrotate...",
+  "Restoring subscription banner...": "Restaurando banner de assinatura...",
+  "Results will be saved automatically to:": "Os resultados serão salvos automaticamente em:",
+  "Results will be saved to:": "Os resultados serão salvos em:",
+  "Retention": "Retenção",
+  "Return": "Retornar",
+  "Return to Main Menu": "Retornar ao menu principal",
+  "Return to Share Menu": "Retornar ao menu Compartilhar",
+  "Return to main menu": "Voltar ao menu principal",
+  "Reused the encryption key from the PVE storage entry.": "Reutilizou a chave de criptografia da entrada de armazenamento PVE.",
+  "Reverting AMD (Ryzen/EPYC) fixes...": "Revertendo correções AMD (Ryzen/EPYC)...",
+  "Reverting IOMMU/VFIO configuration...": "Revertendo a configuração IOMMU/VFIO...",
+  "Reverting TCP BBR + Fast Open...": "Revertendo TCP BBR + abertura rápida...",
+  "Reverting ZFS ARC tuning...": "Revertendo ajuste do ZFS ARC...",
+  "Reverting pigz wrapper...": "Revertendo o wrapper pigz...",
+  "Reverting vzdump speed tuning...": "Revertendo o ajuste de velocidade do vzdump...",
+  "Review passthrough config files": "Revise os arquivos de configuração de passagem",
+  "Review what will be removed": "Revise o que será removido",
+  "Rollback: nothing to remove (host matches backup)": "Rollback: nada para remover (host corresponde ao backup)",
+  "Root SSH keys/config": "Chaves/configuração SSH raiz",
+  "Root inside container = root on host system": "Raiz dentro do contêiner = raiz no sistema host",
+  "Root shell/profile config": "Configuração de shell/perfil raiz",
+  "Root user on the PVE host (default 'root'):": "Usuário root no host PVE (padrão 'root'):",
+  "Rotate the recovery passphrase": "gire a senha de recuperação",
+  "Routing Information": "Informações de roteamento",
+  "Routing Table": "Tabela de roteamento",
+  "Run 'Mount NFS Share' to install NFS client automatically.": "Execute 'Mount NFS Share' para instalar o cliente NFS automaticamente.",
+  "Run 'Mount Samba Share' to install CIFS client automatically.": "Execute 'Mount Samba Share' para instalar o cliente CIFS automaticamente.",
+  "Run PVE 8 to 9": "Execute PVE 8 a 9",
+  "Run PVE 8 to 9 check": "Execute a verificação PVE 8 a 9",
+  "Run \\\"Install NVIDIA Drivers on Host\\\" first so the installer is cached.": "Execute \"Instalar drivers NVIDIA no host\" primeiro para que o instalador seja armazenado em cache.",
+  "Run a full security audit": "Execute uma auditoria de segurança completa",
+  "Run a job now": "Execute um trabalho agora",
+  "Run as server or client? [s/c]:": "Executar como servidor ou cliente? [s/c]:",
+  "Run checklist again to verify upgrade:": "Execute a lista de verificação novamente para verificar a atualização:",
+  "Run from console, or SSH inside tmux/screen": "Execute a partir do console ou SSH dentro do tmux/screen",
+  "Run job now": "Execute o trabalho agora",
+  "Run mode selected: Automatic": "Modo de execução selecionado: Automático",
+  "Run mode selected: Automatic/Unattended": "Modo de execução selecionado: Automático/Autônomo",
+  "Run mode selected: Interactive": "Modo de execução selecionado: Interativo",
+  "Run mode: Unattended": "Modo de execução: Autônomo",
+  "Run security audit now": "Execute a auditoria de segurança agora",
+  "Run the following inside the VM:": "Execute o seguinte dentro da VM:",
+  "Run upgrade checklist script:": "Execute o script da lista de verificação de atualização:",
+  "Running": "Correndo",
+  "Running Lynis security audit...": "Executando auditoria de segurança do Lynis...",
+  "Running NVIDIA installer in container. This may take several minutes...": "Executando o instalador NVIDIA no contêiner. Isso pode levar vários minutos...",
+  "Running NVIDIA uninstaller...": "Executando o desinstalador da NVIDIA...",
+  "Running VM detected": "VM em execução detectada",
+  "Running backup job:": "Executando tarefa de backup:",
+  "Running containers detected": "Contêineres em execução detectados",
+  "Running pre-upgrade simulation to verify 'proxmox-ve' will remain installed...": "Executando simulação de pré-atualização para verificar se o 'proxmox-ve' permanecerá instalado...",
+  "SATA   (standard - high compatibility)": "SATA (padrão - alta compatibilidade)",
+  "SCSI   (recommended for Linux and Windows)": "SCSI (recomendado para Linux e Windows)",
+  "SCSI   (recommended for Linux)": "SCSI (recomendado para Linux)",
+  "SECURITY CONSIDERATIONS:": "CONSIDERAÇÕES DE SEGURANÇA:",
+  "SECURITY WARNING:": "AVISO DE SEGURANÇA:",
+  "SMART Action": "Ação SMART",
+  "SMART Disk Health & Test": "Integridade e teste do disco SMART",
+  "SMART health status: PASSED": "Status de saúde SMART: APROVADO",
+  "SMB Client Error": "Erro do cliente SMB",
+  "SMB Client Tools: AVAILABLE": "Ferramentas de cliente SMB: DISPONÍVEIS",
+  "SMB Client Tools: NOT AVAILABLE": "Ferramentas de cliente SMB: NÃO DISPONÍVEIS",
+  "SMB Error": "Erro SMB",
+  "SMB port 445:": "Porta SMB 445:",
+  "SMB ports:": "Portas SMB:",
+  "SR-IOV Configuration Detected": "Configuração SR-IOV detectada",
+  "SSD Emulation": "Emulação SSD",
+  "SSH access (host + root)": "Acesso SSH (host + root)",
+  "SSH auth logger service created and started": "Serviço de registrador de autenticação SSH criado e iniciado",
+  "SSH hardening: MaxAuthTries set to 3 (Lynis recommendation)": "Proteção SSH: MaxAuthTries definido como 3 (recomendação Lynis)",
+  "SSH host or IP:": "Host SSH ou IP:",
+  "SSH key strategy": "Estratégia de chave SSH",
+  "SSH login failed": "falha no login SSH",
+  "SSH network risk": "Risco de rede SSH",
+  "SSH password auth refused on server": "autenticação de senha SSH recusada no servidor",
+  "SSH protection (aggressive mode)": "Proteção SSH (modo agressivo)",
+  "STEP 6: Choose commands based on your storage type": "PASSO 6: Escolha comandos com base no seu tipo de armazenamento",
+  "STEP 9: Cleanup (LVM only)": "PASSO 9: Limpeza (somente LVM)",
+  "STORAGE TYPE IDENTIFICATION:": "IDENTIFICAÇÃO DO TIPO DE ARMAZENAMENTO:",
+  "SUGGESTION FOR": "SUGESTÃO PARA",
+  "Safe design: no automatic ACL/ownership mutation on host or CT.": "Design seguro: sem mutação automática de ACL/propriedade no host ou CT.",
+  "Safe to apply now": "É seguro aplicar agora",
+  "Safety Backup": "Backup de segurança",
+  "Safety backup created": "Backup de segurança criado",
+  "Safety check failed: selected disk is now used by host/system.": "Falha na verificação de segurança: o disco selecionado agora é usado pelo host/sistema.",
+  "Safety check failed: selected disk is referenced by a VM/LXC config.": "Falha na verificação de segurança: o disco selecionado é referenciado por uma configuração VM/LXC.",
+  "Samba Client Manager - CT": "Gerente de Cliente Samba - CT",
+  "Samba Client in LXC (Privileged)": "Cliente Samba em LXC (privilegiado)",
+  "Samba Client in LXC (privileged)": "Cliente Samba em LXC (privilegiado)",
+  "Samba Credentials": "Credenciais do Samba",
+  "Samba Host Manager - Proxmox Host": "Gerenciador de host Samba - Host Proxmox",
+  "Samba LXC Manager": "Gerente do Samba LXC",
+  "Samba Manager - CT": "Gerente de Samba - CT",
+  "Samba Not Installed": "Samba não instalado",
+  "Samba Password": "Senha do Samba",
+  "Samba Server": "Servidor Samba",
+  "Samba Server Selection": "Seleção de servidor Samba",
+  "Samba Server in LXC (Privileged)": "Servidor Samba em LXC (privilegiado)",
+  "Samba Server in LXC (privileged)": "Servidor Samba em LXC (privilegiado)",
+  "Samba Server: INSTALLED": "Servidor Samba: INSTALADO",
+  "Samba Server: NOT INSTALLED": "Servidor Samba: NÃO INSTALADO",
+  "Samba Service Status in CT": "Status do serviço Samba no CT",
+  "Samba Service: RUNNING": "Serviço Samba: EM EXECUÇÃO",
+  "Samba Service: STOPPED": "Serviço Samba: PARADO",
+  "Samba User": "Usuário Samba",
+  "Samba Username": "Nome de usuário do Samba",
+  "Samba client tools installed": "Ferramentas cliente Samba instaladas",
+  "Samba configuration backed up.": "Backup da configuração do Samba.",
+  "Samba group kept (has users assigned).": "Grupo Samba mantido (tem usuários atribuídos).",
+  "Samba group removed.": "Grupo de samba removido.",
+  "Samba packages removed.": "Pacotes Samba removidos.",
+  "Samba server has been completely uninstalled!": "O servidor Samba foi completamente desinstalado!",
+  "Samba server installed successfully.": "Servidor Samba instalado com sucesso.",
+  "Samba server is already installed.": "O servidor Samba já está instalado.",
+  "Samba server is not installed in this CT.": "O servidor Samba não está instalado neste CT.",
+  "Samba server is running": "O servidor Samba está em execução",
+  "Samba servers detected": "Servidores Samba detectados",
+  "Samba services stopped and disabled.": "Os serviços Samba foram interrompidos e desativados.",
+  "Samba share": "Compartilhamento de samba",
+  "Samba share created successfully!": "Compartilhamento do Samba criado com sucesso!",
+  "Samba share mounted successfully!": "Compartilhamento Samba montado com sucesso!",
+  "Samba share unmount successfully. Reboot LXC required to take effect.": "Compartilhamento Samba desmontado com sucesso. É necessário reiniciar o LXC para entrar em vigor.",
+  "Samba users removed.": "Usuários do Samba removidos.",
+  "Samba users:": "Usuários do Samba:",
+  "Samba/CIFS Client Status in CT": "Status do cliente Samba/CIFS no CT",
+  "Samba/CIFS client installed successfully.": "Cliente Samba/CIFS instalado com sucesso.",
+  "Samba/CIFS mounts in CT": "Montagens Samba/CIFS no CT",
+  "Samba/NFS clients will likely receive 'permission denied'. Review the steps above.": "Os clientes Samba/NFS provavelmente receberão 'permissão negada'. Revise as etapas acima.",
+  "Same Version Detected": "Mesma versão detectada",
+  "Same host:": "Mesmo anfitrião:",
+  "Same major series:": "Mesma série principal:",
+  "Same major.minor:": "Mesmo maior.menor:",
+  "Sanitizing NVIDIA host services for VFIO mode...": "Sanitizando serviços de host NVIDIA para modo VFIO...",
+  "Save the passphrase somewhere safe NOW, before continuing.": "Salve a senha em algum lugar seguro AGORA, antes de continuar.",
+  "Save this Borg target so you don't need to enter the details again?": "Salvar este alvo Borg para não precisar inserir os detalhes novamente?",
+  "Scan storage for new content": "Verifique o armazenamento em busca de novo conteúdo",
+  "Scanning available physical disks...": "Verificando discos físicos disponíveis...",
+  "Scanning network for NFS servers...": "Verificando a rede em busca de servidores NFS...",
+  "Scanning network for Samba servers...": "Verificando a rede em busca de servidores Samba...",
+  "Schedule": "Agendar",
+  "Schedule:": "Agendar:",
+  "Scheduled backup job created": "Tarefa de backup agendada criada",
+  "Scheduled backup jobs": "Tarefas de backup agendadas",
+  "Scheduled backups and retention policies": "Backups agendados e políticas de retenção",
+  "Scheduled tasks (cron)": "Tarefas agendadas (cron)",
+  "Scheduler script not found:": "Script do agendador não encontrado:",
+  "Script Information": "Informações do roteiro",
+  "Script not found:": "Script não encontrado:",
+  "Scripts in": "Scripts em",
+  "Search Results for:": "Resultados da pesquisa para:",
+  "Search/Filter Scripts": "Scripts de pesquisa/filtro",
+  "Secure Disk Formatter": "Formatador de disco seguro",
+  "Secure Gateway (Tailscale VPN)": "Gateway Seguro (VPN Tailscale)",
+  "Secure Gateway deployed successfully!": "Gateway seguro implantado com sucesso!",
+  "Secure Gateway is already installed.": "O Gateway Seguro já está instalado.",
+  "Security": "Segurança",
+  "Security Updates": "Atualizações de segurança",
+  "Security Warning — read before applying": "Aviso de segurança – leia antes de aplicar",
+  "See": "Ver",
+  "See /tmp/proxmenux-mount.log for details.": "Consulte /tmp/proxmenux-mount.log para obter detalhes.",
+  "Select": "Selecione",
+  "Select Borg target": "Selecione o alvo Borg",
+  "Select CPU model": "Selecione o modelo da CPU",
+  "Select CT": "Selecione CT",
+  "Select CT for destination disk": "Selecione CT para disco de destino",
+  "Select Disk": "Selecione o disco",
+  "Select Disk Images": "Selecione imagens de disco",
+  "Select Disk Interface": "Selecione Interface de Disco",
+  "Select Disks": "Selecione discos",
+  "Select Existing Folder": "Selecione a pasta existente",
+  "Select Filesystem": "Selecione o sistema de arquivos",
+  "Select Folder": "Selecione a pasta",
+  "Select GPU for VM Passthrough": "Selecione GPU para passagem de VM",
+  "Select GPU(s)": "Selecione GPU(s)",
+  "Select Host Directory": "Selecione o diretório de host",
+  "Select Host Folder": "Selecione a pasta host",
+  "Select LXC Container": "Selecione o contêiner LXC",
+  "Select Mount Point": "Selecione o ponto de montagem",
+  "Select Mount Point to Remove": "Selecione o ponto de montagem para remover",
+  "Select NFS Export": "Selecione Exportação NFS",
+  "Select NFS Server": "Selecione Servidor NFS",
+  "Select OVA/OVF file": "Selecione o arquivo OVA/OVF",
+  "Select PBS repository": "Selecione o repositório PBS",
+  "Select Privileged Container": "Selecione Container Privilegiado",
+  "Select SSH private key": "Selecione a chave privada SSH",
+  "Select SSH private key file": "Selecione o arquivo de chave privada SSH",
+  "Select Samba Server": "Selecione Servidor Samba",
+  "Select Samba Share": "Selecione Compartilhamento Samba",
+  "Select Shared Directory Location": "Selecione o local do diretório compartilhado",
+  "Select Storage": "Selecione Armazenamento",
+  "Select Storage Volume": "Selecione o volume de armazenamento",
+  "Select System Type": "Selecione o tipo de sistema",
+  "Select Unprivileged Container": "Selecione contêiner sem privilégios",
+  "Select VM": "Selecione VM",
+  "Select VM to export:": "Selecione VM para exportar:",
+  "Select Virtual Machine": "Selecione Máquina Virtual",
+  "Select a Custom Logo": "Selecione um logotipo personalizado",
+  "Select a VirtIO ISO to use:": "Selecione um VirtIO ISO para usar:",
+  "Select a category of useful commands:": "Selecione uma categoria de comandos úteis:",
+  "Select a category or search for scripts:": "Selecione uma categoria ou pesquise scripts:",
+  "Select a custom ISO to use:": "Selecione um ISO personalizado para usar:",
+  "Select a job:": "Selecione um trabalho:",
+  "Select a network management option:": "Selecione uma opção de gerenciamento de rede:",
+  "Select a new language for the menu:": "Selecione um novo idioma para o menu:",
+  "Select a post-installation script:": "Selecione um script pós-instalação:",
+  "Select a pre-configured Linux VM script to execute:": "Selecione um script de VM Linux pré-configurado para executar:",
+  "Select a script or action:": "Selecione um script ou ação:",
+  "Select a share to delete:": "Selecione um compartilhamento para excluir:",
+  "Select access mode": "Selecione o modo de acesso",
+  "Select an existing group": "Selecione um grupo existente",
+  "Select an existing group:": "Selecione um grupo existente:",
+  "Select an export to delete:": "Selecione uma exportação para excluir:",
+  "Select an option": "Selecione uma opção",
+  "Select an option:": "Selecione uma opção:",
+  "Select another source path and try again.": "Selecione outro caminho de origem e tente novamente.",
+  "Select archive": "Selecione o arquivo",
+  "Select archive to restore": "Selecione o arquivo para restaurar",
+  "Select at least one path to continue.": "Selecione pelo menos um caminho para continuar.",
+  "Select authentication mode:": "Selecione o modo de autenticação:",
+  "Select authentication type:": "Selecione o tipo de autenticação:",
+  "Select available Controllers/NVMe to add:": "Selecione controladores/NVMe disponíveis para adicionar:",
+  "Select backup archive": "Selecione o arquivo de backup",
+  "Select backup archive to restore": "Selecione o arquivo de backup para restaurar",
+  "Select backup backend:": "Selecione back-end de backup:",
+  "Select backup method and profile:": "Selecione o método e perfil de backup:",
+  "Select backup profile:": "Selecione o perfil de backup:",
+  "Select backup to restore": "Selecione backup para restaurar",
+  "Select backup to restore:": "Selecione backup para restaurar:",
+  "Select bridge for network interface(s):": "Selecione a ponte para interface(s) de rede:",
+  "Select container:": "Selecione o contêiner:",
+  "Select content types for this storage:": "Selecione os tipos de conteúdo para este armazenamento:",
+  "Select conversion guide:": "Selecione o guia de conversão:",
+  "Select conversion option:": "Selecione a opção de conversão:",
+  "Select destination": "Selecione o destino",
+  "Select disk interface type:": "Selecione o tipo de interface de disco:",
+  "Select driver version": "Selecione a versão do driver",
+  "Select export format:": "Selecione o formato de exportação:",
+  "Select export permissions:": "Selecione as permissões de exportação:",
+  "Select from /mnt directories": "Selecione nos diretórios /mnt",
+  "Select from existing folders in /mnt": "Selecione uma das pastas existentes em /mnt",
+  "Select from folders inside /mnt": "Selecione nas pastas dentro de /mnt",
+  "Select from recent servers": "Selecione entre servidores recentes",
+  "Select help topic:": "Selecione o tópico de ajuda:",
+  "Select how to provide VirtIO drivers": "Selecione como fornecer drivers VirtIO",
+  "Select iSCSI Target": "Selecione o destino iSCSI",
+  "Select local archive format:": "Selecione o formato de arquivo local:",
+  "Select machine type": "Selecione o tipo de máquina",
+  "Select mount configuration:": "Selecione a configuração de montagem:",
+  "Select mount options. Open uid/gid/file_mode are always applied so unprivileged LXC bind-mounts can write:": "Selecione as opções de montagem. Open uid/gid/file_mode são sempre aplicados para que montagens de ligação LXC sem privilégios possam escrever:",
+  "Select mount options:": "Selecione as opções de montagem:",
+  "Select mount point to remove from container": "Selecione o ponto de montagem para remover do contêiner",
+  "Select mount point to unmount:": "Selecione o ponto de montagem para desmontar:",
+  "Select network access level:": "Selecione o nível de acesso à rede:",
+  "Select one of the ready-to-run Linux VMs:": "Selecione uma das VMs Linux prontas para execução:",
+  "Select one or more GPU(s) to switch mode:": "Selecione uma ou mais GPU(s) para alternar o modo:",
+  "Select one or more disk images to import:": "Selecione uma ou mais imagens de disco para importar:",
+  "Select operation:": "Selecione a operação:",
+  "Select optimizations to uninstall:": "Selecione otimizações para desinstalar:",
+  "Select option": "Selecione a opção",
+  "Select option [1-2] (default: 2):": "Selecione a opção [1-2] (padrão: 2):",
+  "Select option [1-3] (default: 3):": "Selecione a opção [1-3] (padrão: 3):",
+  "Select repository destination:": "Selecione o destino do repositório:",
+  "Select restore source:": "Selecione a fonte de restauração:",
+  "Select run mode": "Selecione o modo de execução",
+  "Select share permissions:": "Selecione permissões de compartilhamento:",
+  "Select storage for imported disk(s):": "Selecione o armazenamento para discos importados:",
+  "Select storage to remove:": "Selecione o armazenamento a ser removido:",
+  "Select target IQN:": "Selecione o IQN alvo:",
+  "Select target mode for selected GPU(s):": "Selecione o modo de destino para GPU(s) selecionada(s):",
+  "Select the CT to manage NFS/Samba client:": "Selecione o CT para gerenciar o cliente NFS/Samba:",
+  "Select the CT to which you want to add disks:": "Selecione o CT ao qual deseja adicionar discos:",
+  "Select the GPU to pass through to the VM:": "Selecione a GPU para passar para a VM:",
+  "Select the GPU(s) to add to LXC": "Selecione as GPU(s) para adicionar ao LXC",
+  "Select the LXC container:": "Selecione o contêiner LXC:",
+  "Select the Linux distribution to install:": "Selecione a distribuição Linux para instalar:",
+  "Select the NAS system to install:": "Selecione o sistema NAS para instalar:",
+  "Select the NVIDIA driver version to install:": "Selecione a versão do driver NVIDIA para instalar:",
+  "Select the VM to add the GPU to:": "Selecione a VM à qual adicionar a GPU:",
+  "Select the VM to which you want to add disks:": "Selecione a VM à qual você deseja adicionar discos:",
+  "Select the VM where you want to import the disk image:": "Selecione a VM para a qual deseja importar a imagem de disco:",
+  "Select the bus type for the disks:": "Selecione o tipo de barramento para os discos:",
+  "Select the directory containing disk images:": "Selecione o diretório que contém as imagens de disco:",
+  "Select the directory to bind to container:": "Selecione o diretório para vincular ao contêiner:",
+  "Select the disk to add as Proxmox storage:": "Selecione o disco para adicionar como armazenamento Proxmox:",
+  "Select the disk to test or inspect:": "Selecione o disco para testar ou inspecionar:",
+  "Select the disk you want to format:": "Selecione o disco que deseja formatar:",
+  "Select the disks you want to add:": "Selecione os discos que deseja adicionar:",
+  "Select the disks you want to import (use spacebar to toggle):": "Selecione os discos que deseja importar (use a barra de espaço para alternar):",
+  "Select the entry to remove. [pvesm] entries are removed from Proxmox storage; [fstab] entries are unmounted and removed from /etc/fstab.": "Selecione a entrada a ser removida. As entradas [pvesm] são removidas do armazenamento do Proxmox; As entradas [fstab] são desmontadas e removidas de /etc/fstab.",
+  "Select the entry to remove. [pvesm] entries are removed from Proxmox storage; [fstab] entries are unmounted, removed from /etc/fstab and have their credentials file deleted.": "Selecione a entrada a ser removida. As entradas [pvesm] são removidas do armazenamento do Proxmox; As entradas [fstab] são desmontadas, removidas de /etc/fstab e têm seus arquivos de credenciais excluídos.",
+  "Select the file to import:": "Selecione o arquivo a ser importado:",
+  "Select the filesystem for": "Selecione o sistema de arquivos para",
+  "Select the folder to mount:": "Selecione a pasta para montar:",
+  "Select the interface type for all disks:": "Selecione o tipo de interface para todos os discos:",
+  "Select the interface type for:": "Selecione o tipo de interface para:",
+  "Select the mounted USB to use as backup target:": "Selecione o USB montado para usar como destino de backup:",
+  "Select the optimizations to update. Each one re-runs its post-install function and registers the new version.": "Selecione as otimizações a serem atualizadas. Cada um executa novamente sua função pós-instalação e registra a nova versão.",
+  "Select the parent job to attach to:": "Selecione o trabalho pai ao qual deseja anexar:",
+  "Select the paths to restore (one per backup entry):": "Selecione os caminhos para restaurar (um por entrada de backup):",
+  "Select the privileged LXC container to convert:": "Selecione o contêiner LXC privilegiado para converter:",
+  "Select the storage volume for disk import:": "Selecione o volume de armazenamento para importação de disco:",
+  "Select the sync interval (in hours):": "Selecione o intervalo de sincronização (em horas):",
+  "Select the target VM for PCI passthrough:": "Selecione a VM de destino para passagem PCI:",
+  "Select the type of Linux installation:": "Selecione o tipo de instalação do Linux:",
+  "Select the type of Windows installation:": "Selecione o tipo de instalação do Windows:",
+  "Select the unprivileged LXC container to convert:": "Selecione o contêiner LXC sem privilégios para converter:",
+  "Select utilities to install": "Selecione utilitários para instalar",
+  "Select what to do with this disk:": "Selecione o que fazer com este disco:",
+  "Select where to export VM files (OVA/OVF + temporary workspace):": "Selecione para onde exportar arquivos VM (OVA/OVF + espaço de trabalho temporário):",
+  "Selected GPU function": "Função GPU selecionada",
+  "Selected GPU(s)": "GPU(s) selecionada(s)",
+  "Selected GPU(s):": "GPU(s) selecionada(s):",
+  "Selected LXC action": "Ação LXC selecionada",
+  "Selected VM": "VM selecionada",
+  "Selected VM action": "Ação de VM selecionada",
+  "Selected container": "Contêiner selecionado",
+  "Selected controller/NVMe is already assigned to other VM(s):": "O controlador/NVMe selecionado já está atribuído a outras VMs:",
+  "Selected device is already assigned to other VM(s):": "O dispositivo selecionado já está atribuído a outras VMs:",
+  "Selected devices": "Dispositivos selecionados",
+  "Selected optimizations have been uninstalled.": "As otimizações selecionadas foram desinstaladas.",
+  "Selected paths produced no entries to apply.": "Os caminhos selecionados não produziram entradas a serem aplicadas.",
+  "Selected utilities installation completed": "Instalação de utilitários selecionados concluída",
+  "Sending backup to Borg repository...": "Enviando backup para o repositório Borg...",
+  "Sending backup to PBS...": "Enviando backup para PBS...",
+  "Server": "Servidor",
+  "Server (listen for incoming tests on TCP 5201)": "Servidor (ouvir testes recebidos no TCP 5201)",
+  "Server IP/hostname is correct": "O IP/nome do host do servidor está correto",
+  "Server IP:": "IP do servidor:",
+  "Server is accessible:": "O servidor está acessível:",
+  "Server is online": "O servidor está on-line",
+  "Server is running": "O servidor está em execução",
+  "Server response:": "Resposta do servidor:",
+  "Server stopped. Press Enter to return to menu...": "Servidor parou. Pressione Enter para retornar ao menu...",
+  "Server will listen on TCP port 5201.": "O servidor escutará na porta TCP 5201.",
+  "Server:": "Servidor:",
+  "Servers": "Servidores",
+  "Service Status": "Status do serviço",
+  "Service is active and running": "O serviço está ativo e em execução",
+  "Service is inactive": "O serviço está inativo",
+  "Service restarted.": "Serviço reiniciado.",
+  "Service restarts:": "O serviço é reiniciado:",
+  "Service stopped.": "Serviço parado.",
+  "Services failed": "Falha nos serviços",
+  "Services restarted": "Serviços reiniciados",
+  "Services:": "Serviços:",
+  "Set Display > Graphic card (VGA, SPICE or VirtIO) to match the guest": "Defina Display> Placa gráfica (VGA, SPICE ou VirtIO) para corresponder ao convidado",
+  "Set Hostname": "Definir nome do host",
+  "Set Interface MTU Size (leave blank for default)": "Definir tamanho da MTU da interface (deixe em branco por padrão)",
+  "Set MAC Address (leave empty for automatic)": "Definir endereço MAC (deixe em branco para automático)",
+  "Set MTU (leave empty for default)": "Definir MTU (deixe em branco por padrão)",
+  "Set VLAN (leave empty for none)": "Definir VLAN (deixe em branco para nenhuma)",
+  "Set VM boot order": "Definir ordem de inicialização da VM",
+  "Set Virtual Machine ID": "Definir ID da máquina virtual",
+  "Set a Bridge": "Defina uma ponte",
+  "Set a MAC Address": "Defina um endereço MAC",
+  "Set a Vlan(leave blank for default)": "Defina uma Vlan (deixe em branco por padrão)",
+  "Set network bridge (default: vmbr0)": "Definir ponte de rede (padrão: vmbr0)",
+  "Set ownership and permissions:": "Defina propriedade e permissões:",
+  "Set this disk as the primary boot disk?": "Definir este disco como disco de inicialização principal?",
+  "Set up custom MOTD banner": "configurar banner MOTD personalizado",
+  "Set up the apex group and udev rules": "Configure o grupo apex e as regras do udev",
+  "Set up time synchronization and entropy generation": "Configurar sincronização de tempo e geração de entropia",
+  "Setting APT language configuration...": "Definindo a configuração do idioma APT...",
+  "Setting VM description": "Configurando a descrição da VM",
+  "Setting boot order...": "Configurando a ordem de inicialização...",
+  "Setting directory ownership and permissions...": "Configurando propriedade e permissões do diretório...",
+  "Setting sharedfiles group with UID remapping...": "Configurando grupo de arquivos compartilhados com remapeamento de UID...",
+  "Setting systemd ulimits...": "Configurando limites do systemd...",
+  "Setting ulimit for the shell user...": "Configurando ulimit para o usuário shell...",
+  "Setting up persistent network interfaces": "Configurando interfaces de rede persistentes",
+  "Setting up persistent network interfaces successfully.": "Configurando interfaces de rede persistentes com êxito.",
+  "Setting up the Google Coral APT repository...": "Configurando o repositório Google Coral APT...",
+  "Settings": "Configurações",
+  "Settings post-install Proxmox": "Configurações pós-instalação do Proxmox",
+  "Setup Persistent Network Names": "Configurar nomes de rede persistentes",
+  "Share Access Error": "Erro de acesso ao compartilhamento",
+  "Share Name": "Compartilhar nome",
+  "Share Options": "Opções de compartilhamento",
+  "Share added successfully.": "Compartilhamento adicionado com sucesso.",
+  "Share deleted and Samba service restarted.": "Compartilhamento excluído e serviço Samba reiniciado.",
+  "Share exists:": "Existe compartilhamento:",
+  "Share name:": "Nome do compartilhamento:",
+  "Share not found on server:": "Compartilhamento não encontrado no servidor:",
+  "Share path:": "Compartilhar caminho:",
+  "Share updated successfully.": "Compartilhamento atualizado com sucesso.",
+  "Share:": "Compartilhar:",
+  "Shared Directory Ready:": "Diretório compartilhado pronto:",
+  "Shared Group": "Grupo Compartilhado",
+  "Shared group: CONFIGURED": "Grupo compartilhado: CONFIGURADO",
+  "Shared group: sharedfiles (GID:": "Grupo compartilhado: arquivos compartilhados (GID:",
+  "Sharedfiles group already exists (GID: 101000)": "O grupo Sharedfiles já existe (GID: 101000)",
+  "Shares found:": "Ações encontradas:",
+  "Shell user ulimit set": "Conjunto de limites de usuário do Shell",
+  "Short self-test started on": "Autoteste curto iniciado em",
+  "Short test            — ~2 minutes, basic surface check": "Teste curto — aproximadamente 2 minutos, verificação básica da superfície",
+  "Should show 'unprivileged: 0' or no unprivileged line": "Deve mostrar 'sem privilégios: 0' ou nenhuma linha sem privilégios",
+  "Should show 'unprivileged: 1'": "Deve mostrar 'sem privilégios: 1'",
+  "Should show 'unprivileged: 1' if it's unprivileged": "Deve mostrar 'sem privilégios: 1' se não tiver privilégios",
+  "Should show fewer or no issues": "Deve mostrar menos ou nenhum problema",
+  "Should show pve-manager/9.x.x": "Deve mostrar pve-manager/9.x.x",
+  "Show All Scripts": "Mostrar todos os scripts",
+  "Show CT users in table format": "Mostrar usuários do CT em formato de tabela",
+  "Show Container Privilege Status": "Mostrar status de privilégio do contêiner",
+  "Show DNS resolution status": "Mostrar status de resolução DNS",
+  "Show Ethernet device info": "Mostrar informações do dispositivo Ethernet",
+  "Show GPU frequency": "Mostrar frequência da GPU",
+  "Show GPU kernel driver in use": "Mostrar driver do kernel da GPU em uso",
+  "Show GPU time": "Mostrar tempo da GPU",
+  "Show Monitor Service Status": "Mostrar status do serviço do monitor",
+  "Show Network Config File": "Mostrar arquivo de configuração de rede",
+  "Show Proxmox storage configuration": "Mostrar configuração de armazenamento Proxmox",
+  "Show Proxmox version": "Mostrar versão do Proxmox",
+  "Show Routing Table": "Mostrar tabela de roteamento",
+  "Show UUID and filesystem type of block devices": "Mostrar UUID e tipo de sistema de arquivos de dispositivos de bloco",
+  "Show VM configuration. Use the correct <vmid>": "Mostrar configuração da VM. Use o <vmid> correto",
+  "Show Version Information": "Mostrar informações da versão",
+  "Show ZFS pool status": "Mostrar status do pool ZFS",
+  "Show active firewall rules (iptables)": "Mostrar regras de firewall ativas (iptables)",
+  "Show all active mounts from the kernel": "Mostrar todas as montagens ativas do kernel",
+  "Show available Proxmox upgrades": "Mostrar atualizações disponíveis do Proxmox",
+  "Show configured network bridges": "Mostrar pontes de rede configuradas",
+  "Show container configuration. Use the correct <ctid>": "Mostrar configuração do contêiner. Use o <ctid> correto",
+  "Show detailed keyfile info": "Mostrar informações detalhadas do arquivo-chave",
+  "Show disk usage by mount point": "Mostrar o uso do disco por ponto de montagem",
+  "Show jobs and last run status": "Mostrar trabalhos e status da última execução",
+  "Show listening ports (TCP/UDP)": "Mostrar portas de escuta (TCP/UDP)",
+  "Show manual repair commands": "Mostrar comandos de reparo manual",
+  "Show me the line to paste manually on the server": "Mostre-me a linha para colar manualmente no servidor",
+  "Show mounted storage devices": "Mostrar dispositivos de armazenamento montados",
+  "Show network interfaces and IPs": "Mostrar interfaces de rede e IPs",
+  "Show nftables rules": "Mostrar regras nftables",
+  "Show raw network configuration": "Mostrar configuração de rede bruta",
+  "Show routing table": "Mostrar tabela de roteamento",
+  "Show size of a directory": "Mostrar tamanho de um diretório",
+  "Show standard exclude patterns": "Mostrar padrões de exclusão padrão",
+  "Show status of all storage pools": "Mostrar o status de todos os pools de armazenamento",
+  "Show traffic statistics per interface": "Mostrar estatísticas de tráfego por interface",
+  "Show vzdump backup configuration": "Mostrar configuração de backup do vzdump",
+  "Shows status and type (nfs/cifs/dir/iscsi...).": "Mostra status e tipo (nfs/cifs/dir/iscsi...).",
+  "Shutdown timeout": "Tempo limite de desligamento",
+  "Signatures removed. Partition table preserved.": "Assinaturas removidas. Tabela de partição preservada.",
+  "Single GPU Warning": "Aviso de GPU única",
+  "Single target found — selected automatically:": "Único alvo encontrado — selecionado automaticamente:",
+  "Size": "Tamanho",
+  "Size:": "Tamanho:",
+  "Skip downloading additional languages": "ignorar o download de idiomas adicionais",
+  "Skip this device": "Ignorar este dispositivo",
+  "Skip this step for ZFS/BTRFS": "Pule esta etapa para ZFS/BTRFS",
+  "Skip this step if using no-subscription repository": "Pule esta etapa se estiver usando um repositório sem assinatura",
+  "Skip — I will add it as PCIe device": "Ignorar – vou adicioná-lo como dispositivo PCIe",
+  "Skip — leave as-is": "Pular – deixe como está",
+  "Skipped device": "Dispositivo ignorado",
+  "Skipped to protect target system (would cascade-remove packages)": "Ignorado para proteger o sistema de destino (removeria pacotes em cascata)",
+  "Skipped, not in apt cache:": "Ignorado, não no cache do apt:",
+  "Skipping LXC": "Ignorando LXC",
+  "Skipping SR-IOV device": "Ignorando dispositivo SR-IOV",
+  "Skipping installation.": "Ignorando a instalação.",
+  "Skipping manual patches — feranick fork already supports this kernel.": "Ignorando patches manuais – feranick fork já suporta este kernel.",
+  "Smart restore plan — hardware compatibility check": "Plano de restauração inteligente – verificação de compatibilidade de hardware",
+  "Snippets          — hook scripts / config": "Snippets – scripts/configuração de gancho",
+  "SoC-integrated GPU: tight coupling with other SoC components": "GPU integrada ao SoC: forte acoplamento com outros componentes do SoC",
+  "Some changes require a reboot to take effect. Do you want to restart now?": "Algumas alterações exigem uma reinicialização para entrar em vigor. Quer reiniciar agora?",
+  "Some essential Proxmox packages may not have been installed": "Alguns pacotes essenciais do Proxmox podem não ter sido instalados",
+  "Some log2ram files may still exist. Manual cleanup may be required.": "Alguns arquivos log2ram ainda podem existir. A limpeza manual pode ser necessária.",
+  "Some old time services could not be removed (not installed)": "Alguns serviços antigos não puderam ser removidos (não instalados)",
+  "Some operations failed — review messages above. Press Enter to continue...": "Algumas operações falharam — revise as mensagens acima. Pressione Enter para continuar...",
+  "Some repairs failed. Please fix manually and re-run the script.": "Alguns reparos falharam. Corrija manualmente e execute novamente o script.",
+  "Some repositories are not available, continuing with available ones...": "Alguns repositórios não estão disponíveis, continuando com os disponíveis...",
+  "Some selected GPUs are already configured in this container.": "Algumas GPUs selecionadas já estão configuradas neste contêiner.",
+  "Some signatures could not be removed (see warnings above).": "Algumas assinaturas não puderam ser removidas (veja os avisos acima).",
+  "Something is already mounted at": "Algo já está montado em",
+  "Something is already mounted at:": "Algo já está montado em:",
+  "Source": "Fonte",
+  "Source VM": "VM de origem",
+  "Source patched successfully.": "Fonte corrigida com sucesso.",
+  "Source:": "Fonte:",
+  "Sources copied to": "Fontes copiadas para",
+  "Spanish": "Espanhol",
+  "Specific host (enter IP)": "Host específico (insira o IP)",
+  "Specific subnet (enter manually)": "Sub-rede específica (inserir manualmente)",
+  "Stable (main branch)": "Estável (ramo principal)",
+  "Stable monitor service normalized.": "Serviço de monitor estável normalizado.",
+  "Staging directory:": "Diretório de teste:",
+  "Staging ready.": "Preparação pronta.",
+  "Staging source:": "Fonte de teste:",
+  "Standard NAS   (backup, iso, vztmpl)": "NAS padrão (backup, iso, vztmpl)",
+  "Start VM": "Iniciar VM",
+  "Start VM after creation": "Inicie a VM após a criação",
+  "Start VM after creation?": "Iniciar VM após a criação?",
+  "Start a container. Use the correct <ctid>": "Inicie um contêiner. Use o <ctid> correto",
+  "Start a virtual machine. Use the correct <vmid>": "Inicie uma máquina virtual. Use o <vmid> correto",
+  "Start long self-test (hours)": "Iniciar um autoteste longo (horas)",
+  "Start long test now?": "Iniciar um teste longo agora?",
+  "Start on boot already disabled for VM": "Iniciar na inicialização já desabilitado para VM",
+  "Start on boot disabled for LXC": "Iniciar na inicialização desabilitado para LXC",
+  "Start on boot disabled for VM": "Iniciar na inicialização desabilitado para VM",
+  "Start on boot enabled": "Iniciar na inicialização habilitado",
+  "Start on boot enabled (onboot=1)": "Iniciar na inicialização habilitado (onboot=1)",
+  "Start on boot will be disabled on source VM only if currently enabled": "A inicialização na inicialização será desabilitada na VM de origem somente se estiver habilitada no momento",
+  "Start scrub for a ZFS pool": "Iniciar a limpeza de um pool ZFS",
+  "Start short self-test (~2 min)": "Inicie um autoteste curto (~2 min)",
+  "Start terminal multiplexer (recommended):": "Inicie o multiplexador de terminal (recomendado):",
+  "Start the VM": "Inicie a VM",
+  "Start the VM to begin Windows installation from the mounted ISO.": "Inicie a VM para iniciar a instalação do Windows a partir do ISO montado.",
+  "Start the converted container:": "Inicie o contêiner convertido:",
+  "Start the main system upgrade:": "Inicie a atualização principal do sistema:",
+  "Start uploading to PBS — sets a recovery passphrase": "comece a enviar para o PBS – define uma senha de recuperação",
+  "Starting Borg backup...": "Iniciando backup do Borg...",
+  "Starting CT": "Iniciando TC",
+  "Starting LXC Privileged to Unprivileged conversion process...": "Iniciando o processo de conversão LXC privilegiado para não privilegiado...",
+  "Starting LXC Unprivileged to Privileged conversion process...": "Iniciando o processo de conversão de LXC sem privilégios para privilegiados...",
+  "Starting NVIDIA installer. This may take several minutes...": "Iniciando o instalador NVIDIA. Isso pode levar vários minutos...",
+  "Starting NVMe long self-test...": "Iniciando o autoteste longo do NVMe...",
+  "Starting NVMe short self-test...": "Iniciando o autoteste curto do NVMe...",
+  "Starting ProxMenux update...": "Iniciando atualização do ProxMenux...",
+  "Starting Proxmox storage integration...": "Iniciando a integração do armazenamento Proxmox...",
+  "Starting Proxmox system repair...": "Iniciando o reparo do sistema Proxmox...",
+  "Starting SMART long self-test...": "Iniciando o autoteste longo SMART...",
+  "Starting SMART short self-test...": "Iniciando o autoteste curto SMART...",
+  "Starting container": "Iniciando contêiner",
+  "Starting container...": "Iniciando contêiner...",
+  "Starting direct conversion of container": "Iniciando a conversão direta do contêiner",
+  "Starting gateway...": "Iniciando gateway...",
+  "Starting installation...": "Iniciando a instalação...",
+  "Starting installer...": "Iniciando o instalador...",
+  "Starting privileged container...": "Iniciando contêiner privilegiado...",
+  "Starting rpcbind service...": "Iniciando o serviço rpcbind...",
+  "Starting unprivileged container...": "Iniciando contêiner sem privilégios...",
+  "Status": "Status",
+  "Status:": "Status:",
+  "Step": "Etapa",
+  "Step 2: Testing actual share access with guest...": "Etapa 2: Testando o acesso real ao compartilhamento com convidados...",
+  "Steps that will run:": "Etapas que serão executadas:",
+  "Still has issues": "Ainda tem problemas",
+  "Stop it first and run this option again.": "Pare primeiro e execute esta opção novamente.",
+  "Stop the CT, unmount the disk on the HOST, and remount with:": "Pare o CT, desmonte o disco no HOST e remonte com:",
+  "Stop the VM/CT before formatting this disk.": "Pare a VM/CT antes de formatar este disco.",
+  "Stop the container if it's running:": "Pare o contêiner se ele estiver em execução:",
+  "Stop them first and run this script again.": "Pare-os primeiro e execute este script novamente.",
+  "Stop uploading to PBS": "Pare de fazer upload para PBS",
+  "Stop uploading?": "Parar de enviar?",
+  "Stopped": "Parou",
+  "Stopped and disabled": "Parado e desabilitado",
+  "Stopping Coral kernel modules...": "Parando módulos do kernel Coral...",
+  "Stopping LXC": "Parando LXC",
+  "Stopping NFS services...": "Parando serviços NFS...",
+  "Stopping ProxMenux Monitor service...": "Interrompendo o serviço ProxMenux Monitor...",
+  "Stopping Samba services...": "Parando serviços do Samba...",
+  "Stopping VM": "Parando VM",
+  "Stopping and disabling NVIDIA services...": "Parando e desativando serviços NVIDIA...",
+  "Stopping container": "Parando o contêiner",
+  "Stopping gateway...": "Parando o gateway...",
+  "Stopping the container before applying configuration...": "Parando o contêiner antes de aplicar a configuração...",
+  "Stopping the container before conversion...": "Parando o contêiner antes da conversão...",
+  "Storage": "Armazenar",
+  "Storage & Share Manager": "Gerenciador de armazenamento e compartilhamento",
+  "Storage Added:": "Armazenamento adicionado:",
+  "Storage Exists": "Existe armazenamento",
+  "Storage ID": "ID de armazenamento",
+  "Storage ID already exists. Do you want to remove and recreate it?": "O ID de armazenamento já existe. Deseja removê-lo e recriá-lo?",
+  "Storage ID already exists:": "O ID de armazenamento já existe:",
+  "Storage ID is available": "O ID de armazenamento está disponível",
+  "Storage ID:": "ID de armazenamento:",
+  "Storage and Disks Commands": "Comandos de armazenamento e discos",
+  "Storage controller: VirtIO SCSI": "Controlador de armazenamento: VirtIO SCSI",
+  "Storage disk identifier:": "Identificador do disco de armazenamento:",
+  "Storage is now available in Proxmox web interface under Datacenter > Storage": "O armazenamento agora está disponível na interface web do Proxmox em Datacenter > Armazenamento",
+  "Storage plan selection cancelled.": "Seleção do plano de armazenamento cancelada.",
+  "Storage plan selection failed or cancelled": "A seleção do plano de armazenamento falhou ou foi cancelada",
+  "Storage:": "Armazenar:",
+  "Stored Credentials:": "Credenciais armazenadas:",
+  "Stored credentials:": "Credenciais armazenadas:",
+  "Subnet": "Sub-rede",
+  "Subscription banner removed successfully": "Banner de assinatura removido com sucesso",
+  "Subscription banner restored successfully (desktop and mobile)": "Banner de assinatura restaurado com sucesso (desktop e celular)",
+  "Success": "Sucesso",
+  "Successful": "Bem-sucedido",
+  "Supported formats: .img, .qcow2, .vmdk, .raw": "Formatos suportados: .img, .qcow2, .vmdk, .raw",
+  "Swap partition detected": "Partição de troca detectada",
+  "Swappiness configuration created successfully": "Configuração de troca criada com sucesso",
+  "Switch GPU Mode  (VM <-> LXC)": "Alternar modo GPU (VM <-> LXC)",
+  "Switch Script Not Found": "Alternar script não encontrado",
+  "Switch to GPU -> LXC (native driver mode)": "Mude para GPU -> LXC (modo de driver nativo)",
+  "Switch to GPU -> VM (VFIO passthrough mode)": "Mude para GPU -> VM (modo de passagem VFIO)",
+  "Switches to the free no-subscription repository": "Muda para o repositório gratuito sem assinatura",
+  "Switching to GPU -> LXC mode removes VFIO exclusivity.": "Mudar para GPU -> modo LXC remove a exclusividade VFIO.",
+  "Switching to GPU -> VM mode requires exclusive VFIO binding.": "Mudar para o modo GPU -> VM requer ligação VFIO exclusiva.",
+  "Synchronize time automatically": "sincronizar a hora automaticamente",
+  "System": "Sistema",
+  "System CLI Tools": "Ferramentas CLI do sistema",
+  "System Disk Size (GB)": "Tamanho do disco do sistema (GB)",
+  "System Update Information": "Informações de atualização do sistema",
+  "System Utilities Installer": "Instalador de utilitários de sistema",
+  "System disk is SSD or M.2. Proceeding with Log2RAM setup.": "O disco do sistema é SSD ou M.2. Continuando com a configuração do Log2RAM.",
+  "System errors and logs": "Erros e registros do sistema",
+  "System group apex already exists.": "O ápice do grupo de sistemas já existe.",
+  "System group apex created.": "Apex do grupo de sistemas criado.",
+  "System hardening scoring (0-100)": "Pontuação de fortalecimento do sistema (0-100)",
+  "System hostname and kernel info": "Nome do host do sistema e informações do kernel",
+  "System is already up to date": "O sistema já está atualizado",
+  "System is already up to date. No update needed.": "O sistema já está atualizado. Nenhuma atualização necessária.",
+  "System limits increase completed.": "Aumento dos limites do sistema concluído.",
+  "System limits optimizations removed": "Otimizações de limites do sistema removidas",
+  "System must be updated to latest PVE 8.4+ before starting": "O sistema deve ser atualizado para o PVE 8.4+ mais recente antes de iniciar",
+  "System reboot required": "Reinicialização do sistema necessária",
+  "System upgrade completed": "Atualização do sistema concluída",
+  "System uptime": "Tempo de atividade do sistema",
+  "Systemd ulimits set": "Conjunto de limites do Systemd",
+  "TCP BBR configuration created successfully": "Configuração TCP BBR criada com sucesso",
+  "TCP Fast Open configuration created successfully": "Configuração TCP Fast Open criada com sucesso",
+  "TCP optimizations configuration completed": "Configuração de otimizações TCP concluída",
+  "TCP optimizations reverted (defaults restored on next reboot)": "Otimizações de TCP revertidas (padrões restaurados na próxima reinicialização)",
+  "TCP port 5201 is reachable (firewall on server)": "A porta TCP 5201 está acessível (firewall no servidor)",
+  "TPM device added to VM": "Dispositivo TPM adicionado à VM",
+  "TPM storage selection failed or was cancelled. VM creation aborted.": "A seleção de armazenamento TPM falhou ou foi cancelada. Criação de VM abortada.",
+  "TROUBLESHOOTING:": "SOLUÇÃO DE PROBLEMAS:",
+  "TUI mode": "Modo TUI",
+  "TUI mode (requires root)": "Modo TUI (requer root)",
+  "Target IQN:": "IQN alvo:",
+  "Target VM": "VM de destino",
+  "Target VM validated": "VM de destino validada",
+  "Target channel:": "Canal alvo:",
+  "Target disk": "Disco de destino",
+  "Target host runs": "execuções do host de destino",
+  "Target mode": "Modo alvo",
+  "Target server:": "Servidor de destino:",
+  "Target:": "Alvo:",
+  "Temporary working directory (if present):": "Diretório de trabalho temporário (se presente):",
+  "Terminal Multiplexers": "Multiplexadores de terminais",
+  "Terminal multiplexer (Ctrl+b then d to detach, or type exit)": "Multiplexador de terminal (Ctrl+b e depois d para desconectar ou digite exit)",
+  "Test Connectivity": "Testar conectividade",
+  "Test NFS Connectivity": "Teste a conectividade NFS",
+  "Test Samba Connectivity": "Teste a conectividade do Samba",
+  "Test iSCSI Connectivity": "Teste a conectividade iSCSI",
+  "Test in progress:": "Teste em andamento:",
+  "Test runs on the drive hardware — safe to close this terminal.": "Testes executados no hardware da unidade – é seguro fechar este terminal.",
+  "Test share visibility:": "Teste a visibilidade do compartilhamento:",
+  "Test typically completes in ~2 minutes.": "O teste normalmente é concluído em aproximadamente 2 minutos.",
+  "Testing": "Teste",
+  "Testing NFS connection...": "Testando conexão NFS...",
+  "Testing comprehensive guest access to server": "Testando o acesso abrangente de convidados ao servidor",
+  "Testing connectivity to portal...": "Testando conectividade com o portal...",
+  "Testing network connectivity...": "Testando conectividade de rede...",
+  "Thank you for using ProxMenux. Goodbye!": "Obrigado por usar o ProxMenux. Adeus!",
+  "That VM is currently stopped, so the GPU can be reassigned now.": "Essa VM está atualmente parada, então a GPU pode ser reatribuída agora.",
+  "That doesn't look like an SSH private key. Pick the private key file (no .pub extension, parseable by ssh-keygen).": "Isso não se parece com uma chave privada SSH.Escolha o arquivo de chave privada (sem extensão .pub, analisável por ssh-keygen).",
+  "The GPU has been moved out of VM": "A GPU foi removida da VM",
+  "The GPU is being detached from VM": "A GPU está sendo desconectada da VM",
+  "The NVIDIA installer needs at least": "O instalador NVIDIA precisa de pelo menos",
+  "The URL does not contain the required parameters (id, pack, edition).": "A URL não contém os parâmetros necessários (id, pack, edição).",
+  "The VM also has these audio devices assigned via PCI passthrough — typically added together with the GPU. Remove them too?": "A VM também possui esses dispositivos de áudio atribuídos por meio de passagem PCI — normalmente adicionados junto com a GPU. Remova-os também?",
+  "The VM guest will have exclusive access to the GPU.": "O convidado da VM terá acesso exclusivo à GPU.",
+  "The VM is powered on. Turn it off before adding disks.": "A VM está ligada. Desligue-o antes de adicionar discos.",
+  "The VM/LXC will lose access to this disk after formatting.": "O VM/LXC perderá acesso a este disco após a formatação.",
+  "The archive could not be extracted.": "O arquivo não pôde ser extraído.",
+  "The archive destination directory is INSIDE one of the paths you are about to back up. Writing the archive there would copy the backup into itself — producing a corrupted archive, or growing without limit until the disk fills up.": "O diretório de destino do arquivo está DENTRO de um dos caminhos dos quais você está prestes a fazer backup. Escrever o arquivo ali copiaria o backup para si mesmo – produzindo um arquivo corrompido ou crescendo sem limites até que o disco ficasse cheio.",
+  "The backup metadata was compared against this host. The following items will be SKIPPED to keep the boot safe:": "os metadados de backup foram comparados com este host.Os seguintes itens serão IGNORADOS para manter a inicialização segura:",
+  "The backup was taken on a different PVE or kernel major.minor. These paths will be SKIPPED to keep the boot safe:": "O backup foi feito em um PVE ou kernel major.minor diferente.Esses caminhos serão SKIPPED para manter a inicialização segura:",
+  "The compatibility check raised failures that may break the system after restore.": "A verificação de compatibilidade levantou falhas que podem danificar o sistema após a restauração.",
+  "The container is currently stopped. Do you want to start it now to install the package?": "O contêiner está atualmente parado. Deseja iniciá-lo agora para instalar o pacote?",
+  "The container should now start as privileged": "O contêiner agora deve começar como privilegiado",
+  "The container should now start as unprivileged": "O contêiner agora deve começar como sem privilégios",
+  "The current driver will be completely uninstalled before installing the new version. Continue?": "O driver atual será completamente desinstalado antes de instalar a nova versão. Continuar?",
+  "The directory does not exist in the CT.": "O diretório não existe no CT.",
+  "The disk": "O disco",
+  "The file does not exist, is empty or is not readable.": "O arquivo não existe, está vazio ou não é legível.",
+  "The filesystem": "O sistema de arquivos",
+  "The following LXC containers have NVIDIA passthrough configured:": "Os seguintes contêineres LXC têm passagem NVIDIA configurada:",
+  "The following backup paths are kernel-tied and are excluded from the picker to keep the target's boot safe. The operator's own tuning inside these paths (IOMMU cmdline, VFIO IDs, custom quirks) is merged back automatically via kernel-agnostic merge:": "Os seguintes caminhos de backup estão vinculados ao kernel e são excluídos do seletor para manter a inicialização do destino segura.O próprio ajuste do operador dentro desses caminhos (cmdline IOMMU, IDs VFIO, peculiaridades personalizadas) é mesclado automaticamente por meio de mesclagem independente de kernel:",
+  "The following changes will be applied": "As seguintes alterações serão aplicadas",
+  "The following devices were excluded because they are part of an SR-IOV configuration:": "Os seguintes dispositivos foram excluídos porque fazem parte de uma configuração SR-IOV:",
+  "The following devices were excluded from Controller/NVMe passthrough because they are part of an SR-IOV configuration:": "Os seguintes dispositivos foram excluídos da passagem do Controlador/NVMe porque fazem parte de uma configuração SR-IOV:",
+  "The following entries exist on the host but were NOT in the backup. To make the host EXACTLY match the backup state, they must be removed:": "As seguintes entradas existem no host, mas NÃO estavam no backup.Para fazer com que o host corresponda EXATAMENTE ao estado de backup, eles devem ser removidos:",
+  "The following selected GPU(s) are currently in GPU -> VM mode (vfio-pci):": "As seguintes GPUs selecionadas estão atualmente no modo GPU -> VM (vfio-pci):",
+  "The following selected device(s) are Physical Functions with active Virtual Functions:": "Os seguintes dispositivos selecionados são funções físicas com funções virtuais ativas:",
+  "The following selected device(s) are SR-IOV Virtual Functions (VFs):": "The following selected device(s) are SR-IOV Virtual Functions (VFs):",
+  "The fstab entry will still be removed; reboot or manual umount needed.": "A entrada fstab ainda será removida; reinicialização ou desmontagem manual necessária.",
+  "The gateway should appear in your Tailscale admin console shortly.": "O gateway deve aparecer em seu console de administração Tailscale em breve.",
+  "The host directory may not be accessible from an unprivileged container.": "O diretório host pode não estar acessível a partir de um contêiner sem privilégios.",
+  "The installation requires a server restart to apply changes. Do you want to restart now?": "A instalação requer a reinicialização do servidor para aplicar as alterações. Quer reiniciar agora?",
+  "The installation/changes require a server restart to apply correctly. Do you want to reboot now?": "A instalação/alterações requerem a reinicialização do servidor para serem aplicadas corretamente. Você quer reiniciar agora?",
+  "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "O envelope local é eliminado e os backups futuros não carregam nada.Os envelopes carregados já no PBS permanecem intactos e podem ser recuperados com sua senha original.",
+  "The long test runs directly on the disk hardware.": "O teste longo é executado diretamente no hardware do disco.",
+  "The new SSH key was installed and is now authorized on the server.\nKey file:": "A nova chave SSH foi instalada e agora está autorizada no servidor.\nArquivo chave:",
+  "The new SSH key was pushed to the LXC via 'pct exec' on": "A nova chave SSH foi enviada para o LXC via 'pct exec' em",
+  "The next visit to the dashboard will show the initial setup wizard.": "A próxima visita ao painel mostrará o assistente de configuração inicial.",
+  "The passwords do not match. Please try again.": "As senhas não coincidem. Por favor, tente novamente.",
+  "The preselected VMID does not exist on this host:": "O VMID pré-selecionado não existe neste host:",
+  "The same GPU cannot be used by two VMs at the same time.": "A mesma GPU não pode ser usada por duas VMs ao mesmo tempo.",
+  "The script clones the osx-proxmox.com repository and once the setup is complete, the server will automatically reboot.": "O script clona o repositório osx-proxmox.com e assim que a configuração for concluída, o servidor será reinicializado automaticamente.",
+  "The script will continue to restore VM passthrough mode on the host and reuse existing hostpci entries.": "O script continuará a restaurar o modo de passagem da VM no host e a reutilizar as entradas hostpci existentes.",
+  "The script will preconfigure the selected GPU now and finalize hardware binding after reboot.": "O script irá pré-configurar a GPU selecionada agora e finalizará a ligação do hardware após a reinicialização.",
+  "The selected AMD GPU does not report FLR reset support": "A GPU AMD selecionada não relata suporte para redefinição de FLR",
+  "The selected AMD GPU is currently in power state D3cold": "A GPU AMD selecionada está atualmente no estado de energia D3cold",
+  "The selected GPU configuration already exists in this container.": "A configuração de GPU selecionada já existe neste contêiner.",
+  "The selected GPU has no dedicated .1 audio sibling function.": "A GPU selecionada não possui função de irmão de áudio .1 dedicada.",
+  "The selected GPU is already assigned to another VM that is currently running:": "A GPU selecionada já está atribuída a outra VM em execução:",
+  "The selected GPU is already assigned to this VM, but the host is not currently using vfio-pci for this device.": "A GPU selecionada já está atribuída a esta VM, mas o host não está usando atualmente vfio-pci para este dispositivo.",
+  "The selected GPU is already assigned to this VM.": "A GPU selecionada já está atribuída a esta VM.",
+  "The selected GPU is already configured for passthrough to:": "A GPU selecionada já está configurada para passagem para:",
+  "The selected GPU is already present in this VM. Select another GPU to continue:": "A GPU selecionada já está presente nesta VM. Selecione outra GPU para continuar:",
+  "The selected GPU is currently used by the following LXC container(s):": "A GPU selecionada é atualmente usada pelos seguintes contêineres LXC:",
+  "The selected GPU(s) are configured in these VM(s)": "As GPU(s) selecionadas estão configuradas nesta(s) VM(s)",
+  "The selected GPU(s) are configured in these VM(s):": "As GPUs selecionadas estão configuradas nestas VMs:",
+  "The selected GPU(s) are used in these LXC container(s)": "As GPU(s) selecionada(s) são usadas neste(s) contêiner(es) LXC",
+  "The selected GPU(s) are used in these LXC container(s):": "As GPUs selecionadas são usadas nestes contêineres LXC:",
+  "The selected Intel GPU belongs to Apollo Lake generation and is blocked by policy for VM passthrough due to host instability risk.": "A GPU Intel selecionada pertence à geração Apollo Lake e está bloqueada pela política de passagem de VM devido ao risco de instabilidade do host.",
+  "The selected Intel GPU does not expose a PCI reset interface": "A GPU Intel selecionada não expõe uma interface de redefinição PCI",
+  "The selected Intel GPU has non-FLR reset support and unknown subtype": "A GPU Intel selecionada tem suporte para redefinição não FLR e subtipo desconhecido",
+  "The selected Intel GPU is currently in power state D3cold": "A GPU Intel selecionada está atualmente no estado de energia D3cold",
+  "The selected VM": "A VM selecionada",
+  "The selected VM is running.": "A VM selecionada está em execução.",
+  "The selected base folder does not exist and could not be created:": "A pasta base selecionada não existe e não pôde ser criada:",
+  "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "O contêiner selecionado não tem privilégios. Um contêiner privilegiado é necessário para passagem direta do dispositivo.",
+  "The selected device": "O dispositivo selecionado",
+  "The selected directory does not exist:": "O diretório selecionado não existe:",
+  "The selected disk has an active swap partition. Aborting.": "O disco selecionado possui uma partição swap ativa. Abortando.",
+  "The selected disk is currently used by a RUNNING VM or CT. Stop it before formatting.": "O disco selecionado é usado atualmente por uma VM ou CT em RUNNING. Pare antes de formatar.",
+  "The selected disk is now part of the system ZFS pool. Aborting.": "O disco selecionado agora faz parte do pool ZFS do sistema. Abortando.",
+  "The selected disk now contains a system-critical mount. Aborting.": "O disco selecionado agora contém uma montagem crítica do sistema. Abortando.",
+  "The selected path does not exist on this host:": "O caminho selecionado não existe neste host:",
+  "The selected path is not a valid directory:": "O caminho selecionado não é um diretório válido:",
+  "The server connected you as guest instead of the specified user.": "O servidor conectou você como convidado em vez do usuário especificado.",
+  "The server may not have accessible shares.": "O servidor pode não ter compartilhamentos acessíveis.",
+  "The server may require authentication for actual share access.": "O servidor pode exigir autenticação para acesso real ao compartilhamento.",
+  "The server refused password authentication for": "O servidor recusou a autenticação por senha para",
+  "The server rejected": "O servidor rejeitou",
+  "The share already exists in smb.conf:": "O compartilhamento já existe em smb.conf:",
+  "The source VM also has these audio devices, likely added together with the GPU. Remove them too?": "A VM de origem também possui esses dispositivos de áudio, provavelmente adicionados junto com a GPU. Remova-os também?",
+  "The specified directory does not exist:": "O diretório especificado não existe:",
+  "The storage has been removed and the disk unmounted.": "O armazenamento foi removido e o disco desmontado.",
+  "The test will continue even if you close this terminal.": "O teste continuará mesmo se você fechar este terminal.",
+  "Then bind-mount to container": "Em seguida, ligue a montagem ao contêiner",
+  "Then change the VM display to none (vga: none) when the guest is stable.": "Em seguida, altere a exibição da VM para nenhum (vga: nenhum) quando o convidado estiver estável.",
+  "Then change the VM display to none (vga: none) when the system is stable.": "Em seguida, altere a exibição da VM para nenhum (vga: nenhum) quando o sistema estiver estável.",
+  "Then run this option again:": "Em seguida, execute esta opção novamente:",
+  "Then update /etc/fstab on the host with the same options.": "Em seguida, atualize /etc/fstab no host com as mesmas opções.",
+  "These are the changes that will be made": "Estas são as mudanças que serão feitas",
+  "These interface configurations will be removed": "Essas configurações de interface serão removidas",
+  "These paths will not be restored live and will be extracted for manual recovery.": "Esses caminhos não serão restaurados ao vivo e serão extraídos para recuperação manual.",
+  "This CIFS share is mounted with restrictive permissions.": "Este compartilhamento CIFS é montado com permissões restritivas.",
+  "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Esta GPU é considerada incompatível com a passagem de GPU para uma VM no ProxMenux.",
+  "This NFS share is fully restricted — even the host root cannot write to it.": "Este compartilhamento NFS é totalmente restrito — até mesmo o host root não pode gravar nele.",
+  "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Esta VM requer etapas extras de instalação. Consulte o guia de instalação em:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
+  "This action will:": "Esta ação irá:",
+  "This archive does not contain a recognized backup layout.": "Este arquivo não contém um layout de backup reconhecido.",
+  "This backup does not contain any restorable paths.": "Este backup não contém nenhum caminho restaurável.",
+  "This backup includes /etc/zfs/zpool.cache (host-specific ZFS state).": "Este backup inclui /etc/zfs/zpool.cache (estado ZFS específico do host).",
+  "This backup is encrypted.": "Este backup está criptografado.",
+  "This backup was taken on kernel": "Este backup foi feito no kernel",
+  "This container does not have apt-get. NFS client installation only supports Debian/Ubuntu containers.": "Este contêiner não possui o apt-get. A instalação do cliente NFS suporta apenas contêineres Debian/Ubuntu.",
+  "This container does not have apt-get. Samba client installation only supports Debian/Ubuntu containers.": "Este contêiner não possui o apt-get. A instalação do cliente Samba suporta apenas contêineres Debian/Ubuntu.",
+  "This container has no GPU configured. Coral TPU works best alongside hardware video decoding (Quick Sync, VA-API, NVENC) for apps like Frigate.": "Este contêiner não tem GPU configurada. Coral TPU funciona melhor com decodificação de vídeo de hardware (Quick Sync, VA-API, NVENC) para aplicativos como Frigate.",
+  "This converts all directory UIDs/GIDs by adding 100000": "Isso converte todos os UIDs/GIDs de diretório adicionando 100.000",
+  "This converts all file UIDs/GIDs by adding 100000": "Isso converte todos os UIDs/GIDs de arquivo adicionando 100.000",
+  "This creates a backup in case you need to revert changes": "Isso cria um backup caso você precise reverter as alterações",
+  "This erases existing metadata.": "Isso apaga os metadados existentes.",
+  "This explicitly marks the container as privileged": "Isso marca explicitamente o contêiner como privilegiado",
+  "This guarantees that device nodes are available before applying LXC GPU config.": "Isso garante que os nós do dispositivo estejam disponíveis antes de aplicar a configuração da GPU LXC.",
+  "This installation will:": "Esta instalação irá:",
+  "This installer will:": "Este instalador irá:",
+  "This interface is configured but doesn't exist physically": "Esta interface está configurada, mas não existe fisicamente",
+  "This is IRREVERSIBLE.": "Mensagem técnica para Proxmox e TI.Traduza: Isso é IRREVERSÍVEL.",
+  "This is a destructive action": "Esta é uma ação destrutiva",
+  "This is a simple configuration change": "Esta é uma simples mudança de configuração",
+  "This is an external community script maintained by": "Este é um script da comunidade externa mantido por",
+  "This is an external script that creates a macOS VM in Proxmox VE in just a few steps, whether you are using AMD or Intel hardware.": "Este é um script externo que cria uma VM macOS no Proxmox VE em apenas algumas etapas, esteja você usando hardware AMD ou Intel.",
+  "This is unexpected since credentials were validated.": "Isto é inesperado, uma vez que as credenciais foram validadas.",
+  "This marks the container as unprivileged": "Isso marca o contêiner como sem privilégios",
+  "This may be normal for a fresh installation": "Isso pode ser normal para uma nova instalação",
+  "This may take a few seconds...": "Isso pode levar alguns segundos...",
+  "This may take several minutes...": "Isso pode levar vários minutos...",
+  "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "Isso significa que o Proxmox lida com o ciclo de vida da montagem nativamente (não é necessário /etc/fstab manual para armazenamentos de host NFS/CIFS).",
+  "This means the credentials are incorrect.": "Isso significa que as credenciais estão incorretas.",
+  "This might indicate network connectivity issues.": "Isso pode indicar problemas de conectividade de rede.",
+  "This operation may take several minutes and requires internet connectivity.": "Esta operação pode demorar vários minutos e requer conectividade com a Internet.",
+  "This passphrase is the ONLY way to access encrypted Borg backups.": "Esta senha é a ÚNICA maneira de acessar backups criptografados do Borg.",
+  "This path is already used as a mount point in this container.": "Este caminho já é usado como ponto de montagem neste contêiner.",
+  "This path is not a registered mount point. Use it anyway?": "Este caminho não é um ponto de montagem registrado. Usar mesmo assim?",
+  "This process changes file ownership inside the container": "Este processo altera a propriedade do arquivo dentro do contêiner",
+  "This release channel is already active.": "Este canal de lançamento já está ativo.",
+  "This removes the 'unprivileged: 1' line from the config": "Isso remove a linha ‘unprivileged: 1’ da configuração",
+  "This removes the storage from Proxmox. The iSCSI target is not affected.": "Isso remove o armazenamento do Proxmox. O destino iSCSI não é afetado.",
+  "This replaces the currently installed keyfile.": "Isto substitui o arquivo-chave atualmente instalado.",
+  "This returns available IQNs.": "Isso retorna IQNs disponíveis.",
+  "This script cannot be executed from the Proxmox web terminal.": "Este script não pode ser executado no terminal web Proxmox.",
+  "This script must be run as root.": "Este script deve ser executado como root.",
+  "This script must be run on a Proxmox host.": "Este script deve ser executado em um host Proxmox.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Este script aplicará as seguintes otimizações e ajustes avançados ao seu servidor Proxmox VE",
+  "This script will update your Proxmox VE system with advanced options:": "Este script atualizará seu sistema Proxmox VE com opções avançadas:",
+  "This shows the storage type and disk identifier": "Isso mostra o tipo de armazenamento e o identificador do disco",
+  "This state has a high probability of VM startup/reset failures.": "Este estado tem uma alta probabilidade de falhas de inicialização/redefinição da VM.",
+  "This state indicates a high risk of passthrough failure due to": "Este estado indica um alto risco de falha de passagem devido a",
+  "This tool is designed for systems with AMD GPUs.": "Esta ferramenta foi projetada para sistemas com GPUs AMD.",
+  "This tool is designed for systems with Intel GPUs.": "Esta ferramenta foi projetada para sistemas com GPUs Intel.",
+  "This will RESET the ProxMenux Monitor login credentials on this host:": "Isso irá REINICIAR as credenciais de login do ProxMenux Monitor neste host:",
+  "This will add the mount to /etc/fstab so it persists after reboot.": "Isso adicionará a montagem ao /etc/fstab para que persista após a reinicialização.",
+  "This will completely remove Fail2Ban and its configuration. Continue?": "Isso removerá completamente o Fail2Ban e sua configuração. Continuar?",
+  "This will completely remove Lynis from the system. Continue?": "Isso removerá completamente Lynis do sistema. Continuar?",
+  "This will create a new VM": "Isso criará uma nova VM",
+  "This will deploy a Tailscale VPN gateway for secure remote access.": "Isso implantará um gateway VPN Tailscale para acesso remoto seguro.",
+  "This will install and configure Fail2Ban with:": "Isto irá instalar e configurar o Fail2Ban com:",
+  "This will install the Beta version from the develop branch and enable beta update checks.\n\nBeta builds may contain bugs or incomplete features.\n\nContinue?": "Isso instalará a versão Beta do branch de desenvolvimento e permitirá verificações de atualização beta.\n\nAs compilações beta podem conter bugs ou recursos incompletos.\n\nContinuar?",
+  "This will launch the GPU assistant after VM creation and may require a host reboot.": "Isso iniciará o assistente de GPU após a criação da VM e poderá exigir a reinicialização do host.",
+  "This will reinstall and reconfigure Fail2Ban with the default ProxMenux settings. Continue?": "Isso irá reinstalar e reconfigurar o Fail2Ban com as configurações padrão do ProxMenux. Continuar?",
+  "This will reinstall core Proxmox packages and regenerate certificates": "Isso irá reinstalar os pacotes principais do Proxmox e regenerar os certificados",
+  "This will reinstall the Stable version from the main branch and disable beta update checks.\n\nContinue?": "Isso reinstalará a versão estável da ramificação principal e desativará as verificações de atualização beta.\n\nContinuar?",
+  "This will remove NVIDIA drivers and related configuration. Do you want to continue?": "Isso removerá os drivers NVIDIA e configurações relacionadas. Você quer continuar?",
+  "This will remove and reinstall Lynis from the latest GitHub source. Continue?": "Isso removerá e reinstalará o Lynis da fonte GitHub mais recente. Continuar?",
+  "This will remove the Coral TPU drivers (gasket DKMS + libedgetpu) and related configuration. Any LXC container with apex passthrough will lose access to /dev/apex_* after reboot. Continue?": "Isso removerá os drivers Coral TPU (junta DKMS + libedgetpu) e a configuração relacionada. Qualquer contêiner LXC com passagem apex perderá acesso a /dev/apex_* após a reinicialização. Continuar?",
+  "This will remove the mount from /etc/fstab and delete credentials if present.": "Isso removerá a montagem de /etc/fstab e excluirá as credenciais, se presentes.",
+  "This will remove the mount from /etc/fstab.": "Isso removerá a montagem de /etc/fstab.",
+  "This will restart the network service and may cause a brief disconnection. Continue?": "Isto reiniciará o serviço de rede e poderá causar uma breve desconexão. Continuar?",
+  "This will take time. Answer prompts carefully - see notes below.": "Isso levará tempo. Responda às solicitações com cuidado - veja as notas abaixo.",
+  "This will upgrade this node to Proxmox VE 9 on Debian Trixie.": "Isto irá atualizar este nó para Proxmox VE 9 no Debian Trixie.",
+  "Tick the paths to include in this backup. Press \"Add custom path\" to add a folder or file of your own to the list.": "Assinale os caminhos a incluir neste backup. Pressione \"Adicionar caminho personalizado\" para adicionar uma pasta ou arquivo à lista.",
+  "Tick the paths to remove (they will not be deleted from disk — only from this list):": "Marque os caminhos a serem removidos (eles não serão excluídos do disco — apenas desta lista):",
+  "Time settings configured - Timezone:": "Configurações de horário configuradas - Fuso horário:",
+  "Time synchronization reset to UTC": "Sincronização de horário redefinida para UTC",
+  "Tip: Also mount the VirtIO ISO for drivers and guest agent installer": "Dica: monte também o VirtIO ISO para drivers e instalador de agente convidado",
+  "Tip: You can install the QEMU Guest Agent inside the VM with:": "Dica: você pode instalar o agente convidado QEMU dentro da VM com:",
+  "Tip: zfs set acltype=posixacl xattr=sa <pool>/<dataset> enables full ACL support.": "Dica: zfs set acltype=posixacl xattr=sa <pool>/<dataset> permite suporte completo a ACL.",
+  "To allow LXC write access, change the NFS export on the server to include:": "Para permitir o acesso de gravação LXC, altere a exportação NFS no servidor para incluir:",
+  "To assign VFs to VMs or LXCs, edit the configuration manually via the Proxmox web interface. The Physical Function will remain bound to the native driver.": "Para atribuir VFs a VMs ou LXCs, edite a configuração manualmente por meio da interface web do Proxmox. A Função Física permanecerá vinculada ao driver nativo.",
+  "To continue with Add GPU to LXC, first switch the host to GPU -> LXC mode and reboot.": "Para continuar com Adicionar GPU ao LXC, primeiro mude o host para GPU -> modo LXC e reinicie.",
+  "To copy any of these files verbatim, restore this backup on a host with the same kernel major.minor.": "Para copiar qualquer um desses arquivos literalmente, restaure esse backup em um host com o mesmo kernel major.minor.",
+  "To exit iftop, press q": "Para sair do iftop, pressione q",
+  "To exit iptraf-ng, press x": "Para sair do iptraf-ng, pressione x",
+  "To fix this, do ONE of the following:": "Para corrigir isso, faça UM dos seguintes:",
+  "To install host drivers, first remove the GPU from VM passthrough configuration and reboot.": "Para instalar drivers de host, primeiro remova a GPU da configuração de passagem da VM e reinicie.",
+  "To install the monitor, reinstall ProxMenux with the latest version": "Para instalar o monitor, reinstale o ProxMenux com a versão mais recente",
+  "To pass SR-IOV Virtual Functions to a VM, edit the VM configuration manually via the Proxmox web interface.": "Para passar funções virtuais SR-IOV para uma VM, edite a configuração da VM manualmente por meio da interface da web do Proxmox.",
+  "To pass SR-IOV Virtual Functions to a container, edit the LXC configuration manually via the Proxmox web interface. The Physical Function will remain bound to the native driver.": "Para passar funções virtuais SR-IOV para um contêiner, edite a configuração LXC manualmente por meio da interface da web do Proxmox. A Função Física permanecerá vinculada ao driver nativo.",
+  "To remove partial VM:": "Para remover VM parcial:",
+  "To restore": "Para restaurar",
+  "To revert changes:": "Para reverter alterações:",
+  "To start the VM:": "Para iniciar a VM:",
+  "To stop:": "Para parar:",
+  "To use Coral from a regular app, install the libedgetpu runtime via the usual method for your distro (community package or build from source). The simplest path is to run an app container that bundles the runtime — e.g. the Frigate Docker image — passing the device through with": "Para usar o Coral a partir de um aplicativo normal, instale o tempo de execução libedgetpu através do método usual para sua distribuição (pacote comunitário ou compilação a partir do código-fonte). O caminho mais simples é executar um contêiner de aplicativo que agrupe o tempo de execução – por exemplo. a imagem do Frigate Docker - passando o dispositivo com",
+  "To use GPU passthrough, please create a new VM configured with:": "Para usar a passagem de GPU, crie uma nova VM configurada com:",
+  "To use a custom Fastfetch logo, place your ASCII logo file in:\n\n/usr/local/share/fastfetch/logos/\n\nThe file should not exceed 35 lines to fit properly in the terminal.\n\nPress OK to continue and select your logo.": "Para usar um logotipo Fastfetch personalizado, coloque o arquivo do logotipo ASCII em:\n\n/usr/local/share/fastfetch/logos/\n\nO arquivo não deve exceder 35 linhas para caber corretamente no terminal.\n\nPressione OK para continuar e selecione seu logotipo.",
+  "To use the GPU again in LXC, run Add GPU to LXC from GPUs and Coral-TPU Menu": "Para usar a GPU novamente no LXC, execute Adicionar GPU ao LXC em GPUs e menu Coral-TPU",
+  "To use the VM without issues, the host must be restarted before starting it.": "Para usar a VM sem problemas, o host deve ser reiniciado antes de iniciá-lo.",
+  "To use this share from an LXC, bind-mount it via:": "Para usar este compartilhamento de um LXC, monte-o por meio de:",
+  "Tool exit code:": "Código de saída da ferramenta:",
+  "Tool output:": "Saída da ferramenta:",
+  "Top memory processes in CT": "Principais processos de memória em CT",
+  "Total": "Total",
+  "Total members:": "Total de membros:",
+  "Total routes": "Rotas totais",
+  "Total size:": "Tamanho total:",
+  "Translation files:": "Arquivos de tradução:",
+  "Tried pvesm path and manual detection methods": "Tentei caminho pvesm e métodos de detecção manual",
+  "Try Again": "Tente novamente",
+  "Try a different search term.": "Experimente um termo de pesquisa diferente.",
+  "Try accessing": "Tente acessar",
+  "Try another archive": "Tente outro arquivo",
+  "Try automatic repair of detected issues": "Experimente o reparo automático dos problemas detectados",
+  "Two-factor authentication and backup codes will be removed.": "A autenticação de dois fatores e os códigos de backup serão removidos.",
+  "Type": "Tipo",
+  "Type the device path EXACTLY to confirm formatting:": "Digite EXATAMENTE o caminho do dispositivo para confirmar a formatação:",
+  "Type the full disk path to confirm": "Digite o caminho completo do disco para confirmar",
+  "Type:": "Tipo:",
+  "Type: attached to PVE storage": "Tipo: anexado ao armazenamento PVE",
+  "Typed value does not match selected disk. Operation cancelled.": "O valor digitado não corresponde ao disco selecionado. Operação cancelada.",
+  "UID in CT": "UID em CT",
+  "UPGRADE PROMPTS - RECOMMENDED ANSWERS:": "PROMPTS DE ATUALIZAÇÃO - RESPOSTAS RECOMENDADAS:",
+  "USB Accelerators:": "Aceleradores USB:",
+  "USB disk target": "destino de disco USB",
+  "USB drives mounted now:": "unidades USB montadas agora:",
+  "USB libedgetpu1": "USB libedgetpu1",
+  "UUP Dump script not found.": "Script de despejo UUP não encontrado.",
+  "UUp Dump ISO creator Custom": "Criador UUp Dump ISO personalizado",
+  "Udev rules for Coral USB devices added and rules reloaded.": "Regras Udev para dispositivos USB Coral adicionadas e regras recarregadas.",
+  "Udev rules for Coral USB devices already exist.": "As regras do Udev para dispositivos USB Coral já existem.",
+  "Udev rules for Coral USB devices appended and rules reloaded.": "Regras Udev para dispositivos Coral USB anexadas e regras recarregadas.",
+  "Umbrel OS installer script by Helper Scripts\n\nVisit the GitHub repo to learn more, contribute, or support the project:\n\nhttps://community-scripts.github.io/ProxmoxVE/scripts?id=umbrel-os-vm": "Script de instalação do Umbrel OS por Helper Scripts\n\nVisite o repositório GitHub para saber mais, contribuir ou apoiar o projeto:\n\nhttps://community-scripts.github.io/ProxmoxVE/scripts?id=umbrel-os-vm",
+  "Unable to detect Proxmox version.": "Não foi possível detectar a versão do Proxmox.",
+  "Understand the security implications of privileged containers": "Entenda as implicações de segurança de contêineres privilegiados",
+  "Uninstall Coral drivers and configuration": "Desinstale os drivers e configuração do Coral",
+  "Uninstall Fail2Ban": "Desinstalar Fail2Ban",
+  "Uninstall Lynis": "Desinstalar Lynis",
+  "Uninstall NFS Server": "Desinstalar o servidor NFS",
+  "Uninstall NVIDIA drivers and configuration": "Desinstale drivers e configurações NVIDIA",
+  "Uninstall Optimizations": "Desinstalar otimizações",
+  "Uninstall ProxMenux": "Desinstalar ProxMenux",
+  "Uninstall Samba Server": "Desinstalar o servidor Samba",
+  "Uninstall optimizations": "Desinstalar otimizações",
+  "Uninstallation Summary:": "Resumo de desinstalação:",
+  "Uninstallation completed. Press Enter to continue...": "Desinstalação concluída. Pressione Enter para continuar...",
+  "Uninstalling Ceph...": "Desinstalando o Ceph...",
+  "Uninstalling Fastfetch...": "Desinstalando o Fastfetch...",
+  "Uninstalling Figurine...": "Desinstalando a estatueta...",
+  "Uninstalling amdgpu_top...": "Desinstalando amdgpu_top...",
+  "Uninstalling current NVIDIA driver before installing new version": "Desinstalando o driver NVIDIA atual antes de instalar a nova versão",
+  "Uninstalling intel-gpu-tools...": "Desinstalando ferramentas Intel-GPU...",
+  "Uninstalling kexec-tools and removing custom service...": "Desinstalando kexec-tools e removendo serviço personalizado...",
+  "Uninstalling log2ram (all versions)...": "Desinstalando log2ram (todas as versões)...",
+  "Universal Group Configuration:": "Configuração de grupo universal:",
+  "Universal Group:": "Grupo universal:",
+  "Universal NFS server has been completely uninstalled!": "O servidor NFS universal foi completamente desinstalado!",
+  "Universal compatibility: ENABLED": "Compatibilidade universal: HABILITADO",
+  "Universal group: NOT CONFIGURED": "Grupo universal: NÃO CONFIGURADO",
+  "Universal sharedfiles group configured with": "Grupo universal de arquivos compartilhados configurado com",
+  "Unknown": "Desconhecido",
+  "Unknown CPU type. IOMMU might not be properly enabled.": "Tipo de CPU desconhecido. O IOMMU pode não estar habilitado corretamente.",
+  "Unknown CPU vendor. Cannot determine IOMMU parameter.": "Fornecedor de CPU desconhecido. Não é possível determinar o parâmetro IOMMU.",
+  "Unknown GPU": "GPU desconhecida",
+  "Unknown model": "Modelo desconhecido",
+  "Unknown size": "Tamanho desconhecido",
+  "Unknown storage controller": "Controlador de armazenamento desconhecido",
+  "Unmount NFS Share": "Desmontar compartilhamento NFS",
+  "Unmount Samba Share": "Desmontar compartilhamento do Samba",
+  "Unmount USB drive": "Desmontar unidade USB",
+  "Unmount a USB drive": "Desmontar uma unidade USB",
+  "Unmount and cleanup (LVM only):": "Desmontar e limpar (somente LVM):",
+  "Unmount failed": "Falha na desmontagem",
+  "Unmount it before proceeding. The script will verify this at execution.": "Desmonte-o antes de continuar. O script verificará isso na execução.",
+  "Unmounted": "Desmontado",
+  "Unmounted successfully": "Desmontado com sucesso",
+  "Unmounted:": "Desmontado:",
+  "Unmounting": "Desmontando",
+  "Unmounting disk...": "Desmontando disco...",
+  "Unprivileged": "Sem privilégios",
+  "Unprivileged Container Access": "Acesso a contêineres sem privilégios",
+  "Unprivileged container": "Contêiner sem privilégios",
+  "Unprivileged container selected:": "Contêiner sem privilégios selecionado:",
+  "Unprivileged container — UID offset:": "Contêiner sem privilégios — deslocamento de UID:",
+  "Unprivileged containers map their UIDs to high host UIDs (e.g. 100000+), which appear as 'others' on the host filesystem.": "Contêineres sem privilégios mapeiam seus UIDs para UIDs de host altos (por exemplo, 100.000+), que aparecem como 'outros' no sistema de arquivos do host.",
+  "Unprivileged: Limited access (more secure)": "Sem privilégios: acesso limitado (mais seguro)",
+  "Unreachable": "Inacessível",
+  "Unsupported Terminal": "Terminal não suportado",
+  "Unsupported format. Only .ova and .ovf files are supported.": "Formato não suportado. Somente arquivos .ova e .ovf são suportados.",
+  "Unsupported output format:": "Formato de saída não suportado:",
+  "Update Available": "atualização disponível",
+  "Update Ceph repository (Only if using Ceph):": "Atualize o repositório do Ceph (somente se estiver usando o Ceph):",
+  "Update Debian repositories to Trixie:": "Atualize os repositórios Debian para Trixie:",
+  "Update Export": "Atualizar exportação",
+  "Update Lynis to latest version": "Atualize Lynis para a versão mais recente",
+  "Update NVIDIA in LXC Containers": "Atualizar NVIDIA em contêineres LXC",
+  "Update PVE enterprise repository (Only if using enterprise):": "Atualize o repositório corporativo PVE (somente se estiver usando corporativo):",
+  "Update Proxmox VE Appliance Manager": "Atualizar Proxmox VE Appliance Manager",
+  "Update Proxmox package lists": "Atualizar listas de pacotes Proxmox",
+  "Update Share": "Atualizar compartilhamento",
+  "Update Status": "Atualizar status",
+  "Update and upgrade all system packages": "Atualize e atualize todos os pacotes do sistema",
+  "Update and upgrade system": "Atualizar e atualizar o sistema",
+  "Update cancelled by user": "Atualização cancelada pelo usuário",
+  "Update completed. Press Enter to continue...": "Atualização concluída. Pressione Enter para continuar...",
+  "Update kernel to compatible version": "Atualize o kernel para uma versão compatível",
+  "Update package index:": "Atualizar índice do pacote:",
+  "Update system to latest PVE 8.4+ (if not done already):": "Atualize o sistema para o PVE 8.4+ mais recente (se ainda não tiver feito):",
+  "Updated": "Atualizado",
+  "Updated sharedfiles group to GID: 101000": "Grupo de arquivos compartilhados atualizado para GID: 101000",
+  "Updates all Proxmox and Debian packages": "Atualiza todos os pacotes Proxmox e Debian",
+  "Updates and Packages Commands": "Comandos de atualizações e pacotes",
+  "Updates file is empty or unreadable.": "O arquivo de atualizações está vazio ou ilegível.",
+  "Updating APT package lists...": "Atualizando listas de pacotes APT...",
+  "Updating Debian Bookworm → Trixie in sources.list...": "Atualizando Debian Bookworm → Trixie em fontes.list...",
+  "Updating Figurine binary...": "Atualizando o binário da estatueta...",
+  "Updating Lynis to the latest version...": "Atualizando Lynis para a versão mais recente...",
+  "Updating PVE application manager...": "Atualizando o gerenciador de aplicativos PVE...",
+  "Updating amdgpu_top...": "Atualizando amdgpu_top...",
+  "Updating cluster certificates...": "Atualizando certificados de cluster...",
+  "Updating initramfs (this may take a minute)...": "Atualizando initramfs (isso pode levar um minuto)...",
+  "Updating initramfs for all kernels...": "Atualizando initramfs para todos os kernels...",
+  "Updating initramfs, GRUB, and EFI boot, patience...": "Atualizando initramfs, GRUB e inicialização EFI, paciência...",
+  "Updating journald to store info-level messages...": "Atualizando o diário para armazenar mensagens de nível informativo...",
+  "Updating kernel panic configuration...": "Atualizando a configuração do kernel panic...",
+  "Updating package lists...": "Atualizando listas de pacotes...",
+  "Updating pve-enterprise.list (if present) to Trixie...": "Atualizando pve-enterprise.list (se presente) para Trixie...",
+  "Updating release channel configuration...": "Atualizando configuração do canal de lançamento...",
+  "Upgrade Ceph to compatible version": "Atualize o Ceph para uma versão compatível",
+  "Upgrade PVE 8 to PVE 9": "Atualize PVE 8 para PVE 9",
+  "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Assistente de atualização: Proxmox VE 8 → 9 (Trixie)",
+  "Upgrade canceled by user": "Atualização cancelada pelo usuário",
+  "Upgrade one node at a time": "Atualize um nó por vez",
+  "Upgrade to Proxmox VE 9": "Atualize para Proxmox VE 9",
+  "Upgrading NVIDIA utils (Arch)...": "Atualizando utilitários NVIDIA (Arch)...",
+  "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "Carregar uma cópia criptografada da chave para o PBS para que você possa recuperá-la em um host reinstalado com apenas uma senha?",
+  "Upload key to PBS?": "Carregar chave para PBS?",
+  "Upload to PBS disabled.": "Upload para PBS desativado.",
+  "Upload to PBS enabled. The envelope is uploaded on every encrypted backup.": "Upload para PBS habilitado.O envelope é carregado em cada backup criptografado.",
+  "Upload to PBS is currently: no. Pick an action:": "O upload para PBS é atualmente: não.Escolha uma ação:",
+  "Upload to PBS is currently: yes. Pick an action:": "O upload para PBS é atualmente: sim.Escolha uma ação:",
+  "Upload to PBS: enable, disable or rotate the recovery passphrase": "Carregar para PBS: ativar, desativar ou alternar a senha de recuperação",
+  "Uptime and who is logged in": "Tempo de atividade e quem está logado",
+  "Use \"Check test progress\" to see results.": "Use \"Verificar o progresso do teste\" para ver os resultados.",
+  "Use 'Export to file' to save it and inspect manually.": "Use 'Exportar para arquivo' para salvá-lo e inspecionar manualmente.",
+  "Use 'pct restore' / 'qmrestore' to recover their disks from your VM backups.": "Use 'pct restore' / 'qmrestore' para recuperar seus discos de seus backups de VM.",
+  "Use Custom backup and uncheck the conflicting path from the list": "Use backup personalizado e desmarque o caminho conflitante na lista",
+  "Use Default Settings?": "Usar configurações padrão?",
+  "Use Download first if you want to save a copy of the current key. Continue?": "Use Baixar primeiro se quiser salvar uma cópia da chave atual.Continuar?",
+  "Use SPACE to select, ENTER to confirm": "Use ESPAÇO para selecionar, ENTER para confirmar",
+  "Use SPACE to select/deselect, ENTER to confirm": "Use ESPAÇO para selecionar/desmarcar, ENTER para confirmar",
+  "Use SSH or terminal access (SSH recommended)": "Use SSH ou acesso de terminal (SSH recomendado)",
+  "Use a USB disk": "Use um disco USB",
+  "Use a custom path": "use um caminho personalizado",
+  "Use a privileged LXC for NFS server/client workflows.": "Use um LXC privilegiado para fluxos de trabalho de servidor/cliente NFS.",
+  "Use a privileged LXC for Samba client/server workflows.": "Use um LXC privilegiado para fluxos de trabalho cliente/servidor Samba.",
+  "Use an existing SSH private key file on this host": "Use um arquivo de chave privada SSH existente neste host",
+  "Use an existing keyfile": "Use um arquivo-chave existente",
+  "Use as-is — keep data and filesystem": "Use como está – mantenha os dados e o sistema de arquivos",
+  "Use content types according to your use case.": "Use tipos de conteúdo de acordo com seu caso de uso.",
+  "Use default": "usar padrão",
+  "Use default (Yes)": "Usar padrão (Sim)",
+  "Use default group:": "Usar grupo padrão:",
+  "Use enterprise URL if you have subscription.": "Use o URL corporativo se você tiver assinatura.",
+  "Use existing VirtIO ISO from storage": "Use VirtIO ISO existente do armazenamento",
+  "Use existing filesystem": "Use o sistema de arquivos existente",
+  "Use existing: mount without formatting": "Use existente: monte sem formatação",
+  "Use images only if the directory is on suitable storage.": "Use imagens somente se o diretório estiver em um armazenamento adequado.",
+  "Use mp1/mp2/... for extra mount points.": "Use mp1/mp2/... para pontos de montagem extras.",
+  "Use only when unprivileged containers cannot meet your needs": "Use somente quando contêineres sem privilégios não atenderem às suas necessidades",
+  "Use option 1 to add a local disk (as Proxmox storage and/or as a host mount).": "Use a opção 1 para adicionar um disco local (como armazenamento Proxmox e/ou como montagem de host).",
+  "Use option 1 to add an iSCSI target as Proxmox storage.": "Use a opção 1 para adicionar um destino iSCSI como armazenamento Proxmox.",
+  "Use pigz for faster gzip compression": "Use pigz para compactação gzip mais rápida",
+  "Use the Guided Cleanup option to fix issues safely": "Use a opção Limpeza guiada para corrigir problemas com segurança",
+  "Use the Guided Repair option to fix issues safely": "Use a opção de reparo guiado para corrigir problemas com segurança",
+  "Use these commands on your Proxmox host to access an LXC container's terminal:": "Use estes comandos em seu host Proxmox para acessar o terminal de um contêiner LXC:",
+  "Use tmux or screen to avoid interruptions": "Use tmux ou screen para evitar interrupções",
+  "Use:": "Usar:",
+  "Useful System Commands": "Comandos úteis do sistema",
+  "Useful to verify options/content after script execution.": "Útil para verificar opções/conteúdo após a execução do script.",
+  "User": "Usuário",
+  "User account exists on server": "A conta de usuário existe no servidor",
+  "User activity and uptime": "Atividade do usuário e tempo de atividade",
+  "User chose not to remove NetworkManager": "O usuário optou por não remover o NetworkManager",
+  "User chose to exit for manual backup creation.": "O usuário optou por sair para a criação manual de backup.",
+  "Username": "Nome de usuário",
+  "Username (e.g. root@pam or user@pbs!token):": "Nome de usuário (por exemplo, root@pam ou user@pbs!token):",
+  "Username and password": "Nome de usuário e senha",
+  "Username and password will be cleared.": "O nome de usuário e a senha serão apagados.",
+  "Username cannot be empty.": "O nome de usuário não pode ficar vazio.",
+  "Username is correct": "O nome de usuário está correto",
+  "Username on the Borg server that runs \"borg serve\" (typically \"borg\"). This is NOT the admin/root user of the server — that one is asked later only if you choose \"Generate a new key and authorize it\".": "Nome de usuário no servidor Borg que executa \"borg serve\" (normalmente \"borg\").Este NÃO é o usuário administrador/root do servidor - esse será solicitado posteriormente apenas se você escolher \"Gerar uma nova chave e autorizá-la\".",
+  "Username:": "Nome de usuário:",
+  "Users:": "Usuários:",
+  "Using UUID is recommended over /dev/sdX.": "O uso de UUID é recomendado em /dev/sdX.",
+  "Using advanced configuration": "Usando configuração avançada",
+  "Using default Proxmox logo...": "Usando o logotipo padrão do Proxmox...",
+  "Using existing encryption key:": "Usando a chave de criptografia existente:",
+  "Utilities Installation Menu": "Menu de instalação de utilitários",
+  "Utilities Menu": "Menu Utilitários",
+  "Utilities Verification": "Verificação de utilitários",
+  "Utilities and Tools": "Utilitários e ferramentas",
+  "Utilities installation completed": "Instalação de utilitários concluída",
+  "VFIO device IDs removed from /etc/modprobe.d/vfio.conf": "IDs de dispositivos VFIO removidos de /etc/modprobe.d/vfio.conf",
+  "VFIO modules configured in /etc/modules": "Módulos VFIO configurados em /etc/modules",
+  "VFIO modules configured.": "Módulos VFIO configurados.",
+  "VFIO modules in /etc/modules": "Módulos VFIO em /etc/modules",
+  "VFIO modules removed from /etc/modules": "Módulos VFIO removidos de /etc/modules",
+  "VFIO orphans cleared and initramfs rebuilt — next boot will free the GPU.": "órfãos VFIO limpos e initramfs reconstruídos – a próxima inicialização irá liberar a GPU.",
+  "VFIO orphans cleared but initramfs rebuild failed; check /var/log/proxmenux logs.": "órfãos VFIO eliminados, mas a reconstrução do initramfs falhou;verifique os logs /var/log/proxmenux.",
+  "VLAN": "VLAN",
+  "VM": "VM",
+  "VM Conflict Policy": "Política de conflitos de VM",
+  "VM ID": "ID da VM",
+  "VM ID:": "ID da VM:",
+  "VM Must Be Stopped": "VM deve ser interrompida",
+  "VM Name": "Nome da VM",
+  "VM Storage     (images, backup)": "Armazenamento VM (imagens, backup)",
+  "VM and CT Management Commands": "Comandos de gerenciamento de VM e CT",
+  "VM creation cancelled before disk planning.": "A criação da VM foi cancelada antes do planejamento do disco.",
+  "VM creation cancelled by user.": "Criação de VM cancelada pelo usuário.",
+  "VM creation completed": "Criação de VM concluída",
+  "VM creation completed with GPU passthrough configured.": "Criação de VM concluída com passagem de GPU configurada.",
+  "VM creation completed. GPU passthrough was not applied.": "Criação da VM concluída. A passagem de GPU não foi aplicada.",
+  "VM creation completed. GPU passthrough was skipped (no compatible GPU detected).": "Criação da VM concluída. A passagem da GPU foi ignorada (nenhuma GPU compatível detectada).",
+  "VM creation failed or was cancelled during storage setup.": "A criação da VM falhou ou foi cancelada durante a configuração do armazenamento.",
+  "VM description configured": "Descrição da VM configurada",
+  "VM imported successfully": "VM importada com sucesso",
+  "VM is running": "VM está em execução",
+  "VM is still running. Export cancelled.": "A VM ainda está em execução. Exportação cancelada.",
+  "VM passthrough configuration failed. Review the log and VM config.": "Falha na configuração de passagem da VM. Revise o log e a configuração da VM.",
+  "VM passthrough requires exclusive VFIO binding of the GPU.": "A passagem de VM requer ligação VFIO exclusiva da GPU.",
+  "VM removed:": "VM removida:",
+  "VM selected:": "VM selecionada:",
+  "VM shell created:": "Shell da VM criado:",
+  "VM started": "VM iniciada",
+  "VM stopped": "VM parada",
+  "VM:": "VM:",
+  "VMID in use": "VMID em uso",
+  "VMID must be a number.": "VMID deve ser um número.",
+  "VMID of the Borg server LXC on": "VMID do servidor Borg LXC em",
+  "VMs to destroy:": "VMs para destruir:",
+  "VMs, LXCs, network, /etc/pve, users, cron, packages, drivers, ProxMenux state, etc.": "VMs, LXCs, rede, /etc/pve, usuários, cron, pacotes, drivers, estado ProxMenux, etc.",
+  "Valid backups for all VMs/CTs": "Backups válidos para todas as VMs/CTs",
+  "Validating Proxmox 9 repositories (checking 'proxmox-ve' candidate)...": "Validando repositórios Proxmox 9 (verificando o candidato 'proxmox-ve')...",
+  "Validating credentials with server": "Validando credenciais com servidor",
+  "Validating disk safety...": "Validando a segurança do disco...",
+  "Verbose pool status": "Status detalhado do pool",
+  "Verification": "Verificação",
+  "Verify IOMMU group for PCI device": "Verifique o grupo IOMMU para dispositivo PCI",
+  "Verify Options > OS Type — currently set to:": "Verifique Opções > Tipo de SO — atualmente definido como:",
+  "Verify PVE version (must be 8.4.1 or newer):": "Verifique a versão do PVE (deve ser 8.4.1 ou mais recente):",
+  "Verify active exports:": "Verifique as exportações ativas:",
+  "Verify bridge assignment and NIC model — change to VirtIO if guest drivers are available": "Verifique a atribuição da ponte e o modelo da NIC — mude para VirtIO se drivers convidados estiverem disponíveis",
+  "Verify iSCSI sessions and storage status:": "Verifique as sessões iSCSI e o status do armazenamento:",
+  "Verify inside container:": "Verifique dentro do contêiner:",
+  "Verify installations": "Verifique as instalações",
+  "Verify mount:": "Verifique a montagem:",
+  "Verify the conversion:": "Verifique a conversão:",
+  "Verify the credentials. Switching to manual paste mode so you can finish the setup without re-typing the password.": "verifique as credenciais.Mudando para o modo de colagem manual para que você possa concluir a configuração sem digitar a senha novamente.",
+  "Verifying Ceph installation...": "Verificando a instalação do Ceph...",
+  "Verifying Ceph packages availability...": "Verificando a disponibilidade dos pacotes do Ceph...",
+  "Verifying all utilities status": "Verificando o status de todos os utilitários",
+  "Verifying disk accessibility in CT": "Verificando a acessibilidade do disco no CT",
+  "Version": "Versão",
+  "Version Change Detected": "Alteração de versão detectada",
+  "Version info not available": "Informações da versão não disponíveis",
+  "Version:": "Versão:",
+  "Version: Auto-negotiation (NFSv3/NFSv4)": "Versão: Negociação automática (NFSv3/NFSv4)",
+  "Versions shown are compatible with your kernel. Latest available is recommended in most cases.": "As versões mostradas são compatíveis com o seu kernel. O mais recente disponível é recomendado na maioria dos casos.",
+  "View CIFS Mounts (pvesm + fstab)": "Ver montagens CIFS (pvesm + fstab)",
+  "View Current Exports": "Ver exportações atuais",
+  "View Current Mounts": "Ver montagens atuais",
+  "View Current Shares": "Ver compartilhamentos atuais",
+  "View Disk Storages": "Ver armazenamentos em disco",
+  "View Mount Points": "Ver pontos de montagem",
+  "View NFS Mounts (pvesm + fstab)": "Ver montagens NFS (pvesm + fstab)",
+  "View backup metadata": "Ver metadados de backup",
+  "View current paths": "Ver caminhos atuais",
+  "View existing folders in /mnt": "Veja as pastas existentes em /mnt",
+  "View iSCSI Storages": "Ver armazenamentos iSCSI",
+  "View raw CT configuration file": "Ver arquivo de configuração CT bruto",
+  "View raw VM configuration file": "Ver arquivo de configuração bruto da VM",
+  "View restore plan": "Ver plano de restauração",
+  "View self-test log": "Ver registro de autoteste",
+  "VirtIO (advanced - high performance)": "VirtIO (avançado - alto desempenho)",
+  "VirtIO ISO not found after selection.": "VirtIO ISO não encontrado após a seleção.",
+  "VirtIO ISO selection cancelled.": "Seleção ISO do VirtIO cancelada.",
+  "VirtIO driver ISO downloaded successfully.": "ISO do driver VirtIO baixado com sucesso.",
+  "Virtual Disks Created:": "Discos virtuais criados:",
+  "Virtual Function": "Função virtual",
+  "Virtual Function (parent PF:": "Função Virtual (PF pai:",
+  "Virtual Machine ID": "ID da máquina virtual",
+  "Virtual disk": "Disco virtual",
+  "Virtual disks": "Discos virtuais",
+  "Virtual display already set to": "Exibição virtual já configurada para",
+  "Virtual display changed from": "Exibição virtual alterada de",
+  "Virtual display normalized to vga: std (compatibility)": "Display virtual normalizado para vga: std (compatibilidade)",
+  "Virtual display set to": "Exibição virtual definida como",
+  "Virtual interface (normal)": "Interface virtual (normal)",
+  "Virtualization": "Virtualização",
+  "Visit https://osx-proxmox.com for more information.": "Visite https://osx-proxmox.com para obter mais informações.",
+  "Visit the website to discover more scripts, stay updated with the latest updates, and support the project:": "Visite o site para descobrir mais scripts, ficar atualizado com as atualizações mais recentes e apoiar o projeto:",
+  "Visit the website to discover more scripts, stay updated with the latest updates, and support the project:\n\nhttps://community-scripts.github.io/ProxmoxVE": "Visite o site para descobrir mais scripts, ficar atualizado com as atualizações mais recentes e apoiar o projeto:\n\nhttps://community-scripts.github.io/ProxmoxVE",
+  "Vulnerability detection": "Detecção de vulnerabilidade",
+  "WARNING": "AVISO",
+  "WARNING — This backup contains paths that are risky to restore on a running system:": "AVISO — Este backup contém caminhos que são arriscados para restauração em um sistema em execução:",
+  "WARNING — You selected risky paths for live restore:": "AVISO — Você selecionou caminhos arriscados para restauração em tempo real:",
+  "WARNING: All data on selected disk will be ERASED if formatted.": "AVISO: Todos os dados no disco selecionado serão APAGADOS se formatados.",
+  "WARNING: The NFS server is not affected. The mount directory contents are NOT deleted (data stays on the server).": "AVISO: O servidor NFS não é afetado. O conteúdo do diretório de montagem NÃO é excluído (os dados permanecem no servidor).",
+  "WARNING: The Samba server is not affected. The mount directory contents are NOT deleted.": "AVISO: O servidor Samba não é afetado. O conteúdo do diretório de montagem NÃO é excluído.",
+  "WARNING: The selected directory is not empty!": "AVISO: O diretório selecionado não está vazio!",
+  "WARNING: This disk has a mounted partition.": "AVISO: Este disco possui uma partição montada.",
+  "WARNING: This disk is also assigned to:": "AVISO: Este disco também está atribuído a:",
+  "WARNING: This disk is referenced in a stopped VM/LXC config.": "AVISO: Este disco é referenciado em uma configuração VM/LXC interrompida.",
+  "WARNING: This is a single GPU system": "AVISO: Este é um sistema de GPU único",
+  "WARNING: This may cause a brief disconnection.": "AVISO: Isto pode causar uma breve desconexão.",
+  "WARNING: This removes the storage from Proxmox. The NFS server is not affected.": "AVISO: Isso remove o armazenamento do Proxmox. O servidor NFS não é afetado.",
+  "WARNING: This removes the storage from Proxmox. The Samba server is not affected.": "AVISO: Isso remove o armazenamento do Proxmox. O servidor Samba não é afetado.",
+  "WARNING: This will ERASE all data on this disk.": "AVISO: Isso apagará todos os dados deste disco.",
+  "WARNING: This will FORMAT the disk": "AVISO: Isso formatará o disco",
+  "WARNING: This will completely remove NFS server from the CT.": "AVISO: Isto removerá completamente o servidor NFS do CT.",
+  "WARNING: This will completely remove Samba server from the CT.": "AVISO: Isto removerá completamente o servidor Samba do CT.",
+  "WARNING: You are about to remove this Proxmox storage:": "AVISO: você está prestes a remover este armazenamento Proxmox:",
+  "WARNING: You are about to remove this disk mount:": "AVISO: você está prestes a remover esta montagem de disco:",
+  "WARNING: this will ERASE EVERYTHING on the disk.": "AVISO: isso APAGARÁ TUDO do disco.",
+  "WILL BE PERMANENTLY ERASED.": "SERÁ APAGADO PERMANENTEMENTE.",
+  "Wait for each node to complete before starting next": "Aguarde a conclusão de cada nó antes de iniciar o próximo",
+  "Warning": "Aviso",
+  "Warning: Auth key should start with 'tskey-'": "Aviso: a chave de autenticação deve começar com 'tskey-'",
+  "Warning: Disk Images on CIFS": "Aviso: imagens de disco no CIFS",
+  "Warning: Limited PCI Reset Support": "Aviso: suporte limitado para redefinição de PCI",
+  "Warning: both VMs have autostart enabled (onboot=1).": "Aviso: ambas as VMs têm inicialização automática habilitada (onboot=1).",
+  "Warnings": "Avisos",
+  "Website": "Site",
+  "What do you want to do?": "O que você quer fazer?",
+  "What would you like to do?": "O que você gostaria de fazer?",
+  "When asked to select a disk, click Load Driver and load the VirtIO drivers.": "Quando solicitado a selecionar um disco, clique em Carregar driver e carregue os drivers VirtIO.",
+  "When this GPU is passed through to a VM, the Proxmox host will lose all video output on the physical monitor.": "Quando esta GPU é passada para uma VM, o host Proxmox perderá toda a saída de vídeo no monitor físico.",
+  "Where are the backup archives stored?": "Onde os arquivos de backup são armazenados?",
+  "Where do you want the host folder?": "Onde você quer a pasta host?",
+  "Where do you want to mount inside container?": "Onde você deseja montar dentro do contêiner?",
+  "Where do you want to mount the NFS export?": "Onde você deseja montar a exportação NFS?",
+  "Where do you want to mount the Samba share?": "Onde você deseja montar o compartilhamento do Samba?",
+  "Where is the OVA/OVF file located?": "Onde está localizado o arquivo OVA/OVF?",
+  "Where to mount inside container?": "Onde montar dentro do container?",
+  "While the server allows guest listing, no shares are actually accessible without authentication.": "Embora o servidor permita a listagem de convidados, nenhum compartilhamento é realmente acessível sem autenticação.",
+  "Will be configured now": "Será configurado agora",
+  "Windows Installation Options": "Opções de instalação do Windows",
+  "Windows path:": "Caminho do Windows:",
+  "Wipe all          — erase partitions + metadata": "Limpe tudo – apague partições + metadados",
+  "Wipe all — remove partitions + metadata": "Limpe tudo – remova partições + metadados",
+  "Wipe old signatures and partition table (DESTRUCTIVE):": "Limpe assinaturas antigas e tabela de partições (DESTRUTIVO):",
+  "Wiping existing partition table...": "Limpando tabela de partição existente...",
+  "Wiping partitions and metadata...": "Limpando partições e metadados...",
+  "Wired NICs in backup missing on target:": "NICs com fio no backup ausentes no destino:",
+  "With warnings": "Com avisos",
+  "Without Function Level Reset (FLR), passthrough is not considered reliable": "Sem a redefinição do nível de função (FLR), o passthrough não é considerado confiável",
+  "Without a usable reset path, passthrough reliability is poor and VM": "Sem um caminho de redefinição utilizável, a confiabilidade da passagem é baixa e a VM",
+  "Working directory:": "Diretório de trabalho:",
+  "Works with LVM, ZFS, and BTRFS storage types": "Funciona com tipos de armazenamento LVM, ZFS e BTRFS",
+  "Would you like to continue in passthrough-only mode? The libedgetpu APT install will be skipped, the Coral device will still be visible inside the container (e.g. /dev/apex_0), and you can install the runtime yourself or use an app container that bundles it (e.g. the Frigate Docker image).": "Gostaria de continuar no modo somente passagem? A instalação do libedgetpu APT será ignorada, o dispositivo Coral ainda estará visível dentro do contêiner (por exemplo, /dev/apex_0) e você mesmo pode instalar o tempo de execução ou usar um contêiner de aplicativo que o agrupe (por exemplo, a imagem Frigate Docker).",
+  "Would you like to see the current": "Você gostaria de ver o atual",
+  "Write access confirmed for user:": "Acesso de gravação confirmado para o usuário:",
+  "Write access confirmed.": "Acesso de gravação confirmado.",
+  "Write access test FAILED for user:": "Teste de acesso de gravação FALHOU para o usuário:",
+  "Write access verified for user:": "Acesso de gravação verificado para o usuário:",
+  "Wrong passphrase": "Senha errada",
+  "Yes": "Sim",
+  "Yes, upload": "Sim, fazer upload",
+  "Yes: set a recovery passphrase now; the encrypted key envelope is uploaded with every backup.": "Sim: defina uma senha de recuperação agora;o envelope da chave criptografada é carregado com cada backup.",
+  "You are connected via SSH and selected network-related restore paths.": "Você está conectado via SSH e caminhos de restauração relacionados à rede selecionados.",
+  "You can add it manually through:": "Você pode adicioná-lo manualmente através de:",
+  "You can add servers manually.": "Você pode adicionar servidores manualmente.",
+  "You can enter the export path manually.": "Você pode inserir o caminho de exportação manualmente.",
+  "You can enter the share name manually.": "Você pode inserir o nome do compartilhamento manualmente.",
+  "You can now monitor your AMD GPU using:": "Agora você pode monitorar sua GPU AMD usando:",
+  "You can now monitor your Intel GPU using:": "Agora você pode monitorar sua GPU Intel usando:",
+  "You can now select Controller/NVMe devices in Storage Plan.": "Agora você pode selecionar dispositivos Controlador/NVMe no Plano de Armazenamento.",
+  "You can reboot later manually with: reboot": "Você pode reiniciar mais tarde manualmente com: reboot",
+  "You can reboot later manually.": "Você pode reiniciar mais tarde manualmente.",
+  "You can restore it anytime with": "Você pode restaurá-lo a qualquer momento com",
+  "You can restore the backup with": "Você pode restaurar o backup com",
+  "You can run a security audit with:": "Você pode executar uma auditoria de segurança com:",
+  "You can still install amdgpu_top if needed.": "Você ainda pode instalar o amdgpu_top, se necessário.",
+  "You can still install intel-gpu-tools if needed.": "Você ainda pode instalar o intel-gpu-tools, se necessário.",
+  "You can still mount this share for READ-ONLY access.": "Você ainda pode montar esse compartilhamento para acesso SOMENTE LEITURA.",
+  "You can use the following credentials to login to the Nextcloud vm:": "Você pode usar as seguintes credenciais para fazer login no Nextcloud vm:",
+  "You haven't added any custom paths yet.": "Você ainda não adicionou nenhum caminho personalizado.",
+  "You may need to run 'pveceph install' manually": "Pode ser necessário executar 'pveceph install' manualmente",
+  "You must select a logo to continue.": "Você deve selecionar um logotipo para continuar.",
+  "You must select at least one mount method to continue.": "Você deve selecionar pelo menos um método de montagem para continuar.",
+  "You need to use username and password authentication.": "Você precisa usar autenticação de nome de usuário e senha.",
+  "You selected 'Disk image' content on a CIFS/SMB storage.": "Você selecionou o conteúdo de 'Imagem de disco' em um armazenamento CIFS/SMB.",
+  "You should now be able to access the Proxmox web interface.": "Agora você deve conseguir acessar a interface da web do Proxmox.",
+  "You will need a Tailscale auth key from: https://login.tailscale.com/admin/settings/keys": "Você precisará de uma chave de autenticação Tailscale de: https://login.tailscale.com/admin/settings/keys",
+  "ZFS ARC config removed (kernel defaults will apply on reboot)": "Configuração do ZFS ARC removida (os padrões do kernel serão aplicados na reinicialização)",
+  "ZFS ARC configuration file created/updated successfully": "Arquivo de configuração ZFS ARC criado/atualizado com sucesso",
+  "ZFS ARC configuration is up to date": "A configuração do ZFS ARC está atualizada",
+  "ZFS ARC optimization completed": "Otimização ZFS ARC concluída",
+  "ZFS Management Commands": "Comandos de gerenciamento ZFS",
+  "ZFS Pool Name": "Nome do conjunto ZFS",
+  "ZFS auto-snapshot installation and configuration completed": "Instalação e configuração do instantâneo automático do ZFS concluídas",
+  "ZFS autotrim already enabled for pool:": "Autotrim ZFS já habilitado para pool:",
+  "ZFS autotrim disabled for pool:": "Autotrim ZFS desabilitado para pool:",
+  "ZFS autotrim enabled for pool:": "Autotrim ZFS habilitado para pool:",
+  "ZFS autotrim is not supported for pool:": "O ajuste automático do ZFS não é compatível com pool:",
+  "ZFS autotrim setup completed": "Configuração de ajuste automático do ZFS concluída",
+  "ZFS command history": "Histórico de comandos do ZFS",
+  "ZFS configuration": "Configuração ZFS",
+  "ZFS member detected": "Membro do ZFS detectado",
+  "ZFS not detected. Nothing to disable.": "ZFS não detectado. Nada para desativar.",
+  "ZFS not detected. Skipping ZFS ARC optimization.": "ZFS não detectado. Ignorando a otimização do ZFS ARC.",
+  "ZFS not detected. Skipping ZFS autotrim.": "ZFS não detectado. Ignorando o ajuste automático do ZFS.",
+  "ZFS pool": "Conjunto ZFS",
+  "ZFS pool created": "Conjunto ZFS criado",
+  "ZFS pool created and mounted at": "Pool ZFS criado e montado em",
+  "ZFS pool exported:": "Conjunto ZFS exportado:",
+  "ZFS pool is not available after creation:": "O pool ZFS não está disponível após a criação:",
+  "ZFS pool not found:": "Conjunto ZFS não encontrado:",
+  "ZFS pool:": "Conjunto ZFS:",
+  "ZFS storage added successfully to Proxmox!": "Armazenamento ZFS adicionado com sucesso ao Proxmox!",
+  "ZFS tools not found. Install zfsutils-linux and retry.": "Ferramentas ZFS não encontradas. Instale zfsutils-linux e tente novamente.",
+  "ZFS:": "ZFS:",
+  "Zero all data     — partition table preserved, data wiped": "Zerar todos os dados – tabela de partição preservada, dados apagados",
+  "Zero all data — partition table preserved": "Zerar todos os dados – tabela de partição preservada",
+  "Zeroing partition": "Zerando partição",
+  "active VF(s)": "FV ativa(s)",
+  "active VFs": "FVs ativas",
+  "active Virtual Functions. Changing its driver binding would destroy every VF.": "Funções virtuais ativas. Alterar a ligação do driver destruiria todos os VF.",
+  "after copy; source tree is incomplete.": "após cópia; a árvore de origem está incompleta.",
+  "after update.": "após a atualização.",
+  "all_squash,anonuid=65534,anongid=65534": "all_squash,anonuid=65534,anongid=65534",
+  "amdgpu_top installed successfully": "amdgpu_top instalado com sucesso",
+  "amdgpu_top is already installed:": "amdgpu_top já está instalado:",
+  "amdgpu_top is not installed": "amdgpu_top não está instalado",
+  "amdgpu_top is up to date": "amdgpu_top está atualizado",
+  "amdgpu_top uninstalled successfully": "amdgpu_top desinstalado com sucesso",
+  "amdgpu_top updated to": "amdgpu_top atualizado para",
+  "and": "e",
+  "and could not be unmounted — disk may be busy.": "e não pôde ser desmontado — o disco pode estar ocupado.",
+  "and upgrade the system (disables the enterprise repo)": "e atualizar o sistema (desativa o repositório corporativo)",
+  "apex device node not found yet; a reboot may be required.": "nó do dispositivo apex ainda não encontrado; uma reinicialização pode ser necessária.",
+  "apex group and udev rules are in place.": "o grupo apex e as regras do udev estão em vigor.",
+  "apex group removed.": "grupo ápice removido.",
+  "apex group still has members; left in place:": "o grupo apex ainda tem membros; deixado no lugar:",
+  "apex kernel module not loaded on host. Run \"Install Coral on Host\" first or the container will not see /dev/apex_0.": "módulo do kernel apex não carregado no host. Execute \"Install Coral on Host\" primeiro ou o contêiner não verá /dev/apex_0.",
+  "appears to be part of a": "parece fazer parte de um",
+  "applying minimal banner patch": "aplicando patch mínimo de banner",
+  "apt cache refreshed.": "cache do apt atualizado.",
+  "apt-get exited": "apt-get saiu",
+  "apt-get update returned warnings. Continuing anyway; check": "apt-get update retornou avisos. Continuando de qualquer maneira; verificar",
+  "as": "como",
+  "automatically. Install it manually inside the container.": "automaticamente. Instale-o manualmente dentro do contêiner.",
+  "automatically. Reboot LXC to fully release.": "automaticamente. Reinicie o LXC para liberar completamente.",
+  "available for LXC bind-mounts via 'LXC Mount Manager'": "disponível para montagens vinculadas LXC via 'LXC Mount Manager'",
+  "available in this same GPU and TPU menu.": "disponível neste mesmo menu GPU e TPU.",
+  "backup at /etc/fstab.proxmenux.bak": "backup em /etc/fstab.proxmenux.bak",
+  "ban": "proibir",
+  "blocking issue(s).": "problema(s) de bloqueio.",
+  "btrfs — Proxmox dir storage (snapshots, compression)": "btrfs — Armazenamento de diretório Proxmox (instantâneos, compactação)",
+  "btrfs — snapshots and compression": "btrfs — instantâneos e compactação",
+  "but it does not match the one used to create the backup. Replace it with the correct keyfile from the source host and retry.": "Mensagem técnica para Proxmox e TI.Traduza: mas não corresponde ao usado para criar o backup.Substitua-o pelo arquivo-chave correto do host de origem e tente novamente.",
+  "bytes": "bytes",
+  "can write to": "pode escrever para",
+  "chmod 1777 + setfacl o::rwx (applied on the NFS share from this host)": "chmod 1777 + setfacl o::rwx (aplicado no compartilhamento NFS deste host)",
+  "chmod failed — NFS server may be restricting changes from root": "chmod falhou — O servidor NFS pode estar restringindo alterações do root",
+  "chown/chmod failed — likely unprivileged CT against host bind mount. Falling back to ACL.": "chown/chmod falhou — provavelmente CT sem privilégios contra montagem de ligação do host. Voltando ao ACL.",
+  "content:": "contente:",
+  "custom path(s) saved.": "caminhos personalizados salvos.",
+  "default": "padrão",
+  "delete the credentials file (if any)": "exclua o arquivo de credenciais (se houver)",
+  "delete the matching line from /etc/fstab": "exclua a linha correspondente de /etc/fstab",
+  "descriptor + VMDK files": "descritor + arquivos VMDK",
+  "device(s) added to VM": "dispositivos adicionados à VM",
+  "devices": "dispositivos",
+  "did not become ready. Skipping.": "não ficou pronto. Pulando.",
+  "disk(s) added to CT": "disco(s) adicionado(s) ao CT",
+  "disk(s) added to VM": "disco(s) adicionado(s) à VM",
+  "dkms.conf generated.": "dkms.conf gerado.",
+  "does not exist on this host. Path not added.": "não existe neste host. Caminho não adicionado.",
+  "does not exist. Exiting.": "não existe. Saindo.",
+  "driver:": "motorista:",
+  "exFAT (portable: Windows/Linux/macOS)": "exFAT (portátil: Windows/Linux/macOS)",
+  "exFAT tools installed successfully.": "Ferramentas exFAT instaladas com sucesso.",
+  "ext4  — Proxmox dir storage (recommended)": "ext4 — Armazenamento de diretório Proxmox (recomendado)",
+  "ext4  — recommended, most compatible": "ext4 — recomendado, mais compatível",
+  "fail2ban-client could not communicate with the server": "fail2ban-client não conseguiu se comunicar com o servidor",
+  "fail2ban-client successfully communicated with the server": "fail2ban-client se comunicou com sucesso com o servidor",
+  "failed:": "fracassado:",
+  "feranick fork unreachable. Falling back to google/gasket-driver...": "garfo feranick inacessível. Voltando ao google/gasket-driver...",
+  "feranick/gasket-driver cloned (actively maintained, kernel 6.12+ ready).": "feranick/gasket-driver clonado (mantido ativamente, kernel 6.12+ pronto).",
+  "file?": "arquivo?",
+  "files": "arquivos",
+  "files/folders": "arquivos/pastas",
+  "filesystem. Skipping format.": "sistema de arquivos. Ignorando formato.",
+  "filesystem...": "sistema de arquivos...",
+  "for better performance and stability": "para melhor desempenho e estabilidade",
+  "for next boot (needs reboot to take effect)": "para a próxima inicialização (precisa de reinicialização para entrar em vigor)",
+  "for this policy and may fail after first use or on subsequent VM starts.": "para esta política e pode falhar após o primeiro uso ou em inícios subsequentes da VM.",
+  "formatted as": "formatado como",
+  "found": "encontrado",
+  "from Proxmox web interface (you will be asked)": "da interface da web do Proxmox (será solicitado)",
+  "from container": "do contêiner",
+  "from the GPUs and Coral-TPU menu first, then run this option again.": "primeiro no menu GPUs e Coral-TPU e, em seguida, execute esta opção novamente.",
+  "fstab entry exists": "existe entrada fstab",
+  "fstab line:": "linha fstab:",
+  "fstab references UUIDs/devices not present on this host:": "fstab faz referência a UUIDs/dispositivos não presentes neste host:",
+  "gasket DKMS entries removed.": "juntas, entradas DKMS removidas.",
+  "gawk installed": "gawk instalado",
+  "google/gasket-driver cloned (fallback — will apply local patches).": "google/gasket-driver clonado (substituto – aplicará patches locais).",
+  "gpg not found; trying apt-key fallback": "gpg não encontrado; tentando substituto do apt-key",
+  "gzip replaced with pigz wrapper successfully": "gzip substituído pelo wrapper pigz com sucesso",
+  "has": "tem",
+  "has a different MAC than the backup — update any DHCP static reservation": "tem um MAC diferente do backup – atualize qualquer reserva estática de DHCP",
+  "has a new MAC": "tem um novo MAC",
+  "has only": "tem apenas",
+  "host fstab only (not registered as Proxmox storage)": "host fstab apenas (não registrado como armazenamento Proxmox)",
+  "hostpci entries for all IOMMU group devices": "entradas hostpci para todos os dispositivos do grupo IOMMU",
+  "hostpci entries for selected GPU functions (full IOMMU group will be enforced after reboot)": "entradas hostpci para funções GPU selecionadas (o grupo IOMMU completo será aplicado após a reinicialização)",
+  "hour(s)": "horas)",
+  "iSCSI Content Type": "Tipo de conteúdo iSCSI",
+  "iSCSI Daemon (iscsid): RUNNING": "Daemon iSCSI (iscsid): EM EXECUÇÃO",
+  "iSCSI Daemon (iscsid): STOPPED": "Daemon iSCSI (iscsid): PARADO",
+  "iSCSI Host Manager - Proxmox Host": "Gerenciador de host iSCSI - Host Proxmox",
+  "iSCSI Initiator: AVAILABLE": "Iniciador iSCSI: DISPONÍVEL",
+  "iSCSI Initiator: NOT INSTALLED": "Iniciador iSCSI: NÃO INSTALADO",
+  "iSCSI Portal": "Portal iSCSI",
+  "iSCSI Storages in Proxmox": "Armazenamentos iSCSI em Proxmox",
+  "iSCSI Storages:": "Armazenamentos iSCSI:",
+  "iSCSI discovery failed": "Falha na descoberta de iSCSI",
+  "iSCSI port": "porta iSCSI",
+  "iSCSI service is running on the target": "O serviço iSCSI está em execução no destino",
+  "iSCSI storage added successfully to Proxmox!": "Armazenamento iSCSI adicionado com sucesso ao Proxmox!",
+  "iSCSI storage provides raw block devices for VM disk images.": "O armazenamento iSCSI fornece dispositivos de bloco brutos para imagens de disco de VM.",
+  "iSCSI tools installed": "Ferramentas iSCSI instaladas",
+  "iftop usage": "uso iftop",
+  "imported:": "importado:",
+  "in CT": "em tomografia computadorizada",
+  "initramfs updated": "initramfs atualizado",
+  "initramfs updated.": "initramfs atualizado.",
+  "installed but command not immediately available": "instalado, mas o comando não está imediatamente disponível",
+  "installed correctly and available": "instalado corretamente e disponível",
+  "installed in CT": "instalado em CT",
+  "installed inside CT": "instalado dentro do CT",
+  "installed successfully.": "instalado com sucesso.",
+  "intel-gpu-tools installed successfully": "ferramentas intel-gpu instaladas com sucesso",
+  "intel-gpu-tools is already installed:": "intel-gpu-tools já está instalado:",
+  "intel-gpu-tools is up to date": "intel-gpu-tools está atualizado",
+  "intel-gpu-tools uninstalled successfully": "intel-gpu-tools desinstalado com sucesso",
+  "intel-gpu-tools updated to": "ferramentas intel-gpu atualizadas para",
+  "intel_iommu/amd_iommu is set in cmdline but no IOMMU groups exist — IOMMU appears disabled in BIOS. Enable VT-d / AMD-Vi in firmware before continuing.": "intel_iommu/amd_iommu está definido no cmdline, mas não existem grupos IOMMU – IOMMU aparece desabilitado no BIOS. Habilite VT-d/AMD-Vi no firmware antes de continuar.",
+  "interfaces": "interfaces",
+  "into an LXC.": "em um LXC.",
+  "iperf3 - Bandwidth test": "iperf3 - teste de largura de banda",
+  "iperf3 - Bandwidth test (Client mode)": "iperf3 - Teste de largura de banda (modo cliente)",
+  "iperf3 - Bandwidth test (Server mode)": "iperf3 - Teste de largura de banda (modo servidor)",
+  "iperf3 client": "cliente iperf3",
+  "iperf3 client output": "saída do cliente iperf3",
+  "iperf3 server": "servidor iperf3",
+  "iperf3 server is running on": "servidor iperf3 está rodando em",
+  "iperf3 server output": "saída do servidor iperf3",
+  "iperf3 test failed": "teste iperf3 falhou",
+  "iptraf-ng usage": "uso de iptraf-ng",
+  "is UNPRIVILEGED.": "é SEM PRIVILÉGIO.",
+  "is a Physical Function with": "é uma função física com",
+  "is already assigned to the following VM(s) or CT(s):": "já está atribuído às seguintes VM(s) ou CT(s):",
+  "is already installed. Do you want to reinstall it? This will perform a clean uninstall first.": "já está instalado. Deseja reinstalá-lo? Isso executará uma desinstalação limpa primeiro.",
+  "is already unprivileged.": "já é desprivilegiado.",
+  "is an SR-IOV Virtual Function (VF). Its parent Physical Function is": "é uma função virtual SR-IOV (VF). Sua função física pai é",
+  "is in use by running VM": "está em uso executando VM",
+  "is in use by the following running VM(s) or CT(s):": "está em uso pelas seguintes VMs ou CTs em execução:",
+  "is mounted at": "está montado em",
+  "is not configured as machine type q35.": "não está configurado como tipo de máquina q35.",
+  "is not in the patch.sh supported list. The patch may no-op or fail; review keylase/nvidia-patch README before continuing.": "não está na lista de suporte do patch.sh. O patch pode não funcionar ou falhar; revise o README keylase/nvidia-patch antes de continuar.",
+  "is not supported by the official Google libedgetpu APT repository.": "não é compatível com o repositório APT oficial do Google libedgetpu.",
+  "is referenced in the following stopped VM(s)/CT(s):": "é referenciado nas seguintes VM(s)/CT(s) interrompidas:",
+  "journald MaxLevelStore is adequate for auth logging": "journald MaxLevelStore é adequado para registro de autenticação",
+  "journald drop-in created: /etc/systemd/journald.conf.d/proxmenux-loglevel.conf": "Drop-in do journald criado: /etc/systemd/journald.conf.d/proxmenux-loglevel.conf",
+  "journald log level restored": "nível de log do journald restaurado",
+  "journald restarted - auth messages will now be stored": "journald reiniciado - mensagens de autenticação agora serão armazenadas",
+  "jq is required for this operation but is not installed.": "jq é necessário para esta operação, mas não está instalado.",
+  "jq is required to apply updates from this menu.": "jq é necessário para aplicar atualizações deste menu.",
+  "jq not available — skipping rollback execution": "jq não disponível - ignorando a execução da reversão",
+  "keep-daily (0 disables)": "keep-daily (0 desabilita)",
+  "keep-hourly (0 disables)": "manter de hora em hora (0 desabilita)",
+  "keep-last (0 disables)": "manter-último (0 desabilita)",
+  "keep-monthly (0 disables)": "manter mensalmente (0 desabilita)",
+  "keep-weekly (0 disables)": "manter semanalmente (0 desabilita)",
+  "keep-yearly (0 disables)": "manter anual (0 desabilita)",
+  "keeping current settings": "mantendo as configurações atuais",
+  "kexec configured successfully. Use the command: reboot-quick": "kexec configurado com sucesso. Use o comando: reinicialização rápida",
+  "kexec-pve service enabled": "serviço kexec-pve habilitado",
+  "kexec-pve service file created": "arquivo de serviço kexec-pve criado",
+  "kexec-tools and related settings removed": "kexec-tools e configurações relacionadas removidas",
+  "kexec-tools installed successfully": "kexec-tools instalado com sucesso",
+  "kexec-tools is not installed or already removed.": "kexec-tools não está instalado ou já foi removido.",
+  "log2ram completely removed from system": "log2ram completamente removido do sistema",
+  "manually inside the container before starting it.": "manualmente dentro do contêiner antes de iniciá-lo.",
+  "manually inside the container.": "manualmente dentro do contêiner.",
+  "maximum performance": "desempenho máximo",
+  "may be closed — trying discovery anyway...": "pode estar fechado - tentando a descoberta de qualquer maneira...",
+  "missing": "faltando",
+  "mkfs.btrfs not found. Install btrfs-progs and retry.": "mkfs.btrfs não encontrado. Instale o btrfs-progs e tente novamente.",
+  "more": "mais",
+  "mount.cifs command not found after installation.": "Comando mount.cifs não encontrado após a instalação.",
+  "mount.nfs command not found after installation.": "Comando mount.nfs não encontrado após a instalação.",
+  "never": "nunca",
+  "nftables not available - using iptables ban action": "nftables não disponível - usando a ação de proibição do iptables",
+  "no": "não",
+  "no (kdf=none, not needed)": "não (kdf = nenhum, não é necessário)",
+  "no (no escrow blob — set a recovery passphrase to enable recovery)": "não (sem blob de garantia – defina uma senha de recuperação para permitir a recuperação)",
+  "no passphrase": "sem senha",
+  "no password": "sem senha",
+  "no_root_squash": "sem_root_squash",
+  "non-ProxMenux .tar archive(s) in this path": "arquivo(s) .tar não-ProxMenux neste caminho",
+  "not found.": "não encontrado.",
+  "not installed": "não instalado",
+  "not reliable on this hardware due to the following limitations": "não é confiável neste hardware devido às seguintes limitações",
+  "nouveau driver has been blacklisted.": "O driver nouveau foi colocado na lista negra.",
+  "nouveau module unloaded after initramfs rebuild.": "Módulo nouveau descarregado após reconstrução do initramfs.",
+  "nouveau module unloaded successfully.": "módulo nouveau descarregado com sucesso.",
+  "nouveau still active. Proceeding with installation. A reboot will be required for the driver to work.": "nouveau ainda ativo. Prosseguindo com a instalação. Uma reinicialização será necessária para que o driver funcione.",
+  "now": "agora",
+  "now?": "agora?",
+  "nvidia-smi not found after install. Check log:": "nvidia-smi não encontrado após a instalação. Verifique o registro:",
+  "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi não encontrado em PATH. Verifique a instalação do driver.",
+  "nvidia-smi not found in container": "nvidia-smi não encontrado no contêiner",
+  "of": "de",
+  "of free disk space.": "de espaço livre em disco.",
+  "older firmware may increase passthrough instability": "firmware mais antigo pode aumentar a instabilidade de passagem",
+  "on SSD/NVMe pools that support discard": "em pools SSD/NVMe que suportam descarte",
+  "openssl encryption failed.": "A criptografia do openssl falhou.",
+  "openssl is not installed — cannot create recovery copy. Install openssl and retry.": "openssl não está instalado — não é possível criar uma cópia de recuperação. Instale o openssl e tente novamente.",
+  "or format it manually using external tools.": "ou formate-o manualmente usando ferramentas externas.",
+  "or use the ProxMenux LXC Mount Manager.": "ou use o ProxMenux LXC Mount Manager.",
+  "orphan iface lines, no impact on restore": "linhas iface órfãs, sem impacto na restauração",
+  "other .tar archive(s) — not ProxMenux host backups (e.g. PVE vzdump or unrelated tarballs).": "outros arquivos .tar — não backups de host ProxMenux (por exemplo, PVE vzdump ou tarballs não relacionados).",
+  "packages (this may take a few minutes)...": "pacotes (isso pode levar alguns minutos)...",
+  "packages.": "pacotes.",
+  "parent PF:": "pai PF:",
+  "partition(s). Partition table preserved.": "partição(ões). Tabela de partição preservada.",
+  "paths for next boot (/etc/pve, guests, drivers, ...)": "caminhos para a próxima inicialização (/etc/pve, convidados, drivers, ...)",
+  "pci_passthrough_helpers.sh missing — SR-IOV / orphan-audio guards will be skipped": "pci_passthrough_helpers.sh ausente – os protetores SR-IOV / orphan-audio serão ignorados",
+  "pct exec authorization failed": "falha na autorização pct exec",
+  "pct push failed. Check log:": "pct push falhou. Verifique o registro:",
+  "pending (reboot required to enumerate full group)": "pendente (reinicialização necessária para enumerar o grupo completo)",
+  "pigz configuration completed": "configuração do pigz concluída",
+  "pigz enabled in vzdump configuration": "pigz habilitado na configuração do vzdump",
+  "pigz installed successfully": "pigz instalado com sucesso",
+  "pigz removed": "porco removido",
+  "pigz wrapper script created": "script de wrapper pigz criado",
+  "port": "porta",
+  "portmapper/rpcbind has been disabled and removed": "portmapper/rpcbind foi desabilitado e removido",
+  "proxmox-backup-client reported:": "proxmox-backup-client relatado:",
+  "proxmox-boot-tool refreshed": "ferramenta proxmox-boot atualizada",
+  "pve-enterprise.list update skipped (no change)": "Atualização de pve-enterprise.list ignorada (sem alteração)",
+  "pve-enterprise.list updated to Trixie": "pve-enterprise.list atualizado para Trixie",
+  "pvecm command not found (might not be in a cluster)": "Comando pvecm não encontrado (pode não estar em um cluster)",
+  "pvesm command found": "Comando pvesm encontrado",
+  "pvesm command not found. This should not happen on Proxmox.": "Comando pvesm não encontrado. Isso não deveria acontecer no Proxmox.",
+  "pvesm not available.": "pvesm não disponível.",
+  "pvesm not found.": "pvesm não encontrado.",
+  "pvesm path failed, trying manual detection...": "caminho pvesm falhou, tentando detecção manual...",
+  "pvesm status failed": "status pvesm falhou",
+  "raw USB disk — no filesystem (will be FORMATTED)": "disco USB bruto - sem sistema de arquivos (será FORMATADO)",
+  "reboot-quick alias added": "alias de reinicialização rápida adicionado",
+  "recommended": "recomendado",
+  "remapped users": "usuários remapeados",
+  "remove the (now-empty) directory if possible": "remova o diretório (agora vazio), se possível",
+  "removed from Proxmox": "removido do Proxmox",
+  "removed successfully from Proxmox.": "removido com sucesso do Proxmox.",
+  "requires the package": "requer o pacote",
+  "restarted successfully": "reiniciado com sucesso",
+  "restoring /etc/network would lose connectivity": "restaurar /etc/network perderia conectividade",
+  "restoring on:": "restaurando em:",
+  "retries": "novas tentativas",
+  "reverse proxy": "proxy reverso",
+  "root and real users only": "apenas usuários root e reais",
+  "rpcbind service has been disabled and stopped": "O serviço rpcbind foi desativado e interrompido",
+  "running": "correndo",
+  "safe paths now (configs, packages, /etc, /root, ...)": "caminhos seguros agora (configs, pacotes, /etc, /root, ...)",
+  "same MAC": "mesmo MAC",
+  "seconds (default)": "segundos (padrão)",
+  "see log:": "veja o log:",
+  "selected path(s):": "caminho(s) selecionado(s):",
+  "server": "servidor",
+  "server IP or hostname:": "IP do servidor ou nome do host:",
+  "server?": "servidor?",
+  "servers found on the network.": "servidores encontrados na rede.",
+  "servers found.": "servidores encontrados.",
+  "sha256sum not found. Cannot verify Borg binary.": "sha256sum não encontrado. Não é possível verificar o binário Borg.",
+  "showmount command is not working properly.": "O comando showmount não está funcionando corretamente.",
+  "showmount command not found after installation.": "Comando showmount não encontrado após a instalação.",
+  "single portable archive": "arquivo portátil único",
+  "skipped (already exist)": "ignorado (já existe)",
+  "smbclient command is not working properly.": "O comando smbclient não está funcionando corretamente.",
+  "smbclient command not found after installation.": "Comando smbclient não encontrado após a instalação.",
+  "sources.list update skipped (no change)": "Atualização de sources.list ignorada (sem alteração)",
+  "sources.list updated to Trixie": "fontes.list atualizado para Trixie",
+  "ssh-keygen failed. Cannot create a new SSH key.": "ssh-keygen falhou. Não é possível criar uma nova chave SSH.",
+  "standard performance": "desempenho padrão",
+  "start/restart failures and reset instability.": "falhas de inicialização/reinício e instabilidade de redefinição.",
+  "started successfully.": "iniciado com sucesso.",
+  "started.": "iniciado.",
+  "startup/restart errors are likely.": "erros de inicialização/reinicialização são prováveis.",
+  "stop source VM first": "pare a VM de origem primeiro",
+  "stopped": "parou",
+  "storage yet.": "armazenamento ainda.",
+  "storage(s) from backup exist on target": "armazenamento(s) do backup existem no destino",
+  "storage.": "armazenamento.",
+  "successfully formatted with": "formatado com sucesso com",
+  "suggested:": "sugerido:",
+  "switch_gpu_mode.sh was not found.": "switch_gpu_mode.sh não foi encontrado.",
+  "sysfs ROM dump failed — trying ACPI VFCT table...": "Falha no despejo de ROM do sysfs - tentando tabela ACPI VFCT...",
+  "systemctl restart networking failed:": "falha na reinicialização da rede do systemctl:",
+  "systemd OnCalendar expression": "Expressão Systemd OnCalendar",
+  "this distribution": "esta distribuição",
+  "to": "para",
+  "to CT": "para TC",
+  "to VM": "para VM",
+  "to move the GPU safely.": "para mover a GPU com segurança.",
+  "to run without being killed by the OOM killer.": "correr sem ser morto pelo assassino OOM.",
+  "to sharedfiles group": "para o grupo de arquivos compartilhados",
+  "total": "total",
+  "umount the path if currently mounted": "desmontar o caminho se estiver montado atualmente",
+  "updating NVIDIA userspace libs": "atualizando bibliotecas de espaço de usuário NVIDIA",
+  "user packages missing — will be installed automatically:": "pacotes de usuário ausentes — serão instalados automaticamente:",
+  "users": "Usuários",
+  "users (for unprivileged compatibility)": "usuários (para compatibilidade sem privilégios)",
+  "using": "usando",
+  "using direct path (not guaranteed to survive reboots).": "usando caminho direto (não é garantido que sobreviva às reinicializações).",
+  "vCPUs:": "vCPUs:",
+  "vfio-pci IDs configured": "IDs vfio-pci configurados",
+  "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "IDs vfio-pci em /etc/modprobe.d/vfio.conf",
+  "vzdump backup speed optimization completed": "otimização da velocidade de backup do vzdump concluída",
+  "was": "era",
+  "wipefs failed on": "Wipefs falhou em",
+  "with": "com",
+  "with the password you provided.": "com a senha que você forneceu.",
+  "xfs   — Proxmox dir storage (large files and VMs)": "xfs — Armazenamento em diretório Proxmox (arquivos grandes e VMs)",
+  "xfs   — better for large files": "xfs — melhor para arquivos grandes",
+  "years old": "anos",
+  "yes": "sim",
+  "yes (scrypt-unlock passphrase stored)": "sim (senha de desbloqueio de criptografia armazenada)",
+  "yes (survives reboot)": "sim (sobrevive à reinicialização)",
+  "yes (via PBS escrow + recovery passphrase)": "sim (via garantia PBS + senha de recuperação)",
+  "zeroed.": "zerado.",
+  "zfs   — Proxmox ZFS pool storage": "zfs — Armazenamento de pool Proxmox ZFS",
+  "zfs-auto-snapshot installed successfully": "zfs-auto-snapshot instalado com sucesso",
+  "zfs-auto-snapshot is already installed": "zfs-auto-snapshot já está instalado",
+  "zfs-auto-snapshot removed (existing snapshots preserved on the pool)": "zfs-auto-snapshot removido (instantâneos existentes preservados no pool)",
+  "zpool command not found. Install zfsutils-linux and retry.": "Comando zpool não encontrado. Instale zfsutils-linux e tente novamente.",
+  "zpool not found. Install zfsutils-linux and retry.": "zpool não encontrado. Instale zfsutils-linux e tente novamente.",
+  "— Full/Custom restore will skip kernel-tied paths": "- A restauração completa/personalizada irá ignorar os caminhos vinculados ao kernel",
+  "— disk may be busy. Skipping fstab removal.": "— o disco pode estar ocupado. Ignorando a remoção do fstab.",
+  "— restore proceeds as same-version (verified safe)": "- a restauração prossegue como a mesma versão (seguro verificado)",
+  "— safe restore mode will skip boot/kernel/apt config": "- o modo de restauração segura irá ignorar a configuração de boot/kernel/apt",
+  "— that part works on any distro and is harmless.": "– essa parte funciona em qualquer distro e é inofensiva.",
+  "• Both: mounts twice (pvesm + an independent fstab entry)": "• Ambos: monta duas vezes (pvesm + uma entrada fstab independente)",
+  "• Both: registers as Proxmox storage AND keeps the mount available for LXC bind-mounts": "• Ambos: registra como armazenamento Proxmox E mantém a montagem disponível para montagens vinculadas LXC",
+  "• Both: two independent CIFS mounts (one for Proxmox UI, one for LXC bind-mounts with open perms)": "• Ambos: duas montagens CIFS independentes (uma para Proxmox UI, uma para montagens vinculadas LXC com permissões abertas)",
+  "• Clean up remapped users": "• Limpar usuários remapeados",
+  "• Host fstab: mounted at a path you choose, NOT visible as Proxmox storage": "• Host fstab: montado em um caminho que você escolher, NÃO visível como armazenamento Proxmox",
+  "• Host fstab: mounted at host path only, for LXC bind-mounts (NOT visible as Proxmox storage)": "• Host fstab: montado apenas no caminho do host, para montagens de ligação LXC (NÃO visível como armazenamento Proxmox)",
+  "• Host fstab: mounted with open uid/gid/file_mode at a path you choose, ideal for LXC bind-mounts": "• Host fstab: montado com uid/gid/file_mode aberto em um caminho que você escolher, ideal para montagens de ligação LXC",
+  "• Proxmox storage (pvesm): visible in Datacenter > Storage, mount at /mnt/pve/<id>": "• Armazenamento Proxmox (pvesm): visível em Datacenter > Armazenamento, monte em /mnt/pve/<id>",
+  "• Proxmox storage (pvesm): visible in Datacenter > Storage, usable for VMs/backups/ISOs": "• Armazenamento Proxmox (pvesm): visível em Datacenter > Armazenamento, utilizável para VMs/backups/ISOs",
+  "• Remove Samba groups": "• Remover grupos do Samba",
+  "• Remove all Samba users": "• Remover todos os usuários do Samba",
+  "• Remove all exports": "• Remover todas as exportações",
+  "• Remove all shares": "• Remover todos os compartilhamentos",
+  "• Remove universal sharedfiles group": "• Remover grupo universal de arquivos compartilhados",
+  "• Stop all NFS services": "• Pare todos os serviços NFS",
+  "• Stop all Samba services": "• Pare todos os serviços do Samba",
+  "• Uninstall NFS packages": "• Desinstalar pacotes NFS",
+  "• Uninstall Samba packages": "• Desinstalar pacotes Samba",
+  "← Return": "← Retorno",
+  "− Remove a path": "− Remover um caminho",
+  "──── [ Finish and continue ] ────": "──── [Terminar e continuar] ────",
+  "─────── Custom profile (choose paths manually) ───────": "─────── Perfil personalizado (escolha os caminhos manualmente) ───────",
+  "────────────────── Default profile ───────────────────": "────────────────── Perfil padrão───────────────────",
+  "⚠ Disk data will NOT be erased.": "⚠ Os dados do disco NÃO serão apagados.",
+  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ O disco será desmontado e removido de /etc/fstab.",
+  "⚠ The /etc/fstab entry will be removed.": "⚠ A entrada /etc/fstab será removida.",
+  "⚠ The disk will be unmounted.": "⚠ O disco será desmontado."
+}
diff --git a/menu b/menu
index c6184ea0..8117082d 100644
--- a/menu
+++ b/menu
@@ -135,8 +135,22 @@ check_updates_stable() {
     [[ -z "$LOCAL_VERSION" ]] && return 0
     [[ "$LOCAL_VERSION" = "$REMOTE_VERSION" ]] && return 0
 
-    if whiptail --title "$(translate 'Update Available')" \
-                --yesno "$(translate 'New version available') ($REMOTE_VERSION)\n\n$(translate 'Do you want to update now?')" \
+    # Extract the translated prompt strings into variables FIRST so the
+    # whiptail line below is trivially parseable. A user on the 1.2.2
+    # update path hit:
+    #   menu: line 138: syntax error near unexpected token `$REMOTE_VERSION'
+    # The original inline form was technically valid bash, but a
+    # translate() return that contains a stray quote or paren is enough
+    # to confuse a partially-rewritten file (race during update) or a
+    # corrupted download. Splitting the strings out closes the entire
+    # parsing-risk surface for zero behavioural change.
+    local PROMPT_TITLE PROMPT_AVAIL PROMPT_ASK
+    PROMPT_TITLE="$(translate 'Update Available')"
+    PROMPT_AVAIL="$(translate 'New version available')"
+    PROMPT_ASK="$(translate 'Do you want to update now?')"
+
+    if whiptail --title "$PROMPT_TITLE" \
+                --yesno "$PROMPT_AVAIL ($REMOTE_VERSION)\n\n$PROMPT_ASK" \
                 10 60 --defaultno; then
 
         msg_warn "$(translate 'Starting ProxMenux update...')"
@@ -189,6 +203,34 @@ main_menu() {
     exec bash "$MAIN_MENU"
 }
 
+# `menu -v` / `-h` print info and exit without opening the TUI so
+# admins can query the install over SSH (issue #240).
+case "${1:-}" in
+    -v|--version|-V)
+        local_ver="unknown"
+        [[ -f "$LOCAL_VERSION_FILE" ]] && local_ver="$(<"$LOCAL_VERSION_FILE")"
+        printf 'ProxMenux %s\n' "$local_ver"
+        if is_beta && [[ -f "$BETA_VERSION_FILE" ]]; then
+            printf 'Beta build: %s\n' "$(<"$BETA_VERSION_FILE")"
+        fi
+        exit 0
+        ;;
+    -h|--help)
+        cat <<'EOF'
+Usage: menu [OPTION]
+
+Interactive menu for Proxmox VE management.
+
+Options:
+  -v, --version   Print installed ProxMenux version and exit.
+  -h, --help      Show this help and exit.
+
+Run without arguments to launch the interactive menu.
+EOF
+        exit 0
+        ;;
+esac
+
 load_language
 initialize_cache
 auto_repair_monitor_unit
diff --git a/scripts/backup_restore/Proxmox_Backup_Client.AppImage b/scripts/backup_restore/Proxmox_Backup_Client.AppImage
deleted file mode 100644
index 7b0c4d32..00000000
Binary files a/scripts/backup_restore/Proxmox_Backup_Client.AppImage and /dev/null differ
diff --git a/scripts/backup_restore/apply_cluster_postboot.sh b/scripts/backup_restore/apply_cluster_postboot.sh
new file mode 100755
index 00000000..a2c91d28
--- /dev/null
+++ b/scripts/backup_restore/apply_cluster_postboot.sh
@@ -0,0 +1,714 @@
+#!/bin/bash
+# ==========================================================
+# ProxMenux - Apply Cluster Configs (post-boot)
+# ==========================================================
+# Fires AFTER pve-cluster.service is up, when /etc/pve is
+# the live pmxcfs FUSE mount. We can write individual files
+# to /etc/pve at this point and they propagate through the
+# cluster filesystem normally — no need to stop pve-cluster
+# (which would be unsafe at this stage of boot).
+#
+# Trigger: apply_pending_restore.sh writes a marker file at
+# /var/lib/proxmenux/cluster-apply-pending whose contents is
+# the absolute path of the recovery dir containing the
+# extracted /etc/pve content. The systemd unit has
+# ConditionPathExists=<marker>, so on a normal boot (no
+# marker), the unit short-circuits and does nothing.
+
+set +u
+
+MARKER="${PMX_CLUSTER_APPLY_MARKER:-/var/lib/proxmenux/cluster-apply-pending}"
+LOG_DIR="${PMX_LOG_DIR:-/var/log/proxmenux}"
+# State file the Monitor Web polls to show a live progress card on
+# the Backups tab. A dismiss action (POST /api/host-backups/restore/dismiss)
+# just flips `acknowledged` to true — the file itself lives until the
+# next restore overwrites it, and a copy is archived under history/
+# when the run finishes so the operator can browse past restores.
+STATE_DIR="/var/lib/proxmenux"
+STATE_FILE="$STATE_DIR/restore-state.json"
+HISTORY_DIR="$STATE_DIR/restore-history"
+mkdir -p "$STATE_DIR" "$HISTORY_DIR" >/dev/null 2>&1 || true
+
+mkdir -p "$LOG_DIR" >/dev/null 2>&1 || true
+LOG_FILE="${LOG_DIR}/proxmenux-cluster-postboot-$(date +%Y%m%d_%H%M%S).log"
+exec >>"$LOG_FILE" 2>&1
+
+# Capture start epoch BEFORE any long-running step. The final duration
+# is derived from this; the previous approach used stat -c %Y on the
+# log file, which reads the last-write mtime — and since we `exec >>`
+# to the log for the whole run, that mtime is always ~end-of-run and
+# the duration came out as 0m00s.
+POSTBOOT_START_EPOCH=$(date +%s)
+
+# ── State-file helpers ─────────────────────────────────────────
+# Every milestone advances `steps_done` and optionally updates a
+# handful of other fields. Writes go through a temp file + rename
+# so the Monitor never reads a half-written JSON. All calls are
+# `|| true` at the callsite — if jq or write fails, the restore
+# still proceeds; only the UI progress reporting suffers.
+_state_started_at="$(date -Iseconds)"
+_state_steps_total=0
+_state_steps_done=0
+_state_write() {
+    # Merges a JSON snippet ($1) into the existing state file.
+    # Missing state file → seeded from an empty JSON object first.
+    command -v jq >/dev/null 2>&1 || return 0
+    [[ -f "$STATE_FILE" ]] || echo '{}' > "$STATE_FILE"
+    local tmp
+    tmp=$(mktemp "${STATE_FILE}.XXXXXX") || return 0
+    if jq -c ". * $1" "$STATE_FILE" > "$tmp" 2>/dev/null; then
+        mv -f "$tmp" "$STATE_FILE"
+    else
+        rm -f "$tmp"
+    fi
+}
+_state_step() {
+    # Called as a *step transition*: the previous step just finished,
+    # start the next one. Increments steps_done and sets the label to
+    # $1. Init seeds current_step with the first step's label; every
+    # _state_step call after that advances to the NEXT step.
+    #
+    # Example flow with 3 total steps:
+    #   init         → steps_done=0, current_step="Applying cluster config"
+    #   step "Foo"   → steps_done=1, current_step="Foo"
+    #   step "Bar"   → steps_done=2, current_step="Bar"
+    #   _state_finish→ steps_done=3, status="complete"
+    local label="$1"
+    _state_steps_done=$((_state_steps_done + 1))
+    # jq variable names sdone/stotal — plain `done` collides with the
+    # bash reserved word when the arg is on its own continuation line.
+    _state_write "$(jq -n \
+        --arg step "$label" \
+        --argjson sdone "$_state_steps_done" \
+        --argjson stotal "$_state_steps_total" \
+        '{current_step:$step, steps_done:$sdone, steps_total:$stotal}')"
+}
+_state_component() {
+    # Add or update an entry in state.components. Arrays are replaced
+    # by jq's `*` merge, so plain _state_write can't be used for the
+    # per-component list — this helper explicitly appends new entries
+    # and updates existing ones by name.
+    #   $1 = component name (nvidia_driver, coral_driver, …)
+    #   $2 = status: installing | ok | failed
+    #   $3 = per-component log path (empty allowed)
+    #   $4 = installer exit code (only meaningful for failed; empty otherwise)
+    command -v jq >/dev/null 2>&1 || return 0
+    [[ -f "$STATE_FILE" ]] || echo '{}' > "$STATE_FILE"
+    local tmp
+    tmp=$(mktemp "${STATE_FILE}.XXXXXX") || return 0
+    if jq -c \
+        --arg name "$1" \
+        --arg status "$2" \
+        --arg log "$3" \
+        --arg rc "${4:-}" \
+        '($.components // []) as $comps
+         | ($comps | map(.name) | index($name)) as $idx
+         | ({name:$name, status:$status, log:$log}
+            + (if $rc == "" then {} else {exit_code:$rc} end)) as $entry
+         | .components =
+             (if $idx == null then $comps + [$entry]
+              else ($comps | map(if .name == $name then $entry else . end)) end)' \
+        "$STATE_FILE" > "$tmp" 2>/dev/null; then
+        mv -f "$tmp" "$STATE_FILE"
+    else
+        rm -f "$tmp"
+    fi
+}
+_state_finish() {
+    # $1 = "complete" | "failed"
+    # Promotes steps_done to steps_total so the progress bar reads 100%
+    # instead of freezing at whatever the last _state_step call left it
+    # at (typically N-1 because "finalize" itself never gets its own
+    # _state_step). Also relabels current_step so the card stops
+    # showing the last in-flight step ("Boot sanity check") as if it
+    # were still running.
+    local final_status="$1"
+    local final_label="Restore finished"
+    [[ "$final_status" == "failed" ]] && final_label="Restore failed"
+    _state_write "$(jq -n \
+        --arg s "$final_status" \
+        --arg t "$(date -Iseconds)" \
+        --arg dur "${POSTBOOT_DURATION_FMT:-}" \
+        --arg step "$final_label" \
+        --argjson stotal "$_state_steps_total" \
+        '{status:$s, finished_at:$t, duration:$dur, current_step:$step, steps_done:$stotal, steps_total:$stotal}')"
+    # Archive a copy to history/ so past restores stay browsable
+    # from the Monitor even after the operator dismisses the card.
+    if [[ -f "$STATE_FILE" ]]; then
+        cp -f "$STATE_FILE" "$HISTORY_DIR/$(date +%Y%m%d_%H%M%S)-${final_status}.json" 2>/dev/null || true
+        # Keep the last 20 entries in the history dir. Everything
+        # older is expected to have been reviewed already. Using
+        # find+sort-by-mtime keeps this safe against odd filenames.
+        find "$HISTORY_DIR" -maxdepth 1 -type f -name '*.json' -printf '%T@ %p\n' 2>/dev/null \
+            | sort -rn | tail -n +21 | cut -d' ' -f2- | xargs -r rm -f 2>/dev/null || true
+    fi
+}
+
+echo "=== ProxMenux cluster post-boot apply at $(date -Iseconds) ==="
+
+if [[ ! -f "$MARKER" ]]; then
+    echo "No marker found at $MARKER — nothing to apply."
+    exit 0
+fi
+
+# Marker is env-style key=value, written by apply_pending_restore.sh.
+# Defaults so a malformed marker still gives us safe behaviour.
+RECOVERY_ROOT=""
+PENDING_DIR=""
+NEEDS_INITRAMFS=0
+NEEDS_GRUB=0
+# shellcheck source=/dev/null
+source "$MARKER"
+echo "Recovery root:   $RECOVERY_ROOT"
+echo "Pending dir:     $PENDING_DIR"
+echo "Needs initramfs: $NEEDS_INITRAMFS"
+echo "Needs grub:      $NEEDS_GRUB"
+
+# Compute how many milestones the Monitor will see for this run.
+# Base 3 = apply /etc/pve + boot sanity check + finalize. Add one
+# for each optional phase that will actually run.
+_state_steps_total=3
+[[ "$NEEDS_INITRAMFS" == "1" ]] && _state_steps_total=$((_state_steps_total + 1))
+[[ "$NEEDS_GRUB" == "1" ]] && _state_steps_total=$((_state_steps_total + 1))
+# Count components that will be re-installed via --auto-reinstall.
+# Read the same components_status.json the reinstall loop uses so
+# our step count matches exactly what the loop will process.
+_COMP_STATUS_PATH="/usr/local/share/proxmenux/components_status.json"
+_COMPONENT_KEYS=(nvidia_driver amdgpu_top intel_gpu_tools coral_driver)
+_comps_to_reinstall=0
+if command -v jq >/dev/null 2>&1 && [[ -f "$_COMP_STATUS_PATH" ]]; then
+    for _k in "${_COMPONENT_KEYS[@]}"; do
+        [[ "$(jq -r ".$_k.status // \"\"" "$_COMP_STATUS_PATH" 2>/dev/null)" == "installed" ]] \
+            && _comps_to_reinstall=$((_comps_to_reinstall + 1))
+    done
+fi
+(( _comps_to_reinstall > 0 )) && _state_steps_total=$((_state_steps_total + _comps_to_reinstall))
+
+# Seed the initial state file so the Monitor's poll sees the run
+# almost immediately after the postboot unit starts. `acknowledged`
+# false means the Backups tab card will show; the operator flips
+# it to true (via POST /dismiss) after they've read the summary.
+_state_write "$(jq -n \
+    --arg started "$_state_started_at" \
+    --arg log "$LOG_FILE" \
+    --argjson steps "$_state_steps_total" \
+    '{status:"running",
+      started_at:$started,
+      finished_at:null,
+      current_step:"Applying cluster config",
+      steps_done:0,
+      steps_total:$steps,
+      log_path:$log,
+      components:[],
+      rollback_delta:{},
+      sanity_warnings:[],
+      summary:null,
+      acknowledged:false}')"
+
+if [[ -z "$RECOVERY_ROOT" || ! -d "$RECOVERY_ROOT" ]]; then
+    echo "Recovery root invalid — aborting cleanly."
+    rm -f "$MARKER"
+    _state_finish "failed" || true
+    exit 0
+fi
+
+SOURCE_PVE="$RECOVERY_ROOT/etc/pve"
+if [[ ! -d "$SOURCE_PVE" ]]; then
+    echo "No /etc/pve content in recovery dir — nothing to do."
+    rm -f "$MARKER"
+    exit 0
+fi
+
+# Wait for pmxcfs to be fully writable. The After=pve-cluster.service
+# in our unit gets us past the service-start point, but on slow boots
+# the FUSE mount can take a few extra seconds to settle.
+echo "Waiting for /etc/pve to be writable..."
+for i in {1..60}; do
+    if [[ -d /etc/pve ]] \
+        && touch "/etc/pve/.proxmenux-test-$$" 2>/dev/null; then
+        rm -f "/etc/pve/.proxmenux-test-$$" 2>/dev/null
+        echo "/etc/pve writable after ${i}s"
+        break
+    fi
+    sleep 1
+done
+
+# ── Detect source node name for cross-host node rename ────
+# The source backup's node dir is whatever the source host
+# was called; we copy its contents into THIS host's node
+# dir. Two sources for the source hostname, in order of
+# preference:
+#   1. metadata/run_info.env from the pending dir (definitive)
+#   2. The first (and usually only) dir under nodes/ in the
+#      source backup — works when metadata is missing
+SRC_NODE=""
+if [[ -n "$PENDING_DIR" ]]; then
+    META_RUN_INFO=$(find "$PENDING_DIR" -maxdepth 3 -name run_info.env 2>/dev/null | head -1)
+    if [[ -n "$META_RUN_INFO" && -f "$META_RUN_INFO" ]]; then
+        SRC_NODE=$(grep -m1 '^hostname=' "$META_RUN_INFO" 2>/dev/null | cut -d= -f2- | tr -d '[:space:]')
+    fi
+fi
+if [[ -z "$SRC_NODE" && -d "$SOURCE_PVE/nodes" ]]; then
+    SRC_NODE=$(find "$SOURCE_PVE/nodes" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | head -1)
+    SRC_NODE=$(basename "$SRC_NODE" 2>/dev/null)
+fi
+CUR_NODE=$(hostname)
+echo "Source node: ${SRC_NODE:-(unknown)} / Current node: ${CUR_NODE}"
+
+# ── Apply EVERY top-level file in /etc/pve ────────────────
+# Anything that's a regular file at the root of /etc/pve
+# (datacenter.cfg, storage.cfg, user.cfg, domains.cfg,
+# vzdump.cron, jobs.cfg, replication.cfg, ceph.conf,
+# corosync.conf if cluster, etc). pmxcfs symlinks like
+# /etc/pve/local, /etc/pve/lxc, /etc/pve/qemu-server,
+# /etc/pve/openvz are auto-created by pmxcfs and we skip
+# them — copying over them throws "Operation not permitted".
+echo ""
+echo "── Global config files ──"
+copied_global=0
+PMX_SYMLINKS_SKIP="local lxc qemu-server openvz"
+for src in "$SOURCE_PVE"/*; do
+    [[ -f "$src" ]] || continue
+    name=$(basename "$src")
+    # Skip files that mirror pmxcfs symlinks
+    skip=0
+    for s in $PMX_SYMLINKS_SKIP; do
+        [[ "$name" == "$s" ]] && { skip=1; break; }
+    done
+    (( skip )) && continue
+    if cp -f "$src" "/etc/pve/$name" 2>&1; then
+        echo "  ✓ $name"
+        ((copied_global++))
+    else
+        echo "  ✗ $name (cp failed)"
+    fi
+done
+
+# ── Subdirectories we want to preserve verbatim ───────────
+# Each gets contents copied flat (no recursive dir copy of
+# symlinks). These are the "shared cluster state" dirs.
+echo ""
+echo "── Cluster subdirectories ──"
+copied_subdirs=0
+for subdir in firewall sdn mapping virtual-guest priv ha; do
+    src_dir="$SOURCE_PVE/$subdir"
+    [[ -d "$src_dir" ]] || continue
+    mkdir -p "/etc/pve/$subdir" 2>/dev/null || true
+    while IFS= read -r f; do
+        rel="${f#"$src_dir"/}"
+        dst="/etc/pve/$subdir/$rel"
+        if [[ -d "$f" ]]; then
+            mkdir -p "$dst" 2>/dev/null || true
+        elif [[ -f "$f" ]]; then
+            mkdir -p "$(dirname "$dst")" 2>/dev/null || true
+            cp -f "$f" "$dst" 2>/dev/null && ((copied_subdirs++))
+        fi
+    done < <(find "$src_dir" -mindepth 1 2>/dev/null)
+    echo "  ✓ $subdir/ (subtree)"
+done
+
+# ── Apply guest configs into THIS node's dir ──────────────
+# This is the bit that makes `pct list` / `qm list` show
+# the restored guests. We deliberately copy from the
+# source's node dir into the current host's node dir, so
+# cross-host restores Just Work without renaming anything.
+echo ""
+echo "── Guest configs (LXC + QEMU) ──"
+copied_guests=0
+skipped_guests=0
+if [[ -n "$SRC_NODE" ]] && [[ -d "$SOURCE_PVE/nodes/$SRC_NODE" ]]; then
+    for kind in lxc qemu-server; do
+        src_dir="$SOURCE_PVE/nodes/$SRC_NODE/$kind"
+        dst_dir="/etc/pve/nodes/$CUR_NODE/$kind"
+        [[ -d "$src_dir" ]] || continue
+        mkdir -p "$dst_dir" 2>/dev/null || true
+        for conf in "$src_dir"/*.conf; do
+            [[ -f "$conf" ]] || continue
+            vmid=$(basename "$conf" .conf)
+            if [[ -e "$dst_dir/$vmid.conf" ]]; then
+                echo "  ⚠ $kind/$vmid.conf already exists on this host — skipping (avoid clash)"
+                ((skipped_guests++))
+                continue
+            fi
+            if cp -f "$conf" "$dst_dir/$vmid.conf" 2>&1; then
+                echo "  ✓ $kind/$vmid.conf"
+                ((copied_guests++))
+            else
+                echo "  ✗ $kind/$vmid.conf (cp failed)"
+            fi
+        done
+    done
+else
+    echo "  (no source node dir to copy from)"
+fi
+
+# ── LXC bind-mount stub directories ───────────────────────
+# LXC containers with `mp<n>: /path,mp=...` bind-mount entries fail the
+# pre-start hook (status 2) if `/path` doesn't exist on the host. After a
+# cross-host restore the source's bind-mount paths (custom NAS mounts, second
+# disk paths, etc.) generally don't exist on the target's fresh install yet.
+# We create empty stubs so `onboot: 1` containers start; the operator wires
+# the real data source afterwards. PVE-managed storages (`/mnt/pve/*`) and
+# /dev/* are skipped — PVE handles the first, kernel handles the second.
+echo ""
+echo "── LXC bind-mount stubs ──"
+stub_created=0
+stub_skipped=0
+if compgen -G "/etc/pve/nodes/$CUR_NODE/lxc/*.conf" >/dev/null 2>&1; then
+    for conf in /etc/pve/nodes/"$CUR_NODE"/lxc/*.conf; do
+        [[ -f "$conf" ]] || continue
+        while IFS= read -r line; do
+            if [[ "$line" =~ ^mp[0-9]+:[[:space:]]*(/[^,]+), ]]; then
+                src="${BASH_REMATCH[1]}"
+                [[ "$src" == /mnt/pve/* ]] && continue
+                [[ "$src" == /dev/* ]]    && continue
+                if [[ -e "$src" ]]; then
+                    ((stub_skipped++))
+                    continue
+                fi
+                if mkdir -p "$src" 2>/dev/null; then
+                    echo "  + stub $src  (from $(basename "$conf"))"
+                    ((stub_created++))
+                fi
+            fi
+        done < "$conf"
+    done
+fi
+echo "Stubs: created=$stub_created, already-present=$stub_skipped"
+
+# ── Stale node-dir cleanup ────────────────────────────────
+# Fresh PVE install creates /etc/pve/nodes/<install-hostname>/. After our
+# restore changes the hostname back to the source's, pve-cluster boots into
+# the source's node dir but leaves the install-hostname dir orphaned. The
+# web UI then shows a phantom offline node. Only remove dirs whose lxc/
+# qemu-server/ are empty — never trample a real second cluster member.
+echo ""
+echo "── Stale node-dir cleanup ──"
+removed_nodes=0
+for nodedir in /etc/pve/nodes/*/; do
+    n=$(basename "$nodedir")
+    [[ "$n" == "$CUR_NODE" ]] && continue
+    lxc_empty=1; qemu_empty=1
+    [[ -d "$nodedir/lxc" ]] && [[ -n "$(ls -A "$nodedir/lxc"        2>/dev/null)" ]] && lxc_empty=0
+    [[ -d "$nodedir/qemu-server" ]] && [[ -n "$(ls -A "$nodedir/qemu-server" 2>/dev/null)" ]] && qemu_empty=0
+    if (( lxc_empty && qemu_empty )); then
+        if rm -rf "$nodedir" 2>/dev/null; then
+            echo "  ✓ removed stale node dir: $n"
+            ((removed_nodes++))
+        else
+            echo "  ✗ rm failed for $n (pmxcfs may have it busy)"
+        fi
+    else
+        echo "  ⚠ kept $n (has guest configs — looks like a real cluster member)"
+    fi
+done
+echo "Stale node dirs removed: $removed_nodes"
+
+# ── Done with cluster config apply ─────────────────────────
+echo ""
+echo "Cluster summary: globals=$copied_global, subdirs=$copied_subdirs, guests=$copied_guests, guest-clashes-skipped=$skipped_guests"
+
+# Remove the marker NOW (before the slow maintenance step
+# below) so if the operator reboots mid-maintenance, we
+# don't redo the (idempotent but wasteful) cluster apply.
+# Maintenance below is also idempotent on re-run but takes
+# 10+ min, so we'd rather not repeat it either — see the
+# marker handling in the maintenance block.
+rm -f "$MARKER"
+
+# ── Post-restore maintenance (slow, deferrable) ────────────
+# After a host-config restore, we need to:
+#   - update-initramfs -u -k all  → so /etc/modules /etc/modprobe.d
+#       /etc/initramfs-tools changes get baked into the initramfs
+#       of every installed kernel for the NEXT boot.
+#   - update-grub  → so /etc/default/grub changes land in
+#       /boot/grub/grub.cfg for the NEXT boot.
+#
+# These are EXPENSIVE (initramfs build per kernel × 3 = 5-10 min;
+# grub a few seconds) but the user's system is already fully up
+# at this point: they can SSH in, use PVE, do anything — these
+# run in the background and finish whenever they finish. The
+# unit's TimeoutStartSec=900 (set in apply_pending_restore.sh)
+# gives us a 15-min cushion. We log progress to the same log
+# file so the operator can `tail -f` if curious.
+echo ""
+echo "── Post-restore maintenance ──"
+# Only do these if the apply_pending_restore.sh's path-trigger
+# analysis said they're needed. On a restore that didn't touch
+# /etc/modules /etc/default/grub etc., both flags are 0 and we
+# skip the slow rebuild entirely.
+MAINT_MARKER="/var/lib/proxmenux/post-restore-maintenance-pending"
+if [[ "$NEEDS_INITRAMFS" == "1" ]] || [[ "$NEEDS_GRUB" == "1" ]]; then
+    mkdir -p /var/lib/proxmenux >/dev/null 2>&1 || true
+    printf 'started: %s\n' "$(date -Iseconds)" > "$MAINT_MARKER"
+fi
+
+if [[ "$NEEDS_INITRAMFS" == "1" ]] && command -v update-initramfs >/dev/null 2>&1; then
+    _state_step "Rebuilding initramfs" || true
+    echo "Running: update-initramfs -u -k all  (5-10 min — restore touched initramfs inputs)"
+    if update-initramfs -u -k all 2>&1 | tail -10; then
+        echo "  ✓ update-initramfs done"
+    else
+        echo "  ✗ update-initramfs failed (system still boots; re-run manually)"
+    fi
+    if command -v proxmox-boot-tool >/dev/null 2>&1; then
+        proxmox-boot-tool refresh 2>&1 | tail -3 || true
+    fi
+else
+    echo "Skipping update-initramfs (restore didn't touch modules/initramfs-tools/crypttab)"
+fi
+
+if [[ "$NEEDS_GRUB" == "1" ]] && command -v update-grub >/dev/null 2>&1; then
+    _state_step "Updating bootloader" || true
+    echo "Running: update-grub"
+    if update-grub 2>&1 | tail -3; then
+        echo "  ✓ update-grub done"
+    else
+        echo "  ✗ update-grub failed (re-run manually)"
+    fi
+else
+    echo "Skipping update-grub (restore didn't touch /etc/default/grub or /etc/kernel)"
+fi
+
+# Clean up the maintenance marker now that we're done.
+rm -f "$MAINT_MARKER"
+
+# ── Component auto-reinstall (driven by components_status.json) ──
+# The host-config restore brings back ProxMenux state (including
+# components_status.json) but NOT the binary artifacts those
+# components installed outside of apt — driver modules under
+# /lib/modules/<kernel>/, binaries in /usr/bin/<tool>, downloaded
+# .deb files, DKMS source trees, etc. For each component the
+# restore state says was installed, we kick off its native
+# installer in `--auto-reinstall` mode so it replays the install
+# without dialogs. The installer's own logic handles "already
+# present → no-op", so this is idempotent.
+#
+# Apt-only components are still handled by the
+# packages.manual.list pass done earlier in the restore flow
+# (they're in `apt-mark showmanual`). Running the installer here
+# for them is harmless overhead (the installer just sees the
+# package is present and exits 0), so we don't try to filter.
+#
+# To register a NEW component for auto-reinstall: add it to the
+# COMPONENT_INSTALLERS array below as "component_key:relative
+# script path". The script must accept `--auto-reinstall` and
+# read its own state from components_status.json.
+COMPONENTS_STATUS="/usr/local/share/proxmenux/components_status.json"
+COMPONENT_INSTALLERS=(
+    "nvidia_driver:gpu_tpu/nvidia_installer.sh"
+    "amdgpu_top:gpu_tpu/amd_gpu_tools.sh"
+    "intel_gpu_tools:gpu_tpu/intel_gpu_tools.sh"
+    "coral_driver:gpu_tpu/install_coral.sh"
+)
+
+if command -v jq >/dev/null 2>&1 && [[ -f "$COMPONENTS_STATUS" ]]; then
+    echo ""
+    echo "── Component auto-reinstall ──"
+    SCRIPTS_BASE="/usr/local/share/proxmenux/scripts"
+    for entry in "${COMPONENT_INSTALLERS[@]}"; do
+        comp="${entry%%:*}"
+        installer="$SCRIPTS_BASE/${entry#*:}"
+
+        comp_status=$(jq -r ".${comp}.status // \"\"" "$COMPONENTS_STATUS" 2>/dev/null)
+        if [[ "$comp_status" != "installed" ]]; then
+            continue   # Was never installed on the source, or was uninstalled — skip.
+        fi
+
+        if [[ ! -f "$installer" ]]; then
+            echo "  ✗ $comp: installer missing at $installer — skipping"
+            continue
+        fi
+
+        echo ""
+        echo "  → $comp (running $installer --auto-reinstall)"
+        _state_step "Reinstalling $comp" || true
+        _state_component "$comp" "installing" "" ""
+        # Redirect to a per-component log instead of piping. NVIDIA's
+        # runfile installer forks helpers that inherit stdout, so a
+        # `bash $installer | sed | tail` pipeline never sees EOF after
+        # the parent exits and hangs until systemd kills the unit.
+        comp_log="/var/log/proxmenux/component-${comp}-$(date +%Y%m%d_%H%M%S).log"
+        bash "$installer" --auto-reinstall >"$comp_log" 2>&1
+        rc=$?
+        sed -e 's/^/    /' "$comp_log" | tail -15
+        if (( rc == 0 )); then
+            echo "  ✓ $comp ok  (full log: $comp_log)"
+            _state_component "$comp" "ok" "$comp_log" ""
+        else
+            echo "  ✗ $comp installer exited $rc — see $comp_log"
+            _state_component "$comp" "failed" "$comp_log" "$rc"
+        fi
+    done
+fi
+
+POSTBOOT_END_EPOCH=$(date +%s)
+POSTBOOT_DURATION=$((POSTBOOT_END_EPOCH - POSTBOOT_START_EPOCH))
+POSTBOOT_DURATION_FMT=$(printf '%dm%02ds' $((POSTBOOT_DURATION / 60)) $((POSTBOOT_DURATION % 60)))
+
+# ── Rollback delta report (read-only) ──────────────────────────
+# If _rs_prepare_pending_restore left a rollback.json in the
+# pending dir, surface the deltas that a full rollback would
+# touch: VMs/LXCs created after the backup that are still here,
+# extra components not present in the backup. The operator
+# decides what to do with them — we don't destroy guests or
+# uninstall packages automatically (left to a future R2.D fase 2
+# once every installer ships an --auto-uninstall mode).
+ROLLBACK_PLAN_FILE=""
+[[ -n "$PENDING_DIR" && -f "$PENDING_DIR/rollback.json" ]] && \
+    ROLLBACK_PLAN_FILE="$PENDING_DIR/rollback.json"
+if [[ -n "$ROLLBACK_PLAN_FILE" ]] && command -v jq >/dev/null 2>&1; then
+    rb_vm_extras=$(jq -r '.vms_to_remove | join(", ") // ""' "$ROLLBACK_PLAN_FILE" 2>/dev/null)
+    rb_lxc_extras=$(jq -r '.lxcs_to_remove | join(", ") // ""' "$ROLLBACK_PLAN_FILE" 2>/dev/null)
+    rb_comp_extras=$(jq -r '.components_to_uninstall | join(", ") // ""' "$ROLLBACK_PLAN_FILE" 2>/dev/null)
+    # Copy the structured plan into the state file so the Monitor's
+    # detail modal can render each list as its own table without
+    # re-parsing the CSV strings above.
+    _state_write "$(jq -c '{rollback_delta:{
+        vms_to_remove: (.vms_to_remove // []),
+        lxcs_to_remove: (.lxcs_to_remove // []),
+        components_to_uninstall: (.components_to_uninstall // [])
+    }}' "$ROLLBACK_PLAN_FILE" 2>/dev/null)" || true
+    if [[ -n "$rb_vm_extras" || -n "$rb_lxc_extras" || -n "$rb_comp_extras" ]]; then
+        echo ""
+        echo "── Rollback delta report ──"
+        echo "These entries exist on the host but were NOT in the restored backup."
+        echo "Review them and remove manually if a clean rollback is desired:"
+        [[ -n "$rb_vm_extras"   ]] && echo "  • VMs   created after the backup: $rb_vm_extras"
+        [[ -n "$rb_lxc_extras"  ]] && echo "  • LXCs  created after the backup: $rb_lxc_extras"
+        [[ -n "$rb_comp_extras" ]] && echo "  • Components installed after the backup: $rb_comp_extras"
+        echo ""
+        echo "Manual cleanup commands (run only if you want to truly roll back):"
+        for _id in $(echo "$rb_vm_extras" | tr ',' ' '); do
+            [[ -n "$_id" ]] && echo "  qm stop $_id 2>/dev/null; qm destroy $_id --purge"
+        done
+        for _id in $(echo "$rb_lxc_extras" | tr ',' ' '); do
+            [[ -n "$_id" ]] && echo "  pct stop $_id 2>/dev/null; pct destroy $_id --purge"
+        done
+    fi
+fi
+
+# ── Boot sanity check ──────────────────────────────────────────
+# Cross-version restores are the most likely path to a broken
+# boot: even with the safe-restore filter, catch situations where
+# the default kernel has no matching /lib/modules, no ESP is
+# configured, or a stale reference survived. Runs on every restore
+# (cheap); warnings feed the completion notification so it tells
+# the truth instead of a blanket "all fine".
+_state_step "Boot sanity check" || true
+SANITY_WARNINGS=""
+_sanity_warn() {
+    if [[ -z "$SANITY_WARNINGS" ]]; then
+        SANITY_WARNINGS="$1"
+    else
+        SANITY_WARNINGS="${SANITY_WARNINGS}; $1"
+    fi
+}
+
+if command -v proxmox-boot-tool >/dev/null 2>&1; then
+    if ! proxmox-boot-tool status 2>/dev/null | grep -q 'configured with'; then
+        _sanity_warn "proxmox-boot-tool reports no ESP configured"
+    fi
+fi
+
+if [[ -d /boot ]]; then
+    for _vmlinuz in /boot/vmlinuz-*; do
+        [[ -e "$_vmlinuz" ]] || continue
+        _kver="${_vmlinuz##*vmlinuz-}"
+        if [[ ! -d "/lib/modules/$_kver" ]]; then
+            _sanity_warn "kernel $_kver has no /lib/modules"
+        fi
+    done
+fi
+
+if [[ -L /vmlinuz && ! -e /vmlinuz ]]; then
+    _sanity_warn "/vmlinuz symlink is dangling"
+fi
+
+if [[ -n "$SANITY_WARNINGS" ]]; then
+    echo ""
+    echo "── Boot sanity check ──"
+    echo "$SANITY_WARNINGS"
+    echo "Cross-version: ${HB_COMPAT_CROSS_VERSION:-0}"
+fi
+
+# Persist sanity warnings as a JSON array so the Monitor's detail
+# modal can render each warning as its own line. Empty warnings →
+# empty array, which the UI treats as "sanity OK".
+if command -v jq >/dev/null 2>&1; then
+    _state_write "$(jq -cn --arg s "$SANITY_WARNINGS" \
+        '{sanity_warnings: (if $s == "" then [] else ($s | split("; ")) end)}')" || true
+fi
+
+# ── Notify ProxMenux Monitor that we're done ───────────────────
+# Routes through the user's configured channels (Telegram, Discord,
+# ntfy, etc.). Localhost-only endpoint, no auth needed. We try
+# briefly — if the Monitor isn't running, just log and move on.
+COMPONENTS_REINSTALLED_CSV=""
+if command -v jq >/dev/null 2>&1 && [[ -f "$COMPONENTS_STATUS" ]]; then
+    COMPONENTS_REINSTALLED_CSV=$(
+        for entry in "${COMPONENT_INSTALLERS[@]}"; do
+            comp="${entry%%:*}"
+            s=$(jq -r ".${comp}.status // \"\"" "$COMPONENTS_STATUS" 2>/dev/null)
+            [[ "$s" == "installed" ]] && printf '%s,' "$comp"
+        done | sed 's/,$//'
+    )
+    [[ -z "$COMPONENTS_REINSTALLED_CSV" ]] && COMPONENTS_REINSTALLED_CSV="none"
+fi
+
+if command -v curl >/dev/null 2>&1; then
+    # jq builds a proper JSON when available so SANITY_WARNINGS with
+    # special chars can't break the payload. Falls back to printf on
+    # hosts without jq — we already restrict SANITY_WARNINGS content
+    # to plain ASCII in the sanity check above, so the fallback is
+    # safe too.
+    if command -v jq >/dev/null 2>&1; then
+        PAYLOAD=$(jq -cn \
+            --arg hostname    "$(hostname)" \
+            --arg guests      "${copied_guests:-0}" \
+            --arg stubs       "${stub_created:-0}" \
+            --arg stale_nodes "${removed_nodes:-0}" \
+            --arg components  "${COMPONENTS_REINSTALLED_CSV:-none}" \
+            --arg duration    "$POSTBOOT_DURATION_FMT" \
+            --arg warnings    "$SANITY_WARNINGS" \
+            '{hostname:$hostname, guests:$guests, stubs:$stubs, stale_nodes:$stale_nodes, components:$components, duration:$duration, warnings:$warnings}')
+    else
+        PAYLOAD=$(printf '{"hostname":"%s","guests":"%s","stubs":"%s","stale_nodes":"%s","components":"%s","duration":"%s","warnings":"%s"}' \
+            "$(hostname)" \
+            "${copied_guests:-0}" \
+            "${stub_created:-0}" \
+            "${removed_nodes:-0}" \
+            "${COMPONENTS_REINSTALLED_CSV:-none}" \
+            "$POSTBOOT_DURATION_FMT" \
+            "$SANITY_WARNINGS")
+    fi
+    NOTIFY_HTTP=$(curl -s -o /dev/null -w '%{http_code}' \
+        -X POST "http://127.0.0.1:8008/api/internal/restore-event" \
+        -H "Content-Type: application/json" \
+        -d "$PAYLOAD" \
+        --max-time 5 2>/dev/null || echo "000")
+    if [[ "$NOTIFY_HTTP" == "200" ]]; then
+        echo "Notification sent (HTTP 200)"
+    else
+        echo "Notification skipped (Monitor not reachable or disabled — HTTP $NOTIFY_HTTP)"
+    fi
+fi
+
+# Persist a compact summary the Monitor's card can render inline.
+# Mirrors what the notification block sends; keeps a single source
+# of truth for both the alert channels and the Web UI.
+if command -v jq >/dev/null 2>&1; then
+    _state_write "$(jq -cn \
+        --arg hostname    "$(hostname)" \
+        --arg guests      "${copied_guests:-0}" \
+        --arg stubs       "${stub_created:-0}" \
+        --arg stale_nodes "${removed_nodes:-0}" \
+        --arg components  "${COMPONENTS_REINSTALLED_CSV:-none}" \
+        --arg duration    "$POSTBOOT_DURATION_FMT" \
+        '{summary:{hostname:$hostname, guests:$guests, stubs:$stubs, stale_nodes:$stale_nodes, components:$components, duration:$duration}}')" || true
+fi
+_state_finish "complete" || true
+
+echo ""
+echo "=== Apply finished at $(date -Iseconds) — total ${POSTBOOT_DURATION_FMT} ==="
+echo "Log: $LOG_FILE"
diff --git a/scripts/backup_restore/apply_pending_restore.sh b/scripts/backup_restore/apply_pending_restore.sh
old mode 100644
new mode 100755
index 2e756be8..594eb166
--- a/scripts/backup_restore/apply_pending_restore.sh
+++ b/scripts/backup_restore/apply_pending_restore.sh
@@ -7,8 +7,8 @@ PENDING_BASE="${PMX_RESTORE_PENDING_BASE:-/var/lib/proxmenux/restore-pending}"
 CURRENT_LINK="${PENDING_BASE}/current"
 LOG_DIR="${PMX_RESTORE_LOG_DIR:-/var/log/proxmenux}"
 DEST_PREFIX="${PMX_RESTORE_DEST_PREFIX:-/}"
-PRE_BACKUP_BASE="${PMX_RESTORE_PRE_BACKUP_BASE:-/root/proxmenux-pre-restore}"
-RECOVERY_BASE="${PMX_RESTORE_RECOVERY_BASE:-/root/proxmenux-recovery}"
+PRE_BACKUP_BASE="${PMX_RESTORE_PRE_BACKUP_BASE:-/var/lib/proxmenux/pre-restore}"
+RECOVERY_BASE="${PMX_RESTORE_RECOVERY_BASE:-/var/lib/proxmenux/recovery}"
 
 mkdir -p "$LOG_DIR" "$PENDING_BASE/completed" >/dev/null 2>&1 || true
 LOG_FILE="${LOG_DIR}/proxmenux-restore-onboot-$(date +%Y%m%d_%H%M%S).log"
@@ -39,6 +39,9 @@ if [[ -f "$PLAN_ENV" ]]; then
 fi
 
 : "${HB_RESTORE_INCLUDE_ZFS:=0}"
+: "${HB_COMPAT_CROSS_VERSION:=0}"
+: "${HB_COMPAT_KERNEL_DIRECTION:=same}"
+: "${HB_HYDRATION_APPLIED:=0}"
 
 if [[ ! -f "$APPLY_LIST" ]]; then
     echo "Apply list missing: $APPLY_LIST"
@@ -46,9 +49,30 @@ if [[ ! -f "$APPLY_LIST" ]]; then
     exit 1
 fi
 
-echo "Pending dir: $PENDING_DIR"
-echo "Apply list:  $APPLY_LIST"
-echo "Include ZFS: $HB_RESTORE_INCLUDE_ZFS"
+echo "Pending dir:      $PENDING_DIR"
+echo "Apply list:       $APPLY_LIST"
+echo "Include ZFS:      $HB_RESTORE_INCLUDE_ZFS"
+echo "Cross-version:    $HB_COMPAT_CROSS_VERSION"
+echo "Kernel direction: $HB_COMPAT_KERNEL_DIRECTION"
+
+# Hardware-drift skips persisted by _rs_prepare_pending_restore.
+# Each line is an absolute path; we drop any rel path that matches
+# (exact or descendant) before writing it back to disk. Without this
+# the post-boot apply restored e.g. /etc/kernel/proxmox-boot-uuids
+# from the backup, leaving the new bootloader pointing at a stale
+# EFI UUID.
+RS_SKIP_PATHS=""
+SKIP_PATHS_FILE="$PENDING_DIR/rs-skip-paths.txt"
+if [[ -f "$SKIP_PATHS_FILE" ]]; then
+    RS_SKIP_PATHS=$(cat "$SKIP_PATHS_FILE")
+    # Skips come from two sources today: hardware drift and
+    # cross-version safe restore. The label is generic so the log
+    # is truthful without having to reconcile the two upstream.
+    _skip_source_label="drift"
+    [[ "${HB_COMPAT_CROSS_VERSION:-0}" == "1" ]] && _skip_source_label="drift + cross-version"
+    echo "Skip paths:  $(wc -l <"$SKIP_PATHS_FILE") entries (${_skip_source_label})"
+fi
+
 echo "running" >"$STATE_FILE"
 
 backup_root="${PRE_BACKUP_BASE}/$(date +%Y%m%d_%H%M%S)-onboot"
@@ -70,7 +94,44 @@ while IFS= read -r rel; do
         continue
     fi
 
-    # Never restore cluster virtual filesystem data live.
+    # Hardware-drift skip filter — three cases:
+    #   1) "$rel" is exactly a skipped path → drop the whole rel
+    #   2) "$rel" is under a skipped path → drop the whole rel
+    #   3) A skipped path is under "$rel" (e.g. rel="etc/kernel" and
+    #      skip="/etc/kernel/proxmox-boot-uuids") → keep applying rel
+    #      but rsync with --exclude for the specific file, and NO
+    #      --delete (so the host's existing file is preserved)
+    RSYNC_EXCLUDES=()
+    if [[ -n "$RS_SKIP_PATHS" ]]; then
+        _abs="/$rel"
+        _drop=0
+        while IFS= read -r _skip; do
+            [[ -z "$_skip" ]] && continue
+            if [[ "$_abs" == "$_skip" || "$_abs" == "$_skip"/* ]]; then
+                _drop=1
+                break
+            fi
+            # Case 3: skip is under our rel — build a relative exclude
+            if [[ "$_skip" == "$_abs"/* ]]; then
+                _rel_skip="${_skip#"$_abs"/}"
+                RSYNC_EXCLUDES+=(--exclude="$_rel_skip")
+            fi
+        done <<<"$RS_SKIP_PATHS"
+        if (( _drop )); then
+            echo "  drift-skip: $rel"
+            ((skipped++))
+            continue
+        fi
+    fi
+
+    # Cluster data (/etc/pve, /var/lib/pve-cluster) goes into a
+    # recovery dir for forensics/rollback, but unlike the live-
+    # menu apply path we ALSO apply it for real here: at this
+    # point in boot we're before networking.service, nothing is
+    # talking to the cluster yet, so a `systemctl stop pve-cluster`
+    # → copy → `systemctl start pve-cluster` is safe. This is the
+    # whole reason the operator picked "schedule remaining for
+    # next boot" instead of doing it live from SSH.
     if [[ "$rel" == etc/pve* ]] || [[ "$rel" == var/lib/pve-cluster* ]]; then
         if [[ -z "$cluster_recovery_root" ]]; then
             cluster_recovery_root="${RECOVERY_BASE}/$(date +%Y%m%d_%H%M%S)-onboot"
@@ -78,6 +139,10 @@ while IFS= read -r rel; do
         fi
         mkdir -p "$cluster_recovery_root/$(dirname "$rel")" >/dev/null 2>&1 || true
         cp -a "$src" "$cluster_recovery_root/$rel" >/dev/null 2>&1 || true
+        # Mark that we need to do the live apply at the end of
+        # the loop (we don't want to stop/start pve-cluster
+        # per-file — once is enough).
+        cluster_live_apply=1
         ((skipped++))
         continue
     fi
@@ -97,10 +162,21 @@ while IFS= read -r rel; do
 
     if [[ -d "$src" ]]; then
         mkdir -p "$dst" >/dev/null 2>&1 || true
-        if rsync -aAXH --delete "$src/" "$dst/" >/dev/null 2>&1; then
-            ((applied++))
+        # When an exclude list is present, drop --delete so the host's
+        # copy of the excluded file isn't removed by rsync after being
+        # skipped from the source side.
+        if [[ ${#RSYNC_EXCLUDES[@]} -gt 0 ]]; then
+            if rsync -aAXH "${RSYNC_EXCLUDES[@]}" "$src/" "$dst/" >/dev/null 2>&1; then
+                ((applied++))
+            else
+                ((failed++))
+            fi
         else
-            ((failed++))
+            if rsync -aAXH --delete "$src/" "$dst/" >/dev/null 2>&1; then
+                ((applied++))
+            else
+                ((failed++))
+            fi
         fi
     else
         mkdir -p "$(dirname "$dst")" >/dev/null 2>&1 || true
@@ -113,8 +189,13 @@ while IFS= read -r rel; do
 done <"$APPLY_LIST"
 
 systemctl daemon-reload >/dev/null 2>&1 || true
-command -v update-initramfs >/dev/null 2>&1 && update-initramfs -u -k all >/dev/null 2>&1 || true
-command -v update-grub >/dev/null 2>&1 && update-grub >/dev/null 2>&1 || true
+
+# `update-initramfs -u -k all` and `update-grub` used to live here
+# but: (a) they take 5-10 minutes for 3 kernels, hanging early-boot
+# for that long, and (b) ifupdown2 was waiting on us. They now run
+# AFTER pve-cluster is up via the apply_cluster_postboot.sh script
+# we hook below, in the background where the user is already on the
+# login prompt and using the system. Zero manual steps needed.
 
 echo "Applied: $applied"
 echo "Skipped: $skipped"
@@ -122,6 +203,8 @@ echo "Failed:  $failed"
 echo "Backup before restore: $backup_root"
 
 if [[ -n "$cluster_recovery_root" ]]; then
+    # Always write the manual-helper script first — that's the
+    # rollback path if the live apply below blows up.
     helper="${cluster_recovery_root}/apply-cluster-restore.sh"
     cat > "$helper" <<EOF
 #!/bin/bash
@@ -146,6 +229,108 @@ EOF
 
     echo "Cluster paths extracted to: $cluster_recovery_root"
     echo "Cluster recovery helper: $helper"
+
+    # We DON'T auto-apply /etc/pve here at boot because early-boot
+    # pve-cluster start blocks the unit (corosync etc. not ready).
+    # Instead we hand off to a SECOND oneshot unit that fires
+    # AFTER pve-cluster.service is up, when /etc/pve is the live
+    # pmxcfs FUSE mount and we can write individual files to it
+    # without restarting anything. That second unit is gated by
+    # ConditionPathExists on the marker file we drop here, so on
+    # a normal boot (no marker) it's a no-op.
+    if [[ "${cluster_live_apply:-0}" == "1" ]]; then
+        echo "Installing post-boot cluster apply unit..."
+
+        # Decide whether the post-boot script needs to run
+        # update-initramfs and/or update-grub by inspecting the
+        # apply list. Skipping them when nothing relevant was
+        # restored saves the operator 5-10 minutes of background
+        # initramfs rebuilds on EVERY restore — only do it when
+        # the backup actually touched paths that affect those
+        # tools' inputs.
+        NEEDS_INITRAMFS=0
+        NEEDS_GRUB=0
+        while IFS= read -r _rel; do
+            case "$_rel" in
+                etc/modules|etc/modules/*|\
+                etc/modules-load.d|etc/modules-load.d/*|\
+                etc/modprobe.d|etc/modprobe.d/*|\
+                etc/initramfs-tools|etc/initramfs-tools/*|\
+                etc/crypttab|\
+                etc/cryptsetup-initramfs|etc/cryptsetup-initramfs/*)
+                    NEEDS_INITRAMFS=1 ;;
+                etc/default/grub|\
+                etc/kernel|etc/kernel/*|\
+                etc/grub.d|etc/grub.d/*)
+                    NEEDS_GRUB=1 ;;
+            esac
+        done < "$APPLY_LIST"
+        # bk_older hydration writes tokens/modules/files DIRECTLY to
+        # the live target (bypassing the apply_list because the whole
+        # paths are in RS_SKIP_PATHS). Those changes still need
+        # update-initramfs + update-grub / proxmox-boot-tool refresh
+        # to take effect on the next boot — force the flags so the
+        # post-boot script picks them up.
+        if [[ "${HB_HYDRATION_APPLIED:-0}" == "1" ]]; then
+            NEEDS_INITRAMFS=1
+            NEEDS_GRUB=1
+        fi
+        echo "Post-boot maintenance flags: initramfs=$NEEDS_INITRAMFS grub=$NEEDS_GRUB"
+
+        # Marker as env-style key=value so the post-boot script
+        # can `source` it and read structured fields.
+        mkdir -p /var/lib/proxmenux >/dev/null 2>&1 || true
+        {
+            printf 'RECOVERY_ROOT=%s\n' "$cluster_recovery_root"
+            printf 'PENDING_DIR=%s\n'   "$PENDING_DIR"
+            printf 'NEEDS_INITRAMFS=%s\n' "$NEEDS_INITRAMFS"
+            printf 'NEEDS_GRUB=%s\n'      "$NEEDS_GRUB"
+            printf 'HB_COMPAT_CROSS_VERSION=%s\n' "${HB_COMPAT_CROSS_VERSION:-0}"
+        } > /var/lib/proxmenux/cluster-apply-pending
+        chmod 600 /var/lib/proxmenux/cluster-apply-pending
+
+        # Install the systemd unit. Idempotent: overwrite if it
+        # already exists (so script changes get picked up).
+        cat > /etc/systemd/system/proxmenux-apply-cluster-postboot.service <<UNITEOF
+[Unit]
+Description=ProxMenux Apply Cluster Configs (post-boot)
+After=pve-cluster.service pveproxy.service network-online.target
+Wants=pve-cluster.service
+# Only fire on boots where pending_restore left us a marker.
+# On every other boot, the condition fails and systemd skips
+# us — zero overhead.
+ConditionPathExists=/var/lib/proxmenux/cluster-apply-pending
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/share/proxmenux/scripts/backup_restore/apply_cluster_postboot.sh
+# Cap sized for the worst case: update-initramfs across all
+# kernels + update-grub + cluster apply + component auto-reinstall
+# (NVIDIA driver download + kernel-module build is the long pole).
+# Service runs after pve-cluster is up, so this is purely background.
+TimeoutStartSec=3600
+
+[Install]
+WantedBy=multi-user.target
+UNITEOF
+
+        systemctl daemon-reload >/dev/null 2>&1 || true
+        systemctl enable proxmenux-apply-cluster-postboot.service >/dev/null 2>&1 || true
+
+        # `systemctl enable` only adds the unit to multi-user.target.wants/.
+        # It does NOT pull the unit into the currently-running boot
+        # transaction — by the time we run, multi-user.target may have
+        # already collected its wants. `start --no-block` schedules the
+        # unit for activation respecting its After= ordering (pve-cluster
+        # comes up first), without blocking apply_pending_restore.sh
+        # itself. Without this, the postboot unit only fires on the
+        # NEXT reboot, defeating the "single reboot, zero manual steps"
+        # promise.
+        systemctl start --no-block proxmenux-apply-cluster-postboot.service >/dev/null 2>&1 || true
+
+        echo "Cluster apply will run automatically after pve-cluster comes up."
+        echo "Fallback manual: bash $helper"
+    fi
 fi
 
 if [[ "$failed" -eq 0 ]]; then
diff --git a/scripts/backup_restore/backup_host.sh b/scripts/backup_restore/backup_host.sh
old mode 100644
new mode 100755
index 055fabeb..97ce6fa7
--- a/scripts/backup_restore/backup_host.sh
+++ b/scripts/backup_restore/backup_host.sh
@@ -65,7 +65,10 @@ _bk_pbs() {
     local backup_id epoch log_file staging_root t_start elapsed staged_size
 
     hb_select_pbs_repository || return 1
-    hb_ask_pbs_encryption
+    # Return 1 propagates operator cancel from the encryption / passphrase
+    # dialogs so the outer menu shows the source picker again instead of
+    # proceeding with a half-configured backup.
+    hb_ask_pbs_encryption || return 1
 
     hb_select_profile_paths "$profile_mode" paths || return 1
 
@@ -99,6 +102,17 @@ _bk_pbs() {
     staged_size=$(hb_file_size "$staging_root/rootfs")
     msg_ok "$(translate "Staging ready.") $(translate "Data size:") $staged_size"
 
+    # Notify host_backup_start. Per-channel/per-event toggles in
+    # Settings decide whether the user actually receives it; same
+    # template the scheduled runner uses.
+    export HB_NOTIFY_JOB_ID="manual-pbs-${backup_id}"
+    export HB_NOTIFY_BACKEND="pbs"
+    export HB_NOTIFY_DESTINATION="$HB_PBS_REPOSITORY"
+    export HB_NOTIFY_PROFILE_MODE="$profile_mode"
+    export HB_NOTIFY_LOG_FILE="$log_file"
+    export HB_NOTIFY_DATA_SIZE="$staged_size"
+    hb_notify_lifecycle "start"
+
     echo -e ""
     msg_info "$(translate "Connecting to PBS and starting backup...")"
     stop_spinner
@@ -106,9 +120,19 @@ _bk_pbs() {
     epoch=$(date +%s)
     t_start=$SECONDS
 
+    # We back up the WHOLE staging_root (rootfs/ + metadata/) into
+    # the .pxar — earlier versions used `$staging_root/rootfs` as
+    # the source, which left metadata/ (hostname, pveversion,
+    # selected paths, etc.) out of the archive. The compat check
+    # in restore then had nothing to read and degraded to
+    # cross-host warnings even on same-host restores. Old PBS
+    # snapshots created with the rootfs-only source still restore
+    # correctly via case 3 in _rs_check_layout (which wraps a flat
+    # etc/var/root/usr layout into rootfs/ and creates an empty
+    # metadata/), so this change is backward-compatible.
     local -a cmd=(
         proxmox-backup-client backup
-        "hostcfg.pxar:$staging_root/rootfs"
+        "hostcfg.pxar:$staging_root"
         --repository "$HB_PBS_REPOSITORY"
         --backup-type host
         --backup-id  "$backup_id"
@@ -121,8 +145,27 @@ _bk_pbs() {
     if env \
         PBS_PASSWORD="$HB_PBS_SECRET" \
         PBS_ENCRYPTION_PASSWORD="${HB_PBS_ENC_PASS:-}" \
+        PBS_FINGERPRINT="${HB_PBS_FINGERPRINT:-}" \
         "${cmd[@]}" 2>&1 | tee -a "$log_file"; then
 
+        # Main backup OK — also upload the keyfile recovery blob if
+        # one was configured AND this backup actually used the
+        # keyfile. Gating on HB_PBS_KEYFILE_OPT (rather than only on
+        # the file existing on disk) stops the upload when the
+        # operator declined encryption for this run but a recovery
+        # blob is still cached from a prior encrypted backup: in
+        # that case the blob does not describe this snapshot and
+        # uploading it as a paired recovery would be misleading.
+        # This runs as a SEPARATE backup group
+        # (`host/hostcfg-<host>-keyrecovery`) with NO --keyfile,
+        # so PBS stores it as a plain (non-PBS-encrypted) blob that
+        # can be retrieved during fresh-install recovery. The blob
+        # is still passphrase-protected by openssl.
+        if [[ -n "$HB_PBS_KEYFILE_OPT" && -f "$HB_STATE_DIR/pbs-key.recovery.enc" ]]; then
+            hb_pbs_upload_recovery_blob "$epoch" \
+                || msg_warn "$(translate "Recovery blob upload failed — main backup is OK, but keyfile recovery from PBS will not be available for this backup.")"
+        fi
+
         elapsed=$((SECONDS - t_start))
         local snap_time
         snap_time=$(date -d "@$epoch" '+%Y-%m-%dT%H:%M:%S' 2>/dev/null || date -r "$epoch" '+%Y-%m-%dT%H:%M:%S' 2>/dev/null || echo "$epoch")
@@ -131,16 +174,30 @@ _bk_pbs() {
         echo -e "${TAB}${BGN}$(translate "Method:")${CL}      ${BL}Proxmox Backup Server (PBS)${CL}"
         echo -e "${TAB}${BGN}$(translate "Repository:")${CL}  ${BL}${HB_PBS_REPOSITORY}${CL}"
         echo -e "${TAB}${BGN}$(translate "Backup ID:")${CL}   ${BL}${backup_id}${CL}"
-        echo -e "${TAB}${BGN}$(translate "Snapshot:")${CL}    ${BL}host/${backup_id}/${snap_time}${CL}"
+        echo -e "${TAB}${BGN}$(translate "Backup path:")${CL} ${BL}host/${backup_id}/${snap_time}${CL}"
         echo -e "${TAB}${BGN}$(translate "Data size:")${CL}   ${BL}${staged_size}${CL}"
         echo -e "${TAB}${BGN}$(translate "Duration:")${CL}    ${BL}$(hb_human_elapsed "$elapsed")${CL}"
         echo -e "${TAB}${BGN}$(translate "Encryption:")${CL}  ${BL}${_pbs_enc_label}${CL}"
-        echo -e "${TAB}${BGN}$(translate "Log:")${CL}         ${BL}${log_file}${CL}"
+        # Only point at the log if it actually has output. On a clean
+        # success the underlying tool is silent and surfacing an empty
+        # file path just confuses the operator into thinking they need
+        # to look at it.
+        [[ -s "$log_file" ]] && echo -e "${TAB}${BGN}$(translate "Log:")${CL}         ${BL}${log_file}${CL}"
         echo -e ""
         msg_ok "$(translate "Backup completed successfully.")"
+        export HB_NOTIFY_ARCHIVE_SIZE="-"
+        export HB_NOTIFY_DURATION="$(hb_human_elapsed "$elapsed" 2>/dev/null || echo "${elapsed}s")"
+        hb_notify_lifecycle "complete"
     else
         echo -e ""
         msg_error "$(translate "PBS backup failed.")"
+        local _hb_reason
+        _hb_reason=$(grep -iE 'error|fail|fatal|abort' "$log_file" 2>/dev/null | tail -1 | sed 's/^[[:space:]]*//')
+        [[ -z "$_hb_reason" ]] && _hb_reason="proxmox-backup-client returned non-zero"
+        export HB_NOTIFY_ARCHIVE_SIZE="-"
+        export HB_NOTIFY_DURATION="$(hb_human_elapsed "$((SECONDS - t_start))" 2>/dev/null || echo "")"
+        export HB_NOTIFY_REASON="$_hb_reason"
+        hb_notify_lifecycle "fail"
         hb_show_log "$log_file" "$(translate "PBS backup error log")"
         echo -e ""
         msg_success "$(translate "Press Enter to return to menu...")"
@@ -189,6 +246,14 @@ _bk_borg() {
     staged_size=$(hb_file_size "$staging_root/rootfs")
     msg_ok "$(translate "Staging ready.") $(translate "Data size:") $staged_size"
 
+    export HB_NOTIFY_JOB_ID="manual-borg-${archive_name}"
+    export HB_NOTIFY_BACKEND="borg"
+    export HB_NOTIFY_DESTINATION="$repo"
+    export HB_NOTIFY_PROFILE_MODE="$profile_mode"
+    export HB_NOTIFY_LOG_FILE="$log_file"
+    export HB_NOTIFY_DATA_SIZE="$staged_size"
+    hb_notify_lifecycle "start"
+
     msg_info "$(translate "Initializing Borg repository if needed...")"
     if ! hb_borg_init_if_needed "$borg_bin" "$repo" "${BORG_ENCRYPT_MODE:-none}" >/dev/null 2>&1; then
         msg_error "$(translate "Failed to initialize Borg repository at:") $repo"
@@ -202,8 +267,12 @@ _bk_borg() {
 
     t_start=$SECONDS
     : > "$log_file"
+    # Include manifest.json (top-level) when present — without it,
+    # parse_manifest.sh can't read the schema'd manifest on restore.
+    local -a _bk_borg_paths=(rootfs metadata)
+    [[ -f "$staging_root/manifest.json" ]] && _bk_borg_paths+=(manifest.json)
     if (cd "$staging_root" && "$borg_bin" create --stats --progress \
-        "$repo::$archive_name" rootfs metadata) 2>&1 | tee -a "$log_file"; then
+        "$repo::$archive_name" "${_bk_borg_paths[@]}") 2>&1 | tee -a "$log_file"; then
 
         elapsed=$((SECONDS - t_start))
         # Extract compressed size from borg stats if available
@@ -219,12 +288,22 @@ _bk_borg() {
         echo -e "${TAB}${BGN}$(translate "Compressed size:")${CL} ${BL}${borg_compressed}${CL}"
         echo -e "${TAB}${BGN}$(translate "Duration:")${CL}        ${BL}$(hb_human_elapsed "$elapsed")${CL}"
         echo -e "${TAB}${BGN}$(translate "Encryption:")${CL}      ${BL}${_borg_enc_label}${CL}"
-        echo -e "${TAB}${BGN}$(translate "Log:")${CL}             ${BL}${log_file}${CL}"
+        [[ -s "$log_file" ]] && echo -e "${TAB}${BGN}$(translate "Log:")${CL}             ${BL}${log_file}${CL}"
         echo -e ""
         msg_ok "$(translate "Backup completed successfully.")"
+        export HB_NOTIFY_ARCHIVE_SIZE="$borg_compressed"
+        export HB_NOTIFY_DURATION="$(hb_human_elapsed "$elapsed" 2>/dev/null || echo "${elapsed}s")"
+        hb_notify_lifecycle "complete"
     else
         echo -e ""
         msg_error "$(translate "Borg backup failed.")"
+        local _hb_reason
+        _hb_reason=$(grep -iE 'error|fail|fatal|abort' "$log_file" 2>/dev/null | tail -1 | sed 's/^[[:space:]]*//')
+        [[ -z "$_hb_reason" ]] && _hb_reason="borg create returned non-zero"
+        export HB_NOTIFY_ARCHIVE_SIZE="-"
+        export HB_NOTIFY_DURATION="$(hb_human_elapsed "$((SECONDS - t_start))" 2>/dev/null || echo "")"
+        export HB_NOTIFY_REASON="$_hb_reason"
+        hb_notify_lifecycle "fail"
         hb_show_log "$log_file" "$(translate "Borg backup error log")"
         echo -e ""
         msg_success "$(translate "Press Enter to return to menu...")"
@@ -247,9 +326,41 @@ _bk_local() {
 
     hb_require_cmd rsync rsync || return 1
 
-    dest_dir=$(hb_prompt_dest_dir) || return 1
+    dest_dir=$(hb_select_local_target) || return 1
     hb_select_profile_paths "$profile_mode" paths || return 1
 
+    # Safety check: if the destination directory is INSIDE any selected
+    # backup path, creating the archive would copy the backup into
+    # itself — recursion → corrupted archive or unbounded growth that
+    # fills the disk. Common footgun when an operator adds a custom
+    # path like /var/lib/vz and then picks /var/lib/vz/dump as
+    # destination, or the default profile's /root and a destination
+    # under /root/.
+    local dest_real conflict=""
+    dest_real=$(readlink -m "$dest_dir" 2>/dev/null || echo "$dest_dir")
+    local p_real p
+    for p in "${paths[@]}"; do
+        p_real=$(readlink -m "$p" 2>/dev/null || echo "$p")
+        if [[ "$dest_real" == "$p_real" || "$dest_real" == "$p_real"/* ]]; then
+            conflict="$p"
+            break
+        fi
+    done
+    if [[ -n "$conflict" ]]; then
+        local body
+        body="$(translate "The archive destination directory is INSIDE one of the paths you are about to back up. Writing the archive there would copy the backup into itself — producing a corrupted archive, or growing without limit until the disk fills up.")"$'\n\n'
+        body+="\Zb$(translate "Destination:")\ZB  \Z4${dest_dir}\Zn"$'\n'
+        body+="\Zb$(translate "Conflicting path included in backup:")\ZB  \Z1${conflict}\Zn"$'\n\n'
+        body+="$(translate "To fix this, do ONE of the following:")"$'\n'
+        body+="  • $(translate "Choose a destination directory OUTSIDE of") ${conflict}"$'\n'
+        body+="  • $(translate "Go to \"Manage custom paths\" and remove your custom entry that includes the destination")"$'\n'
+        body+="  • $(translate "Use Custom backup and uncheck the conflicting path from the list")"
+        dialog --backtitle "ProxMenux" --colors \
+            --title "$(translate "Backup destination is inside the backup")" \
+            --msgbox "$body" 20 88
+        return 1
+    fi
+
     archive="$dest_dir/hostcfg-$(hostname)-$(date +%Y%m%d_%H%M%S).tar.zst"
     log_file="/tmp/proxmenux-local-backup-$(date +%Y%m%d_%H%M%S).log"
     staging_root=$(mktemp -d /tmp/proxmenux-local-stage.XXXXXX)
@@ -269,6 +380,14 @@ _bk_local() {
     staged_size=$(hb_file_size "$staging_root/rootfs")
     msg_ok "$(translate "Staging ready.") $(translate "Data size:") $staged_size"
 
+    export HB_NOTIFY_JOB_ID="manual-local-$(basename "$archive" .tar.zst)"
+    export HB_NOTIFY_BACKEND="local"
+    export HB_NOTIFY_DESTINATION="$archive"
+    export HB_NOTIFY_PROFILE_MODE="$profile_mode"
+    export HB_NOTIFY_LOG_FILE="$log_file"
+    export HB_NOTIFY_DATA_SIZE="$staged_size"
+    hb_notify_lifecycle "start"
+
     echo -e ""
     msg_info "$(translate "Creating compressed archive...")"
     stop_spinner
@@ -285,7 +404,7 @@ _bk_local() {
         # Fallback: gzip (rename archive)
         archive="${archive%.zst}"
         archive="${archive%.tar}.tar.gz"
-        if command -v pv >/dev/null 2>&1; then
+        if hb_ensure_pv; then
             local stage_bytes
             local pipefail_state
             stage_bytes=$(du -sb "$staging_root" 2>/dev/null | awk '{print $1}')
@@ -306,6 +425,11 @@ _bk_local() {
     elapsed=$((SECONDS - t_start))
 
     if [[ $tar_ok -eq 1 && -f "$archive" ]]; then
+        # Drop a sidecar JSON next to the archive so the Monitor
+        # (and any future tooling) can identify this as a
+        # ProxMenux host backup regardless of any future rename.
+        hb_write_archive_sidecar "$archive" "manual" "" "$profile_mode" || true
+
         archive_size=$(hb_file_size "$archive")
         echo -e ""
         echo -e "${TAB}${BOLD}$(translate "Backup completed:")${CL}"
@@ -314,12 +438,22 @@ _bk_local() {
         echo -e "${TAB}${BGN}$(translate "Data size:")${CL}       ${BL}${staged_size}${CL}"
         echo -e "${TAB}${BGN}$(translate "Archive size:")${CL}    ${BL}${archive_size}${CL}"
         echo -e "${TAB}${BGN}$(translate "Duration:")${CL}        ${BL}$(hb_human_elapsed "$elapsed")${CL}"
-        echo -e "${TAB}${BGN}$(translate "Log:")${CL}             ${BL}${log_file}${CL}"
+        [[ -s "$log_file" ]] && echo -e "${TAB}${BGN}$(translate "Log:")${CL}             ${BL}${log_file}${CL}"
         echo -e ""
         msg_ok "$(translate "Backup completed successfully.")"
+        export HB_NOTIFY_ARCHIVE_SIZE="$archive_size"
+        export HB_NOTIFY_DURATION="$(hb_human_elapsed "$elapsed" 2>/dev/null || echo "${elapsed}s")"
+        hb_notify_lifecycle "complete"
     else
         echo -e ""
         msg_error "$(translate "Local backup failed.")"
+        local _hb_reason
+        _hb_reason=$(grep -iE 'error|fail|fatal|abort' "$log_file" 2>/dev/null | tail -1 | sed 's/^[[:space:]]*//')
+        [[ -z "$_hb_reason" ]] && _hb_reason="tar/zstd returned non-zero"
+        export HB_NOTIFY_ARCHIVE_SIZE="-"
+        export HB_NOTIFY_DURATION="$(hb_human_elapsed "$elapsed" 2>/dev/null || echo "${elapsed}s")"
+        export HB_NOTIFY_REASON="$_hb_reason"
+        hb_notify_lifecycle "fail"
         hb_show_log "$log_file" "$(translate "Local backup error log")"
         echo -e ""
         msg_success "$(translate "Press Enter to return to menu...")"
@@ -351,23 +485,531 @@ _bk_scheduler() {
     bash "$scheduler"
 }
 
+_bk_manage_local_destinations() {
+    while true; do
+        # Single configured target (or none → caller falls back to default)
+        local current=""
+        current=$(hb_get_local_target 2>/dev/null) || current=""
+
+        local body=""
+        if [[ -n "$current" ]]; then
+            body+="\Zb$(translate "Currently configured target:")\ZB"$'\n'
+            body+="  \Z4${current}\Zn"
+        else
+            body+="$(translate "No target configured.")"$'\n'
+            body+="$(translate "Default will be used:") \Z4${HB_LOCAL_TARGET_DEFAULT}\Zn"
+        fi
+
+        local -a menu_args=()
+        menu_args+=("default" "1   $(translate "Use default") (${HB_LOCAL_TARGET_DEFAULT})")
+        menu_args+=("custom"  "2   $(translate "Use a custom path")")
+        menu_args+=("usb"     "3   $(translate "Use a USB disk")")
+        if [[ -n "$current" ]]; then
+            menu_args+=("clear"   "C   $(translate "Clear configured target")")
+        fi
+        menu_args+=("back"    "$(translate "← Return")")
+
+        local choice
+        choice=$(dialog --backtitle "ProxMenux" --colors \
+            --title "$(translate "Manage local backup target")" \
+            --menu "\n${body}\n" \
+            "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${menu_args[@]}" \
+            3>&1 1>&2 2>&3) || break
+
+        case "$choice" in
+            default)
+                hb_set_local_target "$HB_LOCAL_TARGET_DEFAULT"
+                ;;
+            custom)
+                local new_path
+                new_path=$(dialog --backtitle "ProxMenux" \
+                    --title "$(translate "Custom path")" \
+                    --inputbox "$(translate "Absolute directory path to use as backup target:")" \
+                    "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "/backup" \
+                    3>&1 1>&2 2>&3) || continue
+                new_path=$(hb_trim_dialog_value "$new_path")
+                [[ -z "$new_path" ]] && continue
+                mkdir -p "$new_path" 2>/dev/null || {
+                    dialog --backtitle "ProxMenux" --msgbox \
+                        "$(translate "Cannot create:") $new_path" 8 60
+                    continue
+                }
+                hb_set_local_target "$new_path"
+                ;;
+            usb)
+                _bk_local_target_usb_submenu
+                ;;
+            clear)
+                hb_clear_local_target
+                ;;
+            back) break ;;
+        esac
+    done
+}
+
+# Submenu reached when the user picks "Use a USB disk" in the local
+# target manager. Lists mounted USB partitions so the operator can pick
+# one as the target; mount / unmount are auxiliary actions for preparing
+# a fresh disk or releasing one. Picking a USB sets it as the configured
+# target and returns to the parent menu.
+_bk_local_target_usb_submenu() {
+    while true; do
+        local -a usb_mp=()
+        local -a usb_desc=()
+        local state path_or_dev label size fstype uuid
+        while IFS=$'\t' read -r state path_or_dev label size fstype uuid; do
+            [[ "$state" != "mounted" ]] && continue
+            usb_mp+=("$path_or_dev")
+            usb_desc+=("${label:-?}  [${fstype}]  $size  →  $path_or_dev")
+        done < <(hb_list_usb_partitions)
+
+        local body=""
+        if (( ${#usb_mp[@]} > 0 )); then
+            body+="\Zb$(translate "USB drives mounted now:")\ZB"$'\n'
+            local d
+            for d in "${usb_desc[@]}"; do
+                body+="  • ${d}"$'\n'
+            done
+        else
+            body+="$(translate "No USB drives mounted by ProxMenux yet. Mount one first to use it as a target.")"
+        fi
+
+        local -a menu_args=()
+        if (( ${#usb_mp[@]} > 0 )); then
+            menu_args+=("pick"    "$(translate "Pick a mounted USB as target")")
+        fi
+        menu_args+=("mount"   "⊕ $(translate "Mount a USB drive now")")
+        if (( ${#usb_mp[@]} > 0 )); then
+            menu_args+=("unmount" "⊖ $(translate "Unmount a USB drive")")
+        fi
+        menu_args+=("back"    "$(translate "← Return")")
+
+        local choice
+        choice=$(dialog --backtitle "ProxMenux" --colors \
+            --title "$(translate "USB disk target")" \
+            --menu "\n${body}\n" \
+            "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${menu_args[@]}" \
+            3>&1 1>&2 2>&3) || break
+
+        case "$choice" in
+            pick)
+                local pick_menu=() i=1 idx
+                for idx in "${!usb_mp[@]}"; do
+                    pick_menu+=("$i" "${usb_desc[$idx]}"); ((i++))
+                done
+                local pick
+                pick=$(dialog --backtitle "ProxMenux" \
+                    --title "$(translate "Pick USB target")" \
+                    --menu "\n$(translate "Select the mounted USB to use as backup target:")" \
+                    "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${pick_menu[@]}" \
+                    3>&1 1>&2 2>&3) || continue
+                hb_set_local_target "${usb_mp[$((pick-1))]}"
+                return 0
+                ;;
+            mount)
+                # Auxiliary: prepare a USB so it can be picked next pass.
+                hb_prompt_mounted_path "/mnt/backup" >/dev/null || true
+                ;;
+            unmount)
+                if (( ${#usb_mp[@]} == 0 )); then
+                    continue
+                fi
+                local unmenu=() j=1 mp
+                for mp in "${usb_mp[@]}"; do
+                    unmenu+=("$j" "$mp"); ((j++))
+                done
+                local pick
+                pick=$(dialog --backtitle "ProxMenux" \
+                    --title "$(translate "Unmount USB drive")" \
+                    --menu "\n$(translate "Pick a drive to unmount:")" \
+                    "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${unmenu[@]}" \
+                    3>&1 1>&2 2>&3) || continue
+                local victim="${usb_mp[$((pick-1))]}"
+                if umount "$victim" 2>/tmp/proxmenux-umount.log; then
+                    rmdir "$victim" 2>/dev/null || true
+                    dialog --backtitle "ProxMenux" --colors \
+                        --msgbox "$(translate "Unmounted") \Z4${victim}\Zn" 8 70
+                else
+                    local err
+                    err=$(cat /tmp/proxmenux-umount.log 2>/dev/null)
+                    dialog --backtitle "ProxMenux" --colors \
+                        --title "$(translate "Unmount failed")" \
+                        --msgbox "$(translate "Could not unmount") \Z1${victim}\Zn.\n\n${err}" 12 78
+                fi
+                ;;
+            back) break ;;
+        esac
+    done
+}
+
+_bk_manage_destinations() {
+    while true; do
+        # Option 4 (keyfile management) only appears when a keyfile is
+        # actually installed on disk. Without one there's nothing to
+        # manage — the keyfile gets materialised during job creation
+        # (Generate / Import flow), not from this destinations menu.
+        # Once the first encrypted job is created, this entry becomes
+        # visible on the next open.
+        local -a menu_items=(
+            1 "$(translate "Proxmox Backup Server (PBS) destinations")"
+            2 "$(translate "Borg repositories")"
+            3 "$(translate "Local archive targets (paths + USB mount/unmount)")"
+        )
+        if [[ -s "$HB_STATE_DIR/pbs-key.conf" ]]; then
+            menu_items+=(4 "$(translate "PBS encryption keyfile (show / replace / remove)")")
+        fi
+        menu_items+=(0 "$(translate "Return")")
+
+        local choice
+        choice=$(dialog --backtitle "ProxMenux" \
+            --title "$(translate "Configure backup destinations")" \
+            --menu "\n$(translate "Pre-configure destinations so you don't have to enter them every time you back up.")" \
+            "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
+            "${menu_items[@]}" \
+            3>&1 1>&2 2>&3) || break
+
+        case "$choice" in
+            1)
+                hb_select_pbs_repository || true
+                ;;
+            2)
+                local _discard=""
+                hb_select_borg_repo _discard || true
+                ;;
+            3)
+                _bk_manage_local_destinations
+                ;;
+            4)
+                _bk_manage_pbs_encryption_keyfile
+                ;;
+            0) break ;;
+        esac
+    done
+}
+
+# Dedicated management submenu for the PBS encryption keyfile.
+# Available as option 4 of "Configure backup destinations". All
+# destructive actions offer a backup-to-/root step first and require
+# an explicit confirmation before touching disk.
+_bk_manage_pbs_encryption_keyfile() {
+    local key_file="$HB_STATE_DIR/pbs-key.conf"
+    local pass_file="$HB_STATE_DIR/pbs-key.pass"
+    local recovery_enc="$HB_STATE_DIR/pbs-key.recovery.enc"
+    while true; do
+        local installed=0
+        [[ -s "$key_file" ]] && installed=1
+
+        # Precompute values used both by the compact prompt and the
+        # detailed info modal.
+        local fp="" kdf_hint="unknown" installed_at=""
+        if (( installed )); then
+            if command -v proxmox-backup-client >/dev/null 2>&1; then
+                fp=$(proxmox-backup-client key show --output-format json "$key_file" 2>/dev/null \
+                     | grep -oE '"fingerprint"[[:space:]]*:[[:space:]]*"[^"]*"' \
+                     | head -1 | sed 's/.*"\([^"]*\)".*/\1/')
+            fi
+            if grep -qE '"kdf":[[:space:]]*(null|"None")' "$key_file" 2>/dev/null; then
+                kdf_hint="none"
+            elif grep -q '"Scrypt"' "$key_file" 2>/dev/null; then
+                kdf_hint="scrypt"
+            fi
+            installed_at=$(date -r "$key_file" '+%Y-%m-%d %H:%M' 2>/dev/null || echo "")
+        fi
+
+        # Menu prompt: ONE line summarising the two things that
+        # actually matter (installed + recoverable). Everything else
+        # goes in the "Show detailed keyfile info" action which uses
+        # --msgbox — that widget honours embedded newlines, whereas
+        # dialog --menu collapses them into spaces on many distros and
+        # produced an unreadable wall of text no matter how tight the
+        # per-field layout was.
+        local prompt=""
+        if (( installed )); then
+            local recov_state="\Zb\Z1no — set a recovery passphrase\Zn"
+            [[ -s "$recovery_enc" ]] && recov_state="\Zb\Z4yes\Zn"
+            prompt="Encryption keyfile: \Zb\Z4installed\Zn  •  Recoverable: ${recov_state}"
+        else
+            prompt="No encryption keyfile installed on this host."
+        fi
+
+        local choice
+        if (( installed )); then
+            choice=$(dialog --backtitle "ProxMenux" --colors \
+                --title "$(translate "Manage PBS encryption keyfile")" \
+                --menu "\n${prompt}\n" \
+                "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
+                "info"     "$(hb_translate "Show detailed keyfile info")" \
+                "download" "$(hb_translate "Copy the keyfile to a path for offsite backup")" \
+                "import"   "$(hb_translate "Import a keyfile from an absolute path (replaces the current one)")" \
+                "escrow"   "$(hb_translate "Upload to PBS: enable, disable or rotate the recovery passphrase")" \
+                "remove"   "$(hb_translate "Remove keyfile from this host")" \
+                "back"     "$(hb_translate "← Return")" \
+                3>&1 1>&2 2>&3) || break
+        else
+            choice=$(dialog --backtitle "ProxMenux" --colors \
+                --title "$(translate "Manage PBS encryption keyfile")" \
+                --menu "\n${prompt}\n" \
+                "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
+                "back" "$(hb_translate "← Return")" \
+                3>&1 1>&2 2>&3) || break
+        fi
+
+        case "$choice" in
+            info)
+                # Terminal output pattern used across ProxMenux (logo +
+                # msg_title + labeled TAB/BGN/BL/CL rows + "press enter
+                # to return"), same shape as _bk_pbs's post-backup
+                # summary. Fits arbitrarily wide fingerprints without
+                # the wrapping issues that dialog --msgbox has, and lets
+                # the operator copy-paste the fingerprint from a real
+                # terminal buffer.
+                show_proxmenux_logo
+                msg_title "$(translate "PBS encryption keyfile — detailed info")"
+                echo -e ""
+                echo -e "${TAB}${BGN}$(translate "Path:")${CL}           ${BL}${key_file}${CL}"
+                [[ -n "$installed_at" ]] && \
+                  echo -e "${TAB}${BGN}$(translate "Installed at:")${CL}   ${BL}${installed_at}${CL}"
+                echo -e "${TAB}${BGN}$(translate "KDF:")${CL}            ${BL}${kdf_hint}${CL}"
+                [[ -n "$fp" ]] && \
+                  echo -e "${TAB}${BGN}$(translate "Fingerprint:")${CL}    ${BL}${fp}${CL}"
+                if [[ -s "$pass_file" ]]; then
+                    echo -e "${TAB}${BGN}$(translate "Keyfile passphrase stored:")${CL}  ${BL}$(translate "yes (scrypt-unlock passphrase stored)")${CL}"
+                else
+                    echo -e "${TAB}${BGN}$(translate "Keyfile passphrase stored:")${CL}  ${BL}$(translate "no (kdf=none, not needed)")${CL}"
+                fi
+                if [[ -s "$recovery_enc" ]]; then
+                    echo -e "${TAB}${BGN}$(translate "Recovery blob:")${CL}  ${BL}$(translate "yes")${CL}"
+                    echo -e "${TAB}${BGN}$(translate "Recoverable:")${CL}    ${BL}$(translate "yes (via PBS escrow + recovery passphrase)")${CL}"
+                else
+                    echo -e "${TAB}${BGN}$(translate "Recovery blob:")${CL}  ${BL}$(translate "no")${CL}"
+                    echo -e "${TAB}${BGN}$(translate "Recoverable:")${CL}    ${BL}$(translate "no (no escrow blob — set a recovery passphrase to enable recovery)")${CL}"
+                fi
+                echo -e ""
+                msg_success "$(translate "Press Enter to return to menu...")"
+                read -r
+                ;;
+            download)
+                # Copy the keyfile to an operator-supplied path so
+                # they can scp/USB it offsite. Same trust boundary as
+                # the Monitor's Download button.
+                local dst
+                dst=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "Download keyfile")" \
+                    --inputbox "$(hb_translate "Destination path for the copy (typically outside ProxMenux state):")"$'\n\n'"$(hb_translate "Default:") /tmp/pbs-key.conf" \
+                    12 78 "/tmp/pbs-key.conf" 3>&1 1>&2 2>&3) || continue
+                dst="$(echo "$dst" | xargs)"
+                [[ -z "$dst" ]] && continue
+                if cp -f "$key_file" "$dst" 2>/dev/null; then
+                    chmod 600 "$dst" 2>/dev/null || true
+                    dialog --backtitle "ProxMenux" --title "$(hb_translate "Keyfile copied")" \
+                        --msgbox "$(hb_translate "Keyfile copied to:")"$'\n\n'"$dst"$'\n\n'"$(hb_translate "Move that copy offsite (USB, password manager, another host). Delete it from this path when done.")" \
+                        13 78
+                else
+                    dialog --backtitle "ProxMenux" --title "$(hb_translate "Copy failed")" \
+                        --msgbox "$(hb_translate "Could not write to:") $dst" 9 70
+                fi
+                ;;
+            import)
+                # Import a new keyfile from an absolute path — replaces
+                # the currently installed one only if the operator
+                # completes the import dialog. Cancel / empty path /
+                # missing file all leave the current keyfile in place.
+                local warn_body
+                warn_body="\Zb\Z1$(hb_translate "This replaces the currently installed keyfile.")\Zn"$'\n\n'
+                warn_body+="$(hb_translate "Backups already on PBS were encrypted with the current key — downloading them will fail unless you first Download the current keyfile to keep a copy.")"$'\n\n'
+                warn_body+="$(hb_translate "Continue with the import?")"
+                if ! dialog --backtitle "ProxMenux" --colors --yesno "$warn_body" 14 78; then
+                    continue
+                fi
+                # No upfront wipe. `_hb_pbs_import_dialog` only touches
+                # the canonical path after the operator has typed a
+                # valid absolute path AND finished the whole wizard;
+                # on cancel or missing file it returns non-zero and
+                # the current keyfile stays untouched.
+                _hb_pbs_import_dialog || true
+                ;;
+            escrow)
+                # Toggle Upload to PBS Yes/No + set or rotate the
+                # recovery passphrase — same three transitions the
+                # Monitor exposes on the KeyfileActionsBar.
+                local cur_mode="none"
+                [[ -s "$HB_STATE_DIR/pbs-key.mode" ]] && cur_mode="$(cat "$HB_STATE_DIR/pbs-key.mode" 2>/dev/null | tr -d '[:space:]')"
+                local esc_action
+                if [[ "$cur_mode" == "full" ]]; then
+                    esc_action=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "PBS upload")" \
+                        --menu "$(hb_translate "Upload to PBS is currently: yes. Pick an action:")" \
+                        12 78 3 \
+                        "rotate" "$(hb_translate "Rotate the recovery passphrase")" \
+                        "stop"   "$(hb_translate "Stop uploading to PBS")" \
+                        "cancel" "$(hb_translate "Cancel")" \
+                        3>&1 1>&2 2>&3) || continue
+                else
+                    esc_action=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "PBS upload")" \
+                        --menu "$(hb_translate "Upload to PBS is currently: no. Pick an action:")" \
+                        10 78 2 \
+                        "start"  "$(hb_translate "Start uploading to PBS — sets a recovery passphrase")" \
+                        "cancel" "$(hb_translate "Cancel")" \
+                        3>&1 1>&2 2>&3) || continue
+                fi
+                case "$esc_action" in
+                    start|rotate)
+                        _hb_pbs_prompt_recovery_pass || continue
+                        local pass="$HB_PBS_PASS_RESULT"
+                        if _hb_pbs_finalize_recovery "$pass" full; then
+                            _hb_pbs_write_escrow_mode full
+                            dialog --backtitle "ProxMenux" \
+                                --msgbox "$(hb_translate "Upload to PBS enabled. The envelope is uploaded on every encrypted backup.")" 10 70
+                        fi
+                        ;;
+                    stop)
+                        if dialog --backtitle "ProxMenux" --colors --defaultno --yesno \
+                            "\Zb\Z1$(hb_translate "Stop uploading?")\Zn"$'\n\n'"$(hb_translate "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.")" \
+                            13 78; then
+                            rm -f "$recovery_enc" 2>/dev/null
+                            _hb_pbs_write_escrow_mode none
+                            dialog --backtitle "ProxMenux" \
+                                --msgbox "$(hb_translate "Upload to PBS disabled.")" 8 60
+                        fi
+                        ;;
+                esac
+                ;;
+            remove)
+                # Destructive removal of the local keyfile. No copies
+                # kept anywhere — the operator is expected to hit
+                # Download first if they want to save the key.
+                local warn_body
+                warn_body="\Zb\Z1$(hb_translate "This is a destructive action")\Zn"$'\n\n'
+                warn_body+="$(hb_translate "Backups already stored on PBS were encrypted with the current keyfile. After this action:")"$'\n'
+                warn_body+="  • $(hb_translate "New backups on this host will be unencrypted until a new keyfile is set up.")"$'\n'
+                warn_body+="  • $(hb_translate "Downloading pre-existing encrypted backups from this host will fail unless you kept a copy of the current key.")"$'\n'
+                warn_body+="  • $(hb_translate "Existing recovery envelopes already on PBS stay intact — they still recover the old key with its original passphrase.")"$'\n\n'
+                warn_body+="$(hb_translate "Use Download first if you want to save a copy of the current key. Continue?")"
+                if ! dialog --backtitle "ProxMenux" --colors --defaultno --yesno "$warn_body" 18 80; then
+                    continue
+                fi
+                rm -f "$key_file" "$recovery_enc" "$pass_file" \
+                      "$HB_STATE_DIR/pbs-key.mode" 2>/dev/null
+                dialog --backtitle "ProxMenux" \
+                    --msgbox "$(hb_translate "Keyfile removed.")" 8 60
+                ;;
+            back|"") break ;;
+        esac
+    done
+}
+
+_bk_manage_extra_paths() {
+    while true; do
+        local -a paths=()
+        mapfile -t paths < <(hb_load_extra_paths)
+        local count=${#paths[@]}
+
+        # Descriptive header for the manage menu. We avoid listing the actual
+        # paths here — a user with dozens of entries would blow the dialog
+        # box height and force scrolling. The count is enough; "− Remove a
+        # path" shows the full list when the user actually needs to see it.
+        local preview=""
+        if (( count == 0 )); then
+            preview="$(hb_translate "You haven't added any custom paths yet.")"
+        else
+            preview="$(hb_translate "Currently"): \Zb\Z4${count}\Zn $(hb_translate "custom path(s) saved.")"
+        fi
+        preview+=$'\n\n'"$(hb_translate "Custom paths are included in BOTH default and custom backup profiles.")"
+
+        local choice
+        choice=$(dialog --backtitle "ProxMenux" --colors \
+            --title "$(translate "Manage custom backup paths")" \
+            --menu "\n${preview}\n" \
+            "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
+            "view" "$(translate "View current paths")" \
+            "add"  "$(translate "+ Add a path")" \
+            "del"  "$(translate "− Remove a path")" \
+            "back" "$(translate "← Return")" \
+            3>&1 1>&2 2>&3) || break
+
+        case "$choice" in
+            view)
+                if (( count == 0 )); then
+                    dialog --backtitle "ProxMenux" --msgbox \
+                        "$(translate "You haven't added any custom paths yet.")" 8 60
+                    continue
+                fi
+                local list_body="" pv
+                for pv in "${paths[@]}"; do
+                    list_body+="• ${pv}"$'\n'
+                done
+                dialog --backtitle "ProxMenux" \
+                    --title "$(translate "Custom backup paths") (${count})" \
+                    --msgbox "\n${list_body}" \
+                    "$HB_UI_MENU_H" "$HB_UI_MENU_W"
+                ;;
+            add)
+                local new_path
+                new_path=$(dialog --backtitle "ProxMenux" \
+                    --title "$(translate "Add custom path")" \
+                    --inputbox "$(translate "Absolute path to a file or directory you want backed up:")" \
+                    "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "/root/" 3>&1 1>&2 2>&3) || continue
+                new_path="${new_path%/}"
+                [[ -z "$new_path" ]] && continue
+                if [[ ! -e "$new_path" ]]; then
+                    dialog --backtitle "ProxMenux" --colors \
+                        --title "$(translate "Path not found")" \
+                        --msgbox "\Z1${new_path}\Zn\n\n$(translate "does not exist on this host. Path not added.")" 10 70
+                    continue
+                fi
+                hb_add_extra_path "$new_path"
+                ;;
+            del)
+                if (( count == 0 )); then
+                    dialog --backtitle "ProxMenux" --msgbox \
+                        "$(translate "You haven't added any custom paths yet.")" 8 60
+                    continue
+                fi
+                local del_options=() j=1 p
+                for p in "${paths[@]}"; do
+                    del_options+=("$j" "$p" "off"); ((j++))
+                done
+                local del_selected
+                del_selected=$(dialog --backtitle "ProxMenux" \
+                    --title "$(translate "Remove custom paths")" \
+                    --default-button ok \
+                    --separate-output --checklist \
+                    "\n$(translate "Tick the paths to remove (they will not be deleted from disk — only from this list):")" \
+                    "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${del_options[@]}" \
+                    3>&1 1>&2 2>&3) || continue
+                # Empty selection → nothing to do
+                [[ -z "$del_selected" ]] && continue
+                local sel
+                while read -r sel; do
+                    [[ -z "$sel" ]] && continue
+                    hb_del_extra_path "${paths[$((sel-1))]}"
+                done <<< "$del_selected"
+                ;;
+            back) break ;;
+        esac
+    done
+}
+
 backup_menu() {
     while true; do
         local choice
+        # 12 visible rows (3 separators + 6 actions + Return + blanks).
+        # Override the global HB_UI_MENU_LIST=10 locally so every row
+        # fits without a scrollbar; the height bump to 24 keeps the
+        # dialog chrome (title + borders + question prompt) from
+        # squeezing the list area.
         choice=$(dialog --backtitle "ProxMenux" \
             --title "$(translate "Host Config Backup")" \
             --menu "\n$(translate "Select backup method and profile:")" \
-            "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
-            ""  "$(translate "─── Default profile  (all critical paths) ──────────")" \
+            24 "$HB_UI_MENU_W" 13 \
+            ""  "$(translate "────────────────── Default profile ───────────────────")" \
             1   "$(translate "Backup to Proxmox Backup Server (PBS)")" \
             2   "$(translate "Backup to Borg repository")" \
             3   "$(translate "Backup to local archive  (.tar.zst)")" \
-            ""  "$(translate "─── Custom profile  (choose paths manually) ────────")" \
+            ""  " " \
+            ""  "$(translate "─────── Custom profile (choose paths manually) ───────")" \
             4   "$(translate "Custom backup to PBS")" \
             5   "$(translate "Custom backup to Borg")" \
             6   "$(translate "Custom backup to local archive")" \
-            ""  "$(translate "─── Automation ─────────────────────────────────────")" \
-            7   "$(translate "Scheduled backups and retention policies")" \
+            ""  " " \
             0   "$(translate "Return")" \
             3>&1 1>&2 2>&3) || return 0
 
@@ -378,7 +1020,6 @@ backup_menu() {
             4) _bk_pbs   custom  ;;
             5) _bk_borg  custom  ;;
             6) _bk_local custom  ;;
-            7) _bk_scheduler      ;;
             0) break ;;
         esac
     done
@@ -397,18 +1038,60 @@ _rs_extract_pbs() {
     hb_require_cmd proxmox-backup-client proxmox-backup-client || return 1
     hb_select_pbs_repository || return 1
 
-    msg_info "$(translate "Listing snapshots from PBS...")"
+    # If we're restoring on a fresh host (or one where the keyfile
+    # was wiped) the encrypted snapshots are unreadable until we
+    # restore the keyfile. Look for a recovery blob in PBS and let
+    # the operator decrypt it with their passphrase. We try this
+    # silently up-front so subsequent steps (snapshot list, files,
+    # restore) Just Work whether or not the snapshots happen to be
+    # encrypted. Failure here is non-fatal: a missing recovery
+    # blob plus an unencrypted snapshot is a perfectly valid case
+    # and the rest of the flow handles it.
+    if [[ ! -f "$HB_STATE_DIR/pbs-key.conf" ]]; then
+        hb_pbs_try_keyfile_recovery "$HB_STATE_DIR/pbs-key.conf" || true
+    fi
+
+    # Current proxmox-backup-client prints both `snapshot list` and
+    # `snapshot files` as a Unicode box-drawing table even when piped
+    # — the old awk-by-whitespace parser captures the `│` column
+    # separators instead of the data and ends up with an empty array.
+    # We now request --output-format json and parse with jq, then
+    # convert the epoch returned by `snapshot list` to the UTC ISO
+    # form (`YYYY-MM-DDTHH:MM:SSZ`) that `snapshot files` and
+    # `restore` actually accept as the snapshot path.
+    #
     mapfile -t snapshots < <(
         PBS_PASSWORD="$HB_PBS_SECRET" \
+        PBS_FINGERPRINT="${HB_PBS_FINGERPRINT:-}" \
         proxmox-backup-client snapshot list \
-            --repository "$HB_PBS_REPOSITORY" 2>/dev/null \
-        | awk '$2 ~ /^host\// {print $2}' \
+            --repository "$HB_PBS_REPOSITORY" \
+            --output-format json 2>/dev/null \
+        | jq -r '.[]
+            | select(."backup-type" == "host"
+                     and (
+                          ((."backup-id" | startswith("proxmenux-keyrecovery-"))
+                           or ((."backup-id" | startswith("hostcfg-")) and (."backup-id" | endswith("-keyrecovery"))))
+                          | not
+                         ))
+            | "\(."backup-type")|\(."backup-id")|\(."backup-time")"' 2>/dev/null \
+        | while IFS='|' read -r _type _id _epoch; do
+            local _iso
+            _iso=$(date -u -d "@${_epoch}" '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null \
+                || date -u -r "${_epoch}" '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null \
+                || echo "${_epoch}")
+            echo "${_type}/${_id}/${_iso}"
+        done \
         | sort -r | awk '!seen[$0]++'
     )
-    msg_ok "$(translate "Snapshot list retrieved.")"
 
     if [[ ${#snapshots[@]} -eq 0 ]]; then
-        msg_error "$(translate "No host snapshots found in this PBS repository.")"
+        # Surface error as a blocking dialog so the operator can read
+        # it. msg_error alone gets erased the moment we `return 1`
+        # because the restore_menu loop redraws the source picker
+        # immediately afterward.
+        dialog --backtitle "ProxMenux" --title "$(translate "No backups")" \
+            --msgbox "$(translate "No host backups were found in this PBS repository:")"$'\n\n'"$HB_PBS_REPOSITORY" \
+            10 78
         return 1
     fi
 
@@ -416,19 +1099,28 @@ _rs_extract_pbs() {
     for snapshot in "${snapshots[@]}"; do menu+=("$i" "$snapshot"); ((i++)); done
     local sel
     sel=$(dialog --backtitle "ProxMenux" \
-        --title "$(translate "Select snapshot to restore")" \
-        --menu "\n$(translate "Available host snapshots:")" \
+        --title "$(translate "Select backup to restore")" \
+        --menu "\n$(translate "Available host backups:")" \
         "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${menu[@]}" 3>&1 1>&2 2>&3) || return 1
     snapshot="${snapshots[$((sel-1))]}"
 
+    # `snapshot files` filenames carry a `.didx` (chunk index) or
+    # `.blob` suffix that doesn't match the bare `.pxar` name that
+    # `restore` expects. Strip it before filtering.
     mapfile -t archives < <(
         PBS_PASSWORD="$HB_PBS_SECRET" \
+        PBS_FINGERPRINT="${HB_PBS_FINGERPRINT:-}" \
         proxmox-backup-client snapshot files "$snapshot" \
-            --repository "$HB_PBS_REPOSITORY" 2>/dev/null \
-        | awk '{print $1}' | grep '\.pxar$' || true
+            --repository "$HB_PBS_REPOSITORY" \
+            --output-format json 2>/dev/null \
+        | jq -r '.[].filename' 2>/dev/null \
+        | sed -e 's/\.didx$//' -e 's/\.blob$//' \
+        | grep '\.pxar$' || true
     )
     if [[ ${#archives[@]} -eq 0 ]]; then
-        msg_error "$(translate "No .pxar archives found in selected snapshot.")"
+        dialog --backtitle "ProxMenux" --title "$(translate "No archives")" \
+            --msgbox "$(translate "No .pxar archives were found in this backup:")"$'\n\n'"$snapshot" \
+            10 78
         return 1
     fi
 
@@ -449,7 +1141,7 @@ _rs_extract_pbs() {
     msg_title "$(translate "Restore from PBS  →  staging")"
     echo -e ""
     echo -e "${TAB}${BGN}$(translate "Repository:")${CL}       ${BL}${HB_PBS_REPOSITORY}${CL}"
-    echo -e "${TAB}${BGN}$(translate "Snapshot:")${CL}         ${BL}${snapshot}${CL}"
+    echo -e "${TAB}${BGN}$(translate "Backup:")${CL}         ${BL}${snapshot}${CL}"
     echo -e "${TAB}${BGN}$(translate "Archive:")${CL}          ${BL}${archive}${CL}"
     echo -e "${TAB}${BGN}$(translate "Staging directory:")${CL} ${BL}${staging_root}${CL}"
     echo -e ""
@@ -462,23 +1154,64 @@ _rs_extract_pbs() {
         enc_pass="$(<"$HB_STATE_DIR/pbs-encryption-pass.txt")"
 
     : > "$log_file"
+    # PIPESTATUS check: `... | tee` masks the binary's exit code
+    # with tee's (always 0). Without this, a failed decrypt or
+    # missing keyfile would silently "succeed" — the staging
+    # would be empty/garbage and _rs_check_layout would then say
+    # "Incompatible archive", which is misleading. We capture the
+    # client's actual exit code separately.
+    local pbs_rc
     # shellcheck disable=SC2086
-    if env \
+    env \
         PBS_PASSWORD="$HB_PBS_SECRET" \
         PBS_ENCRYPTION_PASSWORD="${enc_pass}" \
+        PBS_FINGERPRINT="${HB_PBS_FINGERPRINT:-}" \
         proxmox-backup-client restore \
             "$snapshot" "$archive" "$staging_root" \
             --repository "$HB_PBS_REPOSITORY" \
             --allow-existing-dirs true \
             $key_opt \
-        2>&1 | tee -a "$log_file"; then
+        2>&1 | tee -a "$log_file"
+    pbs_rc=${PIPESTATUS[0]}
+
+    if [[ $pbs_rc -eq 0 ]]; then
         msg_ok "$(translate "Extraction completed.")"
         return 0
-    else
-        msg_error "$(translate "PBS extraction failed.")"
-        hb_show_log "$log_file" "$(translate "PBS restore error log")"
-        return 1
     fi
+
+    # Decide whether this is the "encrypted snapshot without a usable
+    # keyfile" pattern. proxmox-backup-client emits several distinct
+    # messages depending on how the mismatch surfaces:
+    #   • missing key - manifest was created with key XX:XX:...
+    #   • wrong key - unable to verify signature since manifest's
+    #     key AA:AA:.. does not match provided key BB:BB:..
+    #   • unable to load encryption key / no key file / no key found
+    #   • failed to decrypt / decrypt error
+    # If any hits, surface a helpful error and pull the offending
+    # line verbatim into the dialog so the operator has the fingerprint
+    # of the correct key without hunting through a scrolling terminal.
+    local extra_hint=""
+    if grep -qiE 'encryption key|unable to (load|read) key|no key (file|found)|decrypt|failed to decrypt|missing key|wrong key|was created with key|manifest.?s key|does not match' "$log_file" 2>/dev/null; then
+        # Extract the specific PBS diagnostic line (single line — the
+        # subsequent messages usually restate the same fact).
+        local pbc_err
+        pbc_err=$(grep -iE 'missing key|wrong key|was created with key|manifest.?s key|does not match|unable to (load|read) key|no key (file|found)' "$log_file" 2>/dev/null \
+                  | sed -E 's/[[:space:]]+$//' | head -1)
+        extra_hint=$'\n\n'"$(translate "This backup is encrypted.")"
+        if [[ -n "$pbc_err" ]]; then
+            extra_hint+=$'\n\n'"$(translate "proxmox-backup-client reported:")"$'\n'"       $pbc_err"
+        fi
+        if [[ -f "$HB_STATE_DIR/pbs-key.conf" ]]; then
+            extra_hint+=$'\n\n'"$(translate "A keyfile is installed at:")"$'\n'"       $HB_STATE_DIR/pbs-key.conf"$'\n'"$(translate "but it does not match the one used to create the backup. Replace it with the correct keyfile from the source host and retry.")"
+        else
+            extra_hint+=$'\n\n'"$(translate "Copy the correct keyfile to this host and rerun Restore — or pick an unencrypted backup.")"
+        fi
+    fi
+
+    dialog --backtitle "ProxMenux" --title "$(translate "PBS extraction failed")" \
+        --msgbox "$(translate "Could not extract from PBS.")"$'\n\n'"$(translate "Backup:") $snapshot"$'\n'"$(translate "Archive:") $archive$extra_hint"$'\n\n'"$(translate "Full log:") $log_file" \
+        22 84
+    return 1
 }
 
 _rs_extract_borg() {
@@ -490,32 +1223,45 @@ _rs_extract_borg() {
 
     borg_bin=$(hb_ensure_borg) || return 1
     hb_select_borg_repo repo || return 1
+    # Same persistence path as backup: per-target pw file
+    # ($HB_STATE_DIR/borg-pass-<name>.txt), legacy global pw, or
+    # prompt-once-and-save fallback. Bug fix: the old code only
+    # honored the legacy global file and re-prompted otherwise,
+    # defeating the saved-target UX.
+    hb_prepare_borg_passphrase || return 1
 
-    local pass_file="$HB_STATE_DIR/borg-pass.txt"
-    if [[ -f "$pass_file" ]]; then
-        BORG_PASSPHRASE="$(<"$pass_file")"
-        export BORG_PASSPHRASE
-    else
-        BORG_PASSPHRASE=$(dialog --backtitle "ProxMenux" --insecure --passwordbox \
-            "$(hb_translate "Borg passphrase (leave empty if not encrypted):")" \
-            "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 1
-        export BORG_PASSPHRASE
-    fi
-
-    mapfile -t archives < <(
-        "$borg_bin" list "$repo" --format '{archive}{NL}' 2>/dev/null | sort -r
+    # Pull NAME|START in one shot — borg supports strftime via :%fmt
+    # in --format. Sort newest-first by the ISO timestamp so the most
+    # recent backup is always on top regardless of archive naming.
+    local -a archive_lines=()
+    mapfile -t archive_lines < <(
+        "$borg_bin" list "$repo" \
+            --format '{start:%Y-%m-%d %H:%M:%S}|{archive}{NL}' </dev/null 2>/dev/null \
+            | sort -r
     )
-    if [[ ${#archives[@]} -eq 0 ]]; then
+    if [[ ${#archive_lines[@]} -eq 0 ]]; then
         msg_error "$(translate "No archives found in this Borg repository.")"
         return 1
     fi
+    archives=()
+    local -a archive_labels=()
+    local _start _name
+    for line in "${archive_lines[@]}"; do
+        _start="${line%%|*}"
+        _name="${line#*|}"
+        archives+=("$_name")
+        # Menu label: ISO datetime first (sortable, fixed width),
+        # then archive name. Easier to scan when several backups
+        # ran the same day.
+        archive_labels+=("${_start}  ·  ${_name}")
+    done
 
     local menu=() i=1
-    for archive in "${archives[@]}"; do menu+=("$i" "$archive"); ((i++)); done
+    for archive in "${archive_labels[@]}"; do menu+=("$i" "$archive"); ((i++)); done
     local sel
     sel=$(dialog --backtitle "ProxMenux" \
         --title "$(translate "Select archive to restore")" \
-        --menu "\n$(translate "Available Borg archives:")" \
+        --menu "\n$(translate "Available Borg archives (newest first):")" \
         "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
         "${menu[@]}" 3>&1 1>&2 2>&3) || return 1
     archive="${archives[$((sel-1))]}"
@@ -544,41 +1290,81 @@ _rs_extract_borg() {
 
 _rs_extract_local() {
     local staging_root="$1"
-    local log_file
-    log_file="/tmp/proxmenux-local-restore-$(date +%Y%m%d_%H%M%S).log"
-    local source_dir archive
+    local log_file source_dir archive
 
     hb_require_cmd tar tar || return 1
     source_dir=$(hb_prompt_restore_source_dir) || return 1
-    archive=$(hb_prompt_local_archive "$source_dir" \
-        "$(translate "Select backup archive to restore")") || return 1
 
-    show_proxmenux_logo
-    msg_title "$(translate "Restore from local archive  →  staging")"
-    echo -e ""
-    echo -e "${TAB}${BGN}$(translate "Archive:")${CL}          ${BL}${archive}${CL}"
-    echo -e "${TAB}${BGN}$(translate "Archive size:")${CL}     ${BL}$(hb_file_size "$archive")${CL}"
-    echo -e "${TAB}${BGN}$(translate "Staging directory:")${CL} ${BL}${staging_root}${CL}"
-    echo -e ""
-    msg_info "$(translate "Extracting archive...")"
-    stop_spinner
+    # Loop the picker on every recoverable failure so a corrupt
+    # archive doesn't dump the operator back to the top-level
+    # restore menu (which they then read as "the script never
+    # offered me a restore mode"). They stay in the same dir,
+    # pick another archive, or explicitly cancel out.
+    while true; do
+        archive=$(hb_prompt_local_archive "$source_dir" \
+            "$(translate "Select backup archive to restore")") || return 1
 
-    : > "$log_file"
-    if [[ "$archive" == *.zst ]]; then
-        tar --zstd -xf "$archive" -C "$staging_root" >>"$log_file" 2>&1
-    else
-        tar -xf "$archive" -C "$staging_root" >>"$log_file" 2>&1
-    fi
-    local rc=$?
+        log_file="/tmp/proxmenux-local-restore-$(date +%Y%m%d_%H%M%S).log"
+
+        show_proxmenux_logo
+        msg_title "$(translate "Restore from local archive  →  staging")"
+        echo -e ""
+        echo -e "${TAB}${BGN}$(translate "Archive:")${CL}          ${BL}${archive}${CL}"
+        echo -e "${TAB}${BGN}$(translate "Archive size:")${CL}     ${BL}$(hb_file_size "$archive")${CL}"
+        echo -e "${TAB}${BGN}$(translate "Staging directory:")${CL} ${BL}${staging_root}${CL}"
+        echo -e ""
+        msg_info "$(translate "Extracting archive...")"
+        stop_spinner
+
+        : > "$log_file"
+        # Wipe staging from a previous failed attempt so we don't
+        # mix partial extractions across retries.
+        find "$staging_root" -mindepth 1 -maxdepth 1 -exec rm -rf {} + 2>/dev/null
+
+        if [[ "$archive" == *.zst ]]; then
+            tar --zstd -xf "$archive" -C "$staging_root" >>"$log_file" 2>&1
+        else
+            tar -xf "$archive" -C "$staging_root" >>"$log_file" 2>&1
+        fi
+        local rc=$?
+
+        if [[ $rc -eq 0 ]]; then
+            msg_ok "$(translate "Extraction completed.")"
+            return 0
+        fi
 
-    if [[ $rc -eq 0 ]]; then
-        msg_ok "$(translate "Extraction completed.")"
-        return 0
-    else
         msg_error "$(translate "Extraction failed.")"
         hb_show_log "$log_file" "$(translate "Local restore error log")"
-        return 1
-    fi
+
+        # Recoverable: most often a corrupted archive (interrupted
+        # mid-write, bad disk sector, partial copy). Give the user
+        # a clear next step instead of silently bouncing back.
+        local recover_msg recover_choice
+        recover_msg="$(translate "The archive could not be extracted.")"$'\n\n'
+        recover_msg+="$(translate "Most common cause: the archive is corrupted (interrupted write, partial copy, or storage issue).")"$'\n\n'
+        recover_msg+="$(translate "Archive:") $archive"
+        recover_choice=$(dialog --backtitle "ProxMenux" \
+            --title "$(translate "Restore failed")" \
+            --menu "$recover_msg" 16 80 4 \
+            1 "$(translate "Try another archive")" \
+            2 "$(translate "Delete this corrupt archive and pick another")" \
+            0 "$(translate "Cancel restore")" \
+            3>&1 1>&2 2>&3) || return 1
+
+        case "$recover_choice" in
+            1) continue ;;  # back to the picker
+            2)
+                if whiptail --title "$(translate "Delete archive")" \
+                    --yesno "$(translate "Permanently delete this archive and its sidecar?")"$'\n\n'"$archive" \
+                    11 78; then
+                    rm -f "$archive" "${archive}.proxmenux.json"
+                    msg_ok "$(translate "Archive deleted.")"
+                fi
+                continue
+                ;;
+            0|*) return 1 ;;
+        esac
+    done
 }
 
 # Ensure staging has rootfs/ layout (Borg may nest)
@@ -714,10 +1500,12 @@ _rs_preview_diff() {
 
 _rs_export_to_file() {
     local staging_root="$1"
-    local dest_dir archive archive_size t_start elapsed
+    local dest_dir archive archive_size t_start elapsed log_file
+    local stage_bytes pipefail_state tar_ok
 
     dest_dir=$(hb_prompt_dest_dir) || return 1
     archive="$dest_dir/hostcfg-export-$(hostname)-$(date +%Y%m%d_%H%M%S).tar.gz"
+    log_file="/tmp/proxmenux-export-$(date +%Y%m%d_%H%M%S).log"
 
     show_proxmenux_logo
     msg_title "$(translate "Export backup data to file")"
@@ -727,11 +1515,41 @@ _rs_export_to_file() {
     echo -e ""
     echo -e "${TAB}$(translate "No changes will be made to the running system.")"
     echo -e ""
-    msg_info "$(translate "Creating export archive...")"
     stop_spinner
 
     t_start=$SECONDS
-    if tar -czf "$archive" -C "$staging_root" . 2>/dev/null; then
+    tar_ok=0
+    : > "$log_file"
+
+    if hb_ensure_pv; then
+        # Stream tar through pv so the operator sees a live progress
+        # bar instead of staring at a frozen title for minutes. We
+        # mirror the same pattern used by the local backup path
+        # (_bk_local) so the experience is consistent across
+        # create-archive and export-archive flows.
+        stage_bytes=$(du -sb "$staging_root" 2>/dev/null | awk '{print $1}')
+        pipefail_state=$(set -o | awk '$1=="pipefail" {print $2}')
+        set -o pipefail
+        echo -e "${TAB}$(translate "Compressing")  $(numfmt --to=iec-i --suffix=B "$stage_bytes" 2>/dev/null || printf '%s bytes' "$stage_bytes")  →  $archive"
+        echo
+        if tar -cf - -C "$staging_root" . 2>>"$log_file" \
+            | pv -s "$stage_bytes" | gzip > "$archive" 2>>"$log_file"; then
+            tar_ok=1
+        fi
+        [[ "$pipefail_state" == "off" ]] && set +o pipefail
+    else
+        # Offline / apt unavailable — silently fall back to a plain
+        # tar so we still produce the archive. No "install pv" message:
+        # if we couldn't install it ourselves, sending the operator off
+        # to apt is just shifting our problem onto them.
+        msg_info "$(translate "Creating export archive...")"
+        stop_spinner
+        if tar -czf "$archive" -C "$staging_root" . >>"$log_file" 2>&1; then
+            tar_ok=1
+        fi
+    fi
+
+    if [[ $tar_ok -eq 1 && -f "$archive" ]]; then
         elapsed=$((SECONDS - t_start))
         archive_size=$(hb_file_size "$archive")
         echo -e ""
@@ -741,8 +1559,16 @@ _rs_export_to_file() {
         echo -e "${TAB}${BGN}$(translate "Duration:")${CL}     ${BL}$(hb_human_elapsed "$elapsed")${CL}"
         echo -e ""
         msg_ok "$(translate "Export completed. The running system has not been modified.")"
+        echo -e ""
+        msg_success "$(translate "Press Enter to return to menu...")"
+        read -r
+        return 0
     else
         msg_error "$(translate "Export failed.")"
+        hb_show_log "$log_file" "$(translate "Export error log")"
+        echo -e ""
+        msg_success "$(translate "Press Enter to return to menu...")"
+        read -r
         return 1
     fi
 }
@@ -842,7 +1668,10 @@ _rs_apply() {
     fi
 
     local backup_root
-    backup_root="/root/proxmenux-pre-restore/$(date +%Y%m%d_%H%M%S)"
+    # Pre-restore safety snapshot lives outside /root for the same
+    # reason as the cluster recovery dir — restoring /root with
+    # `rsync --delete` would otherwise wipe it mid-flow.
+    backup_root="/var/lib/proxmenux/pre-restore/$(date +%Y%m%d_%H%M%S)"
     mkdir -p "$backup_root"
 
     local applied=0 skipped=0 t_start elapsed
@@ -855,11 +1684,35 @@ _rs_apply() {
         dst="/$rel"
         [[ -e "$src" ]] || { ((skipped++)); continue; }
 
+        # Smart-restore hardware-drift skip list (populated by
+        # _rs_run_complete_guided when hb_assess_hardware_drift flags
+        # paths that would break on this host's hardware). Each path
+        # in $RS_SKIP_PATHS is one absolute path per line. Matching is
+        # exact-or-descendant so "/etc/zfs/zpool.cache" listed in the
+        # skip set covers itself when rel == "etc/zfs/zpool.cache".
+        if [[ -n "${RS_SKIP_PATHS:-}" ]]; then
+            local _abs="/$rel" _skip=""
+            while IFS= read -r _skip; do
+                [[ -z "$_skip" ]] && continue
+                if [[ "$_abs" == "$_skip" || "$_abs" == "$_skip"/* ]]; then
+                    ((skipped++))
+                    continue 2
+                fi
+            done <<<"$RS_SKIP_PATHS"
+        fi
+
         # Never restore cluster virtual filesystem data live.
         # Extract it for manual recovery in maintenance mode.
+        # Path note: this used to live under /root/proxmenux-recovery/,
+        # but a later iteration of the same loop applies /root from
+        # the backup with `rsync --delete`, which wipes anything
+        # under /root that isn't in the backup — including our
+        # freshly-extracted recovery dir. We now stage it under
+        # /var/lib/proxmenux/recovery/, which sits next to
+        # restore-pending/ and isn't touched by any path apply.
         if [[ "$rel" == etc/pve* ]] || [[ "$rel" == var/lib/pve-cluster* ]]; then
             if [[ -z "$cluster_recovery_root" ]]; then
-                cluster_recovery_root="/root/proxmenux-recovery/$(date +%Y%m%d_%H%M%S)"
+                cluster_recovery_root="/var/lib/proxmenux/recovery/$(date +%Y%m%d_%H%M%S)"
                 mkdir -p "$cluster_recovery_root"
             fi
             mkdir -p "$cluster_recovery_root/$(dirname "$rel")"
@@ -890,7 +1743,31 @@ _rs_apply() {
         # Apply
         if [[ -d "$src" ]]; then
             mkdir -p "$dst"
-            rsync -aAXH --delete "$src/" "$dst/" 2>/dev/null && ((applied++)) || ((skipped++))
+            # /usr/local/share/proxmenux/: symmetric to the backup-time excludes
+            # in lib_host_backup_common.sh. We keep the destination's freshly-
+            # installed code (scripts/, web/, AppImage/, monitor-app/, utils.sh)
+            # and only restore the user's state (components_status.json, dbs,
+            # configs). Without these excludes --delete would wipe the entire
+            # /scripts/ tree on the target and the pending-restore boot service
+            # would fail to find its own entry point.
+            local -a rsync_extra=()
+            if [[ "$rel" == "usr/local/share/proxmenux" ]]; then
+                rsync_extra+=(
+                    --exclude "scripts/"
+                    --exclude "web/"
+                    --exclude "monitor-app/"
+                    --exclude "monitor-app.*/"
+                    --exclude "AppImage/"
+                    --exclude "images/"
+                    --exclude "json/"
+                    --exclude "utils.sh"
+                    --exclude "helpers_cache.json"
+                    --exclude "ProxMenux-Monitor.AppImage*"
+                    --exclude "install_proxmenux*.sh"
+                    --exclude "restore-pending/"
+                )
+            fi
+            rsync -aAXH --delete "${rsync_extra[@]}" "$src/" "$dst/" 2>/dev/null && ((applied++)) || ((skipped++))
         else
             mkdir -p "$(dirname "$dst")"
             cp -a "$src" "$dst" 2>/dev/null && ((applied++)) || ((skipped++))
@@ -898,8 +1775,16 @@ _rs_apply() {
     done
 
     elapsed=$((SECONDS - t_start))
-    [[ "$group" == "hot" || "$group" == "all" ]] && \
+    # Skip `systemctl daemon-reload` when invoked from the Monitor
+    # (HB_MONITOR_FLOW=1). The reload itself doesn't restart the
+    # Monitor's unit, but it marks units as "needs restart" and a
+    # later systemctl call against the Monitor would cut the WS
+    # session. The restored unit files are already on disk — they
+    # take effect at the next reboot, which the Monitor flow asks
+    # for explicitly at the end.
+    if [[ "$group" == "hot" || "$group" == "all" ]] && [[ "${HB_MONITOR_FLOW:-0}" != "1" ]]; then
         systemctl daemon-reload >/dev/null 2>&1 || true
+    fi
 
     echo -e ""
     echo -e "${TAB}${BOLD}$(translate "Restore applied:")${CL}"
@@ -919,9 +1804,8 @@ _rs_apply() {
     if [[ -n "$CLUSTER_DATA_EXTRACTED" ]]; then
         export HB_CLUSTER_DATA_EXTRACTED="$CLUSTER_DATA_EXTRACTED"
         _rs_write_cluster_recovery_helper "$CLUSTER_DATA_EXTRACTED"
-        msg_warn "$(translate "Cluster data was extracted for safe manual recovery at:") $CLUSTER_DATA_EXTRACTED"
-        msg_warn "$(translate "Generated helper script:") $CLUSTER_DATA_EXTRACTED/apply-cluster-restore.sh"
-        msg_warn "$(translate "Run it only in a maintenance window.")"
+        msg_ok "$(translate "Cluster data will be applied automatically at next boot.")"
+        msg_info2 "$(translate "Optional safety helper if you ever need to re-apply manually:") $CLUSTER_DATA_EXTRACTED/apply-cluster-restore.sh"
     else
         unset HB_CLUSTER_DATA_EXTRACTED
     fi
@@ -959,49 +1843,50 @@ _rs_collect_plan_stats() {
 _rs_show_plan_summary() {
     local staging_root="$1"
     local meta="$staging_root/metadata"
-    local tmp
-    tmp=$(mktemp) || return 1
 
-    {
-        echo "═══ $(translate "Restore plan summary") ═══"
-        echo ""
-        if [[ -f "$meta/run_info.env" ]]; then
-            echo "$(translate "Backup origin metadata:")"
-            while IFS='=' read -r k v; do
-                [[ -n "$k" ]] && printf "  %-20s %s\n" "${k}:" "$v"
-            done < "$meta/run_info.env"
-            echo ""
-        fi
+    # dialog --colors needs --msgbox/--yesno/--infobox (not --textbox),
+    # so we build the body as a string.
+    local body
+    body=$'\n'"\Zb═══ $(translate "Restore plan summary") ═══\ZB"$'\n\n'
 
-        echo "$(translate "Detected paths in this backup:") ${RS_PLAN_TOTAL}"
-        echo "  • $(translate "Safe to apply now"): ${RS_PLAN_HOT}"
-        echo "  • $(translate "Require reboot"): ${RS_PLAN_REBOOT}"
-        echo "  • $(translate "Risky on running system"): ${RS_PLAN_DANGEROUS}"
-        echo ""
+    if [[ -f "$meta/run_info.env" ]]; then
+        body+="\Zb$(translate "Backup origin metadata:")\ZB"$'\n'
+        while IFS='=' read -r k v; do
+            [[ -z "$k" ]] && continue
+            body+="$(printf '  %-20s \Z4%s\Zn' "${k}:" "$v")"$'\n'
+        done < "$meta/run_info.env"
+        body+=$'\n'
+    fi
 
-        if [[ "$RS_PLAN_HAS_NETWORK" -eq 1 ]]; then
-            echo "  • $(translate "Includes /etc/network (may drop SSH immediately)")"
-        fi
-        if [[ "$RS_PLAN_HAS_CLUSTER" -eq 1 ]]; then
-            echo "  • $(translate "Includes cluster data (/etc/pve, /var/lib/pve-cluster)")"
-            echo "    $(translate "These paths will not be restored live and will be extracted for manual recovery.")"
-        fi
-        if [[ "$RS_PLAN_HAS_ZFS" -eq 1 ]]; then
-            if [[ "${HB_RESTORE_INCLUDE_ZFS:-0}" == "1" ]]; then
-                echo "  • $(translate "Includes /etc/zfs: ENABLED for restore")"
-            else
-                echo "  • $(translate "Includes /etc/zfs: DISABLED unless you enable it")"
-            fi
-        fi
-        echo ""
-        echo "$(translate "Recommendation: start with Complete restore (guided — recommended).")"
-    } > "$tmp"
+    # Reboot-required and live-unsafe both go to the pending set and
+    # are applied by the post-boot dispatcher — to the operator they're
+    # the same bucket "things that complete after reboot".
+    local _reboot_total=$(( RS_PLAN_REBOOT + RS_PLAN_DANGEROUS ))
+    body+="\Zb$(translate "Detected paths in this backup:")\ZB \Zb\Z4${RS_PLAN_TOTAL}\Zn"$'\n'
+    body+="  • $(translate "Safe to apply now"): \Zb\Z4${RS_PLAN_HOT}\Zn"$'\n'
+    body+="  • $(translate "Require reboot"): \Zb\Z4${_reboot_total}\Zn"$'\n'
+    body+=$'\n'
 
-    dialog --backtitle "ProxMenux" \
+    if [[ "$RS_PLAN_HAS_NETWORK" -eq 1 ]]; then
+        body+="  • $(translate "Includes /etc/network (may drop SSH immediately)")"$'\n'
+    fi
+    if [[ "$RS_PLAN_HAS_CLUSTER" -eq 1 ]]; then
+        body+="  • \Z4$(translate "Includes cluster data (/etc/pve, /var/lib/pve-cluster)")\Zn"$'\n'
+        body+="    $(translate "These paths will not be restored live and will be extracted for manual recovery.")"$'\n'
+    fi
+    if [[ "$RS_PLAN_HAS_ZFS" -eq 1 ]]; then
+        if [[ "${HB_RESTORE_INCLUDE_ZFS:-0}" == "1" ]]; then
+            body+="  • $(translate "Includes /etc/zfs"): \Zb$(translate "ENABLED for restore")\ZB"$'\n'
+        else
+            body+="  • $(translate "Includes /etc/zfs"): \Zb$(translate "DISABLED unless you enable it")\ZB"$'\n'
+        fi
+    fi
+    body+=$'\n'
+    body+="\Zb$(translate "Recommendation: start with Complete restore.")\ZB"
+
+    dialog --backtitle "ProxMenux" --colors \
         --title "$(translate "Restore plan")" \
-        --exit-label "OK" \
-        --textbox "$tmp" 24 94 || true
-    rm -f "$tmp"
+        --msgbox "$body" 24 94 || true
 }
 
 _rs_prompt_zfs_opt_in() {
@@ -1012,21 +1897,123 @@ _rs_prompt_zfs_opt_in() {
         return 0
     fi
 
-    local zfs_confirm_msg
-    zfs_confirm_msg="$(translate "This backup includes /etc/zfs. Include it in restore?")"$'\n\n'"$(translate "Only enable this if the target host and ZFS pool names match exactly.")"
+    # /etc/zfs/ on a Proxmox host ALWAYS contains package defaults
+    # (zfs-functions, zpool.d/, zed.d/) — they're shipped by the
+    # zfsutils-linux package and identical across PVE installs.
+    # Only zpool.cache (and the keys/ subdir) carry host-specific
+    # state, because zpool.cache references the source host's
+    # physical disks by GUID. Anything else is safe to restore.
+    local cache="$staging_root/rootfs/etc/zfs/zpool.cache"
+    if [[ ! -f "$cache" ]]; then
+        # No host-specific bits — restore defaults silently.
+        export HB_RESTORE_INCLUDE_ZFS=1
+        return 0
+    fi
+
+    # zpool.cache IS present. Two cases:
+    #  - Same host restore (recovery on the source machine) → quietly
+    #    include; the cache is correct for this host by definition.
+    #  - Cross-host restore → loud warning: pool GUIDs in the cache
+    #    won't match the target's disks, and Proxmox would try to
+    #    import non-existent pools at next boot.
+    local msg
+    if [[ "${HB_COMPAT_SAME_HOST:-0}" == "1" ]]; then
+        msg="$(translate "Backup includes /etc/zfs/zpool.cache. Restore it (same host detected)?")"
+    else
+        msg="$(translate "This backup includes /etc/zfs/zpool.cache (host-specific ZFS state).")"$'\n\n'"$(translate "Restore it ONLY if the target host has the same pools and disks as the source. Otherwise Proxmox may try to import non-existent pools at next boot.")"
+    fi
     if whiptail --title "$(translate "ZFS configuration")" \
-        --yesno "$zfs_confirm_msg" \
-        11 76; then
+        --yesno "$msg" 12 78; then
         export HB_RESTORE_INCLUDE_ZFS=1
     fi
 }
 
 _rs_finish_flow() {
     echo -e ""
+    if [[ "${HB_MONITOR_FLOW:-0}" == "1" ]]; then
+        # Same UX as the TUI but the prompt explicitly says "close"
+        # — the Monitor's ScriptTerminalModal sees isComplete=true on
+        # WS close and dismisses (via the onComplete prop) so the
+        # operator doesn't need to click the Close button.
+        msg_success "$(translate "Press Enter to close...")"
+        read -r
+        return 0
+    fi
     msg_success "$(translate "Press Enter to return to menu...")"
     read -r
 }
 
+# Lists components that the post-boot dispatcher will reinstall in background
+# after reboot, by reading the backup's components_status.json. Mirrors the
+# COMPONENT_INSTALLERS array in apply_cluster_postboot.sh — keep both in sync.
+# Echoes "<key>|<label>|<eta>" one per line for installed components.
+_rs_list_pending_reinstalls() {
+    local staging_root="$1"
+    local state_file="$staging_root/rootfs/usr/local/share/proxmenux/components_status.json"
+    [[ -f "$state_file" ]] || return 0
+    command -v jq >/dev/null 2>&1 || return 0
+
+    local -a known=(
+        "nvidia_driver|NVIDIA driver (DKMS kernel compile)|~5-10 min"
+        "amdgpu_top|amdgpu_top (GitHub .deb download)|~1 min"
+        "intel_gpu_tools|intel-gpu-tools (apt)|~1 min"
+        "coral_driver|Coral TPU driver (DKMS compile)|~3-5 min"
+    )
+    local entry key label eta status
+    for entry in "${known[@]}"; do
+        key="${entry%%|*}"
+        label="${entry#*|}";  label="${label%%|*}"
+        eta="${entry##*|}"
+        status=$(jq -r ".${key}.status // \"\"" "$state_file" 2>/dev/null)
+        [[ "$status" == "installed" ]] && printf '%s|%s|%s\n' "$key" "$label" "$eta"
+    done
+}
+
+# Offers an immediate reboot after the pending restore is prepared, following
+# the same UX pattern as the post-install script. Lists what will keep running
+# in background after reboot so the operator isn't surprised when nvidia-smi
+# or similar tools are missing for the first few minutes.
+_rs_offer_reboot_after_pending() {
+    local staging_root="$1"
+
+    local -a reinstalls=()
+    mapfile -t reinstalls < <(_rs_list_pending_reinstalls "$staging_root")
+
+    local bg_block=""
+    if (( ${#reinstalls[@]} > 0 )); then
+        bg_block="$(translate "After reboot the system will be fully accessible (SSH, web UI, login), but the following components will be reinstalled in BACKGROUND — until they finish, commands like nvidia-smi may not yet be available:")"$'\n'
+        local r key label eta
+        for r in "${reinstalls[@]}"; do
+            key="${r%%|*}"
+            label="${r#*|}"; label="${label%%|*}"
+            eta="${r##*|}"
+            bg_block+="  • ${label}  (${eta})"$'\n'
+        done
+        bg_block+=$'\n'"$(translate "Monitor progress:")"$'\n'
+        bg_block+="  • $(translate "ProxMenux Monitor → Backups tab (live progress card with estimated time, logs, rollback delta)")"$'\n'
+        bg_block+="  • tail -f /var/log/proxmenux/proxmenux-cluster-postboot-*.log"$'\n'
+        bg_block+="  • systemctl status proxmenux-apply-cluster-postboot.service"$'\n\n'
+        bg_block+="$(translate "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.")"$'\n\n'
+    fi
+
+    local prompt="$(translate "Pending restore prepared. A reboot is required to complete it.")"$'\n\n'"${bg_block}$(translate "Reboot now?")"
+
+    # Same dialog for TUI and Monitor — mirrors the post-install
+    # flow (Yes → reboot, No → "You can reboot later manually").
+    # The Monitor's PTY backs whiptail correctly, so the operator
+    # sees the same Yes/No prompt as in the shell.
+    if whiptail --title "$(translate "Reboot Required")" \
+            --yesno "$prompt" 22 90; then
+        msg_warn "$(translate "Rebooting the system...")"
+        sleep 1
+        reboot
+    else
+        msg_info2 "$(translate "You can reboot later manually with: reboot")"
+        msg_success "$(translate "Press Enter to continue...")"
+        read -r
+    fi
+}
+
 _rs_collect_pending_paths() {
     local mode="$1"
     shift
@@ -1045,6 +2032,19 @@ _rs_collect_pending_paths() {
                 ;;
         esac
         [[ -z "$rel" || -n "${seen[$rel]}" ]] && continue
+
+        # Drop hardware-drift skips (see RS_SKIP_PATHS comment in _rs_apply).
+        if [[ -n "${RS_SKIP_PATHS:-}" ]]; then
+            local _abs="/$rel" _skip="" _drop=0
+            while IFS= read -r _skip; do
+                [[ -z "$_skip" ]] && continue
+                if [[ "$_abs" == "$_skip" || "$_abs" == "$_skip"/* ]]; then
+                    _drop=1; break
+                fi
+            done <<<"$RS_SKIP_PATHS"
+            (( _drop )) && continue
+        fi
+
         seen["$rel"]=1
         out+=("$rel")
     done
@@ -1056,24 +2056,186 @@ _rs_install_pending_service_unit() {
     local onboot_script="$1"
     local unit_file="/etc/systemd/system/proxmenux-restore-onboot.service"
 
+    # `network-pre.target` is a passive target activated by
+    # systemd-networkd. On Proxmox the networking stack is
+    # `networking.service` from ifupdown2, NOT systemd-networkd,
+    # so network-pre.target is never reached — the original unit
+    # had `ConditionResult=no` at boot and the pending restore
+    # silently sat in `pending` state forever.
+    #
+    # The correct anchor on PVE is `networking.service`: we run
+    # before it (so we can rewrite /etc/network in time for
+    # ifupdown2 to read the new config) and we pull ourselves in
+    # via `multi-user.target` which IS always activated at boot.
     cat > "$unit_file" <<EOF
 [Unit]
 Description=ProxMenux Pending Restore (on boot)
 DefaultDependencies=no
 After=local-fs.target
-Before=network-pre.target
+Before=networking.service
 Wants=local-fs.target
 
 [Service]
 Type=oneshot
 ExecStart=${onboot_script}
-TimeoutStartSec=0
+# 5-min cap. Original version had TimeoutStartSec=0 (unlimited)
+# combined with update-initramfs -u -k all + update-grub +
+# systemctl start pve-cluster in the script — and a single boot
+# could hang for 15+ minutes with no recourse. With this cap, if
+# the pending apply ever wedges, systemd kills it and the rest of
+# boot continues. The pending state gets marked failed and the
+# operator can re-run it manually from the menu after boot.
+TimeoutStartSec=300
 
 [Install]
-WantedBy=network-pre.target
+WantedBy=multi-user.target
 EOF
 }
 
+# Destructive rollback executor. Reads vms_to_remove / lxcs_to_remove
+# from the rollback.json and runs `qm/pct stop + destroy --purge`
+# on each. Component uninstall is not done here yet — the installers
+# don't expose --auto-uninstall — so we just log them as TODO.
+# Idempotent: missing/already-destroyed guests are skipped.
+_rs_execute_rollback() {
+    local rb_file="$1"
+    [[ ! -s "$rb_file" ]] && return 0
+    command -v jq >/dev/null 2>&1 || { msg_warn "$(translate 'jq not available — skipping rollback execution')"; return 0; }
+
+    local vmids lxcids comps
+    vmids=$(jq -r '.vms_to_remove[]?'             "$rb_file" 2>/dev/null)
+    lxcids=$(jq -r '.lxcs_to_remove[]?'           "$rb_file" 2>/dev/null)
+    comps=$(jq  -r '.components_to_uninstall[]?'  "$rb_file" 2>/dev/null)
+
+    if [[ -z "$vmids" && -z "$lxcids" && -z "$comps" ]]; then
+        msg_ok "$(translate 'Rollback: nothing to remove (host matches backup)')"
+        return 0
+    fi
+
+    msg_info2 "$(translate 'Executing destructive rollback (operator confirmed) ...')"
+
+    local id
+    for id in $vmids; do
+        [[ -z "$id" ]] && continue
+        if qm status "$id" >/dev/null 2>&1; then
+            echo "  → qm stop $id (extra VM, created after backup)"
+            qm stop "$id" --timeout 30 >/dev/null 2>&1 || true
+            echo "  → qm destroy $id --purge"
+            if qm destroy "$id" --purge >/dev/null 2>&1; then
+                msg_ok "$(translate 'VM removed:') $id"
+            else
+                msg_error "$(translate 'Failed to destroy VM:') $id"
+            fi
+        else
+            echo "  • VM $id no longer present — skip"
+        fi
+    done
+
+    for id in $lxcids; do
+        [[ -z "$id" ]] && continue
+        if pct status "$id" >/dev/null 2>&1; then
+            echo "  → pct stop $id (extra LXC, created after backup)"
+            pct stop "$id" >/dev/null 2>&1 || true
+            echo "  → pct destroy $id --purge"
+            if pct destroy "$id" --purge >/dev/null 2>&1; then
+                msg_ok "$(translate 'LXC removed:') $id"
+            else
+                msg_error "$(translate 'Failed to destroy LXC:') $id"
+            fi
+        else
+            echo "  • LXC $id no longer present — skip"
+        fi
+    done
+
+    if [[ -n "$comps" ]]; then
+        local comp
+        for comp in $comps; do
+            [[ -z "$comp" ]] && continue
+            # Until each installer ships --auto-uninstall we can only
+            # flag these for the operator. Once nvidia/amd/intel/coral
+            # support it, this branch can shell out the same way the
+            # auto-reinstall path does.
+            msg_warn "$(translate 'Component to uninstall manually (no --auto-uninstall yet):') $comp"
+        done
+    fi
+
+    # ── VFIO orphan cleanup + initramfs regen (BEFORE the reboot) ──
+    # Restore is additive: if the host has VFIO config files that the
+    # backup doesn't, they survive the apply. The 10-proxmenux-vfio-bind
+    # udev rule, the nvidia hard-blacklist, the vfio-bind.bdfs state file,
+    # the renamed *.proxmenux-disabled-vfio sidecars — all of them keep
+    # the GPU bound to vfio-pci across the next boot. apply_pending_restore.sh
+    # DOES delete them, but it runs AFTER systemd-udevd has already
+    # bound the GPU. We have to clean them up while we're still in the
+    # operator's restore terminal, then regenerate initramfs so the
+    # boot comes up with the host-mode driver stack from the start.
+    local _pending_rootfs
+    _pending_rootfs="$(dirname "$rb_file")/rootfs"
+    [[ -d "$_pending_rootfs" ]] && _rs_cleanup_vfio_orphans "$_pending_rootfs"
+}
+
+# Remove VFIO/passthrough artifacts that exist on the host but not in
+# the backup, and reactivate any host-mode sidecars the backup ships
+# disabled. Idempotent. Called from _rs_execute_rollback when the
+# operator has opted into destructive rollback.
+_rs_cleanup_vfio_orphans() {
+    local backup_root="$1"
+    local changed=0 f active
+
+    # Files that ProxMenux manages and that force vfio-pci binding.
+    # If they're not in the backup, the backup represents a host that
+    # was NOT in VFIO mode → drop them from the host too.
+    local -a vfio_owned=(
+        "/etc/udev/rules.d/10-proxmenux-vfio-bind.rules"
+        "/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf"
+        "/etc/modprobe.d/proxmenux-nvidia-blacklist.conf"
+        "/etc/modprobe.d/nvidia-blacklist.conf"
+        "/etc/proxmenux/vfio-bind.bdfs"
+    )
+    for f in "${vfio_owned[@]}"; do
+        if [[ -e "$f" && ! -e "${backup_root}${f}" ]]; then
+            rm -f "$f" 2>/dev/null
+            echo "  → removed orphan VFIO file: $f"
+            changed=1
+        fi
+    done
+
+    # Re-enable host-mode sidecars: the switch_gpu_mode flow renames
+    # `nvidia-vfio.conf` → `nvidia-vfio.conf.proxmenux-disabled-vfio`
+    # (and the same for the NVIDIA udev rules) when going LXC-only.
+    # If the backup ships the *disabled* sidecar, swap it back in.
+    local -a sidecars=(
+        "/etc/modules-load.d/nvidia-vfio.conf"
+        "/etc/udev/rules.d/70-nvidia.rules"
+    )
+    for active in "${sidecars[@]}"; do
+        local disabled="${active}.proxmenux-disabled"
+        local disabled_vfio="${active}.proxmenux-disabled-vfio"
+        # Check both possible suffixes the switch_gpu scripts use.
+        for f in "$disabled_vfio" "$disabled"; do
+            if [[ -e "${backup_root}${f}" && ! -e "${backup_root}${active}" ]]; then
+                # Backup expects this sidecar active. If the host has
+                # the live file, leave it (it's still there); if it
+                # has the disabled rename, swap.
+                if [[ ! -e "$active" && -e "$f" ]]; then
+                    mv "$f" "$active" 2>/dev/null
+                    echo "  → reactivated host-mode sidecar: $active"
+                    changed=1
+                fi
+            fi
+        done
+    done
+
+    if (( changed )); then
+        echo "  → regenerating initramfs so the next boot drops the VFIO stack ..."
+        if update-initramfs -u >/dev/null 2>&1; then
+            msg_ok "$(translate 'VFIO orphans cleared and initramfs rebuilt — next boot will free the GPU.')"
+        else
+            msg_warn "$(translate 'VFIO orphans cleared but initramfs rebuild failed; check /var/log/proxmenux logs.')"
+        fi
+    fi
+}
+
 _rs_prepare_pending_restore() {
     local staging_root="$1"
     shift
@@ -1123,11 +2285,47 @@ _rs_prepare_pending_restore() {
 
     [[ -d "$staging_root/metadata" ]] && cp -a "$staging_root/metadata/." "$pending_dir/metadata/" 2>/dev/null || true
 
+    # Persist the rollback plan: VMs/LXCs/components that exist
+    # on the host but not in the backup. apply_cluster_postboot.sh
+    # surfaces a read-only "what differs" report from this file
+    # after the boot. When the operator opted into destructive
+    # rollback (HB_ROLLBACK_EXECUTE=1) we also destroy those
+    # guests RIGHT NOW — before the reboot — so the operator
+    # sees `qm destroy` live in the Monitor terminal AND the
+    # next boot comes up without those guests reserving hardware
+    # (critical for GPU passthrough: a stale VM with hostpci
+    # entries makes Proxmox auto-bind the GPU to vfio-pci before
+    # the nvidia driver can claim it).
+    local _rb_script="${SCRIPT_DIR}/restore/compute_rollback_plan.sh"
+    [[ ! -x "$_rb_script" ]] && _rb_script="${LOCAL_SCRIPTS:-/usr/local/share/proxmenux/scripts}/backup_restore/restore/compute_rollback_plan.sh"
+    if [[ -x "$_rb_script" ]]; then
+        bash "$_rb_script" "$staging_root" > "$pending_dir/rollback.json" 2>/dev/null || true
+        [[ ! -s "$pending_dir/rollback.json" ]] && rm -f "$pending_dir/rollback.json"
+    fi
+
+    if [[ "${HB_ROLLBACK_EXECUTE:-0}" == "1" && -s "$pending_dir/rollback.json" ]] \
+       && command -v jq >/dev/null 2>&1; then
+        _rs_execute_rollback "$pending_dir/rollback.json"
+    fi
+
     cat > "$pending_dir/plan.env" <<EOF
 RESTORE_ID=${restore_id}
 CREATED_AT=${created_at}
 HB_RESTORE_INCLUDE_ZFS=${HB_RESTORE_INCLUDE_ZFS:-0}
+HB_ROLLBACK_EXECUTE=${HB_ROLLBACK_EXECUTE:-0}
+HB_COMPAT_CROSS_VERSION=${HB_COMPAT_CROSS_VERSION:-0}
+HB_COMPAT_KERNEL_DIRECTION=${HB_COMPAT_KERNEL_DIRECTION:-same}
+HB_HYDRATION_APPLIED=${HB_HYDRATION_APPLIED:-0}
 EOF
+    # Persist hardware-drift skips so apply_pending_restore.sh can filter
+    # them at boot. The RS_SKIP_PATHS env var only lives in the restore
+    # menu session; without writing it to disk, paths that would break
+    # the boot (stale EFI UUIDs, foreign zpool.cache, ...) leaked through
+    # to the post-boot apply and ended up corrupting the bootloader.
+    if [[ -n "${RS_SKIP_PATHS:-}" ]]; then
+        printf '%s\n' "$RS_SKIP_PATHS" > "$pending_dir/rs-skip-paths.txt"
+        chmod 600 "$pending_dir/rs-skip-paths.txt"
+    fi
     echo "pending" > "$pending_dir/state"
 
     ln -sfn "$pending_dir" "$pending_base/current"
@@ -1178,107 +2376,628 @@ _rs_handle_ssh_network_risk() {
     return 0
 }
 
+# ==========================================================
+# Kernel-agnostic hydration for bk_older restores
+# ==========================================================
+# In bk_older direction we block whole-file restores of the
+# kernel/boot-tied paths (see hb_unsafe_paths_cross_version) to
+# stop the target's boot from being poisoned by systemd unit
+# overrides, APT sources, GRUB defaults, etc. from an older
+# base. But the operator's OWN customisations inside those
+# paths (IOMMU cmdline, VFIO modules, usb-storage.quirks, custom
+# GRUB_TIMEOUT, ...) are kernel-agnostic and should still land
+# on the target — otherwise a fresh install after a restore
+# forgets everything the operator tuned.
+#
+# The hydration functions below implement a merge-not-copy
+# strategy: they read the operator-authored bits from the
+# manifest (cmdline_extra, modules_loaded_at_boot) or from
+# specific whitelisted files in the staging rootfs, and merge
+# them into the target's live config without touching keys or
+# tokens the target already carries. All four phases are
+# idempotent and additive; running them twice is a no-op.
+# ==========================================================
+
+_rs_hyd_manifest() { echo "$1/metadata/manifest.json"; }
+
+# List operator-authored kernel cmdline tokens from the manifest,
+# one per line. Empty output = nothing to merge.
+_rs_hyd_cmdline_tokens() {
+    local manifest="$1"
+    [[ -f "$manifest" ]] || return 0
+    command -v jq >/dev/null 2>&1 || return 0
+    jq -r '.kernel_params.cmdline_extra // [] | .[]' "$manifest" 2>/dev/null || true
+}
+
+# List modules the backup loaded at boot (from /etc/modules on
+# the source host), one per line.
+_rs_hyd_modules_at_boot() {
+    local manifest="$1"
+    [[ -f "$manifest" ]] || return 0
+    command -v jq >/dev/null 2>&1 || return 0
+    jq -r '.kernel_params.modules_loaded_at_boot // [] | .[]' "$manifest" 2>/dev/null || true
+}
+
+# Read a KEY=VALUE line from a `/etc/default/grub`-style file.
+# Prints the raw VALUE part (including surrounding quotes) if
+# present, empty otherwise. Handles both `KEY=value` and
+# `KEY="value with spaces"` forms.
+_rs_hyd_grub_read_key() {
+    local file="$1" key="$2"
+    [[ -f "$file" ]] || return 0
+    # Grab the LAST assignment (later wins in shell-style config),
+    # skip comment lines, tolerate leading whitespace.
+    grep -E "^[[:space:]]*${key}=" "$file" 2>/dev/null | tail -1 | sed -E "s/^[[:space:]]*${key}=//"
+}
+
+# Write or replace a KEY=VALUE line in a `/etc/default/grub`-style
+# file. If the key already exists (uncommented), rewrites its
+# line in place; otherwise appends the new line at the end. Leaves
+# comment lines untouched.
+_rs_hyd_grub_write_key() {
+    local file="$1" key="$2" value="$3"
+    [[ -f "$file" ]] || return 1
+    if grep -qE "^[[:space:]]*${key}=" "$file"; then
+        # In-place rewrite of the last matching line. Use sed with
+        # a temp file so partial failure doesn't corrupt the target.
+        local tmp
+        tmp="$(mktemp)"
+        awk -v k="$key" -v v="$value" '
+            BEGIN { pat = "^[[:space:]]*" k "=" }
+            $0 ~ pat { print k "=" v; next }
+            { print }
+        ' "$file" > "$tmp" && mv "$tmp" "$file"
+    else
+        printf '%s=%s\n' "$key" "$value" >> "$file"
+    fi
+}
+
+# Strip surrounding double quotes and split a GRUB_CMDLINE_-style
+# value into whitespace-delimited tokens (one per line). Handles
+# escaped inner quotes conservatively.
+_rs_hyd_cmdline_split() {
+    local raw="$1"
+    raw="${raw%\"}"; raw="${raw#\"}"
+    raw="${raw%\'}"; raw="${raw#\'}"
+    # tr will collapse any run of whitespace; xargs normalises.
+    tr -s '[:space:]' '\n' <<<"$raw" | sed '/^$/d'
+}
+
+# Merge two cmdline strings: target wins on ties (same key), any
+# backup token whose KEY (or bare flag) is not in target is
+# appended. Prints the merged cmdline as a single line without
+# surrounding quotes. Also returns 0 if any token was added, 1
+# if nothing changed — useful for the caller to decide whether
+# an update-grub / proxmox-boot-tool refresh is needed.
+_rs_hyd_cmdline_merge() {
+    local target_line="$1" backup_line="$2"
+    local -A target_keys=()
+    local -a merged=()
+    local t bkey
+    while IFS= read -r t; do
+        [[ -z "$t" ]] && continue
+        merged+=("$t")
+        bkey="${t%%=*}"
+        target_keys["$bkey"]=1
+    done < <(_rs_hyd_cmdline_split "$target_line")
+    local added=0
+    while IFS= read -r t; do
+        [[ -z "$t" ]] && continue
+        bkey="${t%%=*}"
+        if [[ -z "${target_keys[$bkey]:-}" ]]; then
+            merged+=("$t")
+            target_keys["$bkey"]=1
+            added=1
+        fi
+    done < <(_rs_hyd_cmdline_split "$backup_line")
+    printf '%s' "${merged[*]}"
+    (( added )) && return 0 || return 1
+}
+
+# Phase 1a — GRUB path
+# ────────────────────
+# Merge cmdline tokens from the backup's cmdline_extra into the
+# target's live GRUB_CMDLINE_LINUX_DEFAULT (never overwrite existing
+# tokens or keys). Also merge whitelisted GRUB_* keys from the
+# backup's /etc/default/grub whose values differ. Reports one
+# summary line per action into the global RS_HYDRATION_ACTIONS[].
+# $3=mode: "plan" reports would-be actions only, "commit" writes.
+_rs_hyd_grub() {
+    local backup_rootfs="$1" manifest="$2" mode="${3:-commit}"
+    local target="/etc/default/grub"
+    local bk_file="$backup_rootfs/etc/default/grub"
+    [[ -f "$target" ]] || return 0
+
+    local changed=0
+
+    # ── cmdline merge ──
+    local bk_tokens
+    bk_tokens="$(_rs_hyd_cmdline_tokens "$manifest" | tr '\n' ' ')"
+    if [[ -n "${bk_tokens// /}" ]]; then
+        local live_default merged_default added_tokens
+        live_default="$(_rs_hyd_grub_read_key "$target" GRUB_CMDLINE_LINUX_DEFAULT)"
+        local stripped="${live_default%\"}"; stripped="${stripped#\"}"
+        if merged_default="$(_rs_hyd_cmdline_merge "$stripped" "$bk_tokens")"; then
+            added_tokens="$(comm -13 \
+                <(printf '%s\n' $stripped | sort -u) \
+                <(printf '%s\n' $merged_default | sort -u) 2>/dev/null | tr '\n' ' ')"
+            [[ "$mode" == "commit" ]] && _rs_hyd_grub_write_key "$target" GRUB_CMDLINE_LINUX_DEFAULT "\"${merged_default}\""
+            RS_HYDRATION_ACTIONS+=("GRUB_CMDLINE_LINUX_DEFAULT — merge tokens: ${added_tokens}")
+            changed=1
+        fi
+    fi
+
+    # ── whitelisted GRUB_* keys from the backup file ──
+    if [[ -f "$bk_file" ]]; then
+        local key bk_val live_val
+        while IFS= read -r key; do
+            [[ -z "$key" ]] && continue
+            [[ "$key" == "GRUB_CMDLINE_LINUX_DEFAULT" || "$key" == "GRUB_CMDLINE_LINUX" ]] && continue
+            bk_val="$(_rs_hyd_grub_read_key "$bk_file" "$key")"
+            [[ -z "$bk_val" ]] && continue
+            live_val="$(_rs_hyd_grub_read_key "$target" "$key")"
+            if [[ "$bk_val" != "$live_val" ]]; then
+                [[ "$mode" == "commit" ]] && _rs_hyd_grub_write_key "$target" "$key" "$bk_val"
+                RS_HYDRATION_ACTIONS+=("${key} — restore operator value from backup")
+                changed=1
+            fi
+        done < <(hb_grub_keys_whitelist)
+    fi
+
+    (( changed )) && return 0 || return 1
+}
+
+# Phase 1b — systemd-boot / ZFS path
+# ──────────────────────────────────
+# /etc/kernel/cmdline is a single-line file holding the ENTIRE
+# kernel cmdline (root=, boot=, rootflags=, plus operator tokens).
+# We MUST NOT copy it verbatim across kernels — the target's fresh
+# install references its own ZFS pool. Instead: keep the target's
+# boot boilerplate, append the operator tokens from cmdline_extra
+# that aren't already there.
+_rs_hyd_kernel_cmdline() {
+    local manifest="$1" mode="${2:-commit}"
+    local target="/etc/kernel/cmdline"
+    [[ -f "$target" ]] || return 0
+
+    local bk_tokens
+    bk_tokens="$(_rs_hyd_cmdline_tokens "$manifest" | tr '\n' ' ')"
+    [[ -z "${bk_tokens// /}" ]] && return 1
+
+    local live merged added_tokens
+    live="$(cat "$target" 2>/dev/null | tr -d '\n')"
+    if merged="$(_rs_hyd_cmdline_merge "$live" "$bk_tokens")"; then
+        added_tokens="$(comm -13 \
+            <(printf '%s\n' $live | sort -u) \
+            <(printf '%s\n' $merged | sort -u) 2>/dev/null | tr '\n' ' ')"
+        [[ "$mode" == "commit" ]] && printf '%s\n' "$merged" > "$target"
+        RS_HYDRATION_ACTIONS+=("/etc/kernel/cmdline (systemd-boot/ZFS) — merge tokens: ${added_tokens}")
+        return 0
+    fi
+    return 1
+}
+
+# Phase 2 — /etc/modules merge
+# ────────────────────────────
+# Append modules from modules_loaded_at_boot that are whitelisted
+# AND not already present in /etc/modules. Preserves comments and
+# existing entries.
+_rs_hyd_modules() {
+    local manifest="$1" mode="${2:-commit}"
+    local target="/etc/modules"
+    [[ -f "$target" ]] || return 0
+
+    local -A live_modules=() whitelist=()
+    local m line
+    while IFS= read -r line; do
+        line="${line%%#*}"
+        m="$(printf '%s' "$line" | xargs)"
+        [[ -n "$m" ]] && live_modules["$m"]=1
+    done < "$target"
+    while IFS= read -r m; do
+        m="$(printf '%s' "$m" | xargs)"
+        [[ -n "$m" ]] && whitelist["$m"]=1
+    done < <(hb_hydration_module_whitelist)
+
+    local added=0
+    while IFS= read -r m; do
+        m="$(printf '%s' "$m" | xargs)"
+        [[ -z "$m" ]] && continue
+        [[ -z "${whitelist[$m]:-}" ]] && continue
+        [[ -n "${live_modules[$m]:-}" ]] && continue
+        [[ "$mode" == "commit" ]] && printf '%s\n' "$m" >> "$target"
+        live_modules["$m"]=1
+        RS_HYDRATION_ACTIONS+=("/etc/modules — add: $m")
+        added=1
+    done < <(_rs_hyd_modules_at_boot "$manifest")
+
+    (( added )) && return 0 || return 1
+}
+
+# Phase 3 — whitelisted files
+# ───────────────────────────
+# For each pattern in hb_hydration_files_patterns, copy the
+# matching file from the staging rootfs to the live target IF the
+# backup carries it and its content differs from the live copy.
+_rs_hyd_files() {
+    local backup_rootfs="$1" mode="${2:-commit}"
+    local pattern src dst
+    local copied=0
+    while IFS= read -r pattern; do
+        [[ -z "$pattern" ]] && continue
+        while IFS= read -r src; do
+            [[ -z "$src" || ! -f "$src" ]] && continue
+            dst="${src#${backup_rootfs}}"
+            [[ "$dst" == /* ]] || continue
+            if ! cmp -s "$src" "$dst" 2>/dev/null; then
+                if [[ "$mode" == "commit" ]]; then
+                    mkdir -p "$(dirname "$dst")" 2>/dev/null || true
+                    cp -a "$src" "$dst" 2>/dev/null || continue
+                fi
+                RS_HYDRATION_ACTIONS+=("${dst} — restore from backup")
+                copied=1
+            fi
+        done < <(compgen -G "${backup_rootfs}${pattern}" 2>/dev/null || true)
+    done < <(hb_hydration_files_patterns)
+    (( copied )) && return 0 || return 1
+}
+
+# Orchestrator for the 4 phases. Two modes:
+#   plan   — populates RS_HYDRATION_ACTIONS and RS_HYDRATION_SUMMARY
+#            without writing to any live file. Safe to call before
+#            the operator's final yes/no.
+#   commit — actually writes to the live target and exports
+#            HB_HYDRATION_APPLIED=1 if anything changed, so that
+#            plan.env carries the flag and apply_pending_restore.sh
+#            forces NEEDS_INITRAMFS/NEEDS_GRUB.
+# Both modes are safe to call multiple times: writes are additive
+# and idempotent, plan is side-effect free.
+_rs_apply_bk_older_hydration() {
+    local staging_root="$1" mode="${2:-commit}"
+    local backup_rootfs="$staging_root/rootfs"
+    local manifest
+    manifest="$(_rs_hyd_manifest "$staging_root")"
+
+    RS_HYDRATION_ACTIONS=()
+    RS_HYDRATION_SUMMARY=""
+
+    [[ -d "$backup_rootfs" ]] || return 0
+
+    local bootloader
+    bootloader="$(hb_detect_bootloader)"
+
+    local any=0
+    case "$bootloader" in
+        systemd-boot)
+            _rs_hyd_kernel_cmdline "$manifest" "$mode" && any=1 || true
+            ;;
+        grub|*)
+            _rs_hyd_grub "$backup_rootfs" "$manifest" "$mode" && any=1 || true
+            ;;
+    esac
+    _rs_hyd_modules "$manifest" "$mode" && any=1 || true
+    _rs_hyd_files "$backup_rootfs" "$mode" && any=1 || true
+
+    if (( any )); then
+        if [[ "$mode" == "commit" ]]; then
+            HB_HYDRATION_APPLIED=1
+            export HB_HYDRATION_APPLIED
+        fi
+        local body a header
+        if [[ "$mode" == "plan" ]]; then
+            header="$(translate "Operator config that WILL be re-applied via kernel-agnostic merge")"
+        else
+            header="$(translate "Operator config re-applied via kernel-agnostic merge")"
+        fi
+        body="\Zb${header}\ZB"$'\n\n'
+        for a in "${RS_HYDRATION_ACTIONS[@]}"; do
+            body+="  \Z2•\Zn ${a}"$'\n'
+        done
+        RS_HYDRATION_SUMMARY="$body"
+    fi
+    return 0
+}
+
 _rs_run_complete_guided() {
     local staging_root="$1"
     local -a all_paths=()
     hb_load_restore_paths "$staging_root" all_paths
 
-    local choice
-    choice=$(dialog --backtitle "ProxMenux" \
-        --title "$(translate "Complete restore (guided)")" \
-        --menu "\n$(translate "Choose strategy:")" \
-        "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
-        1 "$(translate "Apply safe + reboot-required now (skip risky live paths)")" \
-        2 "$(translate "Full now: apply all paths (advanced — may drop SSH)")" \
-        3 "$(translate "Apply safe now + schedule remaining for next boot (recommended for SSH)")" \
-        4 "$(translate "Schedule full restore for next boot (no live apply now)")" \
-        0 "$(translate "Return")" \
-        3>&1 1>&2 2>&3) || return 1
+    # ── Smart restore plan ──────────────────────────────────
+    # Compare the backup metadata against the live host and surface
+    # anything that would be unsafe to restore as-is (ZFS pool GUID
+    # changed, fstab UUIDs gone, NVIDIA driver state for a host with
+    # no NVIDIA card, ...). Only opens an extra dialog when there's
+    # actually drift — same-hardware/same-host restores skip it.
+    export RS_SKIP_PATHS=""
+    local -a drift_lines=()
+    mapfile -t drift_lines < <(hb_assess_hardware_drift "$staging_root" 2>/dev/null)
+    if (( ${#drift_lines[@]} > 0 )); then
+        local skip_paths=""
+        local skip_components=""
+        local plan_body
+        plan_body="\Zb$(translate "Smart restore plan — hardware compatibility check")\ZB"$'\n\n'
+        plan_body+="$(translate "The backup metadata was compared against this host. The following items will be SKIPPED to keep the boot safe:")"$'\n\n'
 
-    case "$choice" in
-        1)
-            if ! whiptail --title "$(translate "Confirm guided restore")" \
-                --yesno "$(translate "Apply safe + reboot-required restore now?")"$'\n\n'"$(translate "Risky live paths (for example /etc/network) will NOT be applied in this mode.")" \
-                11 78; then
-                return 1
+        # Identifier-based skips (ZFS pool GUID, boot EFI UUID, fstab UUID)
+        # always fire on cross-host restores. The skip itself still applies
+        # — only the dialog is suppressed when nothing else is signal-bearing.
+        local -A _IDENTIFIER_PATHS=(
+            ["/etc/zfs/zpool.cache"]=1
+            ["/etc/kernel/proxmox-boot-uuids"]=1
+            ["/etc/fstab"]=1
+        )
+        local dialog_signal=0
+        local line key action reason
+        for line in "${drift_lines[@]}"; do
+            IFS=$'\t' read -r key action reason <<<"$line"
+            [[ "$action" != "skip" ]] && continue
+            if [[ "$key" == component:* ]]; then
+                local cname="${key#component:}"
+                skip_components+="${cname} "
+                plan_body+="  \Z1•\Zn $(translate "Component:") \Zb${cname}\ZB"$'\n'
+                plan_body+="    ${reason}"$'\n\n'
+                dialog_signal=1
+            else
+                skip_paths+="${key}"$'\n'
+                if [[ "${HB_COMPAT_SAME_HOST:-1}" == "0" ]] \
+                    && [[ -n "${_IDENTIFIER_PATHS[$key]:-}" ]]; then
+                    continue
+                fi
+                plan_body+="  \Z1•\Zn $(translate "Path:") \Zb${key}\ZB"$'\n'
+                plan_body+="    ${reason}"$'\n\n'
+                dialog_signal=1
             fi
+        done
 
-            show_proxmenux_logo
-            msg_title "$(translate "Applying guided complete restore")"
-            if [[ "$RS_PLAN_HOT" -gt 0 ]]; then
-                _rs_apply "$staging_root" hot
+        # Persist for _rs_apply / _rs_collect_pending_paths to honor.
+        # The drift summary is merged into the single confirmation
+        # dialog below — no extra yes/no popup.
+        RS_SKIP_PATHS="${skip_paths%$'\n'}"
+        export RS_SKIP_PATHS
+        # Stash the plan_body fragment so the confirm dialog can show it.
+        RS_DRIFT_SUMMARY=""
+        (( dialog_signal == 1 )) && RS_DRIFT_SUMMARY="$plan_body"
+    fi
+
+    # ── NIC remap (silent, staging_root) ─────────────────────
+    # If hb_plan_nic_remaps found NIC(s) with the same MAC as the
+    # backup but a different ifname on the target (motherboard
+    # swap that shifted PCI addresses), rewrite the staging config
+    # in-place so the restored /etc/network/interfaces references
+    # the ifname that actually exists on this host. Also builds
+    # a small summary block for the confirm dialog — informative
+    # only, no yes/no.
+    RS_NIC_REMAP_SUMMARY=""
+    # `${#ARR[@]:-0}` is NOT valid bash — you get either length OR
+    # default, never both. `hb_plan_nic_remaps` initialises both
+    # arrays (empty declarations) before this runs, so plain
+    # `${#ARR[@]}` returns 0 for the empty case without tripping
+    # `set -u`. Reported by a user during restore: "line 2195: bad
+    # substitution".
+    if (( ${#HB_NIC_REMAP[@]} > 0 || ${#HB_NIC_MAC_CHANGED[@]} > 0 )); then
+        local nr_body entry old_if new_if nic_mac old_mac
+        nr_body="\Zb$(translate "NIC changes detected — adjusted automatically")\ZB"$'\n\n'
+        for entry in "${HB_NIC_REMAP[@]}"; do
+            IFS='|' read -r old_if new_if nic_mac <<<"$entry"
+            nr_body+="  \Z4•\Zn $(translate "Renamed"): \Zb${old_if}\ZB → \Zb${new_if}\ZB  ($(translate "same MAC"): ${nic_mac})"$'\n'
+        done
+        for entry in "${HB_NIC_MAC_CHANGED[@]}"; do
+            IFS='|' read -r new_if old_mac nic_mac <<<"$entry"
+            nr_body+="  \Z4•\Zn \Zb${new_if}\ZB $(translate "has a new MAC"): ${nic_mac} ($(translate "was") ${old_mac})"$'\n'
+            nr_body+="    $(translate "If your DHCP has a static reservation for the old MAC, update it.")"$'\n'
+        done
+        RS_NIC_REMAP_SUMMARY="$nr_body"
+        hb_apply_nic_remaps "$staging_root"
+    fi
+
+    # ── Cross-version safe-restore filter ────────────────────
+    # Only activates on `bk_older` (backup kernel older than target).
+    # The reverse direction (`bk_newer`) restores cleanly as-is —
+    # verified empirically on multiple 9.2 → 9.1 restores with GPU
+    # passthrough / IOMMU / DKMS drivers.
+    RS_CROSS_VERSION_SKIPS=""
+    if [[ "${HB_COMPAT_KERNEL_DIRECTION:-same}" == "bk_older" ]]; then
+        local -a cv_skipped=()
+        local cv_line cv_path cv_reason cv_rel
+        # The drift block above trims the trailing newline off
+        # RS_SKIP_PATHS ("${skip_paths%$'\n'}"), so the first cv_path
+        # appended below would be pasted onto the previous drift path
+        # (bench-reproduced: `/etc/kernel/proxmox-boot-uuids/etc/default/grub`
+        # in rs-skip-paths.txt broke the match on /etc/default/grub,
+        # apply_pending_restore restored it from the backup, update-grub
+        # generated a boot config against the backup kernel and the
+        # host paniced on next reboot). Restore the missing separator.
+        [[ -n "$RS_SKIP_PATHS" && "${RS_SKIP_PATHS: -1}" != $'\n' ]] && RS_SKIP_PATHS+=$'\n'
+        while IFS=$'\t' read -r cv_path cv_reason; do
+            [[ -z "$cv_path" ]] && continue
+            cv_rel="${cv_path#/}"
+            # Only skip when the backup actually carries the path —
+            # otherwise the "excluded" line is misleading.
+            if [[ -e "$staging_root/rootfs/$cv_rel" ]]; then
+                cv_skipped+=("${cv_path}"$'\t'"${cv_reason}")
+                RS_SKIP_PATHS+="${cv_path}"$'\n'
             fi
-            if [[ "$RS_PLAN_REBOOT" -gt 0 ]]; then
-                _rs_apply "$staging_root" reboot
+        done < <(hb_unsafe_paths_cross_version)
+
+        if (( ${#cv_skipped[@]} > 0 )); then
+            local cv_body
+            cv_body="\Zb$(translate "Cross-version detected — safe restore mode")\ZB"$'\n\n'
+            cv_body+="$(translate "The backup was taken on a different PVE or kernel major.minor. These paths will be SKIPPED to keep the boot safe:")"$'\n\n'
+            for cv_line in "${cv_skipped[@]}"; do
+                cv_path="${cv_line%%$'\t'*}"
+                cv_reason="${cv_line#*$'\t'}"
+                cv_body+="  \Z1•\Zn \Zb${cv_path}\ZB"$'\n'
+                cv_body+="    $(translate "${cv_reason}")"$'\n\n'
+            done
+            RS_CROSS_VERSION_SKIPS="$cv_body"
+        fi
+        # Trim any leading duplicate newlines the concat may introduce.
+        RS_SKIP_PATHS="${RS_SKIP_PATHS#$'\n'}"
+        RS_SKIP_PATHS="${RS_SKIP_PATHS%$'\n'}"
+        export RS_SKIP_PATHS
+
+        # Kernel-agnostic hydration of operator-authored bits that
+        # would otherwise be lost with the whole-file skip above.
+        # See _rs_apply_bk_older_hydration for the four merge phases.
+        # Runs in "plan" mode BEFORE the confirm dialog so
+        # RS_HYDRATION_SUMMARY can preview what will be re-applied;
+        # the commit runs AFTER the operator says yes, right before
+        # the hot apply.
+        _rs_apply_bk_older_hydration "$staging_root" plan
+    fi
+
+    # Build the rich confirmation body. Replaces the previous 4-strategy
+    # menu — by design a Proxmox host restore always requires a reboot
+    # for predictable end state (pmxcfs live writes + initramfs + driver
+    # reinstall via the post-boot dispatcher all need it). Forcing the
+    # strategy to "apply safe hot + pending for boot" gives the user the
+    # full restore + zero-manual NVIDIA/Intel/Coral reinstall path with
+    # one consistent UX, no footguns.
+    local hot_count="${RS_PLAN_HOT:-0}"
+    local pending_count=$(( ${RS_PLAN_REBOOT:-0} + ${RS_PLAN_DANGEROUS:-0} ))
+
+    # Surface which components the post-boot dispatcher will reinstall
+    # (read from the backup's components_status.json — same logic as
+    # _rs_offer_reboot_after_pending).
+    local -a reinstalls=()
+    mapfile -t reinstalls < <(_rs_list_pending_reinstalls "$staging_root")
+    local comp_line=""
+    if (( ${#reinstalls[@]} > 0 )); then
+        local r label
+        comp_line=$'\n'"$(translate "After reboot, these components will reinstall in background:")"$'\n'
+        for r in "${reinstalls[@]}"; do
+            label="${r#*|}"; label="${label%%|*}"
+            local eta="${r##*|}"
+            comp_line+="  • ${label}  (${eta})"$'\n'
+        done
+    fi
+
+    # dialog --colors lets us highlight the counts, the warning, and
+    # the reinstall list. Inline escape codes:
+    #   \Zb bold   \ZB unbold   \Zn reset all
+    #   \Z2 green  \Z3 yellow   \Z4 blue   \Z1 red
+    local body
+    body="\Zb$(translate "A complete restore will:")\ZB"$'\n\n'
+    body+="  • $(translate "Apply") \Zb\Z4${hot_count}\Zn $(translate "safe paths now (configs, packages, /etc, /root, ...)")"$'\n'
+    body+="  • $(translate "Schedule") \Zb\Z4${pending_count}\Zn $(translate "paths for next boot (/etc/pve, guests, drivers, ...)")"$'\n'
+    if (( ${#reinstalls[@]} > 0 )); then
+        body+=$'\n'"\Zb$(translate "After reboot, these components will reinstall in background:")\ZB"$'\n'
+        local r label eta
+        for r in "${reinstalls[@]}"; do
+            label="${r#*|}"; label="${label%%|*}"
+            eta="${r##*|}"
+            body+="  • \Zb${label}\ZB  (${eta})"$'\n'
+        done
+    fi
+    # Silent NIC remap block first (informational, no action needed
+    # from the operator — the staging config has already been
+    # rewritten). Kept above drift/cross-version because it's the
+    # least alarming and the most common on hardware refreshes.
+    if [[ -n "${RS_NIC_REMAP_SUMMARY:-}" ]]; then
+        body+=$'\n'"${RS_NIC_REMAP_SUMMARY}"
+    fi
+    # If smart restore flagged drift skips earlier, surface them here
+    # so the operator sees everything in one screen instead of two
+    # consecutive yes/no popups.
+    if [[ -n "${RS_DRIFT_SUMMARY:-}" ]]; then
+        body+=$'\n'"\Zb$(translate "Hardware compatibility — these items will be skipped to keep the boot safe:")\ZB"$'\n'
+        # Trim the original header from the stashed plan_body — we only
+        # want the bullet list.
+        local _drift_bullets
+        _drift_bullets=$(printf '%s\n' "$RS_DRIFT_SUMMARY" | sed -n '/\Z1•\Zn/,$p')
+        body+="$_drift_bullets"$'\n'
+    fi
+    # Same treatment for cross-version skips (PVE major or kernel
+    # major.minor differ between backup and target). The stashed
+    # body already carries its own header — merge it as-is.
+    if [[ -n "${RS_CROSS_VERSION_SKIPS:-}" ]]; then
+        body+=$'\n'"${RS_CROSS_VERSION_SKIPS}"
+    fi
+    # And the counterpart: what gets re-applied via kernel-agnostic
+    # merge. Rendered in green because it's what the operator gets
+    # back for free even though the whole file was skipped above.
+    if [[ -n "${RS_HYDRATION_SUMMARY:-}" ]]; then
+        body+=$'\n'"${RS_HYDRATION_SUMMARY}"
+    fi
+    body+=$'\n'"\Zb\Z4$(translate "A reboot is required to finish the restore.")\Zn"$'\n\n'
+    body+="$(translate "After the reboot you can follow the post-restore work live from ProxMenux Monitor → Backups tab (estimated time, per-component status, log tail, rollback delta).")"$'\n\n'
+    body+="$(translate "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.")"$'\n\n'
+    body+="\Zb$(translate "Continue?")\ZB"
+
+    if ! dialog --backtitle "ProxMenux" --colors \
+            --title "$(translate "Confirm complete restore")" \
+            --yesno "$body" 22 88; then
+        return 1
+    fi
+
+    # ── Destructive rollback opt-in ───────────────────────────
+    # If the host has VMs / LXCs / components that are NOT in
+    # the backup, ask whether we should ALSO destroy them as
+    # part of "rollback to the backup state". Without this the
+    # restore is additive — a stale VM with hostpci entries
+    # will keep reserving the GPU for vfio-pci after the boot
+    # (we hit this in the test). Skip the prompt entirely when
+    # already in HB_MONITOR_FLOW: the web UI raised its own
+    # destructive-ack checkbox and exported HB_ROLLBACK_EXECUTE.
+    if [[ "${HB_MONITOR_FLOW:-0}" != "1" && "${HB_ROLLBACK_EXECUTE:-0}" != "1" ]]; then
+        local _rb_script="${SCRIPT_DIR}/restore/compute_rollback_plan.sh"
+        [[ ! -x "$_rb_script" ]] && _rb_script="${LOCAL_SCRIPTS:-/usr/local/share/proxmenux/scripts}/backup_restore/restore/compute_rollback_plan.sh"
+        if [[ -x "$_rb_script" ]] && command -v jq >/dev/null 2>&1; then
+            local _rb_json
+            _rb_json=$(bash "$_rb_script" "$staging_root" 2>/dev/null || true)
+            if [[ -n "$_rb_json" ]]; then
+                local _rb_vms _rb_lxcs _rb_comps
+                _rb_vms=$(jq  -r '.vms_to_remove           | join(", ")' <<<"$_rb_json" 2>/dev/null)
+                _rb_lxcs=$(jq -r '.lxcs_to_remove          | join(", ")' <<<"$_rb_json" 2>/dev/null)
+                _rb_comps=$(jq -r '.components_to_uninstall| join(", ")' <<<"$_rb_json" 2>/dev/null)
+                if [[ -n "$_rb_vms" || -n "$_rb_lxcs" || -n "$_rb_comps" ]]; then
+                    local rb_body
+                    rb_body="\Zb\Z1$(translate "Destructive rollback")\ZB\Zn"$'\n\n'
+                    rb_body+="$(translate "The following entries exist on the host but were NOT in the backup. To make the host EXACTLY match the backup state, they must be removed:")"$'\n\n'
+                    [[ -n "$_rb_vms"   ]] && rb_body+="  \Z1•\Zn $(translate "VMs to destroy:")  \Zb${_rb_vms}\ZB"$'\n'
+                    [[ -n "$_rb_lxcs"  ]] && rb_body+="  \Z1•\Zn $(translate "LXCs to destroy:") \Zb${_rb_lxcs}\ZB"$'\n'
+                    [[ -n "$_rb_comps" ]] && rb_body+="  \Z1•\Zn $(translate "Components to uninstall (manual for now):") \Zb${_rb_comps}\ZB"$'\n'
+                    rb_body+=$'\n'"\Zb\Z1$(translate "This is IRREVERSIBLE.")\ZB\Zn"$'\n\n'
+                    rb_body+="$(translate "Pick Yes to destroy them now (before reboot). Pick No to keep the additive restore and clean up manually later.")"
+                    if dialog --backtitle "ProxMenux" --colors \
+                            --title "$(translate "Execute destructive rollback?")" \
+                            --defaultno --yesno "$rb_body" 20 88; then
+                        export HB_ROLLBACK_EXECUTE=1
+                    fi
+                fi
             fi
-            if [[ "$RS_PLAN_DANGEROUS" -gt 0 ]]; then
-                msg_warn "$(translate "Risky live paths were skipped in guided mode. Use Custom restore if you need to apply them.")"
-            fi
-            _rs_finish_flow
-            return 0
-            ;;
+        fi
+    fi
 
-        2)
-            local ssh_network_rc
-            _rs_handle_ssh_network_risk "$staging_root" "${all_paths[@]}"
-            ssh_network_rc=$?
-            [[ $ssh_network_rc -eq 2 ]] && return 0
-            [[ $ssh_network_rc -ne 0 ]] && return 1
+    show_proxmenux_logo
+    msg_title "$(translate "Applying safe paths and preparing pending restore")"
+    # Commit the kernel-agnostic hydration BEFORE hot apply so
+    # /etc/modules, /etc/default/grub (or /etc/kernel/cmdline),
+    # and whitelisted vfio/nvidia files carry the operator's
+    # tokens by the time apply_pending_restore.sh reads its
+    # pending list. plan.env picks up HB_HYDRATION_APPLIED=1
+    # and forces NEEDS_INITRAMFS/NEEDS_GRUB post-boot.
+    if [[ "${HB_COMPAT_KERNEL_DIRECTION:-same}" == "bk_older" ]]; then
+        _rs_apply_bk_older_hydration "$staging_root" commit
+    fi
+    [[ "$hot_count" -gt 0 ]] && _rs_apply "$staging_root" hot
 
-            _rs_warn_dangerous "$staging_root"
-            if ! whiptail --title "$(translate "Final confirmation")" \
-                --yesno "$(translate "You are about to apply ALL changes, including risky paths.")"$'\n\n'"$(translate "This may interrupt SSH immediately and a reboot is recommended.")"$'\n\n'"$(translate "Continue?")" \
-                12 80; then
-                return 1
-            fi
-
-            show_proxmenux_logo
-            msg_title "$(translate "Applying full restore")"
-            _rs_apply "$staging_root" all
-            _rs_finish_flow
-            return 0
-            ;;
-
-        3)
-            if ! whiptail --title "$(translate "Confirm")" \
-                --yesno "$(translate "Apply safe paths now and schedule remaining paths for next boot?")"$'\n\n'"$(translate "This is recommended when connected by SSH.")" \
-                11 80; then
-                return 1
-            fi
-
-            show_proxmenux_logo
-            msg_title "$(translate "Applying safe paths and preparing pending restore")"
-            [[ "$RS_PLAN_HOT" -gt 0 ]] && _rs_apply "$staging_root" hot
-
-            local -a pending_paths=()
-            mapfile -t pending_paths < <(_rs_collect_pending_paths remaining_after_hot "${all_paths[@]}")
-            if _rs_prepare_pending_restore "$staging_root" "${pending_paths[@]}"; then
-                msg_warn "$(translate "Reboot is required to complete the pending restore.")"
-            fi
-            _rs_finish_flow
-            return 0
-            ;;
-
-        4)
-            if ! whiptail --title "$(translate "Confirm")" \
-                --yesno "$(translate "Schedule full restore for next boot without applying live changes now?")" \
-                10 80; then
-                return 1
-            fi
-
-            local -a pending_paths=()
-            mapfile -t pending_paths < <(_rs_collect_pending_paths all_selected "${all_paths[@]}")
-            show_proxmenux_logo
-            msg_title "$(translate "Preparing full pending restore")"
-            if _rs_prepare_pending_restore "$staging_root" "${pending_paths[@]}"; then
-                msg_warn "$(translate "Reboot is required to apply the scheduled restore.")"
-            fi
-            _rs_finish_flow
-            return 0
-            ;;
-    esac
-
-    return 1
+    local -a pending_paths=()
+    mapfile -t pending_paths < <(_rs_collect_pending_paths remaining_after_hot "${all_paths[@]}")
+    local pending_ok=0
+    if _rs_prepare_pending_restore "$staging_root" "${pending_paths[@]}"; then
+        pending_ok=1
+    fi
+    # /etc/pve is in the pending set → defer guest configs to the
+    # post-boot dispatcher (same as the old Strategy 3).
+    _rs_run_complete_extras "$staging_root" 0
+    if (( pending_ok )); then
+        _rs_offer_reboot_after_pending "$staging_root"
+    else
+        _rs_finish_flow
+    fi
+    return 0
 }
 
 _rs_component_paths() {
@@ -1331,18 +3050,22 @@ _rs_component_is_available() {
 }
 
 _rs_unique_paths() {
-    local __out_var="$1"
+    # All locals prefixed with `_rup_` so the nameref doesn't bind
+    # to one of OUR locals when a caller passes the same array name
+    # (e.g. `_rs_unique_paths uniq "$@"` — bash would otherwise
+    # resolve `__out_ref → uniq` to our local instead of the caller's).
+    local _rup_out_var="$1"
     shift
-    local -A seen=()
-    local -a uniq=()
-    local p
-    for p in "$@"; do
-        [[ -z "$p" || -n "${seen[$p]}" ]] && continue
-        seen["$p"]=1
-        uniq+=("$p")
+    local -A _rup_seen=()
+    local -a _rup_uniq=()
+    local _rup_p
+    for _rup_p in "$@"; do
+        [[ -z "$_rup_p" || -n "${_rup_seen[$_rup_p]}" ]] && continue
+        _rup_seen["$_rup_p"]=1
+        _rup_uniq+=("$_rup_p")
     done
-    local -n __out_ref="$__out_var"
-    __out_ref=("${uniq[@]}")
+    local -n _rup_out_ref="$_rup_out_var"
+    _rup_out_ref=("${_rup_uniq[@]}")
 }
 
 _rs_collect_stats_for_paths() {
@@ -1395,52 +3118,152 @@ _rs_warn_dangerous_paths() {
 
 _rs_select_component_paths() {
     local staging_root="$1"
-    local __out_var="$2"
-    local -n __out_ref="$__out_var"
+    # IMPORTANT: every local inside this function must use a unique
+    # prefix (`_rsp_`). Bash nameref resolution walks the dynamic
+    # scope outwards and stops at the first matching name — if we
+    # declare `local -a selected_paths=()` while the caller's array
+    # is also called `selected_paths`, _rs_unique_paths's
+    # `local -n __out_ref="selected_paths"` would resolve to OUR
+    # local one and the caller's array silently stays empty (which
+    # surfaced as the "Selected paths produced no entries to apply"
+    # dialog despite a non-empty selection).
+    local _rsp_out_var="$2"
+    local -n _rsp_out_ref="$_rsp_out_var"
 
-    local -a component_ids=(
-        network ssh_access host_identity cron_jobs apt_repos kernel_boot
-        systemd_custom scripts root_config root_ssh zfs_cfg postfix_cfg cluster_cfg
-    )
-    local -a checklist=()
-    local comp_id
-    for comp_id in "${component_ids[@]}"; do
-        _rs_component_is_available "$staging_root" "$comp_id" || continue
-        checklist+=("$comp_id" "$(_rs_component_label "$comp_id")" "off")
-    done
-
-    if [[ ${#checklist[@]} -eq 0 ]]; then
-        dialog --backtitle "ProxMenux" --title "$(translate "No components available")" \
-            --msgbox "$(translate "No restorable components were detected in this backup.")" 8 68
-        return 1
+    # ── Build the list of paths actually present in this backup ──
+    local -a _rsp_backup=()
+    local _rsp_selected_file="$staging_root/metadata/selected_paths.txt"
+    if [[ -f "$_rsp_selected_file" ]]; then
+        local _rsp_rel
+        while IFS= read -r _rsp_rel; do
+            [[ -z "$_rsp_rel" ]] && continue
+            _rsp_rel="${_rsp_rel#/}"
+            [[ -e "$staging_root/rootfs/$_rsp_rel" ]] && _rsp_backup+=("$_rsp_rel")
+        done < "$_rsp_selected_file"
+    else
+        # Pre-metadata backup: walk rootfs/ at depth 1-2.
+        local _rsp_entry
+        while IFS= read -r _rsp_entry; do
+            [[ -z "$_rsp_entry" ]] && continue
+            _rsp_entry="${_rsp_entry#./}"
+            _rsp_backup+=("$_rsp_entry")
+        done < <(cd "$staging_root/rootfs" 2>/dev/null \
+            && find . -mindepth 1 -maxdepth 2 -print 2>/dev/null)
     fi
 
-    local selected
-    selected=$(dialog --backtitle "ProxMenux" --separate-output \
-        --title "$(translate "Custom restore by components")" \
-        --checklist "\n$(translate "Select components to restore:")" \
-        24 94 14 "${checklist[@]}" 3>&1 1>&2 2>&3) || return 1
-
-    if [[ -z "$selected" ]]; then
-        dialog --backtitle "ProxMenux" --title "$(translate "No components selected")" \
-            --msgbox "$(translate "Select at least one component to continue.")" 8 66
-        return 1
-    fi
-
-    local -a selected_paths=()
-    while IFS= read -r comp_id; do
-        [[ -z "$comp_id" ]] && continue
-        local rel
-        while IFS= read -r rel; do
-            [[ -n "$rel" && -e "$staging_root/rootfs/$rel" ]] && selected_paths+=("$rel")
-        done < <(_rs_component_paths "$comp_id")
-    done <<< "$selected"
-
-    _rs_unique_paths "$__out_var" "${selected_paths[@]}"
-
-    if [[ ${#__out_ref[@]} -eq 0 ]]; then
+    if [[ ${#_rsp_backup[@]} -eq 0 ]]; then
         dialog --backtitle "ProxMenux" --title "$(translate "No paths available")" \
-            --msgbox "$(translate "Selected components have no matching paths in this backup.")" 8 72
+            --msgbox "$(translate "This backup does not contain any restorable paths.")" 8 70
+        return 1
+    fi
+
+    # ── Non-interactive bypass for the Monitor ──
+    local _rsp_selected=""
+    if [[ -n "${HB_PRESELECTED_PATHS:-}" ]]; then
+        local IFS=','
+        local _rsp_pp
+        for _rsp_pp in $HB_PRESELECTED_PATHS; do
+            _rsp_pp="${_rsp_pp#"${_rsp_pp%%[![:space:]]*}"}"
+            _rsp_pp="${_rsp_pp%"${_rsp_pp##*[![:space:]]}"}"
+            [[ -z "$_rsp_pp" ]] && continue
+            _rsp_pp="${_rsp_pp#/}"
+            local _rsp_known
+            for _rsp_known in "${_rsp_backup[@]}"; do
+                [[ "$_rsp_pp" == "$_rsp_known" ]] && { _rsp_selected+="${_rsp_pp}"$'\n'; break; }
+            done
+        done
+        unset IFS
+    fi
+
+    # ── Dialog checklist (one entry per real backup path) ──
+    if [[ -z "$_rsp_selected" ]]; then
+        # In bk_older restores, kernel-tied paths are excluded from
+        # the list entirely (bash `dialog` has no gray-out primitive,
+        # so we hide the unsafe entries and surface their names in a
+        # msgbox up front). Uses the same list `hb_unsafe_paths_cross_version`
+        # returns — single source of truth with the safe filter used
+        # by Full restore.
+        local -A _rsp_blocked=()
+        local -a _rsp_blocked_list=()
+        if [[ "${HB_COMPAT_KERNEL_DIRECTION:-same}" == "bk_older" ]]; then
+            local _rsp_bp _rsp_reason
+            while IFS=$'\t' read -r _rsp_bp _rsp_reason; do
+                [[ -z "$_rsp_bp" ]] && continue
+                local _rsp_bp_rel="${_rsp_bp#/}"
+                _rsp_blocked["$_rsp_bp_rel"]=1
+            done < <(hb_unsafe_paths_cross_version)
+        fi
+
+        local -a _rsp_checklist=()
+        local _rsp_p
+        for _rsp_p in "${_rsp_backup[@]}"; do
+            # Skip paths whose parent (or itself) is on the blocked
+            # list: `/etc/systemd/system/foo` counts as blocked when
+            # `/etc/systemd/system` is on the list.
+            local _rsp_hit="" _rsp_probe="$_rsp_p"
+            while [[ -n "$_rsp_probe" ]]; do
+                if [[ -n "${_rsp_blocked[$_rsp_probe]:-}" ]]; then
+                    _rsp_hit="/$_rsp_probe"
+                    break
+                fi
+                [[ "$_rsp_probe" != *"/"* ]] && break
+                _rsp_probe="${_rsp_probe%/*}"
+            done
+            if [[ -n "$_rsp_hit" ]]; then
+                _rsp_blocked_list+=("$_rsp_hit")
+                continue
+            fi
+            _rsp_checklist+=("$_rsp_p" "/$_rsp_p" "off")
+        done
+
+        # If any paths were dropped, show them in a msgbox before the
+        # picker so the operator understands why they don't appear.
+        if (( ${#_rsp_blocked_list[@]} > 0 )); then
+            # Deduplicate — a folder can hide many child paths.
+            local -A _rsp_seen=()
+            local _rsp_list_str=""
+            local _rsp_e
+            for _rsp_e in "${_rsp_blocked_list[@]}"; do
+                [[ -n "${_rsp_seen[$_rsp_e]:-}" ]] && continue
+                _rsp_seen["$_rsp_e"]=1
+                _rsp_list_str+="  • ${_rsp_e}"$'\n'
+            done
+            dialog --backtitle "ProxMenux" --colors \
+                --title "$(translate "Cross-kernel — paths hidden from picker")" \
+                --msgbox "$(translate "The following backup paths are kernel-tied and are excluded from the picker to keep the target's boot safe. The operator's own tuning inside these paths (IOMMU cmdline, VFIO IDs, custom quirks) is merged back automatically via kernel-agnostic merge:")"$'\n\n'"${_rsp_list_str}"$'\n'"$(translate "To copy any of these files verbatim, restore this backup on a host with the same kernel major.minor.")" \
+                22 84
+        fi
+
+        if (( ${#_rsp_checklist[@]} == 0 )); then
+            dialog --backtitle "ProxMenux" --title "$(translate "Nothing selectable")" \
+                --msgbox "$(translate "Every path in this backup is kernel-tied: the restore applies these paths automatically via the safe-subset filter and re-merges the operator's tuning.")" 10 82
+            return 1
+        fi
+
+        _rsp_selected=$(dialog --backtitle "ProxMenux" --separate-output \
+            --title "$(translate "Custom restore by paths")" \
+            --checklist "\n$(translate "Select the paths to restore (one per backup entry):")" \
+            24 94 16 "${_rsp_checklist[@]}" 3>&1 1>&2 2>&3) || return 1
+
+        if [[ -z "$_rsp_selected" ]]; then
+            dialog --backtitle "ProxMenux" --title "$(translate "Nothing selected")" \
+                --msgbox "$(translate "Select at least one path to continue.")" 8 66
+            return 1
+        fi
+    fi
+
+    local -a _rsp_picked=()
+    local _rsp_line
+    while IFS= read -r _rsp_line; do
+        [[ -z "$_rsp_line" ]] && continue
+        _rsp_picked+=("$_rsp_line")
+    done <<< "$_rsp_selected"
+
+    _rs_unique_paths "$_rsp_out_var" "${_rsp_picked[@]}"
+
+    if [[ ${#_rsp_out_ref[@]} -eq 0 ]]; then
+        dialog --backtitle "ProxMenux" --title "$(translate "Nothing to restore")" \
+            --msgbox "$(translate "Selected paths produced no entries to apply.")" 8 70
         return 1
     fi
     return 0
@@ -1453,135 +3276,423 @@ _rs_run_custom_restore() {
     _rs_select_component_paths "$staging_root" selected_paths || return 1
     _rs_collect_stats_for_paths "${selected_paths[@]}"
 
-    while true; do
-        local choice
-        choice=$(dialog --backtitle "ProxMenux" \
-            --title "$(translate "Custom restore")" \
-            --menu "\n$(translate "Selected component paths:") ${RS_SEL_TOTAL}" \
-            "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
-            1 "$(translate "Apply safe changes now")  (${RS_SEL_HOT})" \
-            2 "$(translate "Apply safe + reboot-required")  ($((RS_SEL_HOT + RS_SEL_REBOOT)))" \
-            3 "$(translate "Apply all selected now (advanced)")  (${RS_SEL_TOTAL})" \
-            4 "$(translate "Reselect components")" \
-            5 "$(translate "Apply safe now + schedule remaining for next boot")" \
-            6 "$(translate "Schedule selected components for next boot (no live apply)")" \
-            0 "$(translate "Return")" \
-            3>&1 1>&2 2>&3) || return 1
+    # ── Smart auto-strategy (no 6-option menu any more) ──
+    # The classifier already split every selected path into:
+    #   RS_SEL_HOT       — applyable live, no risk
+    #   RS_SEL_REBOOT    — needs reboot to take effect
+    #   RS_SEL_DANGEROUS — applyable live but risky (e.g. network
+    #                      from a SSH session)
+    # The operator doesn't need to know that taxonomy. We just:
+    #   1. Show ONE confirmation summarizing what happens.
+    #   2. Apply hot paths now.
+    #   3. Schedule reboot + dangerous paths for next boot.
+    #   4. Tell the operator a reboot is needed when there's pending.
 
-        case "$choice" in
-            1)
-                if [[ "$RS_SEL_HOT" -eq 0 ]]; then
-                    dialog --backtitle "ProxMenux" --title "$(translate "Nothing to apply")" \
-                        --msgbox "$(translate "No safe-now paths in selected components.")" 8 60
-                    continue
-                fi
-                if ! whiptail --title "$(translate "Confirm")" \
-                    --yesno "$(translate "Apply safe changes from selected components now?")" 9 72; then
-                    continue
-                fi
-                show_proxmenux_logo
-                msg_title "$(translate "Applying selected safe changes")"
-                _rs_apply "$staging_root" hot "${selected_paths[@]}"
-                [[ "$RS_SEL_REBOOT" -gt 0 || "$RS_SEL_DANGEROUS" -gt 0 ]] && \
-                    msg_warn "$(translate "Some selected paths were not applied in safe mode.")"
-                _rs_finish_flow
-                return 0
-                ;;
+    if [[ "$RS_SEL_TOTAL" -eq 0 ]]; then
+        dialog --backtitle "ProxMenux" --title "$(translate "Nothing to restore")" \
+            --msgbox "$(translate "Selected paths produced no entries to apply.")" 8 70
+        return 1
+    fi
 
-            2)
-                if [[ $((RS_SEL_HOT + RS_SEL_REBOOT)) -eq 0 ]]; then
-                    dialog --backtitle "ProxMenux" --title "$(translate "Nothing to apply")" \
-                        --msgbox "$(translate "No safe/reboot paths in selected components.")" 8 64
-                    continue
-                fi
-                if ! whiptail --title "$(translate "Confirm")" \
-                    --yesno "$(translate "Apply safe + reboot-required paths from selected components now?")"$'\n\n'"$(translate "Risky live paths will be skipped.")" \
-                    11 78; then
-                    continue
-                fi
-                show_proxmenux_logo
-                msg_title "$(translate "Applying selected safe + reboot changes")"
-                [[ "$RS_SEL_HOT" -gt 0 ]] && _rs_apply "$staging_root" hot "${selected_paths[@]}"
-                [[ "$RS_SEL_REBOOT" -gt 0 ]] && _rs_apply "$staging_root" reboot "${selected_paths[@]}"
-                [[ "$RS_SEL_DANGEROUS" -gt 0 ]] && \
-                    msg_warn "$(translate "Risky selected paths were skipped in this mode.")"
-                _rs_finish_flow
-                return 0
-                ;;
+    # SSH/network protection — if the operator is on a SSH session
+    # and selected network paths, offer to move EVERYTHING to next
+    # boot (avoids disconnection mid-restore). _rs_handle_ssh_network_risk
+    # returns 2 when it has already scheduled for boot — in that case
+    # we're done.
+    local ssh_network_rc
+    _rs_handle_ssh_network_risk "$staging_root" "${selected_paths[@]}"
+    ssh_network_rc=$?
+    [[ $ssh_network_rc -eq 2 ]] && return 0
+    [[ $ssh_network_rc -ne 0 ]] && return 1
 
-            3)
-                local ssh_network_rc
-                _rs_handle_ssh_network_risk "$staging_root" "${selected_paths[@]}"
-                ssh_network_rc=$?
-                [[ $ssh_network_rc -eq 2 ]] && return 0
-                [[ $ssh_network_rc -ne 0 ]] && continue
+    local hot_count="$RS_SEL_HOT"
+    local pending_count=$(( RS_SEL_REBOOT + RS_SEL_DANGEROUS ))
 
-                [[ "$RS_SEL_DANGEROUS" -gt 0 ]] && _rs_warn_dangerous_paths "${selected_paths[@]}"
-                if ! whiptail --title "$(translate "Final confirmation")" \
-                    --yesno "$(translate "Apply ALL selected component paths now? This can include risky paths.")" \
-                    10 78; then
-                    continue
-                fi
-                show_proxmenux_logo
-                msg_title "$(translate "Applying all selected component paths")"
-                _rs_apply "$staging_root" all "${selected_paths[@]}"
-                _rs_finish_flow
-                return 0
-                ;;
+    # In bk_older, preview the kernel-agnostic hydration so the
+    # operator sees UPFRONT what will be re-applied automatically
+    # (IOMMU cmdline, VFIO modules, custom GRUB_TIMEOUT, etc.)
+    # even though the whole-file paths remain blocked from the
+    # custom picker.
+    if [[ "${HB_COMPAT_KERNEL_DIRECTION:-same}" == "bk_older" ]]; then
+        _rs_apply_bk_older_hydration "$staging_root" plan
+    fi
 
-            4)
-                _rs_select_component_paths "$staging_root" selected_paths || continue
-                _rs_collect_stats_for_paths "${selected_paths[@]}"
-                ;;
+    local body
+    body="\Zb$(translate "About to restore") ${RS_SEL_TOTAL} $(translate "selected path(s):")\ZB"$'\n\n'
+    if (( hot_count > 0 )); then
+        body+="  • $(translate "Apply") \Zb\Z4${hot_count}\Zn $(translate "now")"$'\n'
+    fi
+    if (( pending_count > 0 )); then
+        body+="  • $(translate "Schedule") \Zb\Z4${pending_count}\Zn $(translate "for next boot (needs reboot to take effect)")"$'\n'
+    fi
+    if [[ -n "${RS_HYDRATION_SUMMARY:-}" ]]; then
+        body+=$'\n'"${RS_HYDRATION_SUMMARY}"
+    fi
+    if (( pending_count > 0 )); then
+        body+=$'\n'"\Zb\Z4$(translate "A reboot will be required to complete the restore.")\Zn"$'\n'
+        body+="$(translate "Follow post-restore progress live from ProxMenux Monitor → Backups tab after the reboot.")"$'\n'
+    fi
+    body+=$'\n'"\Zb$(translate "Continue?")\ZB"
 
-            5)
-                if ! whiptail --title "$(translate "Confirm")" \
-                    --yesno "$(translate "Apply safe selected paths now and schedule remaining selected paths for next boot?")" \
-                    10 82; then
-                    continue
-                fi
-                show_proxmenux_logo
-                msg_title "$(translate "Applying safe selected paths and preparing pending restore")"
-                [[ "$RS_SEL_HOT" -gt 0 ]] && _rs_apply "$staging_root" hot "${selected_paths[@]}"
-                local -a pending_paths=()
-                mapfile -t pending_paths < <(_rs_collect_pending_paths remaining_after_hot "${selected_paths[@]}")
-                if _rs_prepare_pending_restore "$staging_root" "${pending_paths[@]}"; then
-                    msg_warn "$(translate "Reboot is required to complete the pending restore.")"
-                fi
-                _rs_finish_flow
-                return 0
-                ;;
+    if ! dialog --backtitle "ProxMenux" --colors \
+        --title "$(translate "Confirm custom restore")" \
+        --yesno "$body" 22 82; then
+        return 1
+    fi
 
-            6)
-                if ! whiptail --title "$(translate "Confirm")" \
-                    --yesno "$(translate "Schedule selected component paths for next boot without applying live changes now?")" \
-                    10 82; then
-                    continue
-                fi
-                local -a pending_paths=()
-                mapfile -t pending_paths < <(_rs_collect_pending_paths all_selected "${selected_paths[@]}")
-                show_proxmenux_logo
-                msg_title "$(translate "Preparing selected pending restore")"
-                if _rs_prepare_pending_restore "$staging_root" "${pending_paths[@]}"; then
-                    msg_warn "$(translate "Reboot is required to apply the scheduled restore.")"
-                fi
-                _rs_finish_flow
-                return 0
-                ;;
+    show_proxmenux_logo
+    msg_title "$(translate "Applying custom restore")"
 
-            0)
-                return 1
-                ;;
+    # Commit the hydration BEFORE hot apply. Same rationale as in
+    # the Complete flow: plan.env picks up HB_HYDRATION_APPLIED=1
+    # so apply_pending_restore.sh forces initramfs+grub regen.
+    if [[ "${HB_COMPAT_KERNEL_DIRECTION:-same}" == "bk_older" ]]; then
+        _rs_apply_bk_older_hydration "$staging_root" commit
+    fi
+
+    if (( hot_count > 0 )); then
+        _rs_apply "$staging_root" hot "${selected_paths[@]}"
+    fi
+
+    if (( pending_count > 0 )); then
+        local -a pending_paths=()
+        mapfile -t pending_paths < <(_rs_collect_pending_paths remaining_after_hot "${selected_paths[@]}")
+        if _rs_prepare_pending_restore "$staging_root" "${pending_paths[@]}"; then
+            msg_warn "$(translate "Reboot is required to complete the pending restore.")"
+        fi
+    elif [[ "${HB_HYDRATION_APPLIED:-0}" == "1" ]]; then
+        # Custom restore picked only hot paths, but hydration
+        # merged tokens into /etc/default/grub or /etc/kernel/cmdline
+        # and/or added modules to /etc/modules. Those need
+        # initramfs + bootloader refresh before the next reboot to
+        # be effective. No post-boot dispatcher runs in this
+        # branch (plan.env is only written by
+        # _rs_prepare_pending_restore), so we do the reflows here.
+        msg_info "$(translate "Regenerating boot artifacts for the merged kernel-agnostic changes...")"
+        update-initramfs -u -k all >/dev/null 2>&1 || true
+        local _bl
+        _bl="$(hb_detect_bootloader)"
+        case "$_bl" in
+            systemd-boot) proxmox-boot-tool refresh >/dev/null 2>&1 || true ;;
+            grub|*)       update-grub               >/dev/null 2>&1 || true ;;
         esac
-    done
+        stop_spinner 2>/dev/null || true
+        msg_ok "$(translate "Boot artifacts regenerated — reboot the host to activate the merged config.")"
+    fi
+
+    _rs_finish_flow
+    return 0
 }
 
+# Extras the Complete restore runs INLINE after applying file
+# paths. The operator picked "Complete restore" — they implicitly
+# asked for everything restorable from the backup. We don't ask
+# them again about packages or guest configs, we just do it.
+#
+# Behaviour by strategy:
+#   include_guests=1 → also copy LXC/QEMU .conf files (full mode)
+#   include_guests=0 → skip them (safe / schedule-remaining modes
+#                     where the operator opted out of risky paths)
+# Packages are always installed when they're listed in the backup
+# and missing on this host, regardless of strategy — installing
+# user-installed packages is a prerequisite for the restored
+# systemd units and config files to actually do anything.
+_rs_run_complete_extras() {
+    local staging_root="$1"
+    local include_guests="${2:-1}"
+
+    # ─ Packages — silent run when there's anything to do ──────
+    local pkglist="$staging_root/metadata/packages.manual.list"
+    if [[ -f "$pkglist" ]] \
+        && command -v apt-mark >/dev/null 2>&1 \
+        && command -v apt-get >/dev/null 2>&1; then
+        local cur_pkgs_file
+        cur_pkgs_file=$(mktemp)
+        apt-mark showmanual 2>/dev/null | sort -u > "$cur_pkgs_file"
+        local -a missing=()
+        mapfile -t missing < <(comm -23 <(sort -u "$pkglist") "$cur_pkgs_file")
+        rm -f "$cur_pkgs_file"
+        if [[ ${#missing[@]} -gt 0 ]]; then
+            echo
+            # ── Intelligent package filter (universal, not cross-version-only) ─
+            #
+            # `packages.manual.list` lists everything apt-marked as manual on
+            # the SOURCE host. A blind `apt install` of that list on the
+            # target can wreck it in two ways:
+            #
+            #   1. The backup pinned a package to an older SO-major (e.g.
+            #      libzfs6linux from Proxmox 9.1) but the target already
+            #      ships the newer sibling (libzfs7linux from 9.2). APT
+            #      would resolve the older version by cascade-removing the
+            #      newer one plus everything that depends on it
+            #      (zfsutils-linux, zfs-initramfs, zfs-zed). The `zpool`
+            #      binary vanishes → next reboot panics on rpool mount.
+            #      Bench-reproduced on nvidia3 (9.2.3 / kernel 7.0.12) with
+            #      an nvidia2 backup (9.1.9 / kernel 6.17.2).
+            #
+            #   2. Some packages are already present on the target because
+            #      the fresh install included them — apt doesn't need us
+            #      to re-request them, and re-requesting can pull config
+            #      prompts we don't want during unattended restore.
+            #
+            # The filter runs three passes:
+            #   (a) already_installed  → dpkg -s says the pkg is on target
+            #   (b) provided_by_newer  → target already has libFOO<N>* where
+            #                            the backup's pkg is libFOO<M>* with
+            #                            M < N (SO-major bump between
+            #                            Proxmox releases)
+            #   (c) cascade_risk       → apt-get simulate proves the install
+            #                            would REMOVE something critical
+            #
+            # Each pass populates a report array. Nothing is silent — the
+            # operator sees the final tally with reasons.
+            local -a rep_skipped_installed=()
+            local -a rep_skipped_provided=()
+            local -a rep_skipped_cascade=()
+            local -a rep_unknown=()
+            local -a candidates=()
+
+            local pkg
+            for pkg in "${missing[@]}"; do
+                # Pass (a): already installed?
+                if dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null \
+                    | grep -q '^install ok installed$'; then
+                    rep_skipped_installed+=("$pkg")
+                    continue
+                fi
+                # Pass (b): provided by newer sibling? Only for
+                # `<base><N><suffix>` shaped names — the SO-major
+                # convention used by libzfs<N>linux, libzpool<N>linux,
+                # libnvpair<N>linux, libuutil<N>linux, libzstd<N>, etc.
+                if [[ "$pkg" =~ ^(lib[a-z]+)([0-9]+)([a-z]*[0-9]*)$ ]]; then
+                    local _base="${BASH_REMATCH[1]}"
+                    local _num="${BASH_REMATCH[2]}"
+                    local _suffix="${BASH_REMATCH[3]}"
+                    local _newer_found=""
+                    # Only look up to +5 majors ahead — enough to cover any
+                    # realistic Proxmox jump without probing forever.
+                    local _n
+                    for _n in $(seq $((_num + 1)) $((_num + 5))); do
+                        local _sibling="${_base}${_n}${_suffix}"
+                        if dpkg-query -W -f='${Status}' "$_sibling" 2>/dev/null \
+                            | grep -q '^install ok installed$'; then
+                            _newer_found="$_sibling"
+                            break
+                        fi
+                    done
+                    if [[ -n "$_newer_found" ]]; then
+                        rep_skipped_provided+=("${pkg}|${_newer_found}")
+                        continue
+                    fi
+                fi
+                # Not skipped yet — needs the apt cache to know if it's
+                # installable at all. Unknown-to-apt goes to its own list.
+                if apt-cache show "$pkg" >/dev/null 2>&1; then
+                    candidates+=("$pkg")
+                else
+                    rep_unknown+=("$pkg")
+                fi
+            done
+
+            # Pass (c): apt-simulate to catch cascade-remove risk. We
+            # simulate the full candidate set first; if apt would remove
+            # anything, iteratively drop the "first offender" (the pkg
+            # that appears earliest in the simulated remove path) and
+            # retry until the simulation is clean or the list is empty.
+            local -a installable=()
+            if (( ${#candidates[@]} > 0 )) && command -v apt-get >/dev/null 2>&1; then
+                local _work=("${candidates[@]}")
+                local _guard=0
+                while (( ${#_work[@]} > 0 && _guard < 20 )); do
+                    _guard=$((_guard + 1))
+                    local _sim_out
+                    _sim_out=$(DEBIAN_FRONTEND=noninteractive \
+                        apt-get install -y --simulate --no-install-recommends \
+                        -o Dpkg::Options::="--force-confdef" \
+                        -o Dpkg::Options::="--force-confold" \
+                        "${_work[@]}" 2>&1)
+                    # Look for removals: apt marks them as `Remv <pkg>...`
+                    # in the plan output.
+                    local -a _would_remove=()
+                    mapfile -t _would_remove < <(printf '%s\n' "$_sim_out" \
+                        | awk '/^Remv / {print $2}')
+                    if (( ${#_would_remove[@]} == 0 )); then
+                        installable=("${_work[@]}")
+                        break
+                    fi
+                    # Pick the offender: a package in _work whose install
+                    # is directly linked to the removal. Heuristic — if
+                    # any _work package shares the base+suffix pattern
+                    # with a would-remove package but a different major,
+                    # that's the offender. Otherwise, drop the last one
+                    # (least "essential" by convention of the list).
+                    local _offender=""
+                    local _rm
+                    for _rm in "${_would_remove[@]}"; do
+                        if [[ "$_rm" =~ ^(lib[a-z]+)([0-9]+)([a-z]*[0-9]*)$ ]]; then
+                            local _rmbase="${BASH_REMATCH[1]}"
+                            local _rmsuffix="${BASH_REMATCH[3]}"
+                            local _cand
+                            for _cand in "${_work[@]}"; do
+                                if [[ "$_cand" =~ ^${_rmbase}[0-9]+${_rmsuffix}$ ]]; then
+                                    _offender="$_cand"; break
+                                fi
+                            done
+                        fi
+                        [[ -n "$_offender" ]] && break
+                    done
+                    if [[ -z "$_offender" ]]; then
+                        # No obvious mapping — bail out safely: report
+                        # everything as cascade risk and install nothing.
+                        rep_skipped_cascade+=("${_work[@]/#/${_would_remove[0]}<-}")
+                        _work=()
+                        break
+                    fi
+                    rep_skipped_cascade+=("${_offender}|would remove ${_would_remove[*]:0:3}")
+                    # Drop the offender and retry.
+                    local -a _new_work=()
+                    local _c
+                    for _c in "${_work[@]}"; do
+                        [[ "$_c" == "$_offender" ]] || _new_work+=("$_c")
+                    done
+                    _work=("${_new_work[@]}")
+                done
+            fi
+
+            local -a unknown=("${rep_unknown[@]}")
+
+            # ── Summarize what the filter decided ──
+            if (( ${#rep_skipped_installed[@]} > 0 )); then
+                local _prev="${rep_skipped_installed[*]:0:5}"
+                (( ${#rep_skipped_installed[@]} > 5 )) && _prev+=" … (+ $((${#rep_skipped_installed[@]} - 5)) more)"
+                echo -e "${TAB}${BGN}$(translate "Already installed — skipping"):${CL} ${BL}${_prev}${CL}"
+            fi
+            if (( ${#rep_skipped_provided[@]} > 0 )); then
+                echo -e "${TAB}${BGN}$(translate "Provided by newer version — skipping"):${CL}"
+                local _rec
+                for _rec in "${rep_skipped_provided[@]}"; do
+                    echo -e "${TAB}  ${DGN}${_rec%%|*}${CL} → ${BL}${_rec##*|}${CL}"
+                done
+            fi
+            if (( ${#rep_skipped_cascade[@]} > 0 )); then
+                echo -e "${TAB}${YWB}$(translate "Skipped to protect target system (would cascade-remove packages)"):${CL}"
+                local _rec
+                for _rec in "${rep_skipped_cascade[@]}"; do
+                    echo -e "${TAB}  ${YWB}${_rec%%|*}${CL} — ${_rec##*|}"
+                done
+            fi
+
+            if (( ${#installable[@]} > 0 )); then
+                local _preview="${installable[*]:0:6}"
+                (( ${#installable[@]} > 6 )) && _preview+=" … (+ $((${#installable[@]} - 6)) more)"
+                echo -e "${TAB}${BGN}$(translate "Packages from backup to install:")${CL} ${BL}${_preview}${CL}"
+                echo
+
+                local apt_log="/var/log/proxmenux/restore-apt-$(date +%Y%m%d_%H%M%S).log"
+                mkdir -p "$(dirname "$apt_log")" 2>/dev/null
+
+                msg_info "$(translate "Refreshing apt cache...")"
+                apt-get update -qq >"$apt_log" 2>&1 || true
+                msg_ok "$(translate "apt cache refreshed.")"
+
+                msg_info "$(translate "Installing") ${#installable[@]} $(translate "packages (this may take a few minutes)...")"
+                # Full output to $apt_log so the spinner keeps turning
+                # instead of stalling silently then dumping at the end.
+                # --force-confold keeps the restored configs over any
+                # ucf prompts that would otherwise block dpkg.
+                DEBIAN_FRONTEND=noninteractive \
+                    apt-get install -y \
+                        -o Dpkg::Options::="--force-confdef" \
+                        -o Dpkg::Options::="--force-confold" \
+                        "${installable[@]}" >>"$apt_log" 2>&1
+                local apt_rc=$?
+                if (( apt_rc == 0 )); then
+                    msg_ok "$(translate "Installed:") ${#installable[@]} $(translate "packages.")"
+                else
+                    msg_warn "$(translate "apt-get exited") ${apt_rc} — $(translate "see log:") $apt_log"
+                fi
+            fi
+            if (( ${#unknown[@]} > 0 )); then
+                msg_warn "$(translate "Skipped, not in apt cache:") ${unknown[*]:0:6}$([[ ${#unknown[@]} -gt 6 ]] && echo " … (+ $((${#unknown[@]} - 6)) more)")"
+            fi
+        fi
+    fi
+
+    # ─ Guest configs — only in full strategies ────────────────
+    if [[ "$include_guests" == "1" ]]; then
+        local nodes_root="$staging_root/rootfs/etc/pve/nodes"
+        if [[ -d "$nodes_root" ]]; then
+            local src_node_dir
+            src_node_dir=$(find "$nodes_root" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | head -1)
+            if [[ -n "$src_node_dir" ]]; then
+                local -a lxc_confs=() qm_confs=()
+                [[ -d "$src_node_dir/lxc"         ]] && mapfile -t lxc_confs < <(find "$src_node_dir/lxc"         -maxdepth 1 -type f -name '*.conf' 2>/dev/null | sort)
+                [[ -d "$src_node_dir/qemu-server" ]] && mapfile -t qm_confs  < <(find "$src_node_dir/qemu-server" -maxdepth 1 -type f -name '*.conf' 2>/dev/null | sort)
+                if [[ ${#lxc_confs[@]} -gt 0 || ${#qm_confs[@]} -gt 0 ]]; then
+                    local cur_node target_lxc target_qm
+                    cur_node=$(hostname)
+                    target_lxc="/etc/pve/nodes/$cur_node/lxc"
+                    target_qm="/etc/pve/nodes/$cur_node/qemu-server"
+                    mkdir -p "$target_lxc" "$target_qm" 2>/dev/null
+                    echo
+                    msg_info "$(translate "Restoring guest configs (LXC + QEMU)...")"
+                    stop_spinner
+                    local copied=0 skipped=0 f vmid
+                    for f in "${lxc_confs[@]}"; do
+                        vmid=$(basename "$f" .conf)
+                        if [[ -e "$target_lxc/$vmid.conf" ]]; then
+                            ((skipped++))
+                        elif cp "$f" "$target_lxc/$vmid.conf" 2>/dev/null; then
+                            ((copied++))
+                        fi
+                    done
+                    for f in "${qm_confs[@]}"; do
+                        vmid=$(basename "$f" .conf)
+                        if [[ -e "$target_qm/$vmid.conf" ]]; then
+                            ((skipped++))
+                        elif cp "$f" "$target_qm/$vmid.conf" 2>/dev/null; then
+                            ((copied++))
+                        fi
+                    done
+                    msg_ok "$(translate "Guest configs restored:") LXC+QEMU=$copied, $(translate "skipped (already exist)"):$skipped"
+                    if (( copied > 0 )); then
+                        echo -e "${TAB}${BL}$(translate "Use 'pct restore' / 'qmrestore' to recover their disks from your VM backups.")${CL}"
+                    fi
+                fi
+            fi
+        fi
+    fi
+}
+
+
 _rs_apply_menu() {
     local staging_root="$1"
 
     _rs_collect_plan_stats "$staging_root"
     _rs_prompt_zfs_opt_in "$staging_root"
-    _rs_show_plan_summary "$staging_root"
+    # _rs_show_plan_summary intentionally NOT called here — the
+    # essential plan info now appears inside the Complete restore
+    # confirmation dialog (option 1). It's still reachable on demand
+    # from option 6 of this menu.
+
+    # ── Cross-kernel notice (only for bk_older) ───────────────
+    # When the backup was taken on a kernel older than the target,
+    # let the operator know BEFORE they see the mode menu that
+    # Full restore will silently skip kernel-tied paths and that
+    # Custom will present them as blocked. Nothing to click through
+    # for the reverse direction (bk_newer) — those restores go
+    # through as-is because empirical testing shows they work.
+    if [[ "${HB_COMPAT_KERNEL_DIRECTION:-same}" == "bk_older" ]]; then
+        local _bkk="" _cur_k _cur_mm
+        [[ -f "$staging_root/metadata/run_info.env" ]] && \
+            _bkk=$(grep -m1 '^kernel=' "$staging_root/metadata/run_info.env" 2>/dev/null | cut -d= -f2-)
+        _cur_k=$(uname -r 2>/dev/null || echo "?")
+        _cur_mm=$(echo "$_cur_k" | cut -d. -f1-2)
+        dialog --backtitle "ProxMenux" --colors \
+            --title "$(translate "Cross-kernel restore — kernel-tied paths merged, not copied")" \
+            --msgbox "$(translate "This backup was taken on kernel"): \Zb${_bkk}\ZB"$'\n'"$(translate "Target host runs"): \Zb${_cur_k}\ZB"$'\n\n'"\Zb$(translate "Everything restorable in this backup will be restored"):\ZB $(translate "VMs, LXCs, network, /etc/pve, users, cron, packages, drivers, ProxMenux state, etc.")"$'\n\n'"$(translate "Kernel/boot-tied files (boot config, /etc/systemd/system, initramfs config, apt sources, ZFS state, ...) are NOT copied verbatim to keep the target's boot safe. The operator's own tuning inside them (IOMMU cmdline, VFIO IDs, custom quirks, GRUB timeout, ...) is merged into the target's fresh copies automatically via kernel-agnostic merge.")" \
+            20 84
+    fi
 
     while true; do
         local choice
@@ -1589,7 +3700,7 @@ _rs_apply_menu() {
             --title "$(translate "Restore actions")" \
             --menu "\n$(translate "Choose how to continue:")" \
             "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
-            1 "$(translate "Complete restore (guided — recommended)")" \
+            1 "$(translate "Complete restore")" \
             2 "$(translate "Custom restore by components")" \
             3 "$(translate "Export to file (no system changes)")" \
             4 "$(translate "Preview changes (diff)")" \
@@ -1608,8 +3719,11 @@ _rs_apply_menu() {
                 _rs_run_custom_restore "$staging_root" && return 0
                 ;;
             3)
+                # _rs_export_to_file owns its own end-of-flow
+                # (showing result + "Press Enter to return to menu")
+                # so we don't call _rs_finish_flow here — doing so
+                # would queue a second identical prompt.
                 if _rs_export_to_file "$staging_root"; then
-                    _rs_finish_flow
                     return 0
                 fi
                 ;;
@@ -1652,9 +3766,26 @@ restore_menu() {
         esac
 
         if [[ $ok -eq 1 ]] && _rs_check_layout "$staging_root"; then
-            if _rs_apply_menu "$staging_root"; then
-                rm -rf "$staging_root"
-                return 0
+            # Plan NIC remaps FIRST so hb_compat_check knows which
+            # "missing" NICs are actually renames (same MAC, new
+            # ifname after a motherboard swap) and can downgrade
+            # them from FAIL to INFO. Also fills HB_NIC_MAC_CHANGED
+            # for same-name-different-MAC hosts.
+            hb_plan_nic_remaps "$staging_root"
+
+            # Run the compatibility check BEFORE the apply menu so
+            # the operator sees PVE-version / hostname / network /
+            # storage drift up front. This also sets
+            # HB_COMPAT_SAME_HOST, which downstream prompts
+            # (_rs_prompt_zfs_opt_in) read to choose between the
+            # silent same-host path and the loud cross-host path.
+            hb_compat_check "$staging_root"
+
+            if hb_show_compat_report; then
+                if _rs_apply_menu "$staging_root"; then
+                    rm -rf "$staging_root"
+                    return 0
+                fi
             fi
         fi
 
@@ -1662,28 +3793,103 @@ restore_menu() {
     done
 }
 
+# ==========================================================
+# COMMUNITY SCRIPTS LAUNCHERS
+# ==========================================================
+
+_bk_format_menu_item() {
+    local description="$1"
+    local source="$2"
+    local total_width=61
+
+    local spaces_needed=$((total_width - ${#description} - ${#source}))
+    [[ $spaces_needed -lt 3 ]] && spaces_needed=3
+
+    printf '%s%*s%s' "$description" "$spaces_needed" "" "$source"
+}
+
+_bk_community_launcher() {
+    local title="$1" author="$2" repo_url="$3" run_cmd="$4"
+    local body
+    body="\n$(translate "This is an external community script maintained by") ${author}.\n\n"
+    body+="$(translate "For any question, issue or bug report, please use the official repository"):\n"
+    body+="${repo_url}\n\n"
+    body+="$(translate "Consider visiting the repository and supporting the project.")\n\n"
+    body+="$(translate "ProxMenux only acts as a launcher — once the script starts, control leaves ProxMenux.")\n\n"
+    body+="$(translate "Do you want to run the script now?")"
+
+    dialog --backtitle "ProxMenux" --title "$title" --yesno "$body" 20 78
+    if [[ $? -eq 0 ]]; then
+        clear
+        eval "$run_cmd"
+    fi
+}
+
+_bk_community_pve_host_backup() {
+    _bk_community_launcher \
+        "PVE Host Backup — Helper-Scripts" \
+        "Helper-Scripts (community-scripts)" \
+        "https://github.com/community-scripts/ProxmoxVE" \
+        'bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/host-backup.sh)"'
+}
+
+_bk_community_proxmox_toolbox() {
+    _bk_community_launcher \
+        "proxmox_toolbox — Tontonjo" \
+        "Tontonjo" \
+        "https://github.com/Tontonjo/proxmox_toolbox" \
+        'bash <(wget -qO- https://raw.githubusercontent.com/Tontonjo/proxmox_toolbox/main/proxmox_toolbox.sh)'
+}
+
+_bk_community_proxsave() {
+    _bk_community_launcher \
+        "proxsave — tis24dev" \
+        "tis24dev" \
+        "https://github.com/tis24dev/proxsave" \
+        'bash -c "$(curl -fsSL https://raw.githubusercontent.com/tis24dev/proxsave/main/install.sh)"'
+}
+
+
 # ==========================================================
 # MAIN MENU
 # ==========================================================
 main_menu() {
     while true; do
-        show_proxmenux_logo
         local choice
-        choice=$(dialog --backtitle "ProxMenux" \
+
+        choice=$(dialog --colors --backtitle "ProxMenux" \
             --title "$(translate "Host Config Backup / Restore")" \
             --menu "\n$(translate "Select operation:")" \
-            "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
-            1  "$(translate "Backup host configuration")" \
-            2  "$(translate "Restore host configuration")" \
-            0  "$(translate "Return")" \
+            24 84 16 \
+            1   "$(_bk_format_menu_item "$(translate "Backup host configuration")" "")" \
+            2   "$(_bk_format_menu_item "$(translate "Restore host configuration")" "")" \
+            ""  " " \
+            3   "$(_bk_format_menu_item "$(translate "Manage custom paths (add / remove your folders)")" "")" \
+            4   "$(_bk_format_menu_item "$(translate "Scheduled backups and retention policies")" "")" \
+            5   "$(_bk_format_menu_item "$(translate "Configure backup destinations (PBS, Borg, local)")" "")" \
+            ""  " " \
+            ""  "\Z4───────────────────── Community Scripts ─────────────────────\Zn" \
+            6   "$(_bk_format_menu_item "PVE Host Backup" "Helper-Scripts")" \
+            7   "$(_bk_format_menu_item "proxmox_toolbox" "Tontonjo")" \
+            8   "$(_bk_format_menu_item "proxsave" "tis24dev")" \
+            ""  " " \
+            0   "$(_bk_format_menu_item "$(translate "Return")" "")" \
             3>&1 1>&2 2>&3) || break
 
         case "$choice" in
-            1) backup_menu  ;;
+            1) backup_menu ;;
             2) restore_menu ;;
+            3) _bk_manage_extra_paths ;;
+            4) _bk_scheduler ;;
+            5) _bk_manage_destinations ;;
+            6) _bk_community_pve_host_backup ;;
+            7) _bk_community_proxmox_toolbox ;;
+            8) _bk_community_proxsave ;;
             0) break ;;
         esac
     done
 }
 
-main_menu
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    main_menu
+fi
\ No newline at end of file
diff --git a/scripts/backup_restore/backup_host2.sh b/scripts/backup_restore/backup_host2.sh
deleted file mode 100644
index abe86ece..00000000
--- a/scripts/backup_restore/backup_host2.sh
+++ /dev/null
@@ -1,1061 +0,0 @@
-#!/usr/bin/env bash
-
-# Configuration ============================================
-LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
-BASE_DIR="/usr/local/share/proxmenux"
-UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
-
-if [[ -f "$UTILS_FILE" ]]; then
-    source "$UTILS_FILE"
-fi
-load_language
-initialize_cache
-# ==========================================================
-
-
-get_external_backup_mount_point() {
-    local BACKUP_MOUNT_FILE="/usr/local/share/proxmenux/last_backup_mount.txt"
-    local STORAGE_REPO="$LOCAL_SCRIPTS/backup_restore"
-    local MOUNT_POINT
-
-    if [[ -f "$BACKUP_MOUNT_FILE" ]]; then
-        MOUNT_POINT=$(head -n1 "$BACKUP_MOUNT_FILE" | tr -d '\r\n' | xargs)
-        >&2 echo "DEBUG: Valor MOUNT_POINT='$MOUNT_POINT'"
-        if [[ ! -d "$MOUNT_POINT" ]]; then
-            msg_error "Mount point does not exist: $MOUNT_POINT"
-            rm -f "$BACKUP_MOUNT_FILE"
-            return 1
-        fi
-        if ! mountpoint -q "$MOUNT_POINT"; then
-            msg_error "Mount point is not mounted: $MOUNT_POINT"
-            rm -f "$BACKUP_MOUNT_FILE"
-            return 1
-        fi
- 
-        echo "$MOUNT_POINT"
-        return 0
-    else
-       source "$STORAGE_REPO/mount_disk_host_bk.sh"
-       MOUNT_POINT=$(mount_disk_host_bk)
-        [[ -z "$MOUNT_POINT" ]] && msg_error "$(translate "No disk mounted.")" && return 1
-        echo "$MOUNT_POINT"
-        return 0
-    fi
-}
-
-
-
-# === Host Backup Main Menu ===
-host_backup_menu() {
-    while true; do
-        local CHOICE
-        CHOICE=$(dialog --backtitle "ProxMenux" \
-            --title "$(translate 'Host Backup')" \
-            --menu "\n$(translate 'Select backup option:')" 22 70 12 \
-            ""         "$(translate '--- FULL BACKUP ---')" \
-            1 "$(translate 'Full backup to Proxmox Backup Server (PBS)')" \
-            2 "$(translate 'Full backup with BorgBackup')" \
-            3 "$(translate 'Full backup to local .tar.gz')" \
-            ""         "$(translate '--- CUSTOM BACKUP ---')" \
-            4 "$(translate 'Custom backup to PBS')" \
-            5 "$(translate 'Custom backup with BorgBackup')" \
-            6 "$(translate 'Custom backup to local .tar.gz')" \
-            0 "$(translate 'Return')" \
-            3>&1 1>&2 2>&3) || return 0
-
-        case "$CHOICE" in
-            1) backup_full_pbs_root ;;
-            2) backup_with_borg "/boot/efi /etc/pve /etc/network /var/lib/pve-cluster /root /etc/ssh /home /usr/local/bin /etc/cron.d /etc/systemd/system /var/lib/vz" ;;
-            3) backup_to_local_tar "/boot/efi /etc/pve /etc/network /var/lib/pve-cluster /root /etc/ssh /home /usr/local/bin /etc/cron.d /etc/systemd/system /var/lib/vz" ;;
-            4) custom_backup_menu backup_to_pbs ;;
-            5) custom_backup_menu backup_with_borg ;;
-            6) custom_backup_menu backup_to_local_tar ;;
-            0) break ;;
-        esac
-    done
-}
-
-
-
-# === Menu checklist for custom backup ===
-custom_backup_menu() {
-    declare -A BACKUP_PATHS=(
-        [etc-pve]="/etc/pve"
-        [etc-network]="/etc/network"
-        [var-lib-pve-cluster]="/var/lib/pve-cluster"
-        [root-dir]="/root"
-        [etc-ssh]="/etc/ssh"
-        [home]="/home"
-        [local-bin]="/usr/local/bin"
-        [cron]="/etc/cron.d"
-        [custom-systemd]="/etc/systemd/system"
-        [var-lib-vz]="/var/lib/vz"
-    )
-    local CHECKLIST_OPTIONS=()
-    for KEY in "${!BACKUP_PATHS[@]}"; do
-        DIR="${BACKUP_PATHS[$KEY]}"
-        CHECKLIST_OPTIONS+=("$KEY" "$DIR" "off")
-    done
-
-    SELECTED_KEYS=$(dialog --separate-output --checklist \
-        "$(translate 'Select directories to backup:')" 22 70 12 \
-        "${CHECKLIST_OPTIONS[@]}" \
-        3>&1 1>&2 2>&3) || return 1
-
-    local BACKUP_DIRS=()
-    for KEY in $SELECTED_KEYS; do
-        BACKUP_DIRS+=("${BACKUP_PATHS[$KEY]}")
-    done
-
-
-#    "$1" "${BACKUP_DIRS[*]}"
-     "$1" "${BACKUP_DIRS[@]}"
-
-
-}
-
-
-
-
-
-
-
-
-
-
-
-configure_pbs_repository() {
-local PBS_REPO_FILE="/usr/local/share/proxmenux/pbs-repo.conf"
-local PBS_PASS_FILE="/usr/local/share/proxmenux/pbs-pass.txt"
-local PBS_TOKEN_FILE="/usr/local/share/proxmenux/pbs-token.txt"
-local PBS_MANUAL_CONFIGS="/usr/local/share/proxmenux/pbs-manual-configs.txt"
-
-[[ ! -f "$PBS_MANUAL_CONFIGS" ]] && touch "$PBS_MANUAL_CONFIGS"
-
-local PBS_CONFIGS=()
-local PBS_SOURCES=()
-local PBS_USERNAMES=()
-
-if [[ -f "/etc/pve/storage.cfg" ]]; then
-    local current_pbs="" server="" datastore="" username=""
-    
-    while IFS= read -r line; do
-        if [[ $line =~ ^pbs:\ (.+)$ ]]; then
-            if [[ -n "$current_pbs" && -n "$server" && -n "$datastore" && -n "$username" ]]; then
-                PBS_CONFIGS+=("$current_pbs|$username@$server:$datastore")
-                PBS_SOURCES+=("proxmox|$current_pbs")
-                PBS_USERNAMES+=("$username")
-            fi
-            current_pbs="${BASH_REMATCH[1]}"
-            server="" datastore="" username=""
-        elif [[ -n "$current_pbs" ]]; then
-            if [[ $line =~ ^[[:space:]]*server[[:space:]]+(.+)$ ]]; then
-                server="${BASH_REMATCH[1]}"
-            elif [[ $line =~ ^[[:space:]]*datastore[[:space:]]+(.+)$ ]]; then
-                datastore="${BASH_REMATCH[1]}"
-            elif [[ $line =~ ^[[:space:]]*username[[:space:]]+(.+)$ ]]; then
-                username="${BASH_REMATCH[1]}"
-            elif [[ $line =~ ^[a-zA-Z]+: ]]; then
-                if [[ -n "$server" && -n "$datastore" && -n "$username" ]]; then
-                    PBS_CONFIGS+=("$current_pbs|$username@$server:$datastore")
-                    PBS_SOURCES+=("proxmox|$current_pbs")
-                    PBS_USERNAMES+=("$username")
-                fi
-                current_pbs=""
-            fi
-        fi
-    done < "/etc/pve/storage.cfg"
-    
-    if [[ -n "$current_pbs" && -n "$server" && -n "$datastore" && -n "$username" ]]; then
-        PBS_CONFIGS+=("$current_pbs|$username@$server:$datastore")
-        PBS_SOURCES+=("proxmox|$current_pbs")
-        PBS_USERNAMES+=("$username")
-    fi
-fi
-
-if [[ -f "$PBS_MANUAL_CONFIGS" ]]; then
-    while IFS= read -r line; do
-        if [[ -n "$line" ]]; then
-            PBS_CONFIGS+=("$line")
-            local name="${line%%|*}"
-            PBS_SOURCES+=("manual|$name")
-            PBS_USERNAMES+=("")
-        fi
-    done < "$PBS_MANUAL_CONFIGS"
-fi
-
-local menu_options=()
-local i=1
-
-for j in "${!PBS_CONFIGS[@]}"; do
-    local config="${PBS_CONFIGS[$j]}"
-    local source="${PBS_SOURCES[$j]}"
-    local name="${config%%|*}"
-    local repo="${config##*|}"
-    local source_type="${source%%|*}"
-
-    if [[ "$source_type" == "proxmox" ]]; then
-        menu_options+=("$i" " $name ($repo) [Proxmox]")
-    else
-        menu_options+=("$i" " $name ($repo) [Manual]")
-    fi
-    ((i++))
-done
-
-menu_options+=("" "")
-menu_options+=("$i" "\Z4\Zb $(translate 'Configure new PBS')\Zn")
-local choice
-choice=$(dialog --colors --backtitle "ProxMenux" --title "PBS Server Selection" \
---menu "$(translate 'Select PBS server for this backup:')" 22 70 12 "${menu_options[@]}" 3>&1 1>&2 2>&3) || return 1
-
-if [[ $choice -eq $i ]]; then
-    configure_pbs_manually || return 1
-else
-    local selected_config="${PBS_CONFIGS[$((choice-1))]}"
-    local selected_source="${PBS_SOURCES[$((choice-1))]}"
-    local selected_username="${PBS_USERNAMES[$((choice-1))]}"
-    local pbs_name="${selected_config%%|*}"
-    local source_type="${selected_source%%|*}"
-    PBS_REPO="${selected_config##*|}"
-    
-    {
-        mkdir -p "$(dirname "$PBS_REPO_FILE")"
-        echo "$PBS_REPO" > "$PBS_REPO_FILE"
-    } >/dev/null 2>&1
-    
-    local password_found=false
-    if [[ "$source_type" == "proxmox" ]]; then
-        local password_file="/etc/pve/priv/storage/${pbs_name}.pw"
-        
-        if [[ -f "$password_file" ]]; then
-            local auth_content
-            auth_content=$(<"$password_file")
-            
-
-            [[ -f "$PBS_PASS_FILE" ]] && rm "$PBS_PASS_FILE"
-            [[ -f "$PBS_TOKEN_FILE" ]] && rm "$PBS_TOKEN_FILE"
-            
-
-            if [[ "$selected_username" == *"@pbs!"* ]]; then
-
-                echo "$auth_content" > "$PBS_PASS_FILE"
-                chmod 600 "$PBS_PASS_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') PBS Cloud Token
-$(translate 'Token ID:') $selected_username" 15 80
-            elif [[ "$auth_content" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ ]]; then
-                local full_token="${selected_username}:${auth_content}"
-                echo "$full_token" > "$PBS_TOKEN_FILE"
-                chmod 600 "$PBS_TOKEN_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') API Token
-$(translate 'Token ID:') $selected_username" 15 80
-            elif [[ "$auth_content" == *":"* ]]; then
-                echo "$auth_content" > "$PBS_TOKEN_FILE"
-                chmod 600 "$PBS_TOKEN_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') API Token (Complete)" 12 80
-            else
-                echo "$auth_content" > "$PBS_PASS_FILE"
-                chmod 600 "$PBS_PASS_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') Password" 12 80
-            fi
-        fi
-    else
-        local manual_pass_file="/usr/local/share/proxmenux/pbs-pass-${pbs_name}.txt"
-        if [[ -f "$manual_pass_file" ]]; then
-            [[ -f "$PBS_TOKEN_FILE" ]] && rm "$PBS_TOKEN_FILE"
-            
-            {
-                cp "$manual_pass_file" "$PBS_PASS_FILE"
-                chmod 600 "$PBS_PASS_FILE"
-            } >/dev/null 2>&1
-            password_found=true
-            dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using manual PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Password:') $(translate 'Previously saved')" 12 80
-        fi
-    fi
-    
-    if ! $password_found; then
-        dialog --backtitle "ProxMenux" --title "Password Required" --msgbox "$(translate 'Password not found for:') $pbs_name
-$(translate 'Please enter the password.')" 10 60
-        get_pbs_password "$pbs_name" || return 1
-    fi
-    
-    clear
-fi
-}
-
-
-
-
-
-
-
-
-
-
-# ========== PBS BACKUP ==========
-backup_full_pbs_root() {
-    local HOSTNAME PBS_REPO PBS_KEY_FILE PBS_PASS_FILE PBS_TOKEN_FILE PBS_ENCRYPTION_PASS_FILE ENCRYPT_OPT=""
-    HOSTNAME=$(hostname)
-    
-
-    local PBS_REPO_FILE="/usr/local/share/proxmenux/pbs-repo.conf"
-    PBS_KEY_FILE="/usr/local/share/proxmenux/pbs-key.conf"
-    PBS_PASS_FILE="/usr/local/share/proxmenux/pbs-pass.txt"
-    PBS_TOKEN_FILE="/usr/local/share/proxmenux/pbs-token.txt"
-    PBS_ENCRYPTION_PASS_FILE="/usr/local/share/proxmenux/pbs-encryption-pass.txt"
-    LOGFILE="/tmp/pbs-backup-${HOSTNAME}.log"
-
-
-    configure_pbs_repository || return 1
-
-    if [[ ! -f "$PBS_REPO_FILE" ]]; then
-        msg_error "$(translate "Failed to configure PBS connection")"
-        sleep 3
-        return 1
-    fi
-    PBS_REPO=$(<"$PBS_REPO_FILE")
-
-
-    unset PBS_PASSWORD PBS_API_TOKEN PBS_API_TOKEN_ID PBS_API_TOKEN_SECRET PBS_FINGERPRINT
-
-
-    local AUTH_TYPE="password"  
-    local PBS_AUTH_VALUE=""
-    
-    if [[ "$PBS_REPO" == *"@pbs!"* ]]; then
-
-        AUTH_TYPE="pbs_cloud"
-        [[ -f "$PBS_PASS_FILE" ]] && PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    elif [[ -f "$PBS_TOKEN_FILE" ]]; then
-
-        AUTH_TYPE="token"
-        PBS_AUTH_VALUE=$(<"$PBS_TOKEN_FILE")
-    elif [[ -f "$PBS_PASS_FILE" ]]; then
-
-        AUTH_TYPE="password"
-        PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    else
-        msg_error "$(translate "No PBS authentication found!")"
-        sleep 3
-        return 1
-    fi
-
-  
-    dialog --backtitle "ProxMenux" --title "Encryption" --yesno "$(translate 'Do you want to encrypt the backup?')" 8 60
-    if [[ $? -eq 0 ]]; then
-
-        if [[ ! -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-            while true; do
-                PBS_KEY_PASS=$(dialog --backtitle "ProxMenux" --title "Encryption Password" --insecure --passwordbox "$(translate 'Enter encryption password (different from PBS login):')" 12 70 "" 3>&1 1>&2 2>&3) || return 1
-                PBS_KEY_PASS2=$(dialog --backtitle "ProxMenux" --title "Encryption Password" --insecure --passwordbox "$(translate 'Confirm encryption password:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                
-                if [[ "$PBS_KEY_PASS" == "$PBS_KEY_PASS2" ]]; then
-                    break
-                else
-                    dialog --backtitle "ProxMenux" --title "Error" --msgbox "$(translate 'Passwords do not match! Please try again.')" 8 50
-                fi
-            done
-
-
-            {
-                echo "$PBS_KEY_PASS" > "$PBS_ENCRYPTION_PASS_FILE"
-                chmod 600 "$PBS_ENCRYPTION_PASS_FILE"
-            } >/dev/null 2>&1
-            
-            dialog --backtitle "ProxMenux" --title "Success" --msgbox "$(translate 'Encryption password saved successfully!')" 8 50
-        fi
-        
-
-        if [[ ! -f "$PBS_KEY_FILE" ]]; then
-            PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-            
-            dialog --backtitle "ProxMenux" --title "Encryption" --infobox "$(translate 'Creating encryption key...')" 5 50
-            
-            expect -c "
-            set timeout 30
-            spawn proxmox-backup-client key create \"$PBS_KEY_FILE\"
-            expect {
-                \"Encryption Key Password:\" {
-                    send \"$PBS_ENCRYPTION_PASS\r\"
-                    exp_continue
-                }
-                \"Verify Password:\" {
-                    send \"$PBS_ENCRYPTION_PASS\r\"
-                    exp_continue
-                }
-                eof
-            }
-            " >/dev/null 2>&1
-
-            if [[ ! -f "$PBS_KEY_FILE" ]]; then
-                dialog --backtitle "ProxMenux" --title "Error" --msgbox "$(translate 'Error creating encryption key.')" 8 40
-                return 1
-            fi
-            
-            dialog --backtitle "ProxMenux" --title "Important" --msgbox "$(translate 'IMPORTANT: Save the key file. Without it you will not be able to restore your backups!')\n\n$(translate 'Key file location:') $PBS_KEY_FILE" 12 70
-        fi
-        ENCRYPT_OPT="--keyfile $PBS_KEY_FILE"
-    else
-        ENCRYPT_OPT=""
-    fi
-
-
-    clear
-    show_proxmenux_logo
-    echo -e
-    msg_info2 "$(translate "Starting backup to PBS")"
-    echo -e
-    echo -e "${BL}$(translate "PBS Repository:")${WHITE} $PBS_REPO${RESET}"
-    echo -e "${BL}$(translate "Backup ID:")${WHITE} $HOSTNAME${RESET}"
-    echo -e "${BL}$(translate "Included:")${WHITE} /boot/efi /etc/pve (all root)${RESET}"
-    echo -e "${BL}$(translate "Encryption:")${WHITE} $([[ -n "$ENCRYPT_OPT" ]] && echo "Enabled" || echo "Disabled")${RESET}"
-    
-
-    case "$AUTH_TYPE" in
-        "pbs_cloud") echo -e "${BL}$(translate "Authentication:")${WHITE} PBS Cloud Token${RESET}" ;;
-        "token") echo -e "${BL}$(translate "Authentication:")${WHITE} API Token${RESET}" ;;
-        "password") echo -e "${BL}$(translate "Authentication:")${WHITE} Password${RESET}" ;;
-    esac
-    
-    echo -e "${BL}$(translate "Log file:")${WHITE} $LOGFILE${RESET}"
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}-------------------------------${RESET}"
-    echo ""
-
-
-    local backup_cmd="proxmox-backup-client backup --include-dev /boot/efi --include-dev /etc/pve root-${HOSTNAME}.pxar:/ --repository \"$PBS_REPO\" $ENCRYPT_OPT --backup-type host --backup-id \"$HOSTNAME\" --backup-time \"$(date +%s)\""
-    local backup_result=0
-    
-    case "$AUTH_TYPE" in
-        "pbs_cloud")
-
-            if [[ -n "$ENCRYPT_OPT" ]]; then
-                PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                echo "$(translate "Starting encrypted full backup with PBS Cloud...")"
-                echo ""
-                
-                env -i PBS_PASSWORD="$PBS_AUTH_VALUE" expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_ENCRYPTION_PASS\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            else
-
-                echo "$(translate "Starting unencrypted full backup with PBS Cloud...")"
-                echo ""
-                env -i PBS_PASSWORD="$PBS_AUTH_VALUE" bash -c "$backup_cmd" | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            fi
-            ;;
-            
-        "token")
-
-            if [[ -n "$ENCRYPT_OPT" ]]; then
-                PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                echo "$(translate "Starting encrypted full backup with API Token...")"
-                echo ""
-                
-                env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_ENCRYPTION_PASS\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            else
-                echo "$(translate "Starting unencrypted full backup with API Token...")"
-                echo ""
-                env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" bash -c "$backup_cmd" | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            fi
-            ;;
-            
-        "password")
-
-            if [[ -n "$ENCRYPT_OPT" ]]; then
-                PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                echo "$(translate "Starting encrypted full backup with password...")"
-                echo ""
-                
-                env -i expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    -re \"Password for .*:\" {
-                        send \"$PBS_AUTH_VALUE\r\"
-                        exp_continue
-                    }
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_ENCRYPTION_PASS\r\"
-                        exp_continue
-                    }
-                    -re \"Are you sure you want to continue connecting.*\" {
-                        send \"y\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            else
-            
-                echo "$(translate "Starting unencrypted full backup with password...")"
-                echo ""
-                
-                env -i expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    -re \"Password for .*:\" {
-                        send \"$PBS_AUTH_VALUE\r\"
-                        exp_continue
-                    }
-                    -re \"Are you sure you want to continue connecting.*\" {
-                        send \"y\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            fi
-            ;;
-    esac
-
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-    if [[ $backup_result -eq 0 ]]; then
-        msg_ok "$(translate "Full backup process completed successfully")"
-    else
-        msg_error "$(translate "Backup process finished with errors")"
-    fi
-    
-    echo ""
-    msg_success "$(translate "Press Enter to return to the main menu...")"
-    read -r
-}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-backup_to_pbs() {
-    local HOSTNAME TIMESTAMP SNAPSHOT
-    HOSTNAME=$(hostname)
-    TIMESTAMP=$(date +%Y-%m-%d_%H-%M)
-    SNAPSHOT="${HOSTNAME}-${TIMESTAMP}"
-
-    local PBS_REPO_FILE="/usr/local/share/proxmenux/pbs-repo.conf"
-    local PBS_KEY_FILE="/usr/local/share/proxmenux/pbs-key.conf"
-    local PBS_PASS_FILE="/usr/local/share/proxmenux/pbs-pass.txt"
-    local PBS_TOKEN_FILE="/usr/local/share/proxmenux/pbs-token.txt"
-    local PBS_ENCRYPTION_PASS_FILE="/usr/local/share/proxmenux/pbs-encryption-pass.txt"
-    local PBS_REPO ENCRYPT_OPT USE_ENCRYPTION
-    local PBS_KEY_PASS PBS_REPO_PASS
-
-    configure_pbs_repository || return 1
-    PBS_REPO=$(<"$PBS_REPO_FILE")
-
-
-    unset PBS_PASSWORD PBS_API_TOKEN PBS_API_TOKEN_ID PBS_API_TOKEN_SECRET PBS_FINGERPRINT
-
-    USE_ENCRYPTION=false
-    dialog --backtitle "ProxMenux" --yesno "$(translate 'Do you want to encrypt the backup?')" 8 60
-    [[ $? -eq 0 ]] && USE_ENCRYPTION=true
-
-    if $USE_ENCRYPTION && ! command -v expect >/dev/null 2>&1; then
-        apt-get update -qq >/dev/null 2>&1
-        apt-get install -y expect >/dev/null 2>&1
-    fi
-
-    if [[ "$#" -lt 1 ]]; then
-        clear
-        show_proxmenux_logo
-        msg_error "$(translate "No directories specified for backup.")"
-        sleep 2 
-        return 1
-    fi
-
-    local TOTAL="$#"
-    local COUNT=1
-
-
-    local AUTH_TYPE="password"  
-    local PBS_AUTH_VALUE=""
-    
-    if [[ "$PBS_REPO" == *"@pbs!"* ]]; then
-
-        AUTH_TYPE="pbs_cloud"
-        [[ -f "$PBS_PASS_FILE" ]] && PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    elif [[ -f "$PBS_TOKEN_FILE" ]]; then
-
-        AUTH_TYPE="token"
-        PBS_AUTH_VALUE=$(<"$PBS_TOKEN_FILE")
-    elif [[ -f "$PBS_PASS_FILE" ]]; then
-
-        AUTH_TYPE="password"
-        PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    else
-        msg_error "$(translate "No PBS authentication found!")"
-        return 1
-    fi
-
-    for dir in "$@"; do
-        local SAFE_NAME SAFE_ID PXAR_NAME
-        SAFE_NAME=$(basename "$dir" | tr '.-/' '_')
-        PXAR_NAME="root-custom-${SAFE_NAME}-${SNAPSHOT}.pxar"
-        SAFE_ID="custom-${HOSTNAME}-${SAFE_NAME}"
-
-        msg_info2 "$(translate "[$COUNT/$TOTAL] Backing up") $dir $(translate "as") $PXAR_NAME"
-
-        ENCRYPT_OPT=""
-
-        if $USE_ENCRYPTION; then
-            if [[ -f "$PBS_KEY_FILE" ]]; then
-                ENCRYPT_OPT="--keyfile $PBS_KEY_FILE"
-            else
-                while true; do
-                    PBS_KEY_PASS=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Enter encryption password (different from PBS login):')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                    PBS_KEY_PASS2=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Confirm encryption password:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                    
-                    if [[ "$PBS_KEY_PASS" == "$PBS_KEY_PASS2" ]]; then
-                        break
-                    else
-                        dialog --backtitle "ProxMenux" --msgbox "$(translate 'Passwords do not match! Please try again.')" 8 50
-                    fi
-                done
-
-                {
-                    echo "$PBS_KEY_PASS" > "$PBS_ENCRYPTION_PASS_FILE"
-                    chmod 600 "$PBS_ENCRYPTION_PASS_FILE"
-                } >/dev/null 2>&1
-
-                expect -c "
-                set timeout 30
-                spawn proxmox-backup-client key create \"$PBS_KEY_FILE\"
-                expect {
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_KEY_PASS\r\"
-                        exp_continue
-                    }
-                    \"Verify Password:\" {
-                        send \"$PBS_KEY_PASS\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " >/dev/null 2>&1
-
-                if [[ ! -f "$PBS_KEY_FILE" ]]; then
-                    dialog --backtitle "ProxMenux" --msgbox "$(translate 'Error creating encryption key.')" 8 40
-                    return 1
-                fi
-                ENCRYPT_OPT="--keyfile $PBS_KEY_FILE"
-                dialog --backtitle "ProxMenux" --msgbox "$(translate 'Encryption key generated. Save it in a safe place!')" 10 60
-            fi
-        fi
-
-        clear
-        show_proxmenux_logo
-        echo -e
-        msg_info2 "$(translate "Starting backup to PBS")"
-        TOTAL_SIZE=$(du -cb "$@" | awk '/total$/ {print $1}')
-        TOTAL_SIZE_GB=$(awk "BEGIN {printf \"%.2f\", $TOTAL_SIZE/1024/1024/1024}")
-        echo -e
-        echo -e "${BL}$(translate "PBS Repository:")${WHITE} $PBS_REPO${RESET}"
-        echo -e "${BL}$(translate "Backup ID:")${WHITE} $HOSTNAME${RESET}"
-        echo -e "${BL}$(translate "Encryption:")${WHITE} $([[ -n "$ENCRYPT_OPT" ]] && echo "Enabled" || echo "Disabled")${RESET}"
-        
-        case "$AUTH_TYPE" in
-            "pbs_cloud") echo -e "${BL}$(translate "Authentication:")${WHITE} PBS Cloud Token${RESET}" ;;
-            "token") echo -e "${BL}$(translate "Authentication:")${WHITE} API Token${RESET}" ;;
-            "password") echo -e "${BL}$(translate "Authentication:")${WHITE} Password${RESET}" ;;
-        esac
-        
-        echo -e "${BL}$(translate "Included directories:")${WHITE} $*${RESET}"
-        echo -e "${BL}$(translate "Total size:")${WHITE} ${TOTAL_SIZE_GB} GB${RESET}"
-        echo -e "${BOLD}${NEON_PURPLE_BLUE}-------------------------------${RESET}"
-
-
-        local backup_cmd="proxmox-backup-client backup \"${PXAR_NAME}:$dir\" --repository \"$PBS_REPO\" $ENCRYPT_OPT --backup-type host --backup-id \"$SAFE_ID\" --backup-time \"$(date +%s)\""
-        
-        case "$AUTH_TYPE" in
-            "pbs_cloud")
-
-                if $USE_ENCRYPTION && [[ -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-                    PBS_KEY_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                    env -i PBS_PASSWORD="$PBS_AUTH_VALUE" expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        \"Encryption Key Password:\" {
-                            send \"$PBS_KEY_PASS\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                else
-                    env -i PBS_PASSWORD="$PBS_AUTH_VALUE" bash -c "$backup_cmd"
-                fi
-                ;;
-                
-            "token")
-
-                if $USE_ENCRYPTION && [[ -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-                    PBS_KEY_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                    env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        \"Encryption Key Password:\" {
-                            send \"$PBS_KEY_PASS\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                else
-                    env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" bash -c "$backup_cmd"
-                fi
-                ;;
-                
-            "password")
-
-                if $USE_ENCRYPTION && [[ -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-                    PBS_KEY_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                    env -i expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        -re \"Password for .*:\" {
-                            send \"$PBS_AUTH_VALUE\r\"
-                            exp_continue
-                        }
-                        \"Encryption Key Password:\" {
-                            send \"$PBS_KEY_PASS\r\"
-                            exp_continue
-                        }
-                        -re \"Are you sure you want to continue connecting.*\" {
-                            send \"y\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                else
-                    env -i expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        -re \"Password for .*:\" {
-                            send \"$PBS_AUTH_VALUE\r\"
-                            exp_continue
-                        }
-                        -re \"Are you sure you want to continue connecting.*\" {
-                            send \"y\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                fi
-                ;;
-        esac
-
-        COUNT=$((COUNT+1))
-    done
-
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-    msg_ok "$(translate "Backup process finished.")"
-    echo ""
-    msg_success "$(translate "Press Enter to return to the main menu...")"
-    read -r
-}
-# ===============================
-
-
-
-
-
-
-
-# ========== BORGBACKUP ==========
-backup_with_borg() {
-#    local SRC="$1"
-    local BORG_APPIMAGE="/usr/local/share/proxmenux/borg"
-    local LOGFILE="/tmp/borg-backup.log"
-    local DEST
-    local TYPE
-    local ENCRYPT_OPT=""
-    local BORG_KEY
-
-    if [[ ! -x "$BORG_APPIMAGE" ]]; then
-        clear
-        show_proxmenux_logo
-        msg_info "$(translate "BorgBackup not found. Downloading AppImage...")"
-        mkdir -p /usr/local/share/proxmenux
-        wget -qO "$BORG_APPIMAGE" "https://github.com/borgbackup/borg/releases/download/1.2.8/borg-linux64"
-        chmod +x "$BORG_APPIMAGE"
-        msg_ok "$(translate "BorgBackup downloaded and ready.")"
-    fi
-
-
-    TYPE=$(dialog --backtitle "ProxMenux" --menu "$(translate 'Select Borg backup destination:')" 15 60 3 \
-        "local"   "$(translate 'Local directory')" \
-        "usb"     "$(translate 'Internal/External dedicated disk')" \
-        "remote"  "$(translate 'Remote server')" \
-        3>&1 1>&2 2>&3) || return 1
-
-    if [[ "$TYPE" == "local" ]]; then
-        DEST=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter local directory for backup:')" 10 60 "/backup/borgbackup" 3>&1 1>&2 2>&3) || return 1
-        mkdir -p "$DEST"
-    elif [[ "$TYPE" == "usb" ]]; then
-
-    while true; do
-        BASE_DEST=$(get_external_backup_mount_point)
-        if [[ -z "$BASE_DEST" ]]; then
-            dialog --backtitle "ProxMenux" --yesno "$(translate 'No external disk detected or mounted. Would you like to retry?')" 8 60
-            [[ $? -eq 0 ]] && continue
-            return 1
-        fi
-
-        DEST="$BASE_DEST/borgbackup"
-        mkdir -p "$DEST"
-
-        DISK_DEV=$(df "$BASE_DEST" | awk 'NR==2{print $1}')
-        PKNAME=$(lsblk -no PKNAME "$DISK_DEV" 2>/dev/null)
-        [[ -z "$PKNAME" ]] && PKNAME=$(basename "$DISK_DEV" | sed 's/[0-9]*$//')
-        if [[ -n "$PKNAME" && -b /dev/$PKNAME ]]; then
-            DISK_MODEL=$(lsblk -no MODEL "/dev/$PKNAME")
-        else
-            DISK_MODEL="(unknown)"
-        fi
-        FREE_SPACE=$(df -h "$BASE_DEST" | awk 'NR==2{print $4}')
-
-            dialog --backtitle "ProxMenux" \
-                --title "$(translate "Dedicated Backup Disk")" \
-                --yesno "\n$(translate "Mount point:") $DEST\n\n\
-        $(translate "Disk model:") $DISK_MODEL\n\
-        $(translate "Available space:") $FREE_SPACE\n\n\
-        $(translate "Use this disk for backup?")" 12 70
-
-        if [[ $? -eq 0 ]]; then
-            break
-        else
-            return 1
-        fi
-    done
-
-
-    elif [[ "$TYPE" == "remote" ]]; then
-        REMOTE_USER=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter SSH user for remote:')" 10 60 "root" 3>&1 1>&2 2>&3) || return 1
-        REMOTE_HOST=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter SSH host:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-        REMOTE_PATH=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter remote path:')" 10 60 "/backup/borgbackup" 3>&1 1>&2 2>&3) || return 1
-        DEST="ssh://$REMOTE_USER@$REMOTE_HOST:$REMOTE_PATH"
-    fi
-
-
-    dialog --backtitle "ProxMenux" --yesno "$(translate 'Do you want to encrypt the backup?')" 8 60
-    if [[ $? -eq 0 ]]; then
-        BORG_KEY=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter Borg encryption passphrase (will be saved):')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-        ENCRYPT_OPT="--encryption=repokey"
-        export BORG_PASSPHRASE="$BORG_KEY"
-    else
-        ENCRYPT_OPT="--encryption=none"
-    fi
-
-    if [[ "$TYPE" == "local" || "$TYPE" == "usb" ]]; then
-        if [[ ! -f "$DEST/config" ]]; then
-            "$BORG_APPIMAGE" init $ENCRYPT_OPT "$DEST"
-            if [[ $? -ne 0 ]]; then
-                clear
-                show_proxmenux_logo
-                msg_error "$(translate "Failed to initialize Borg repo at") $DEST"
-                sleep 5
-                return 1
-            fi
-        fi
-    fi
-
-
-    dialog --backtitle "ProxMenux" --msgbox "$(translate 'Borg backup will start now. This may take a while.')" 8 40
-
-    clear
-    show_proxmenux_logo
-    msg_info2 "$(translate "Starting backup with BorgBackup...")"
-    echo -e
-
-    TOTAL_SIZE=$(du -cb "$@" | awk '/total$/ {print $1}')
-    TOTAL_SIZE_GB=$(awk "BEGIN {printf \"%.2f\", $TOTAL_SIZE/1024/1024/1024}")
-
-    echo -e "${BL}$(translate "Included directories:")${WHITE} $*${RESET}"
-    echo -e "${BL}$(translate "Total size:")${WHITE} ${TOTAL_SIZE_GB} GB${RESET}"
-
-
-    # 6. Lanzar el backup y guardar log
-#    "$BORG_APPIMAGE" create --progress "$DEST"::"root-$(hostname)-$(date +%Y%m%d_%H%M)" $SRC 2>&1 | tee "$LOGFILE"
-
-    "$BORG_APPIMAGE" create --progress "$DEST"::"root-$(hostname)-$(date +%Y%m%d_%H%M)" "$@" 2>&1 | tee "$LOGFILE"
-
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-    msg_ok "$(translate "Backup process finished.")"
-    echo
-    msg_success "$(translate "Press Enter to return to the main menu...")"
-    read -r
-}
-# ===============================
-
-
-
-
-# ========== LOCAL TAR ==========
-backup_to_local_tar() {
-#    local SRC="$1"
-    local TYPE
-    local DEST
-    local LOGFILE="/tmp/tar-backup.log"
-
-
-if ! command -v pv &>/dev/null; then
-    apt-get update -qq && apt-get install -y pv >/dev/null 2>&1
-fi
-
-
-
-    TYPE=$(dialog --backtitle "ProxMenux"  --menu "$(translate 'Select backup destination:')" 15 60 2 \
-        "local" "$(translate 'Local directory')" \
-        "usb"   "$(translate 'Internal/External dedicated disk')" \
-        3>&1 1>&2 2>&3) || return 1
-
-    if [[ "$TYPE" == "local" ]]; then
-        DEST=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter directory for backup:')" 10 60 "/backup" 3>&1 1>&2 2>&3) || return 1
-
-        mkdir -p "$DEST"
-
-
-else
-
-
-while true; do
-    DEST=$(get_external_backup_mount_point)
-    if [[ -z "$DEST" ]]; then
-        dialog --backtitle "ProxMenux" --yesno "No external disk detected or mounted. Would you like to retry?" 8 60
-        [[ $? -eq 0 ]] && continue
-        return 1
-    fi
-
-    DISK_DEV=$(df "$DEST" | awk 'NR==2{print $1}')
-    PKNAME=$(lsblk -no PKNAME "$DISK_DEV" 2>/dev/null)
-    [[ -z "$PKNAME" ]] && PKNAME=$(basename "$DISK_DEV" | sed 's/[0-9]*$//')
-    if [[ -n "$PKNAME" && -b /dev/$PKNAME ]]; then
-        DISK_MODEL=$(lsblk -no MODEL "/dev/$PKNAME")
-    else
-        DISK_MODEL="(unknown)"
-    fi
-    FREE_SPACE=$(df -h "$DEST" | awk 'NR==2{print $4}')
-
-
-
-    dialog --backtitle "ProxMenux" \
-    --title "$(translate "Dedicated Backup Disk")" \
-    --yesno "\n$(translate "Mount point:") $DEST\n\n\
-    $(translate "Disk model:") $DISK_MODEL\n\
-    $(translate "Available space:") $FREE_SPACE\n\n\
-    $(translate "Use this disk for backup?")" 12 70
-
-
-    if [[ $? -eq 0 ]]; then
-        mkdir -p "$DEST"
-        break
-    else
-        return 1
-    fi
-done
-
-
-
-fi
-
-
-TAR_INPUT=""
-TOTAL_SIZE=0
-for src in $SRC; do
-    sz=$(du -sb "$src" 2>/dev/null | awk '{print $1}')
-    TOTAL_SIZE=$((TOTAL_SIZE + sz))
-    TAR_INPUT="$TAR_INPUT $src"
-done
-
-local FILENAME="root-$(hostname)-$(date +%Y%m%d_%H%M).tar.gz"
-clear
-show_proxmenux_logo
-msg_info2 "$(translate "Starting backup with tar...")"
-echo -e
-
-
-TOTAL_SIZE=$(du -cb "$@" | awk '/total$/ {print $1}')
-TOTAL_SIZE_GB=$(awk "BEGIN {printf \"%.2f\", $TOTAL_SIZE/1024/1024/1024}")
-
-echo -e "${BL}$(translate "Included directories:")${WHITE} $*${RESET}"
-echo -e "${BL}$(translate "Total size:")${WHITE} ${TOTAL_SIZE_GB} GB${RESET}"
-
-tar -cf - "$@" 2> >(grep -v "Removing leading \`/'" >&2) \
-| pv -s "$TOTAL_SIZE" \
-| gzip > "$DEST/$FILENAME"
-
-
-echo -ne "\033[1A\r\033[K"
-
-echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-msg_ok "$(translate "Backup process finished. Review log above or in /tmp/tar-backup.log")"
-echo
-msg_success "$(translate "Press Enter to return to the main menu...")"
-read -r
-
-}
-# ===============================
-
-
-host_backup_menu
diff --git a/scripts/backup_restore/backup_host3.sh b/scripts/backup_restore/backup_host3.sh
deleted file mode 100644
index 9ea0d07d..00000000
--- a/scripts/backup_restore/backup_host3.sh
+++ /dev/null
@@ -1,1294 +0,0 @@
-#!/usr/bin/env bash
-
-# Configuration ============================================
-LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
-BASE_DIR="/usr/local/share/proxmenux"
-UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
-
-if [[ -f "$UTILS_FILE" ]]; then
-    source "$UTILS_FILE"
-fi
-load_language
-initialize_cache
-# ==========================================================
-
-
-get_external_backup_mount_point() {
-    local BACKUP_MOUNT_FILE="/usr/local/share/proxmenux/last_backup_mount.txt"
-    local STORAGE_REPO="$LOCAL_SCRIPTS/backup_restore"
-    local MOUNT_POINT
-
-    if [[ -f "$BACKUP_MOUNT_FILE" ]]; then
-        MOUNT_POINT=$(head -n1 "$BACKUP_MOUNT_FILE" | tr -d '\r\n' | xargs)
-        >&2 echo "DEBUG: Valor MOUNT_POINT='$MOUNT_POINT'"
-        if [[ ! -d "$MOUNT_POINT" ]]; then
-            msg_error "Mount point does not exist: $MOUNT_POINT"
-            rm -f "$BACKUP_MOUNT_FILE"
-            return 1
-        fi
-        if ! mountpoint -q "$MOUNT_POINT"; then
-            msg_error "Mount point is not mounted: $MOUNT_POINT"
-            rm -f "$BACKUP_MOUNT_FILE"
-            return 1
-        fi
- 
-        echo "$MOUNT_POINT"
-        return 0
-    else
-       source "$STORAGE_REPO/mount_disk_host_bk.sh"
-       MOUNT_POINT=$(mount_disk_host_bk)
-        [[ -z "$MOUNT_POINT" ]] && msg_error "$(translate "No disk mounted.")" && return 1
-        echo "$MOUNT_POINT"
-        return 0
-    fi
-}
-
-
-
-# === Host Backup Main Menu ===
-host_backup_menu() {
-    while true; do
-        local CHOICE
-        CHOICE=$(dialog --backtitle "ProxMenux" \
-            --title "$(translate 'Host Backup')" \
-            --menu "\n$(translate 'Select backup option:')" 22 70 12 \
-            ""         "$(translate '--- FULL BACKUP ---')" \
-            1 "$(translate 'Full backup to Proxmox Backup Server (PBS)')" \
-            2 "$(translate 'Full backup with BorgBackup')" \
-            3 "$(translate 'Full backup to local .tar.gz')" \
-            ""         "$(translate '--- CUSTOM BACKUP ---')" \
-            4 "$(translate 'Custom backup to PBS')" \
-            5 "$(translate 'Custom backup with BorgBackup')" \
-            6 "$(translate 'Custom backup to local .tar.gz')" \
-            0 "$(translate 'Return')" \
-            3>&1 1>&2 2>&3) || return 0
-
-        case "$CHOICE" in
-            1) backup_full_pbs_root ;;
-            2) backup_with_borg "/boot/efi /etc/pve /etc/network /var/lib/pve-cluster /root /etc/ssh /home /usr/local/bin /etc/cron.d /etc/systemd/system /var/lib/vz" ;;
-            3) backup_to_local_tar "/boot/efi /etc/pve /etc/network /var/lib/pve-cluster /root /etc/ssh /home /usr/local/bin /etc/cron.d /etc/systemd/system /var/lib/vz" ;;
-            4) custom_backup_menu backup_to_pbs ;;
-            5) custom_backup_menu backup_with_borg ;;
-            6) custom_backup_menu backup_to_local_tar ;;
-            0) break ;;
-        esac
-    done
-}
-
-
-
-# === Menu checklist for custom backup ===
-custom_backup_menu() {
-    declare -A BACKUP_PATHS=(
-        [etc-pve]="/etc/pve"
-        [etc-network]="/etc/network"
-        [var-lib-pve-cluster]="/var/lib/pve-cluster"
-        [root-dir]="/root"
-        [etc-ssh]="/etc/ssh"
-        [home]="/home"
-        [local-bin]="/usr/local/bin"
-        [cron]="/etc/cron.d"
-        [custom-systemd]="/etc/systemd/system"
-        [var-lib-vz]="/var/lib/vz"
-    )
-    local CHECKLIST_OPTIONS=()
-    for KEY in "${!BACKUP_PATHS[@]}"; do
-        DIR="${BACKUP_PATHS[$KEY]}"
-        CHECKLIST_OPTIONS+=("$KEY" "$DIR" "off")
-    done
-
-    SELECTED_KEYS=$(dialog --separate-output --checklist \
-        "$(translate 'Select directories to backup:')" 22 70 12 \
-        "${CHECKLIST_OPTIONS[@]}" \
-        3>&1 1>&2 2>&3) || return 1
-
-    local BACKUP_DIRS=()
-    for KEY in $SELECTED_KEYS; do
-        BACKUP_DIRS+=("${BACKUP_PATHS[$KEY]}")
-    done
-
-
-#    "$1" "${BACKUP_DIRS[*]}"
-     "$1" "${BACKUP_DIRS[@]}"
-
-
-}
-
-
-
-
-
-
-
-
-
-
-
-configure_pbs_repository() {
-local PBS_REPO_FILE="/usr/local/share/proxmenux/pbs-repo.conf"
-local PBS_PASS_FILE="/usr/local/share/proxmenux/pbs-pass.txt"
-local PBS_TOKEN_FILE="/usr/local/share/proxmenux/pbs-token.txt"
-local PBS_MANUAL_CONFIGS="/usr/local/share/proxmenux/pbs-manual-configs.txt"
-
-[[ ! -f "$PBS_MANUAL_CONFIGS" ]] && touch "$PBS_MANUAL_CONFIGS"
-
-local PBS_CONFIGS=()
-local PBS_SOURCES=()
-local PBS_USERNAMES=()
-
-if [[ -f "/etc/pve/storage.cfg" ]]; then
-    local current_pbs="" server="" datastore="" username=""
-    
-    while IFS= read -r line; do
-        if [[ $line =~ ^pbs:\ (.+)$ ]]; then
-            if [[ -n "$current_pbs" && -n "$server" && -n "$datastore" && -n "$username" ]]; then
-                PBS_CONFIGS+=("$current_pbs|$username@$server:$datastore")
-                PBS_SOURCES+=("proxmox|$current_pbs")
-                PBS_USERNAMES+=("$username")
-            fi
-            current_pbs="${BASH_REMATCH[1]}"
-            server="" datastore="" username=""
-        elif [[ -n "$current_pbs" ]]; then
-            if [[ $line =~ ^[[:space:]]*server[[:space:]]+(.+)$ ]]; then
-                server="${BASH_REMATCH[1]}"
-            elif [[ $line =~ ^[[:space:]]*datastore[[:space:]]+(.+)$ ]]; then
-                datastore="${BASH_REMATCH[1]}"
-            elif [[ $line =~ ^[[:space:]]*username[[:space:]]+(.+)$ ]]; then
-                username="${BASH_REMATCH[1]}"
-            elif [[ $line =~ ^[a-zA-Z]+: ]]; then
-                if [[ -n "$server" && -n "$datastore" && -n "$username" ]]; then
-                    PBS_CONFIGS+=("$current_pbs|$username@$server:$datastore")
-                    PBS_SOURCES+=("proxmox|$current_pbs")
-                    PBS_USERNAMES+=("$username")
-                fi
-                current_pbs=""
-            fi
-        fi
-    done < "/etc/pve/storage.cfg"
-    
-    if [[ -n "$current_pbs" && -n "$server" && -n "$datastore" && -n "$username" ]]; then
-        PBS_CONFIGS+=("$current_pbs|$username@$server:$datastore")
-        PBS_SOURCES+=("proxmox|$current_pbs")
-        PBS_USERNAMES+=("$username")
-    fi
-fi
-
-if [[ -f "$PBS_MANUAL_CONFIGS" ]]; then
-    while IFS= read -r line; do
-        if [[ -n "$line" ]]; then
-            PBS_CONFIGS+=("$line")
-            local name="${line%%|*}"
-            PBS_SOURCES+=("manual|$name")
-            PBS_USERNAMES+=("")
-        fi
-    done < "$PBS_MANUAL_CONFIGS"
-fi
-
-local menu_options=()
-local i=1
-
-for j in "${!PBS_CONFIGS[@]}"; do
-    local config="${PBS_CONFIGS[$j]}"
-    local source="${PBS_SOURCES[$j]}"
-    local name="${config%%|*}"
-    local repo="${config##*|}"
-    local source_type="${source%%|*}"
-
-    if [[ "$source_type" == "proxmox" ]]; then
-        menu_options+=("$i" " $name ($repo) [Proxmox]")
-    else
-        menu_options+=("$i" " $name ($repo) [Manual]")
-    fi
-    ((i++))
-done
-
-menu_options+=("" "")
-menu_options+=("$i" "\Z4\Zb $(translate 'Configure new PBS')\Zn")
-local choice
-choice=$(dialog --colors --backtitle "ProxMenux" --title "PBS Server Selection" \
---menu "$(translate 'Select PBS server for this backup:')" 22 70 12 "${menu_options[@]}" 3>&1 1>&2 2>&3) || return 1
-
-if [[ $choice -eq $i ]]; then
-    configure_pbs_manually || return 1
-else
-    local selected_config="${PBS_CONFIGS[$((choice-1))]}"
-    local selected_source="${PBS_SOURCES[$((choice-1))]}"
-    local selected_username="${PBS_USERNAMES[$((choice-1))]}"
-    local pbs_name="${selected_config%%|*}"
-    local source_type="${selected_source%%|*}"
-    PBS_REPO="${selected_config##*|}"
-    
-    {
-        mkdir -p "$(dirname "$PBS_REPO_FILE")"
-        echo "$PBS_REPO" > "$PBS_REPO_FILE"
-    } >/dev/null 2>&1
-    
-    local password_found=false
-    if [[ "$source_type" == "proxmox" ]]; then
-        local password_file="/etc/pve/priv/storage/${pbs_name}.pw"
-        
-        if [[ -f "$password_file" ]]; then
-            local auth_content
-            auth_content=$(<"$password_file")
-            
-
-            [[ -f "$PBS_PASS_FILE" ]] && rm "$PBS_PASS_FILE"
-            [[ -f "$PBS_TOKEN_FILE" ]] && rm "$PBS_TOKEN_FILE"
-            
-
-            if [[ "$selected_username" == *"@pbs!"* ]]; then
-
-                echo "$auth_content" > "$PBS_PASS_FILE"
-                chmod 600 "$PBS_PASS_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') PBS Cloud Token
-$(translate 'Token ID:') $selected_username" 15 80
-            elif [[ "$auth_content" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ ]]; then
-                local full_token="${selected_username}:${auth_content}"
-                echo "$full_token" > "$PBS_TOKEN_FILE"
-                chmod 600 "$PBS_TOKEN_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') API Token
-$(translate 'Token ID:') $selected_username" 15 80
-            elif [[ "$auth_content" == *":"* ]]; then
-                echo "$auth_content" > "$PBS_TOKEN_FILE"
-                chmod 600 "$PBS_TOKEN_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') API Token (Complete)" 12 80
-            else
-                echo "$auth_content" > "$PBS_PASS_FILE"
-                chmod 600 "$PBS_PASS_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') Password" 12 80
-            fi
-        fi
-    else
-        local manual_pass_file="/usr/local/share/proxmenux/pbs-pass-${pbs_name}.txt"
-        if [[ -f "$manual_pass_file" ]]; then
-            [[ -f "$PBS_TOKEN_FILE" ]] && rm "$PBS_TOKEN_FILE"
-            
-            {
-                cp "$manual_pass_file" "$PBS_PASS_FILE"
-                chmod 600 "$PBS_PASS_FILE"
-            } >/dev/null 2>&1
-            password_found=true
-            dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using manual PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Password:') $(translate 'Previously saved')" 12 80
-        fi
-    fi
-    
-    if ! $password_found; then
-        dialog --backtitle "ProxMenux" --title "Password Required" --msgbox "$(translate 'Password not found for:') $pbs_name
-$(translate 'Please enter the password.')" 10 60
-        get_pbs_password "$pbs_name" || return 1
-    fi
-    
-    clear
-fi
-}
-
-
-
-
-
-
-
-
-
-
-# ========== PBS BACKUP ==========
-backup_full_pbs_root() {
-    local HOSTNAME PBS_REPO PBS_KEY_FILE PBS_PASS_FILE PBS_TOKEN_FILE PBS_ENCRYPTION_PASS_FILE ENCRYPT_OPT=""
-    HOSTNAME=$(hostname)
-    
-
-    local PBS_REPO_FILE="/usr/local/share/proxmenux/pbs-repo.conf"
-    PBS_KEY_FILE="/usr/local/share/proxmenux/pbs-key.conf"
-    PBS_PASS_FILE="/usr/local/share/proxmenux/pbs-pass.txt"
-    PBS_TOKEN_FILE="/usr/local/share/proxmenux/pbs-token.txt"
-    PBS_ENCRYPTION_PASS_FILE="/usr/local/share/proxmenux/pbs-encryption-pass.txt"
-    LOGFILE="/tmp/pbs-backup-${HOSTNAME}.log"
-
-
-    configure_pbs_repository || return 1
-
-    if [[ ! -f "$PBS_REPO_FILE" ]]; then
-        msg_error "$(translate "Failed to configure PBS connection")"
-        sleep 3
-        return 1
-    fi
-    PBS_REPO=$(<"$PBS_REPO_FILE")
-
-
-    unset PBS_PASSWORD PBS_API_TOKEN PBS_API_TOKEN_ID PBS_API_TOKEN_SECRET PBS_FINGERPRINT
-
-
-    local AUTH_TYPE="password"  
-    local PBS_AUTH_VALUE=""
-    
-    if [[ "$PBS_REPO" == *"@pbs!"* ]]; then
-
-        AUTH_TYPE="pbs_cloud"
-        [[ -f "$PBS_PASS_FILE" ]] && PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    elif [[ -f "$PBS_TOKEN_FILE" ]]; then
-
-        AUTH_TYPE="token"
-        PBS_AUTH_VALUE=$(<"$PBS_TOKEN_FILE")
-    elif [[ -f "$PBS_PASS_FILE" ]]; then
-
-        AUTH_TYPE="password"
-        PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    else
-        msg_error "$(translate "No PBS authentication found!")"
-        sleep 3
-        return 1
-    fi
-
-  
-    dialog --backtitle "ProxMenux" --title "Encryption" --yesno "$(translate 'Do you want to encrypt the backup?')" 8 60
-    if [[ $? -eq 0 ]]; then
-
-        if [[ ! -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-            while true; do
-                PBS_KEY_PASS=$(dialog --backtitle "ProxMenux" --title "Encryption Password" --insecure --passwordbox "$(translate 'Enter encryption password (different from PBS login):')" 12 70 "" 3>&1 1>&2 2>&3) || return 1
-                PBS_KEY_PASS2=$(dialog --backtitle "ProxMenux" --title "Encryption Password" --insecure --passwordbox "$(translate 'Confirm encryption password:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                
-                if [[ "$PBS_KEY_PASS" == "$PBS_KEY_PASS2" ]]; then
-                    break
-                else
-                    dialog --backtitle "ProxMenux" --title "Error" --msgbox "$(translate 'Passwords do not match! Please try again.')" 8 50
-                fi
-            done
-
-
-            {
-                echo "$PBS_KEY_PASS" > "$PBS_ENCRYPTION_PASS_FILE"
-                chmod 600 "$PBS_ENCRYPTION_PASS_FILE"
-            } >/dev/null 2>&1
-            
-            dialog --backtitle "ProxMenux" --title "Success" --msgbox "$(translate 'Encryption password saved successfully!')" 8 50
-        fi
-        
-
-        if [[ ! -f "$PBS_KEY_FILE" ]]; then
-            PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-            
-            dialog --backtitle "ProxMenux" --title "Encryption" --infobox "$(translate 'Creating encryption key...')" 5 50
-            
-            expect -c "
-            set timeout 30
-            spawn proxmox-backup-client key create \"$PBS_KEY_FILE\"
-            expect {
-                \"Encryption Key Password:\" {
-                    send \"$PBS_ENCRYPTION_PASS\r\"
-                    exp_continue
-                }
-                \"Verify Password:\" {
-                    send \"$PBS_ENCRYPTION_PASS\r\"
-                    exp_continue
-                }
-                eof
-            }
-            " >/dev/null 2>&1
-
-            if [[ ! -f "$PBS_KEY_FILE" ]]; then
-                dialog --backtitle "ProxMenux" --title "Error" --msgbox "$(translate 'Error creating encryption key.')" 8 40
-                return 1
-            fi
-            
-            dialog --backtitle "ProxMenux" --title "Important" --msgbox "$(translate 'IMPORTANT: Save the key file. Without it you will not be able to restore your backups!')\n\n$(translate 'Key file location:') $PBS_KEY_FILE" 12 70
-        fi
-        ENCRYPT_OPT="--keyfile $PBS_KEY_FILE"
-    else
-        ENCRYPT_OPT=""
-    fi
-
-
-    clear
-    show_proxmenux_logo
-    echo -e
-    msg_info2 "$(translate "Starting backup to PBS")"
-    echo -e
-    echo -e "${BL}$(translate "PBS Repository:")${WHITE} $PBS_REPO${RESET}"
-    echo -e "${BL}$(translate "Backup ID:")${WHITE} $HOSTNAME${RESET}"
-    echo -e "${BL}$(translate "Included:")${WHITE} /boot/efi /etc/pve (all root)${RESET}"
-    echo -e "${BL}$(translate "Encryption:")${WHITE} $([[ -n "$ENCRYPT_OPT" ]] && echo "Enabled" || echo "Disabled")${RESET}"
-    
-
-    case "$AUTH_TYPE" in
-        "pbs_cloud") echo -e "${BL}$(translate "Authentication:")${WHITE} PBS Cloud Token${RESET}" ;;
-        "token") echo -e "${BL}$(translate "Authentication:")${WHITE} API Token${RESET}" ;;
-        "password") echo -e "${BL}$(translate "Authentication:")${WHITE} Password${RESET}" ;;
-    esac
-    
-    echo -e "${BL}$(translate "Log file:")${WHITE} $LOGFILE${RESET}"
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}-------------------------------${RESET}"
-    echo ""
-
-
-    local backup_cmd="proxmox-backup-client backup --include-dev /boot/efi --include-dev /etc/pve root-${HOSTNAME}.pxar:/ --repository \"$PBS_REPO\" $ENCRYPT_OPT --backup-type host --backup-id \"$HOSTNAME\" --backup-time \"$(date +%s)\""
-    local backup_result=0
-    
-    case "$AUTH_TYPE" in
-        "pbs_cloud")
-
-            if [[ -n "$ENCRYPT_OPT" ]]; then
-                PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                echo "$(translate "Starting encrypted full backup with PBS Cloud...")"
-                echo ""
-                
-                env -i PBS_PASSWORD="$PBS_AUTH_VALUE" expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_ENCRYPTION_PASS\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            else
-
-                echo "$(translate "Starting unencrypted full backup with PBS Cloud...")"
-                echo ""
-                env -i PBS_PASSWORD="$PBS_AUTH_VALUE" bash -c "$backup_cmd" | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            fi
-            ;;
-            
-        "token")
-
-            if [[ -n "$ENCRYPT_OPT" ]]; then
-                PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                echo "$(translate "Starting encrypted full backup with API Token...")"
-                echo ""
-                
-                env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_ENCRYPTION_PASS\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            else
-                echo "$(translate "Starting unencrypted full backup with API Token...")"
-                echo ""
-                env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" bash -c "$backup_cmd" | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            fi
-            ;;
-            
-        "password")
-
-            if [[ -n "$ENCRYPT_OPT" ]]; then
-                PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                echo "$(translate "Starting encrypted full backup with password...")"
-                echo ""
-                
-                env -i expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    -re \"Password for .*:\" {
-                        send \"$PBS_AUTH_VALUE\r\"
-                        exp_continue
-                    }
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_ENCRYPTION_PASS\r\"
-                        exp_continue
-                    }
-                    -re \"Are you sure you want to continue connecting.*\" {
-                        send \"y\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            else
-            
-                echo "$(translate "Starting unencrypted full backup with password...")"
-                echo ""
-                
-                env -i expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    -re \"Password for .*:\" {
-                        send \"$PBS_AUTH_VALUE\r\"
-                        exp_continue
-                    }
-                    -re \"Are you sure you want to continue connecting.*\" {
-                        send \"y\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            fi
-            ;;
-    esac
-
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-    if [[ $backup_result -eq 0 ]]; then
-        msg_ok "$(translate "Full backup process completed successfully")"
-    else
-        msg_error "$(translate "Backup process finished with errors")"
-    fi
-    
-    echo ""
-    msg_success "$(translate "Press Enter to return to the main menu...")"
-    read -r
-}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-backup_to_pbs() {
-    local HOSTNAME TIMESTAMP SNAPSHOT
-    HOSTNAME=$(hostname)
-    TIMESTAMP=$(date +%Y-%m-%d_%H-%M)
-    SNAPSHOT="${HOSTNAME}-${TIMESTAMP}"
-
-    local PBS_REPO_FILE="/usr/local/share/proxmenux/pbs-repo.conf"
-    local PBS_KEY_FILE="/usr/local/share/proxmenux/pbs-key.conf"
-    local PBS_PASS_FILE="/usr/local/share/proxmenux/pbs-pass.txt"
-    local PBS_TOKEN_FILE="/usr/local/share/proxmenux/pbs-token.txt"
-    local PBS_ENCRYPTION_PASS_FILE="/usr/local/share/proxmenux/pbs-encryption-pass.txt"
-    local PBS_REPO ENCRYPT_OPT USE_ENCRYPTION
-    local PBS_KEY_PASS PBS_REPO_PASS
-
-    configure_pbs_repository || return 1
-    PBS_REPO=$(<"$PBS_REPO_FILE")
-
-
-    unset PBS_PASSWORD PBS_API_TOKEN PBS_API_TOKEN_ID PBS_API_TOKEN_SECRET PBS_FINGERPRINT
-
-    USE_ENCRYPTION=false
-    dialog --backtitle "ProxMenux" --yesno "$(translate 'Do you want to encrypt the backup?')" 8 60
-    [[ $? -eq 0 ]] && USE_ENCRYPTION=true
-
-    if $USE_ENCRYPTION && ! command -v expect >/dev/null 2>&1; then
-        apt-get update -qq >/dev/null 2>&1
-        apt-get install -y expect >/dev/null 2>&1
-    fi
-
-    if [[ "$#" -lt 1 ]]; then
-        clear
-        show_proxmenux_logo
-        msg_error "$(translate "No directories specified for backup.")"
-        sleep 2 
-        return 1
-    fi
-
-    local TOTAL="$#"
-    local COUNT=1
-
-
-    local AUTH_TYPE="password"  
-    local PBS_AUTH_VALUE=""
-    
-    if [[ "$PBS_REPO" == *"@pbs!"* ]]; then
-
-        AUTH_TYPE="pbs_cloud"
-        [[ -f "$PBS_PASS_FILE" ]] && PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    elif [[ -f "$PBS_TOKEN_FILE" ]]; then
-
-        AUTH_TYPE="token"
-        PBS_AUTH_VALUE=$(<"$PBS_TOKEN_FILE")
-    elif [[ -f "$PBS_PASS_FILE" ]]; then
-
-        AUTH_TYPE="password"
-        PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    else
-        msg_error "$(translate "No PBS authentication found!")"
-        return 1
-    fi
-
-    for dir in "$@"; do
-        local SAFE_NAME SAFE_ID PXAR_NAME
-        SAFE_NAME=$(basename "$dir" | tr '.-/' '_')
-        PXAR_NAME="root-custom-${SAFE_NAME}-${SNAPSHOT}.pxar"
-        SAFE_ID="custom-${HOSTNAME}-${SAFE_NAME}"
-
-        msg_info2 "$(translate "[$COUNT/$TOTAL] Backing up") $dir $(translate "as") $PXAR_NAME"
-
-        ENCRYPT_OPT=""
-
-        if $USE_ENCRYPTION; then
-            if [[ -f "$PBS_KEY_FILE" ]]; then
-                ENCRYPT_OPT="--keyfile $PBS_KEY_FILE"
-            else
-                while true; do
-                    PBS_KEY_PASS=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Enter encryption password (different from PBS login):')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                    PBS_KEY_PASS2=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Confirm encryption password:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                    
-                    if [[ "$PBS_KEY_PASS" == "$PBS_KEY_PASS2" ]]; then
-                        break
-                    else
-                        dialog --backtitle "ProxMenux" --msgbox "$(translate 'Passwords do not match! Please try again.')" 8 50
-                    fi
-                done
-
-                {
-                    echo "$PBS_KEY_PASS" > "$PBS_ENCRYPTION_PASS_FILE"
-                    chmod 600 "$PBS_ENCRYPTION_PASS_FILE"
-                } >/dev/null 2>&1
-
-                expect -c "
-                set timeout 30
-                spawn proxmox-backup-client key create \"$PBS_KEY_FILE\"
-                expect {
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_KEY_PASS\r\"
-                        exp_continue
-                    }
-                    \"Verify Password:\" {
-                        send \"$PBS_KEY_PASS\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " >/dev/null 2>&1
-
-                if [[ ! -f "$PBS_KEY_FILE" ]]; then
-                    dialog --backtitle "ProxMenux" --msgbox "$(translate 'Error creating encryption key.')" 8 40
-                    return 1
-                fi
-                ENCRYPT_OPT="--keyfile $PBS_KEY_FILE"
-                dialog --backtitle "ProxMenux" --msgbox "$(translate 'Encryption key generated. Save it in a safe place!')" 10 60
-            fi
-        fi
-
-        clear
-        show_proxmenux_logo
-        echo -e
-        msg_info2 "$(translate "Starting backup to PBS")"
-        TOTAL_SIZE=$(du -cb "$@" | awk '/total$/ {print $1}')
-        TOTAL_SIZE_GB=$(awk "BEGIN {printf \"%.2f\", $TOTAL_SIZE/1024/1024/1024}")
-        echo -e
-        echo -e "${BL}$(translate "PBS Repository:")${WHITE} $PBS_REPO${RESET}"
-        echo -e "${BL}$(translate "Backup ID:")${WHITE} $HOSTNAME${RESET}"
-        echo -e "${BL}$(translate "Encryption:")${WHITE} $([[ -n "$ENCRYPT_OPT" ]] && echo "Enabled" || echo "Disabled")${RESET}"
-        
-        case "$AUTH_TYPE" in
-            "pbs_cloud") echo -e "${BL}$(translate "Authentication:")${WHITE} PBS Cloud Token${RESET}" ;;
-            "token") echo -e "${BL}$(translate "Authentication:")${WHITE} API Token${RESET}" ;;
-            "password") echo -e "${BL}$(translate "Authentication:")${WHITE} Password${RESET}" ;;
-        esac
-        
-        echo -e "${BL}$(translate "Included directories:")${WHITE} $*${RESET}"
-        echo -e "${BL}$(translate "Total size:")${WHITE} ${TOTAL_SIZE_GB} GB${RESET}"
-        echo -e "${BOLD}${NEON_PURPLE_BLUE}-------------------------------${RESET}"
-
-
-        local backup_cmd="proxmox-backup-client backup \"${PXAR_NAME}:$dir\" --repository \"$PBS_REPO\" $ENCRYPT_OPT --backup-type host --backup-id \"$SAFE_ID\" --backup-time \"$(date +%s)\""
-        
-        case "$AUTH_TYPE" in
-            "pbs_cloud")
-
-                if $USE_ENCRYPTION && [[ -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-                    PBS_KEY_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                    env -i PBS_PASSWORD="$PBS_AUTH_VALUE" expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        \"Encryption Key Password:\" {
-                            send \"$PBS_KEY_PASS\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                else
-                    env -i PBS_PASSWORD="$PBS_AUTH_VALUE" bash -c "$backup_cmd"
-                fi
-                ;;
-                
-            "token")
-
-                if $USE_ENCRYPTION && [[ -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-                    PBS_KEY_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                    env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        \"Encryption Key Password:\" {
-                            send \"$PBS_KEY_PASS\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                else
-                    env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" bash -c "$backup_cmd"
-                fi
-                ;;
-                
-            "password")
-
-                if $USE_ENCRYPTION && [[ -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-                    PBS_KEY_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                    env -i expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        -re \"Password for .*:\" {
-                            send \"$PBS_AUTH_VALUE\r\"
-                            exp_continue
-                        }
-                        \"Encryption Key Password:\" {
-                            send \"$PBS_KEY_PASS\r\"
-                            exp_continue
-                        }
-                        -re \"Are you sure you want to continue connecting.*\" {
-                            send \"y\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                else
-                    env -i expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        -re \"Password for .*:\" {
-                            send \"$PBS_AUTH_VALUE\r\"
-                            exp_continue
-                        }
-                        -re \"Are you sure you want to continue connecting.*\" {
-                            send \"y\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                fi
-                ;;
-        esac
-
-        COUNT=$((COUNT+1))
-    done
-
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-    msg_ok "$(translate "Backup process finished.")"
-    echo ""
-    msg_success "$(translate "Press Enter to return to the main menu...")"
-    read -r
-}
-# ===============================
-
-
-
-
-
-
-
-# ========== BORGBACKUP ==========
-backup_with_borg() {
-    local BORG_APPIMAGE="/usr/local/share/proxmenux/borg"
-    local LOGFILE="/tmp/borg-backup.log"
-    local BORG_PASS_FILE="/usr/local/share/proxmenux/borg-pass.txt"
-    local BORG_KEY_FILE="/usr/local/share/proxmenux/borg-key"
-    local DEST
-    local TYPE
-    local ENCRYPT_OPT=""
-    local BORG_KEY
-
-    # Descargar BorgBackup si no existe
-    if [[ ! -x "$BORG_APPIMAGE" ]]; then
-        clear
-        show_proxmenux_logo
-        msg_info "$(translate "BorgBackup not found. Downloading AppImage...")"
-        mkdir -p /usr/local/share/proxmenux
-        wget -qO "$BORG_APPIMAGE" "https://github.com/borgbackup/borg/releases/download/1.2.8/borg-linux64"
-        chmod +x "$BORG_APPIMAGE"
-        msg_ok "$(translate "BorgBackup downloaded and ready.")"
-    fi
-
-    # Seleccionar tipo de destino
-    TYPE=$(dialog --backtitle "ProxMenux" --menu "$(translate 'Select Borg backup destination:')" 15 60 4 \
-        "local"   "$(translate 'Local directory')" \
-        "usb"     "$(translate 'Internal/External dedicated disk')" \
-        "remote"  "$(translate 'Remote server (SSH)')" \
-        "pbs"     "$(translate 'remote-backups.com')" \
-        3>&1 1>&2 2>&3) || return 1
-
-
-    if [[ "$TYPE" == "local" ]]; then
-        DEST=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter local directory for backup:')" 10 60 "/backup/borgbackup" 3>&1 1>&2 2>&3) || return 1
-        mkdir -p "$DEST"
-        
-    elif [[ "$TYPE" == "usb" ]]; then
-        while true; do
-            BASE_DEST=$(get_external_backup_mount_point)
-            if [[ -z "$BASE_DEST" ]]; then
-                dialog --backtitle "ProxMenux" --yesno "$(translate 'No external disk detected or mounted. Would you like to retry?')" 8 60
-                [[ $? -eq 0 ]] && continue
-                return 1
-            fi
-
-            DEST="$BASE_DEST/borgbackup"
-            mkdir -p "$DEST"
-
-            DISK_DEV=$(df "$BASE_DEST" | awk 'NR==2{print $1}')
-            PKNAME=$(lsblk -no PKNAME "$DISK_DEV" 2>/dev/null)
-            [[ -z "$PKNAME" ]] && PKNAME=$(basename "$DISK_DEV" | sed 's/[0-9]*$//')
-            if [[ -n "$PKNAME" && -b /dev/$PKNAME ]]; then
-                DISK_MODEL=$(lsblk -no MODEL "/dev/$PKNAME")
-            else
-                DISK_MODEL="(unknown)"
-            fi
-            FREE_SPACE=$(df -h "$BASE_DEST" | awk 'NR==2{print $4}')
-
-            dialog --backtitle "ProxMenux" \
-                --title "$(translate "Dedicated Backup Disk")" \
-                --yesno "\n$(translate "Mount point:") $DEST\n\n\
-            $(translate "Disk model:") $DISK_MODEL\n\
-            $(translate "Available space:") $FREE_SPACE\n\n\
-            $(translate "Use this disk for backup?")" 12 70
-
-            if [[ $? -eq 0 ]]; then
-                break
-            else
-                return 1
-            fi
-        done
-        
-    elif [[ "$TYPE" == "remote" ]]; then
-
-        REMOTE_USER=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter SSH user for remote:')" 10 60 "root" 3>&1 1>&2 2>&3) || return 1
-        REMOTE_HOST=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter SSH host:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-        REMOTE_PATH=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter remote path:')" 10 60 "/backup/borgbackup" 3>&1 1>&2 2>&3) || return 1
-        
-
-        dialog --backtitle "ProxMenux" --yesno "$(translate 'Do you want to use SSH key authentication?')" 8 60
-        if [[ $? -eq 0 ]]; then
-            SSH_KEY=$(dialog --backtitle "ProxMenux" --fselect "$HOME/.ssh/" 10 60 3>&1 1>&2 2>&3) || return 1
-            export BORG_RSH="ssh -i $SSH_KEY"
-        fi
-        
-        DEST="ssh://$REMOTE_USER@$REMOTE_HOST:$REMOTE_PATH"
-        
-    elif [[ "$TYPE" == "pbs" ]]; then
-
-        PBS_CUSTOMER_ID=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter PBS customer ID (from Connect panel):')" 10 70 "" 3>&1 1>&2 2>&3) || return 1
-        PBS_SERVER=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter PBS server (from Connect panel):')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-        
-
-        local SSH_KEYS=()
-        local SSH_KEY_NAMES=()
-        
-
-        for key_file in ~/.ssh/id_rsa ~/.ssh/id_ed25519 ~/.ssh/pbs_host_key ~/.ssh/id_ecdsa; do
-            if [[ -f "$key_file" && -f "${key_file}.pub" ]]; then
-                SSH_KEYS+=("$key_file")
-                local key_type=$(head -1 "${key_file}.pub" | awk '{print $1}')
-                local key_comment=$(head -1 "${key_file}.pub" | awk '{print $3}')
-                SSH_KEY_NAMES+=("$(basename "$key_file") ($key_type) - $key_comment")
-            fi
-        done
-        
-
-        if [[ ${#SSH_KEYS[@]} -eq 0 ]]; then
-            dialog --backtitle "ProxMenux" --yesno "$(translate 'No SSH keys found. Do you want to create one now?')" 8 60
-            if [[ $? -eq 0 ]]; then
-                clear
-                show_proxmenux_logo
-                echo -e
-                msg_info2 "$(translate "Creating SSH key for PBS-host.de...")"
-                
-
-                ssh-keygen -t rsa -b 4096 -f ~/.ssh/pbs_host_key -N "" -C "pbs-backup-$(hostname)"
-                
-                if [[ $? -eq 0 ]]; then
-                    SSH_KEY="$HOME/.ssh/pbs_host_key"
-                    msg_ok "$(translate "SSH key created successfully!")"
-                else
-                    msg_error "$(translate "Failed to create SSH key")"
-                    return 1
-                fi
-            else
-                return 1
-            fi
-        elif [[ ${#SSH_KEYS[@]} -eq 1 ]]; then
-
-            SSH_KEY="${SSH_KEYS[0]}"
-        else
-
-            local menu_options=()
-            for i in "${!SSH_KEYS[@]}"; do
-                menu_options+=("$i" "${SSH_KEY_NAMES[$i]}")
-            done
-            
-            local choice
-            choice=$(dialog --backtitle "ProxMenux" --menu "$(translate 'Select SSH key to use:')" 15 80 10 "${menu_options[@]}" 3>&1 1>&2 2>&3) || return 1
-            SSH_KEY="${SSH_KEYS[$choice]}"
-        fi
-        
-        export BORG_RSH="ssh -i $SSH_KEY"
-        DEST="$PBS_CUSTOMER_ID@$PBS_SERVER:./borg"
-        
-  
-        clear
-        show_proxmenux_logo
-        echo -e
-        msg_info2 "$(translate "PBS-host.de Configuration")"
-        echo -e "${BL}$(translate "Server:")${WHITE} $PBS_SERVER${RESET}"
-        echo -e "${BL}$(translate "Customer ID:")${WHITE} $PBS_CUSTOMER_ID${RESET}"
-        echo -e "${BL}$(translate "SSH Key:")${WHITE} $SSH_KEY${RESET}"
-        echo -e "${BOLD}${NEON_PURPLE_BLUE}-------------------------------${RESET}"
-        echo ""
-        
-
-        chmod 600 "$SSH_KEY"
-        
-
-        local SSH_PUB_KEY="${SSH_KEY}.pub"
-        if [[ -f "$SSH_PUB_KEY" ]]; then
-            echo -e "${BL}$(translate "Your SSH Public Key:")${RESET}"
-            echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}"
-            echo -e "${WHITE}$(cat "$SSH_PUB_KEY")${RESET}"
-            echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}"
-            echo ""
-            
-
-            if command -v xclip >/dev/null 2>&1; then
-                echo -e "${BL}$(translate "Copying to clipboard...")${RESET}"
-                cat "$SSH_PUB_KEY" | xclip -selection clipboard
-                msg_ok "$(translate "Public key copied to clipboard!")"
-            elif command -v pbcopy >/dev/null 2>&1; then
-                echo -e "${BL}$(translate "Copying to clipboard...")${RESET}"
-                cat "$SSH_PUB_KEY" | pbcopy
-                msg_ok "$(translate "Public key copied to clipboard!")"
-            fi
-            
-            echo ""
-            echo -e "${BL}$(translate "INSTRUCTIONS:")${RESET}"
-            echo "1. $(translate "Copy the key above (or use clipboard if available)")"
-            echo "2. $(translate "Go to PBS-host.de panel → Your datastore → Connect")"
-            echo "3. $(translate "Select 'rsync / borg / sftp' tab")"
-            echo "4. $(translate "Paste the key in 'Save SSH Key' section")"
-            echo "5. $(translate "Click 'Save'")"
-            echo ""
-            
-
-            msg_success "$(translate "Press Enter when you have uploaded the key to PBS-host.de panel...")"
-            read -r
-        fi
-        
-
-        clear
-        show_proxmenux_logo
-        echo -e
-        msg_info2 "$(translate "Testing connection to PBS-host.de...")"
-        echo ""
-        
-        echo "$(translate "Connecting... (you may need to type 'yes' to accept the server fingerprint)")"
-        echo ""
-        
-
-        if timeout 30 ssh -i "$SSH_KEY" -o ConnectTimeout=10 -o BatchMode=no "$PBS_CUSTOMER_ID@$PBS_SERVER" borg --version >/dev/null 2>&1; then
-            echo ""
-            msg_ok "$(translate "✅ Connection successful! Borg is available on the server.")"
-            sleep 2
-        else
-            echo ""
-            msg_error "$(translate "❌ Connection failed or requires manual intervention.")"
-            echo ""
-            echo -e "${BL}$(translate "This could be normal if:")${RESET}"
-            echo "• $(translate "First time connecting (need to accept fingerprint)")"
-            echo "• $(translate "Key not yet uploaded to PBS-host.de panel")"
-            echo "• $(translate "Network connectivity issues")"
-            echo ""
-            
-            dialog --backtitle "ProxMenux" --yesno "$(translate 'Do you want to continue anyway? The backup will test the connection again.')" 10 70
-            if [[ $? -ne 0 ]]; then
-                return 1
-            fi
-        fi
-    fi
-
-
-    local USE_ENCRYPTION=false
-    dialog --backtitle "ProxMenux" --yesno "$(translate 'Do you want to encrypt the backup?')" 8 60
-    if [[ $? -eq 0 ]]; then
-        USE_ENCRYPTION=true
-        ENCRYPT_OPT="--encryption=repokey"
-        
-
-        if [[ -f "$BORG_PASS_FILE" ]]; then
-            dialog --backtitle "ProxMenux" --yesno "$(translate 'A saved encryption passphrase exists. Use it?')" 8 60
-            if [[ $? -eq 0 ]]; then
-                BORG_KEY=$(<"$BORG_PASS_FILE")
-            else
-
-                while true; do
-                    BORG_KEY=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Enter Borg encryption passphrase:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                    BORG_KEY2=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Confirm encryption passphrase:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                    
-                    if [[ "$BORG_KEY" == "$BORG_KEY2" ]]; then
-                        break
-                    else
-                        dialog --backtitle "ProxMenux" --msgbox "$(translate 'Passphrases do not match! Please try again.')" 8 50
-                    fi
-                done
-                
-
-                mkdir -p "$(dirname "$BORG_PASS_FILE")"
-                echo "$BORG_KEY" > "$BORG_PASS_FILE"
-                chmod 600 "$BORG_PASS_FILE"
-            fi
-        else
-
-            while true; do
-                BORG_KEY=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Enter Borg encryption passphrase:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                BORG_KEY2=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Confirm encryption passphrase:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                
-                if [[ "$BORG_KEY" == "$BORG_KEY2" ]]; then
-                    break
-                else
-                    dialog --backtitle "ProxMenux" --msgbox "$(translate 'Passphrases do not match! Please try again.')" 8 50
-                fi
-            done
-            
-
-            mkdir -p "$(dirname "$BORG_PASS_FILE")"
-            echo "$BORG_KEY" > "$BORG_PASS_FILE"
-            chmod 600 "$BORG_PASS_FILE"
-        fi
-        
-        export BORG_PASSPHRASE="$BORG_KEY"
-    else
-        ENCRYPT_OPT="--encryption=none"
-    fi
-
-
-    if [[ "$TYPE" == "local" || "$TYPE" == "usb" ]]; then
-        if [[ ! -f "$DEST/config" ]]; then
-            dialog --backtitle "ProxMenux" --infobox "$(translate 'Initializing Borg repository...')" 5 50
-            "$BORG_APPIMAGE" init $ENCRYPT_OPT "$DEST"
-            if [[ $? -ne 0 ]]; then
-                clear
-                show_proxmenux_logo
-                msg_error "$(translate "Failed to initialize Borg repo at") $DEST"
-                sleep 5
-                return 1
-            fi
-        fi
-    elif [[ "$TYPE" == "remote" || "$TYPE" == "pbs" ]]; then
-
-        if ! "$BORG_APPIMAGE" list "$DEST" >/dev/null 2>&1; then
-            dialog --backtitle "ProxMenux" --yesno "$(translate 'Repository does not exist or is not accessible. Initialize it?')" 8 60
-            if [[ $? -eq 0 ]]; then
-                dialog --backtitle "ProxMenux" --infobox "$(translate 'Initializing Borg repository...')" 5 50
-                "$BORG_APPIMAGE" init $ENCRYPT_OPT "$DEST"
-                if [[ $? -ne 0 ]]; then
-                    clear
-                    show_proxmenux_logo
-                    msg_error "$(translate "Failed to initialize Borg repo at") $DEST"
-                    sleep 5
-                    return 1
-                fi
-            else
-                return 1
-            fi
-        fi
-    fi
-
-
-    dialog --backtitle "ProxMenux" --msgbox "$(translate 'Borg backup will start now. This may take a while.')" 8 40
-
-
-    clear
-    show_proxmenux_logo
-    msg_info2 "$(translate "Starting backup with BorgBackup...")"
-    echo -e
-
-    TOTAL_SIZE=$(du -cb "$@" | awk '/total$/ {print $1}')
-    TOTAL_SIZE_GB=$(awk "BEGIN {printf \"%.2f\", $TOTAL_SIZE/1024/1024/1024}")
-
-    echo -e "${BL}$(translate "Destination:")${WHITE} $DEST${RESET}"
-    echo -e "${BL}$(translate "Encryption:")${WHITE} $($USE_ENCRYPTION && echo "Enabled" || echo "Disabled")${RESET}"
-    echo -e "${BL}$(translate "Included directories:")${WHITE} $*${RESET}"
-    echo -e "${BL}$(translate "Total size:")${WHITE} ${TOTAL_SIZE_GB} GB${RESET}"
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}-------------------------------${RESET}"
-
-
-    local ARCHIVE_NAME="root-$(hostname)-$(date +%Y%m%d_%H%M)"
-    
-    "$BORG_APPIMAGE" create --progress --stats --compression zstd "$DEST"::$ARCHIVE_NAME "$@" 2>&1 | tee "$LOGFILE"
-    local BACKUP_RESULT=$?
-
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-    
-    if [[ $BACKUP_RESULT -eq 0 ]]; then
-        msg_ok "$(translate "Backup completed successfully!")"
-        
-
-        echo -e "\n${BL}$(translate "Backup information:")${RESET}"
-        "$BORG_APPIMAGE" info "$DEST"::$ARCHIVE_NAME 2>&1 | tee -a "$LOGFILE"
-        
-  
-        if [[ "$TYPE" == "remote" || "$TYPE" == "pbs" ]]; then
-            echo -e "\n${BL}$(translate "Tip:")${RESET} $(translate "Run 'borg compact $DEST' to free up space after multiple backups.")"
-        fi
-    else
-        msg_error "$(translate "Backup process failed with error code:") $BACKUP_RESULT"
-    fi
-    
-    echo
-    msg_success "$(translate "Press Enter to return to the main menu...")"
-    read -r
-}
-# ===============================
-
-
-
-
-# ========== LOCAL TAR ==========
-backup_to_local_tar() {
-#    local SRC="$1"
-    local TYPE
-    local DEST
-    local LOGFILE="/tmp/tar-backup.log"
-
-
-if ! command -v pv &>/dev/null; then
-    apt-get update -qq && apt-get install -y pv >/dev/null 2>&1
-fi
-
-
-
-    TYPE=$(dialog --backtitle "ProxMenux"  --menu "$(translate 'Select backup destination:')" 15 60 2 \
-        "local" "$(translate 'Local directory')" \
-        "usb"   "$(translate 'Internal/External dedicated disk')" \
-        3>&1 1>&2 2>&3) || return 1
-
-    if [[ "$TYPE" == "local" ]]; then
-        DEST=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter directory for backup:')" 10 60 "/backup" 3>&1 1>&2 2>&3) || return 1
-
-        mkdir -p "$DEST"
-
-
-else
-
-
-while true; do
-    DEST=$(get_external_backup_mount_point)
-    if [[ -z "$DEST" ]]; then
-        dialog --backtitle "ProxMenux" --yesno "No external disk detected or mounted. Would you like to retry?" 8 60
-        [[ $? -eq 0 ]] && continue
-        return 1
-    fi
-
-    DISK_DEV=$(df "$DEST" | awk 'NR==2{print $1}')
-    PKNAME=$(lsblk -no PKNAME "$DISK_DEV" 2>/dev/null)
-    [[ -z "$PKNAME" ]] && PKNAME=$(basename "$DISK_DEV" | sed 's/[0-9]*$//')
-    if [[ -n "$PKNAME" && -b /dev/$PKNAME ]]; then
-        DISK_MODEL=$(lsblk -no MODEL "/dev/$PKNAME")
-    else
-        DISK_MODEL="(unknown)"
-    fi
-    FREE_SPACE=$(df -h "$DEST" | awk 'NR==2{print $4}')
-
-
-
-    dialog --backtitle "ProxMenux" \
-    --title "$(translate "Dedicated Backup Disk")" \
-    --yesno "\n$(translate "Mount point:") $DEST\n\n\
-    $(translate "Disk model:") $DISK_MODEL\n\
-    $(translate "Available space:") $FREE_SPACE\n\n\
-    $(translate "Use this disk for backup?")" 12 70
-
-
-    if [[ $? -eq 0 ]]; then
-        mkdir -p "$DEST"
-        break
-    else
-        return 1
-    fi
-done
-
-
-
-fi
-
-
-TAR_INPUT=""
-TOTAL_SIZE=0
-for src in $SRC; do
-    sz=$(du -sb "$src" 2>/dev/null | awk '{print $1}')
-    TOTAL_SIZE=$((TOTAL_SIZE + sz))
-    TAR_INPUT="$TAR_INPUT $src"
-done
-
-local FILENAME="root-$(hostname)-$(date +%Y%m%d_%H%M).tar.gz"
-clear
-show_proxmenux_logo
-msg_info2 "$(translate "Starting backup with tar...")"
-echo -e
-
-
-TOTAL_SIZE=$(du -cb "$@" | awk '/total$/ {print $1}')
-TOTAL_SIZE_GB=$(awk "BEGIN {printf \"%.2f\", $TOTAL_SIZE/1024/1024/1024}")
-
-echo -e "${BL}$(translate "Included directories:")${WHITE} $*${RESET}"
-echo -e "${BL}$(translate "Total size:")${WHITE} ${TOTAL_SIZE_GB} GB${RESET}"
-
-tar -cf - "$@" 2> >(grep -v "Removing leading \`/'" >&2) \
-| pv -s "$TOTAL_SIZE" \
-| gzip > "$DEST/$FILENAME"
-
-
-echo -ne "\033[1A\r\033[K"
-
-echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-msg_ok "$(translate "Backup process finished. Review log above or in /tmp/tar-backup.log")"
-echo
-msg_success "$(translate "Press Enter to return to the main menu...")"
-read -r
-
-}
-# ===============================
-
-
-host_backup_menu
diff --git a/scripts/backup_restore/backup_host4.sh b/scripts/backup_restore/backup_host4.sh
deleted file mode 100644
index d77ca608..00000000
--- a/scripts/backup_restore/backup_host4.sh
+++ /dev/null
@@ -1,1294 +0,0 @@
-#!/usr/bin/env bash
-
-# Configuration ============================================
-LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
-BASE_DIR="/usr/local/share/proxmenux"
-UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
-
-if [[ -f "$UTILS_FILE" ]]; then
-    source "$UTILS_FILE"
-fi
-load_language
-initialize_cache
-# ==========================================================
-
-
-get_external_backup_mount_point() {
-    local BACKUP_MOUNT_FILE="/usr/local/share/proxmenux/last_backup_mount.txt"
-    local STORAGE_REPO="$LOCAL_SCRIPTS/backup_restore"
-    local MOUNT_POINT
-
-    if [[ -f "$BACKUP_MOUNT_FILE" ]]; then
-        MOUNT_POINT=$(head -n1 "$BACKUP_MOUNT_FILE" | tr -d '\r\n' | xargs)
-        >&2 echo "DEBUG: Valor MOUNT_POINT='$MOUNT_POINT'"
-        if [[ ! -d "$MOUNT_POINT" ]]; then
-            msg_error "Mount point does not exist: $MOUNT_POINT"
-            rm -f "$BACKUP_MOUNT_FILE"
-            return 1
-        fi
-        if ! mountpoint -q "$MOUNT_POINT"; then
-            msg_error "Mount point is not mounted: $MOUNT_POINT"
-            rm -f "$BACKUP_MOUNT_FILE"
-            return 1
-        fi
- 
-        echo "$MOUNT_POINT"
-        return 0
-    else
-       source "$STORAGE_REPO/mount_disk_host_bk.sh"
-       MOUNT_POINT=$(mount_disk_host_bk)
-        [[ -z "$MOUNT_POINT" ]] && msg_error "$(translate "No disk mounted.")" && return 1
-        echo "$MOUNT_POINT"
-        return 0
-    fi
-}
-
-
-
-# === Host Backup Main Menu ===
-host_backup_menu() {
-    while true; do
-        local CHOICE
-        CHOICE=$(dialog --backtitle "ProxMenux" \
-            --title "$(translate 'Host Backup')" \
-            --menu "\n$(translate 'Select backup option:')" 22 70 12 \
-            ""         "$(translate '--- FULL BACKUP ---')" \
-            1 "$(translate 'Full backup to Proxmox Backup Server (PBS)')" \
-            2 "$(translate 'Full backup with BorgBackup')" \
-            3 "$(translate 'Full backup to local .tar.gz')" \
-            ""         "$(translate '--- CUSTOM BACKUP ---')" \
-            4 "$(translate 'Custom backup to PBS')" \
-            5 "$(translate 'Custom backup with BorgBackup')" \
-            6 "$(translate 'Custom backup to local .tar.gz')" \
-            0 "$(translate 'Return')" \
-            3>&1 1>&2 2>&3) || return 0
-
-        case "$CHOICE" in
-            1) backup_full_pbs_root ;;
-            2) backup_with_borg "/boot/efi /etc/pve /etc/network /var/lib/pve-cluster /root /etc/ssh /home /usr/local/bin /etc/cron.d /etc/systemd/system /var/lib/vz" ;;
-            3) backup_to_local_tar "/boot/efi /etc/pve /etc/network /var/lib/pve-cluster /root /etc/ssh /home /usr/local/bin /etc/cron.d /etc/systemd/system /var/lib/vz" ;;
-            4) custom_backup_menu backup_to_pbs ;;
-            5) custom_backup_menu backup_with_borg ;;
-            6) custom_backup_menu backup_to_local_tar ;;
-            0) break ;;
-        esac
-    done
-}
-
-
-
-# === Menu checklist for custom backup ===
-custom_backup_menu() {
-    declare -A BACKUP_PATHS=(
-        [etc-pve]="/etc/pve"
-        [etc-network]="/etc/network"
-        [var-lib-pve-cluster]="/var/lib/pve-cluster"
-        [root-dir]="/root"
-        [etc-ssh]="/etc/ssh"
-        [home]="/home"
-        [local-bin]="/usr/local/bin"
-        [cron]="/etc/cron.d"
-        [custom-systemd]="/etc/systemd/system"
-        [var-lib-vz]="/var/lib/vz"
-    )
-    local CHECKLIST_OPTIONS=()
-    for KEY in "${!BACKUP_PATHS[@]}"; do
-        DIR="${BACKUP_PATHS[$KEY]}"
-        CHECKLIST_OPTIONS+=("$KEY" "$DIR" "off")
-    done
-
-    SELECTED_KEYS=$(dialog --separate-output --checklist \
-        "$(translate 'Select directories to backup:')" 22 70 12 \
-        "${CHECKLIST_OPTIONS[@]}" \
-        3>&1 1>&2 2>&3) || return 1
-
-    local BACKUP_DIRS=()
-    for KEY in $SELECTED_KEYS; do
-        BACKUP_DIRS+=("${BACKUP_PATHS[$KEY]}")
-    done
-
-
-#    "$1" "${BACKUP_DIRS[*]}"
-     "$1" "${BACKUP_DIRS[@]}"
-
-
-}
-
-
-
-
-
-
-
-
-
-
-
-configure_pbs_repository() {
-local PBS_REPO_FILE="/usr/local/share/proxmenux/pbs-repo.conf"
-local PBS_PASS_FILE="/usr/local/share/proxmenux/pbs-pass.txt"
-local PBS_TOKEN_FILE="/usr/local/share/proxmenux/pbs-token.txt"
-local PBS_MANUAL_CONFIGS="/usr/local/share/proxmenux/pbs-manual-configs.txt"
-
-[[ ! -f "$PBS_MANUAL_CONFIGS" ]] && touch "$PBS_MANUAL_CONFIGS"
-
-local PBS_CONFIGS=()
-local PBS_SOURCES=()
-local PBS_USERNAMES=()
-
-if [[ -f "/etc/pve/storage.cfg" ]]; then
-    local current_pbs="" server="" datastore="" username=""
-    
-    while IFS= read -r line; do
-        if [[ $line =~ ^pbs:\ (.+)$ ]]; then
-            if [[ -n "$current_pbs" && -n "$server" && -n "$datastore" && -n "$username" ]]; then
-                PBS_CONFIGS+=("$current_pbs|$username@$server:$datastore")
-                PBS_SOURCES+=("proxmox|$current_pbs")
-                PBS_USERNAMES+=("$username")
-            fi
-            current_pbs="${BASH_REMATCH[1]}"
-            server="" datastore="" username=""
-        elif [[ -n "$current_pbs" ]]; then
-            if [[ $line =~ ^[[:space:]]*server[[:space:]]+(.+)$ ]]; then
-                server="${BASH_REMATCH[1]}"
-            elif [[ $line =~ ^[[:space:]]*datastore[[:space:]]+(.+)$ ]]; then
-                datastore="${BASH_REMATCH[1]}"
-            elif [[ $line =~ ^[[:space:]]*username[[:space:]]+(.+)$ ]]; then
-                username="${BASH_REMATCH[1]}"
-            elif [[ $line =~ ^[a-zA-Z]+: ]]; then
-                if [[ -n "$server" && -n "$datastore" && -n "$username" ]]; then
-                    PBS_CONFIGS+=("$current_pbs|$username@$server:$datastore")
-                    PBS_SOURCES+=("proxmox|$current_pbs")
-                    PBS_USERNAMES+=("$username")
-                fi
-                current_pbs=""
-            fi
-        fi
-    done < "/etc/pve/storage.cfg"
-    
-    if [[ -n "$current_pbs" && -n "$server" && -n "$datastore" && -n "$username" ]]; then
-        PBS_CONFIGS+=("$current_pbs|$username@$server:$datastore")
-        PBS_SOURCES+=("proxmox|$current_pbs")
-        PBS_USERNAMES+=("$username")
-    fi
-fi
-
-if [[ -f "$PBS_MANUAL_CONFIGS" ]]; then
-    while IFS= read -r line; do
-        if [[ -n "$line" ]]; then
-            PBS_CONFIGS+=("$line")
-            local name="${line%%|*}"
-            PBS_SOURCES+=("manual|$name")
-            PBS_USERNAMES+=("")
-        fi
-    done < "$PBS_MANUAL_CONFIGS"
-fi
-
-local menu_options=()
-local i=1
-
-for j in "${!PBS_CONFIGS[@]}"; do
-    local config="${PBS_CONFIGS[$j]}"
-    local source="${PBS_SOURCES[$j]}"
-    local name="${config%%|*}"
-    local repo="${config##*|}"
-    local source_type="${source%%|*}"
-
-    if [[ "$source_type" == "proxmox" ]]; then
-        menu_options+=("$i" " $name ($repo) [Proxmox]")
-    else
-        menu_options+=("$i" " $name ($repo) [Manual]")
-    fi
-    ((i++))
-done
-
-menu_options+=("" "")
-menu_options+=("$i" "\Z4\Zb $(translate 'Configure new PBS')\Zn")
-local choice
-choice=$(dialog --colors --backtitle "ProxMenux" --title "PBS Server Selection" \
---menu "$(translate 'Select PBS server for this backup:')" 22 70 12 "${menu_options[@]}" 3>&1 1>&2 2>&3) || return 1
-
-if [[ $choice -eq $i ]]; then
-    configure_pbs_manually || return 1
-else
-    local selected_config="${PBS_CONFIGS[$((choice-1))]}"
-    local selected_source="${PBS_SOURCES[$((choice-1))]}"
-    local selected_username="${PBS_USERNAMES[$((choice-1))]}"
-    local pbs_name="${selected_config%%|*}"
-    local source_type="${selected_source%%|*}"
-    PBS_REPO="${selected_config##*|}"
-    
-    {
-        mkdir -p "$(dirname "$PBS_REPO_FILE")"
-        echo "$PBS_REPO" > "$PBS_REPO_FILE"
-    } >/dev/null 2>&1
-    
-    local password_found=false
-    if [[ "$source_type" == "proxmox" ]]; then
-        local password_file="/etc/pve/priv/storage/${pbs_name}.pw"
-        
-        if [[ -f "$password_file" ]]; then
-            local auth_content
-            auth_content=$(<"$password_file")
-            
-
-            [[ -f "$PBS_PASS_FILE" ]] && rm "$PBS_PASS_FILE"
-            [[ -f "$PBS_TOKEN_FILE" ]] && rm "$PBS_TOKEN_FILE"
-            
-
-            if [[ "$selected_username" == *"@pbs!"* ]]; then
-
-                echo "$auth_content" > "$PBS_PASS_FILE"
-                chmod 600 "$PBS_PASS_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') PBS Cloud Token
-$(translate 'Token ID:') $selected_username" 15 80
-            elif [[ "$auth_content" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ ]]; then
-                local full_token="${selected_username}:${auth_content}"
-                echo "$full_token" > "$PBS_TOKEN_FILE"
-                chmod 600 "$PBS_TOKEN_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') API Token
-$(translate 'Token ID:') $selected_username" 15 80
-            elif [[ "$auth_content" == *":"* ]]; then
-                echo "$auth_content" > "$PBS_TOKEN_FILE"
-                chmod 600 "$PBS_TOKEN_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') API Token (Complete)" 12 80
-            else
-                echo "$auth_content" > "$PBS_PASS_FILE"
-                chmod 600 "$PBS_PASS_FILE"
-                password_found=true
-                dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using Proxmox PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Authentication:') Password" 12 80
-            fi
-        fi
-    else
-        local manual_pass_file="/usr/local/share/proxmenux/pbs-pass-${pbs_name}.txt"
-        if [[ -f "$manual_pass_file" ]]; then
-            [[ -f "$PBS_TOKEN_FILE" ]] && rm "$PBS_TOKEN_FILE"
-            
-            {
-                cp "$manual_pass_file" "$PBS_PASS_FILE"
-                chmod 600 "$PBS_PASS_FILE"
-            } >/dev/null 2>&1
-            password_found=true
-            dialog --backtitle "ProxMenux" --title "PBS Selected" --msgbox "$(translate 'Using manual PBS:') $pbs_name
-
-$(translate 'Repository:') $PBS_REPO
-$(translate 'Password:') $(translate 'Previously saved')" 12 80
-        fi
-    fi
-    
-    if ! $password_found; then
-        dialog --backtitle "ProxMenux" --title "Password Required" --msgbox "$(translate 'Password not found for:') $pbs_name
-$(translate 'Please enter the password.')" 10 60
-        get_pbs_password "$pbs_name" || return 1
-    fi
-    
-    clear
-fi
-}
-
-
-
-
-
-
-
-
-
-
-# ========== PBS BACKUP ==========
-backup_full_pbs_root() {
-    local HOSTNAME PBS_REPO PBS_KEY_FILE PBS_PASS_FILE PBS_TOKEN_FILE PBS_ENCRYPTION_PASS_FILE ENCRYPT_OPT=""
-    HOSTNAME=$(hostname)
-    
-
-    local PBS_REPO_FILE="/usr/local/share/proxmenux/pbs-repo.conf"
-    PBS_KEY_FILE="/usr/local/share/proxmenux/pbs-key.conf"
-    PBS_PASS_FILE="/usr/local/share/proxmenux/pbs-pass.txt"
-    PBS_TOKEN_FILE="/usr/local/share/proxmenux/pbs-token.txt"
-    PBS_ENCRYPTION_PASS_FILE="/usr/local/share/proxmenux/pbs-encryption-pass.txt"
-    LOGFILE="/tmp/pbs-backup-${HOSTNAME}.log"
-
-
-    configure_pbs_repository || return 1
-
-    if [[ ! -f "$PBS_REPO_FILE" ]]; then
-        msg_error "$(translate "Failed to configure PBS connection")"
-        sleep 3
-        return 1
-    fi
-    PBS_REPO=$(<"$PBS_REPO_FILE")
-
-
-    unset PBS_PASSWORD PBS_API_TOKEN PBS_API_TOKEN_ID PBS_API_TOKEN_SECRET PBS_FINGERPRINT
-
-
-    local AUTH_TYPE="password"  
-    local PBS_AUTH_VALUE=""
-    
-    if [[ "$PBS_REPO" == *"@pbs!"* ]]; then
-
-        AUTH_TYPE="pbs_cloud"
-        [[ -f "$PBS_PASS_FILE" ]] && PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    elif [[ -f "$PBS_TOKEN_FILE" ]]; then
-
-        AUTH_TYPE="token"
-        PBS_AUTH_VALUE=$(<"$PBS_TOKEN_FILE")
-    elif [[ -f "$PBS_PASS_FILE" ]]; then
-
-        AUTH_TYPE="password"
-        PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    else
-        msg_error "$(translate "No PBS authentication found!")"
-        sleep 3
-        return 1
-    fi
-
-  
-    dialog --backtitle "ProxMenux" --title "Encryption" --yesno "$(translate 'Do you want to encrypt the backup?')" 8 60
-    if [[ $? -eq 0 ]]; then
-
-        if [[ ! -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-            while true; do
-                PBS_KEY_PASS=$(dialog --backtitle "ProxMenux" --title "Encryption Password" --insecure --passwordbox "$(translate 'Enter encryption password (different from PBS login):')" 12 70 "" 3>&1 1>&2 2>&3) || return 1
-                PBS_KEY_PASS2=$(dialog --backtitle "ProxMenux" --title "Encryption Password" --insecure --passwordbox "$(translate 'Confirm encryption password:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                
-                if [[ "$PBS_KEY_PASS" == "$PBS_KEY_PASS2" ]]; then
-                    break
-                else
-                    dialog --backtitle "ProxMenux" --title "Error" --msgbox "$(translate 'Passwords do not match! Please try again.')" 8 50
-                fi
-            done
-
-
-            {
-                echo "$PBS_KEY_PASS" > "$PBS_ENCRYPTION_PASS_FILE"
-                chmod 600 "$PBS_ENCRYPTION_PASS_FILE"
-            } >/dev/null 2>&1
-            
-            dialog --backtitle "ProxMenux" --title "Success" --msgbox "$(translate 'Encryption password saved successfully!')" 8 50
-        fi
-        
-
-        if [[ ! -f "$PBS_KEY_FILE" ]]; then
-            PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-            
-            dialog --backtitle "ProxMenux" --title "Encryption" --infobox "$(translate 'Creating encryption key...')" 5 50
-            
-            expect -c "
-            set timeout 30
-            spawn proxmox-backup-client key create \"$PBS_KEY_FILE\"
-            expect {
-                \"Encryption Key Password:\" {
-                    send \"$PBS_ENCRYPTION_PASS\r\"
-                    exp_continue
-                }
-                \"Verify Password:\" {
-                    send \"$PBS_ENCRYPTION_PASS\r\"
-                    exp_continue
-                }
-                eof
-            }
-            " >/dev/null 2>&1
-
-            if [[ ! -f "$PBS_KEY_FILE" ]]; then
-                dialog --backtitle "ProxMenux" --title "Error" --msgbox "$(translate 'Error creating encryption key.')" 8 40
-                return 1
-            fi
-            
-            dialog --backtitle "ProxMenux" --title "Important" --msgbox "$(translate 'IMPORTANT: Save the key file. Without it you will not be able to restore your backups!')\n\n$(translate 'Key file location:') $PBS_KEY_FILE" 12 70
-        fi
-        ENCRYPT_OPT="--keyfile $PBS_KEY_FILE"
-    else
-        ENCRYPT_OPT=""
-    fi
-
-
-    clear
-    show_proxmenux_logo
-    echo -e
-    msg_info2 "$(translate "Starting backup to PBS")"
-    echo -e
-    echo -e "${BL}$(translate "PBS Repository:")${WHITE} $PBS_REPO${RESET}"
-    echo -e "${BL}$(translate "Backup ID:")${WHITE} $HOSTNAME${RESET}"
-    echo -e "${BL}$(translate "Included:")${WHITE} /boot/efi /etc/pve (all root)${RESET}"
-    echo -e "${BL}$(translate "Encryption:")${WHITE} $([[ -n "$ENCRYPT_OPT" ]] && echo "Enabled" || echo "Disabled")${RESET}"
-    
-
-    case "$AUTH_TYPE" in
-        "pbs_cloud") echo -e "${BL}$(translate "Authentication:")${WHITE} PBS Cloud Token${RESET}" ;;
-        "token") echo -e "${BL}$(translate "Authentication:")${WHITE} API Token${RESET}" ;;
-        "password") echo -e "${BL}$(translate "Authentication:")${WHITE} Password${RESET}" ;;
-    esac
-    
-    echo -e "${BL}$(translate "Log file:")${WHITE} $LOGFILE${RESET}"
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}-------------------------------${RESET}"
-    echo ""
-
-
-    local backup_cmd="proxmox-backup-client backup --include-dev /boot/efi --include-dev /etc/pve root-${HOSTNAME}.pxar:/ --repository \"$PBS_REPO\" $ENCRYPT_OPT --backup-type host --backup-id \"$HOSTNAME\" --backup-time \"$(date +%s)\""
-    local backup_result=0
-    
-    case "$AUTH_TYPE" in
-        "pbs_cloud")
-
-            if [[ -n "$ENCRYPT_OPT" ]]; then
-                PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                echo "$(translate "Starting encrypted full backup with PBS Cloud...")"
-                echo ""
-                
-                env -i PBS_PASSWORD="$PBS_AUTH_VALUE" expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_ENCRYPTION_PASS\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            else
-
-                echo "$(translate "Starting unencrypted full backup with PBS Cloud...")"
-                echo ""
-                env -i PBS_PASSWORD="$PBS_AUTH_VALUE" bash -c "$backup_cmd" | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            fi
-            ;;
-            
-        "token")
-
-            if [[ -n "$ENCRYPT_OPT" ]]; then
-                PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                echo "$(translate "Starting encrypted full backup with API Token...")"
-                echo ""
-                
-                env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_ENCRYPTION_PASS\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            else
-                echo "$(translate "Starting unencrypted full backup with API Token...")"
-                echo ""
-                env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" bash -c "$backup_cmd" | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            fi
-            ;;
-            
-        "password")
-
-            if [[ -n "$ENCRYPT_OPT" ]]; then
-                PBS_ENCRYPTION_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                echo "$(translate "Starting encrypted full backup with password...")"
-                echo ""
-                
-                env -i expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    -re \"Password for .*:\" {
-                        send \"$PBS_AUTH_VALUE\r\"
-                        exp_continue
-                    }
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_ENCRYPTION_PASS\r\"
-                        exp_continue
-                    }
-                    -re \"Are you sure you want to continue connecting.*\" {
-                        send \"y\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            else
-            
-                echo "$(translate "Starting unencrypted full backup with password...")"
-                echo ""
-                
-                env -i expect -c "
-                set timeout 3600
-                log_file $LOGFILE
-                spawn $backup_cmd
-                expect {
-                    -re \"Password for .*:\" {
-                        send \"$PBS_AUTH_VALUE\r\"
-                        exp_continue
-                    }
-                    -re \"Are you sure you want to continue connecting.*\" {
-                        send \"y\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " | tee -a "$LOGFILE"
-                backup_result=${PIPESTATUS[0]}
-            fi
-            ;;
-    esac
-
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-    if [[ $backup_result -eq 0 ]]; then
-        msg_ok "$(translate "Full backup process completed successfully")"
-    else
-        msg_error "$(translate "Backup process finished with errors")"
-    fi
-    
-    echo ""
-    msg_success "$(translate "Press Enter to return to the main menu...")"
-    read -r
-}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-backup_to_pbs() {
-    local HOSTNAME TIMESTAMP SNAPSHOT
-    HOSTNAME=$(hostname)
-    TIMESTAMP=$(date +%Y-%m-%d_%H-%M)
-    SNAPSHOT="${HOSTNAME}-${TIMESTAMP}"
-
-    local PBS_REPO_FILE="/usr/local/share/proxmenux/pbs-repo.conf"
-    local PBS_KEY_FILE="/usr/local/share/proxmenux/pbs-key.conf"
-    local PBS_PASS_FILE="/usr/local/share/proxmenux/pbs-pass.txt"
-    local PBS_TOKEN_FILE="/usr/local/share/proxmenux/pbs-token.txt"
-    local PBS_ENCRYPTION_PASS_FILE="/usr/local/share/proxmenux/pbs-encryption-pass.txt"
-    local PBS_REPO ENCRYPT_OPT USE_ENCRYPTION
-    local PBS_KEY_PASS PBS_REPO_PASS
-
-    configure_pbs_repository || return 1
-    PBS_REPO=$(<"$PBS_REPO_FILE")
-
-
-    unset PBS_PASSWORD PBS_API_TOKEN PBS_API_TOKEN_ID PBS_API_TOKEN_SECRET PBS_FINGERPRINT
-
-    USE_ENCRYPTION=false
-    dialog --backtitle "ProxMenux" --yesno "$(translate 'Do you want to encrypt the backup?')" 8 60
-    [[ $? -eq 0 ]] && USE_ENCRYPTION=true
-
-    if $USE_ENCRYPTION && ! command -v expect >/dev/null 2>&1; then
-        apt-get update -qq >/dev/null 2>&1
-        apt-get install -y expect >/dev/null 2>&1
-    fi
-
-    if [[ "$#" -lt 1 ]]; then
-        clear
-        show_proxmenux_logo
-        msg_error "$(translate "No directories specified for backup.")"
-        sleep 2 
-        return 1
-    fi
-
-    local TOTAL="$#"
-    local COUNT=1
-
-
-    local AUTH_TYPE="password"  
-    local PBS_AUTH_VALUE=""
-    
-    if [[ "$PBS_REPO" == *"@pbs!"* ]]; then
-
-        AUTH_TYPE="pbs_cloud"
-        [[ -f "$PBS_PASS_FILE" ]] && PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    elif [[ -f "$PBS_TOKEN_FILE" ]]; then
-
-        AUTH_TYPE="token"
-        PBS_AUTH_VALUE=$(<"$PBS_TOKEN_FILE")
-    elif [[ -f "$PBS_PASS_FILE" ]]; then
-
-        AUTH_TYPE="password"
-        PBS_AUTH_VALUE=$(<"$PBS_PASS_FILE")
-    else
-        msg_error "$(translate "No PBS authentication found!")"
-        return 1
-    fi
-
-    for dir in "$@"; do
-        local SAFE_NAME SAFE_ID PXAR_NAME
-        SAFE_NAME=$(basename "$dir" | tr '.-/' '_')
-        PXAR_NAME="root-custom-${SAFE_NAME}-${SNAPSHOT}.pxar"
-        SAFE_ID="custom-${HOSTNAME}-${SAFE_NAME}"
-
-        msg_info2 "$(translate "[$COUNT/$TOTAL] Backing up") $dir $(translate "as") $PXAR_NAME"
-
-        ENCRYPT_OPT=""
-
-        if $USE_ENCRYPTION; then
-            if [[ -f "$PBS_KEY_FILE" ]]; then
-                ENCRYPT_OPT="--keyfile $PBS_KEY_FILE"
-            else
-                while true; do
-                    PBS_KEY_PASS=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Enter encryption password (different from PBS login):')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                    PBS_KEY_PASS2=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Confirm encryption password:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                    
-                    if [[ "$PBS_KEY_PASS" == "$PBS_KEY_PASS2" ]]; then
-                        break
-                    else
-                        dialog --backtitle "ProxMenux" --msgbox "$(translate 'Passwords do not match! Please try again.')" 8 50
-                    fi
-                done
-
-                {
-                    echo "$PBS_KEY_PASS" > "$PBS_ENCRYPTION_PASS_FILE"
-                    chmod 600 "$PBS_ENCRYPTION_PASS_FILE"
-                } >/dev/null 2>&1
-
-                expect -c "
-                set timeout 30
-                spawn proxmox-backup-client key create \"$PBS_KEY_FILE\"
-                expect {
-                    \"Encryption Key Password:\" {
-                        send \"$PBS_KEY_PASS\r\"
-                        exp_continue
-                    }
-                    \"Verify Password:\" {
-                        send \"$PBS_KEY_PASS\r\"
-                        exp_continue
-                    }
-                    eof
-                }
-                " >/dev/null 2>&1
-
-                if [[ ! -f "$PBS_KEY_FILE" ]]; then
-                    dialog --backtitle "ProxMenux" --msgbox "$(translate 'Error creating encryption key.')" 8 40
-                    return 1
-                fi
-                ENCRYPT_OPT="--keyfile $PBS_KEY_FILE"
-                dialog --backtitle "ProxMenux" --msgbox "$(translate 'Encryption key generated. Save it in a safe place!')" 10 60
-            fi
-        fi
-
-        clear
-        show_proxmenux_logo
-        echo -e
-        msg_info2 "$(translate "Starting backup to PBS")"
-        TOTAL_SIZE=$(du -cb "$@" | awk '/total$/ {print $1}')
-        TOTAL_SIZE_GB=$(awk "BEGIN {printf \"%.2f\", $TOTAL_SIZE/1024/1024/1024}")
-        echo -e
-        echo -e "${BL}$(translate "PBS Repository:")${WHITE} $PBS_REPO${RESET}"
-        echo -e "${BL}$(translate "Backup ID:")${WHITE} $HOSTNAME${RESET}"
-        echo -e "${BL}$(translate "Encryption:")${WHITE} $([[ -n "$ENCRYPT_OPT" ]] && echo "Enabled" || echo "Disabled")${RESET}"
-        
-        case "$AUTH_TYPE" in
-            "pbs_cloud") echo -e "${BL}$(translate "Authentication:")${WHITE} PBS Cloud Token${RESET}" ;;
-            "token") echo -e "${BL}$(translate "Authentication:")${WHITE} API Token${RESET}" ;;
-            "password") echo -e "${BL}$(translate "Authentication:")${WHITE} Password${RESET}" ;;
-        esac
-        
-        echo -e "${BL}$(translate "Included directories:")${WHITE} $*${RESET}"
-        echo -e "${BL}$(translate "Total size:")${WHITE} ${TOTAL_SIZE_GB} GB${RESET}"
-        echo -e "${BOLD}${NEON_PURPLE_BLUE}-------------------------------${RESET}"
-
-
-        local backup_cmd="proxmox-backup-client backup \"${PXAR_NAME}:$dir\" --repository \"$PBS_REPO\" $ENCRYPT_OPT --backup-type host --backup-id \"$SAFE_ID\" --backup-time \"$(date +%s)\""
-        
-        case "$AUTH_TYPE" in
-            "pbs_cloud")
-
-                if $USE_ENCRYPTION && [[ -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-                    PBS_KEY_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                    env -i PBS_PASSWORD="$PBS_AUTH_VALUE" expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        \"Encryption Key Password:\" {
-                            send \"$PBS_KEY_PASS\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                else
-                    env -i PBS_PASSWORD="$PBS_AUTH_VALUE" bash -c "$backup_cmd"
-                fi
-                ;;
-                
-            "token")
-
-                if $USE_ENCRYPTION && [[ -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-                    PBS_KEY_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                    env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        \"Encryption Key Password:\" {
-                            send \"$PBS_KEY_PASS\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                else
-                    env -i PBS_API_TOKEN="$PBS_AUTH_VALUE" bash -c "$backup_cmd"
-                fi
-                ;;
-                
-            "password")
-
-                if $USE_ENCRYPTION && [[ -f "$PBS_ENCRYPTION_PASS_FILE" ]]; then
-                    PBS_KEY_PASS=$(<"$PBS_ENCRYPTION_PASS_FILE")
-                    env -i expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        -re \"Password for .*:\" {
-                            send \"$PBS_AUTH_VALUE\r\"
-                            exp_continue
-                        }
-                        \"Encryption Key Password:\" {
-                            send \"$PBS_KEY_PASS\r\"
-                            exp_continue
-                        }
-                        -re \"Are you sure you want to continue connecting.*\" {
-                            send \"y\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                else
-                    env -i expect -c "
-                    set timeout 300
-                    spawn $backup_cmd
-                    expect {
-                        -re \"Password for .*:\" {
-                            send \"$PBS_AUTH_VALUE\r\"
-                            exp_continue
-                        }
-                        -re \"Are you sure you want to continue connecting.*\" {
-                            send \"y\r\"
-                            exp_continue
-                        }
-                        eof
-                    }
-                    "
-                fi
-                ;;
-        esac
-
-        COUNT=$((COUNT+1))
-    done
-
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-    msg_ok "$(translate "Backup process finished.")"
-    echo ""
-    msg_success "$(translate "Press Enter to return to the main menu...")"
-    read -r
-}
-# ===============================
-
-
-
-
-
-
-
-# ========== BORGBACKUP ==========
-backup_with_borg() {
-    local BORG_APPIMAGE="/usr/local/share/proxmenux/borg"
-    local LOGFILE="/tmp/borg-backup.log"
-    local BORG_PASS_FILE="/usr/local/share/proxmenux/borg-pass.txt"
-    local BORG_KEY_FILE="/usr/local/share/proxmenux/borg-key"
-    local DEST
-    local TYPE
-    local ENCRYPT_OPT=""
-    local BORG_KEY
-
-    # Descargar BorgBackup si no existe
-    if [[ ! -x "$BORG_APPIMAGE" ]]; then
-        clear
-        show_proxmenux_logo
-        msg_info "$(translate "BorgBackup not found. Downloading AppImage...")"
-        mkdir -p /usr/local/share/proxmenux
-        wget -qO "$BORG_APPIMAGE" "https://github.com/borgbackup/borg/releases/download/1.2.8/borg-linux64"
-        chmod +x "$BORG_APPIMAGE"
-        msg_ok "$(translate "BorgBackup downloaded and ready.")"
-    fi
-
-    # Seleccionar tipo de destino
-    TYPE=$(dialog --backtitle "ProxMenux" --menu "$(translate 'Select Borg backup destination:')" 15 60 4 \
-        "local"   "$(translate 'Local directory')" \
-        "usb"     "$(translate 'Internal/External dedicated disk')" \
-        "remote"  "$(translate 'Remote server (SSH)')" \
-        "pbs"     "$(translate 'PBS-host.de Cloud')" \
-        3>&1 1>&2 2>&3) || return 1
-
-    # Configurar destino según el tipo seleccionado
-    if [[ "$TYPE" == "local" ]]; then
-        DEST=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter local directory for backup:')" 10 60 "/backup/borgbackup" 3>&1 1>&2 2>&3) || return 1
-        mkdir -p "$DEST"
-        
-    elif [[ "$TYPE" == "usb" ]]; then
-        while true; do
-            BASE_DEST=$(get_external_backup_mount_point)
-            if [[ -z "$BASE_DEST" ]]; then
-                dialog --backtitle "ProxMenux" --yesno "$(translate 'No external disk detected or mounted. Would you like to retry?')" 8 60
-                [[ $? -eq 0 ]] && continue
-                return 1
-            fi
-
-            DEST="$BASE_DEST/borgbackup"
-            mkdir -p "$DEST"
-
-            DISK_DEV=$(df "$BASE_DEST" | awk 'NR==2{print $1}')
-            PKNAME=$(lsblk -no PKNAME "$DISK_DEV" 2>/dev/null)
-            [[ -z "$PKNAME" ]] && PKNAME=$(basename "$DISK_DEV" | sed 's/[0-9]*$//')
-            if [[ -n "$PKNAME" && -b /dev/$PKNAME ]]; then
-                DISK_MODEL=$(lsblk -no MODEL "/dev/$PKNAME")
-            else
-                DISK_MODEL="(unknown)"
-            fi
-            FREE_SPACE=$(df -h "$BASE_DEST" | awk 'NR==2{print $4}')
-
-            dialog --backtitle "ProxMenux" \
-                --title "$(translate "Dedicated Backup Disk")" \
-                --yesno "\n$(translate "Mount point:") $DEST\n\n\
-            $(translate "Disk model:") $DISK_MODEL\n\
-            $(translate "Available space:") $FREE_SPACE\n\n\
-            $(translate "Use this disk for backup?")" 12 70
-
-            if [[ $? -eq 0 ]]; then
-                break
-            else
-                return 1
-            fi
-        done
-        
-    elif [[ "$TYPE" == "remote" ]]; then
-        # Servidor SSH remoto genérico
-        REMOTE_USER=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter SSH user for remote:')" 10 60 "root" 3>&1 1>&2 2>&3) || return 1
-        REMOTE_HOST=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter SSH host:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-        REMOTE_PATH=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter remote path:')" 10 60 "/backup/borgbackup" 3>&1 1>&2 2>&3) || return 1
-        
-        # Preguntar por clave SSH
-        dialog --backtitle "ProxMenux" --yesno "$(translate 'Do you want to use SSH key authentication?')" 8 60
-        if [[ $? -eq 0 ]]; then
-            SSH_KEY=$(dialog --backtitle "ProxMenux" --fselect "$HOME/.ssh/" 10 60 3>&1 1>&2 2>&3) || return 1
-            export BORG_RSH="ssh -i $SSH_KEY"
-        fi
-        
-        DEST="ssh://$REMOTE_USER@$REMOTE_HOST:$REMOTE_PATH"
-        
-    elif [[ "$TYPE" == "pbs" ]]; then
-        # ✅ PBS-host.de Cloud - CAMPOS LIMPIOS
-        PBS_CUSTOMER_ID=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter PBS customer ID (from Connect panel):')" 10 70 "" 3>&1 1>&2 2>&3) || return 1
-        PBS_SERVER=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter PBS server (from Connect panel):')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-        
-        # ✅ AUTO-DETECTAR CLAVES SSH DISPONIBLES
-        local SSH_KEYS=()
-        local SSH_KEY_NAMES=()
-        
-        # Buscar claves SSH comunes
-        for key_file in ~/.ssh/id_rsa ~/.ssh/id_ed25519 ~/.ssh/pbs_host_key ~/.ssh/id_ecdsa; do
-            if [[ -f "$key_file" && -f "${key_file}.pub" ]]; then
-                SSH_KEYS+=("$key_file")
-                local key_type=$(head -1 "${key_file}.pub" | awk '{print $1}')
-                local key_comment=$(head -1 "${key_file}.pub" | awk '{print $3}')
-                SSH_KEY_NAMES+=("$(basename "$key_file") ($key_type) - $key_comment")
-            fi
-        done
-        
-        # Si no hay claves, ofrecer crear una
-        if [[ ${#SSH_KEYS[@]} -eq 0 ]]; then
-            dialog --backtitle "ProxMenux" --yesno "$(translate 'No SSH keys found. Do you want to create one now?')" 8 60
-            if [[ $? -eq 0 ]]; then
-                clear
-                show_proxmenux_logo
-                echo -e
-                msg_info2 "$(translate "Creating SSH key for PBS-host.de...")"
-                
-                # Crear clave SSH específica para PBS
-                ssh-keygen -t rsa -b 4096 -f ~/.ssh/pbs_host_key -N "" -C "pbs-backup-$(hostname)"
-                
-                if [[ $? -eq 0 ]]; then
-                    SSH_KEY="$HOME/.ssh/pbs_host_key"
-                    msg_ok "$(translate "SSH key created successfully!")"
-                else
-                    msg_error "$(translate "Failed to create SSH key")"
-                    return 1
-                fi
-            else
-                return 1
-            fi
-        elif [[ ${#SSH_KEYS[@]} -eq 1 ]]; then
-            # Solo una clave disponible, usarla automáticamente
-            SSH_KEY="${SSH_KEYS[0]}"
-        else
-            # Múltiples claves, permitir selección
-            local menu_options=()
-            for i in "${!SSH_KEYS[@]}"; do
-                menu_options+=("$i" "${SSH_KEY_NAMES[$i]}")
-            done
-            
-            local choice
-            choice=$(dialog --backtitle "ProxMenux" --menu "$(translate 'Select SSH key to use:')" 15 80 10 "${menu_options[@]}" 3>&1 1>&2 2>&3) || return 1
-            SSH_KEY="${SSH_KEYS[$choice]}"
-        fi
-        
-        export BORG_RSH="ssh -i $SSH_KEY"
-        DEST="$PBS_CUSTOMER_ID@$PBS_SERVER:./borg"
-        
-        # ✅ MOSTRAR INFORMACIÓN Y CLAVE PÚBLICA AUTOMÁTICAMENTE
-        clear
-        show_proxmenux_logo
-        echo -e
-        msg_info2 "$(translate "PBS-host.de Configuration")"
-        echo -e "${BL}$(translate "Server:")${WHITE} $PBS_SERVER${RESET}"
-        echo -e "${BL}$(translate "Customer ID:")${WHITE} $PBS_CUSTOMER_ID${RESET}"
-        echo -e "${BL}$(translate "SSH Key:")${WHITE} $SSH_KEY${RESET}"
-        echo -e "${BOLD}${NEON_PURPLE_BLUE}-------------------------------${RESET}"
-        echo ""
-        
-        # Verificar permisos de la clave SSH
-        chmod 600 "$SSH_KEY"
-        
-        # ✅ MOSTRAR CLAVE PÚBLICA AUTOMÁTICAMENTE
-        local SSH_PUB_KEY="${SSH_KEY}.pub"
-        if [[ -f "$SSH_PUB_KEY" ]]; then
-            echo -e "${BL}$(translate "Your SSH Public Key:")${RESET}"
-            echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}"
-            echo -e "${WHITE}$(cat "$SSH_PUB_KEY")${RESET}"
-            echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}"
-            echo ""
-            
-            # ✅ OFRECER COPIAR AL PORTAPAPELES (si xclip está disponible)
-            if command -v xclip >/dev/null 2>&1; then
-                echo -e "${BL}$(translate "Copying to clipboard...")${RESET}"
-                cat "$SSH_PUB_KEY" | xclip -selection clipboard
-                msg_ok "$(translate "Public key copied to clipboard!")"
-            elif command -v pbcopy >/dev/null 2>&1; then
-                echo -e "${BL}$(translate "Copying to clipboard...")${RESET}"
-                cat "$SSH_PUB_KEY" | pbcopy
-                msg_ok "$(translate "Public key copied to clipboard!")"
-            fi
-            
-            echo ""
-            echo -e "${BL}$(translate "INSTRUCTIONS:")${RESET}"
-            echo "1. $(translate "Copy the key above (or use clipboard if available)")"
-            echo "2. $(translate "Go to PBS-host.de panel → Your datastore → Connect")"
-            echo "3. $(translate "Select 'rsync / borg / sftp' tab")"
-            echo "4. $(translate "Paste the key in 'Save SSH Key' section")"
-            echo "5. $(translate "Click 'Save'")"
-            echo ""
-            
-            # ✅ PAUSA PARA QUE EL USUARIO PUEDA COPIAR LA CLAVE
-            msg_success "$(translate "Press Enter when you have uploaded the key to PBS-host.de panel...")"
-            read -r
-        fi
-        
-        # ✅ VERIFICAR CONEXIÓN CON MEJOR FEEDBACK
-        clear
-        show_proxmenux_logo
-        echo -e
-        msg_info2 "$(translate "Testing connection to PBS-host.de...")"
-        echo ""
-        
-        echo "$(translate "Connecting... (you may need to type 'yes' to accept the server fingerprint)")"
-        echo ""
-        
-        # Test de conexión con timeout y mejor manejo
-        if timeout 30 ssh -i "$SSH_KEY" -o ConnectTimeout=10 -o BatchMode=no "$PBS_CUSTOMER_ID@$PBS_SERVER" borg --version >/dev/null 2>&1; then
-            echo ""
-            msg_ok "$(translate "✅ Connection successful! Borg is available on the server.")"
-            sleep 2
-        else
-            echo ""
-            msg_error "$(translate "❌ Connection failed or requires manual intervention.")"
-            echo ""
-            echo -e "${BL}$(translate "This could be normal if:")${RESET}"
-            echo "• $(translate "First time connecting (need to accept fingerprint)")"
-            echo "• $(translate "Key not yet uploaded to PBS-host.de panel")"
-            echo "• $(translate "Network connectivity issues")"
-            echo ""
-            
-            dialog --backtitle "ProxMenux" --yesno "$(translate 'Do you want to continue anyway? The backup will test the connection again.')" 10 70
-            if [[ $? -ne 0 ]]; then
-                return 1
-            fi
-        fi
-    fi
-
-    # ✅ MANEJO DE ENCRIPTACIÓN CON CONTRASEÑA PERSISTENTE
-    local USE_ENCRYPTION=false
-    dialog --backtitle "ProxMenux" --yesno "$(translate 'Do you want to encrypt the backup?')" 8 60
-    if [[ $? -eq 0 ]]; then
-        USE_ENCRYPTION=true
-        ENCRYPT_OPT="--encryption=repokey"
-        
-        # Verificar si ya existe una contraseña guardada
-        if [[ -f "$BORG_PASS_FILE" ]]; then
-            dialog --backtitle "ProxMenux" --yesno "$(translate 'A saved encryption passphrase exists. Use it?')" 8 60
-            if [[ $? -eq 0 ]]; then
-                BORG_KEY=$(<"$BORG_PASS_FILE")
-            else
-                # Pedir nueva contraseña
-                while true; do
-                    BORG_KEY=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Enter Borg encryption passphrase:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                    BORG_KEY2=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Confirm encryption passphrase:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                    
-                    if [[ "$BORG_KEY" == "$BORG_KEY2" ]]; then
-                        break
-                    else
-                        dialog --backtitle "ProxMenux" --msgbox "$(translate 'Passphrases do not match! Please try again.')" 8 50
-                    fi
-                done
-                
-                # Guardar la nueva contraseña
-                mkdir -p "$(dirname "$BORG_PASS_FILE")"
-                echo "$BORG_KEY" > "$BORG_PASS_FILE"
-                chmod 600 "$BORG_PASS_FILE"
-            fi
-        else
-            # No hay contraseña guardada, pedir una nueva
-            while true; do
-                BORG_KEY=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Enter Borg encryption passphrase:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                BORG_KEY2=$(dialog --backtitle "ProxMenux" --insecure --passwordbox "$(translate 'Confirm encryption passphrase:')" 10 60 "" 3>&1 1>&2 2>&3) || return 1
-                
-                if [[ "$BORG_KEY" == "$BORG_KEY2" ]]; then
-                    break
-                else
-                    dialog --backtitle "ProxMenux" --msgbox "$(translate 'Passphrases do not match! Please try again.')" 8 50
-                fi
-            done
-            
-            # Guardar la contraseña
-            mkdir -p "$(dirname "$BORG_PASS_FILE")"
-            echo "$BORG_KEY" > "$BORG_PASS_FILE"
-            chmod 600 "$BORG_PASS_FILE"
-        fi
-        
-        export BORG_PASSPHRASE="$BORG_KEY"
-    else
-        ENCRYPT_OPT="--encryption=none"
-    fi
-
-    # ✅ INICIALIZAR REPOSITORIO SI ES NECESARIO
-    if [[ "$TYPE" == "local" || "$TYPE" == "usb" ]]; then
-        if [[ ! -f "$DEST/config" ]]; then
-            dialog --backtitle "ProxMenux" --infobox "$(translate 'Initializing Borg repository...')" 5 50
-            "$BORG_APPIMAGE" init $ENCRYPT_OPT "$DEST"
-            if [[ $? -ne 0 ]]; then
-                clear
-                show_proxmenux_logo
-                msg_error "$(translate "Failed to initialize Borg repo at") $DEST"
-                sleep 5
-                return 1
-            fi
-        fi
-    elif [[ "$TYPE" == "remote" || "$TYPE" == "pbs" ]]; then
-        # Verificar si el repositorio existe o necesita inicialización
-        if ! "$BORG_APPIMAGE" list "$DEST" >/dev/null 2>&1; then
-            dialog --backtitle "ProxMenux" --yesno "$(translate 'Repository does not exist or is not accessible. Initialize it?')" 8 60
-            if [[ $? -eq 0 ]]; then
-                dialog --backtitle "ProxMenux" --infobox "$(translate 'Initializing Borg repository...')" 5 50
-                "$BORG_APPIMAGE" init $ENCRYPT_OPT "$DEST"
-                if [[ $? -ne 0 ]]; then
-                    clear
-                    show_proxmenux_logo
-                    msg_error "$(translate "Failed to initialize Borg repo at") $DEST"
-                    sleep 5
-                    return 1
-                fi
-            else
-                return 1
-            fi
-        fi
-    fi
-
-    # ✅ CONFIRMACIÓN ANTES DE INICIAR BACKUP
-    dialog --backtitle "ProxMenux" --msgbox "$(translate 'Borg backup will start now. This may take a while.')" 8 40
-
-    # ✅ MOSTRAR INFORMACIÓN DEL BACKUP
-    clear
-    show_proxmenux_logo
-    msg_info2 "$(translate "Starting backup with BorgBackup...")"
-    echo -e
-
-    TOTAL_SIZE=$(du -cb "$@" | awk '/total$/ {print $1}')
-    TOTAL_SIZE_GB=$(awk "BEGIN {printf \"%.2f\", $TOTAL_SIZE/1024/1024/1024}")
-
-    echo -e "${BL}$(translate "Destination:")${WHITE} $DEST${RESET}"
-    echo -e "${BL}$(translate "Encryption:")${WHITE} $($USE_ENCRYPTION && echo "Enabled" || echo "Disabled")${RESET}"
-    echo -e "${BL}$(translate "Included directories:")${WHITE} $*${RESET}"
-    echo -e "${BL}$(translate "Total size:")${WHITE} ${TOTAL_SIZE_GB} GB${RESET}"
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}-------------------------------${RESET}"
-
-    # ✅ EJECUTAR EL BACKUP
-    local ARCHIVE_NAME="root-$(hostname)-$(date +%Y%m%d_%H%M)"
-    
-    "$BORG_APPIMAGE" create --progress --stats --compression zstd "$DEST"::$ARCHIVE_NAME "$@" 2>&1 | tee "$LOGFILE"
-    local BACKUP_RESULT=$?
-
-    echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-    
-    if [[ $BACKUP_RESULT -eq 0 ]]; then
-        msg_ok "$(translate "Backup completed successfully!")"
-        
-        # Mostrar información del backup
-        echo -e "\n${BL}$(translate "Backup information:")${RESET}"
-        "$BORG_APPIMAGE" info "$DEST"::$ARCHIVE_NAME 2>&1 | tee -a "$LOGFILE"
-        
-        # Sugerir compactación para ahorrar espacio
-        if [[ "$TYPE" == "remote" || "$TYPE" == "pbs" ]]; then
-            echo -e "\n${BL}$(translate "Tip:")${RESET} $(translate "Run 'borg compact $DEST' to free up space after multiple backups.")"
-        fi
-    else
-        msg_error "$(translate "Backup process failed with error code:") $BACKUP_RESULT"
-    fi
-    
-    echo
-    msg_success "$(translate "Press Enter to return to the main menu...")"
-    read -r
-}
-# ===============================
-
-
-
-
-# ========== LOCAL TAR ==========
-backup_to_local_tar() {
-#    local SRC="$1"
-    local TYPE
-    local DEST
-    local LOGFILE="/tmp/tar-backup.log"
-
-
-if ! command -v pv &>/dev/null; then
-    apt-get update -qq && apt-get install -y pv >/dev/null 2>&1
-fi
-
-
-
-    TYPE=$(dialog --backtitle "ProxMenux"  --menu "$(translate 'Select backup destination:')" 15 60 2 \
-        "local" "$(translate 'Local directory')" \
-        "usb"   "$(translate 'Internal/External dedicated disk')" \
-        3>&1 1>&2 2>&3) || return 1
-
-    if [[ "$TYPE" == "local" ]]; then
-        DEST=$(dialog --backtitle "ProxMenux" --inputbox "$(translate 'Enter directory for backup:')" 10 60 "/backup" 3>&1 1>&2 2>&3) || return 1
-
-        mkdir -p "$DEST"
-
-
-else
-
-
-while true; do
-    DEST=$(get_external_backup_mount_point)
-    if [[ -z "$DEST" ]]; then
-        dialog --backtitle "ProxMenux" --yesno "No external disk detected or mounted. Would you like to retry?" 8 60
-        [[ $? -eq 0 ]] && continue
-        return 1
-    fi
-
-    DISK_DEV=$(df "$DEST" | awk 'NR==2{print $1}')
-    PKNAME=$(lsblk -no PKNAME "$DISK_DEV" 2>/dev/null)
-    [[ -z "$PKNAME" ]] && PKNAME=$(basename "$DISK_DEV" | sed 's/[0-9]*$//')
-    if [[ -n "$PKNAME" && -b /dev/$PKNAME ]]; then
-        DISK_MODEL=$(lsblk -no MODEL "/dev/$PKNAME")
-    else
-        DISK_MODEL="(unknown)"
-    fi
-    FREE_SPACE=$(df -h "$DEST" | awk 'NR==2{print $4}')
-
-
-
-    dialog --backtitle "ProxMenux" \
-    --title "$(translate "Dedicated Backup Disk")" \
-    --yesno "\n$(translate "Mount point:") $DEST\n\n\
-    $(translate "Disk model:") $DISK_MODEL\n\
-    $(translate "Available space:") $FREE_SPACE\n\n\
-    $(translate "Use this disk for backup?")" 12 70
-
-
-    if [[ $? -eq 0 ]]; then
-        mkdir -p "$DEST"
-        break
-    else
-        return 1
-    fi
-done
-
-
-
-fi
-
-
-TAR_INPUT=""
-TOTAL_SIZE=0
-for src in $SRC; do
-    sz=$(du -sb "$src" 2>/dev/null | awk '{print $1}')
-    TOTAL_SIZE=$((TOTAL_SIZE + sz))
-    TAR_INPUT="$TAR_INPUT $src"
-done
-
-local FILENAME="root-$(hostname)-$(date +%Y%m%d_%H%M).tar.gz"
-clear
-show_proxmenux_logo
-msg_info2 "$(translate "Starting backup with tar...")"
-echo -e
-
-
-TOTAL_SIZE=$(du -cb "$@" | awk '/total$/ {print $1}')
-TOTAL_SIZE_GB=$(awk "BEGIN {printf \"%.2f\", $TOTAL_SIZE/1024/1024/1024}")
-
-echo -e "${BL}$(translate "Included directories:")${WHITE} $*${RESET}"
-echo -e "${BL}$(translate "Total size:")${WHITE} ${TOTAL_SIZE_GB} GB${RESET}"
-
-tar -cf - "$@" 2> >(grep -v "Removing leading \`/'" >&2) \
-| pv -s "$TOTAL_SIZE" \
-| gzip > "$DEST/$FILENAME"
-
-
-echo -ne "\033[1A\r\033[K"
-
-echo -e "${BOLD}${NEON_PURPLE_BLUE}===============================${RESET}\n"
-msg_ok "$(translate "Backup process finished. Review log above or in /tmp/tar-backup.log")"
-echo
-msg_success "$(translate "Press Enter to return to the main menu...")"
-read -r
-
-}
-# ===============================
-
-
-host_backup_menu
diff --git a/scripts/backup_restore/backup_scheduler.sh b/scripts/backup_restore/backup_scheduler.sh
old mode 100644
new mode 100755
index 26c87d35..dd458795
--- a/scripts/backup_restore/backup_scheduler.sh
+++ b/scripts/backup_restore/backup_scheduler.sh
@@ -75,13 +75,63 @@ _list_jobs() {
   done | sort
 }
 
+# Same as _list_jobs but skips one-shot manual runs (Sprint B).
+# Manual entries are `.env` files with `MANUAL_RUN=1` — they're
+# closed executions, not configured tasks. Used by "Show jobs"
+# and "Run a job now" so those views only surface real backup
+# tasks; Delete / Toggle keep using _list_jobs so the operator
+# can still clean up leftover manual entries from those menus.
+_list_scheduled_jobs() {
+  local f id
+  for f in "$JOBS_DIR"/*.env; do
+    [[ -f "$f" ]] || continue
+    grep -q '^MANUAL_RUN=1$' "$f" 2>/dev/null && continue
+    id=$(basename "$f" .env)
+    printf '%s\n' "$id"
+  done | sort
+}
+
+# Returns 0 if the job is attached to a PVE vzdump storage (no systemd
+# timer — the trigger comes from the vzdump hook, matched by PVE_STORAGE
+# against $STOREID set by PVE for every backup phase).
+_job_is_attached() {
+  local id="$1" f
+  f=$(_job_file "$id")
+  [[ -f "$f" ]] || return 1
+  grep -q "^PVE_STORAGE=" "$f"
+}
+
+# Reads a key=val pair from the job .env file (handles `printf %q`
+# quoting that _write_job_env produces).
+_job_env_get() {
+  local id="$1" key="$2" f raw
+  f=$(_job_file "$id")
+  [[ -f "$f" ]] || return 1
+  raw=$(grep -E "^${key}=" "$f" | head -1 | cut -d'=' -f2-)
+  eval "echo $raw" 2>/dev/null || echo "$raw"
+}
+
 _show_job_status() {
   local id="$1"
-  local timer_state="disabled"
-  local service_state="unknown"
+  if _job_is_attached "$id"; then
+    local storage
+    storage=$(_job_env_get "$id" "PVE_STORAGE")
+    local enabled
+    enabled=$(_job_env_get "$id" "ENABLED")
+    [[ "$enabled" == "0" ]] && { echo "attached(disabled) → storage:$storage"; return; }
+    echo "attached → storage:$storage"
+    return
+  fi
+  local timer_state="disabled" service_state
   systemctl is-enabled --quiet "proxmenux-backup-${id}.timer" >/dev/null 2>&1 && timer_state="enabled"
   service_state=$(systemctl is-active "proxmenux-backup-${id}.service" 2>/dev/null || echo "inactive")
-  echo "${timer_state}/${service_state}"
+  if [[ "$service_state" == "active" ]]; then
+    echo "running"
+  elif [[ "$timer_state" == "enabled" ]]; then
+    echo "enabled"
+  else
+    echo "disabled"
+  fi
 }
 
 _write_job_units() {
@@ -155,10 +205,122 @@ _prompt_retention() {
   )
 }
 
+# Builds a "host backup attached to a PVE vzdump job" — no systemd
+# timer is created; the trigger is the vzdump hook that fires when
+# the parent job runs. Schedule and retention come from the parent.
+_create_job_attached() {
+  local id="$1"
+  local backend="$2"
+
+  local -a jobs=()
+  mapfile -t jobs < <(hb_pve_list_vzdump_jobs_for_backend "$backend")
+  if (( ${#jobs[@]} == 0 )); then
+    dialog --backtitle "ProxMenux" --title "$(translate "No compatible PVE jobs")" \
+      --msgbox "$(translate "No PVE vzdump job uses a") $backend $(translate "storage.")" 8 70
+    return 1
+  fi
+
+  local -a menu=()
+  local i=1 row pve_id pve_storage _ pve_schedule _pve_prune pve_enabled
+  for row in "${jobs[@]}"; do
+    IFS=$'\t' read -r pve_id pve_storage _ pve_schedule _pve_prune pve_enabled <<<"$row"
+    local label="${pve_id}  ·  ${pve_storage}  ·  ${pve_schedule}"
+    [[ "$pve_enabled" == "0" ]] && label+="  $(translate "(disabled)")"
+    menu+=("$i" "$label")
+    ((i++))
+  done
+  local sel
+  sel=$(dialog --backtitle "ProxMenux" --title "$(translate "Pick PVE vzdump job")" \
+    --menu "\n$(translate "Select the parent job to attach to:")" \
+    "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${menu[@]}" \
+    3>&1 1>&2 2>&3) || return 1
+
+  local pve_prune
+  IFS=$'\t' read -r pve_id pve_storage _ pve_schedule pve_prune pve_enabled <<<"${jobs[$((sel-1))]}"
+
+  local profile_mode
+  profile_mode=$(dialog --backtitle "ProxMenux" --title "$(translate "Profile")" \
+    --menu "\n$(translate "Select backup profile:")" 12 68 4 \
+    "default" "Default critical paths" \
+    "custom"  "Custom selected paths" \
+    3>&1 1>&2 2>&3) || return 1
+
+  local -a paths=()
+  hb_select_profile_paths "$profile_mode" paths || return 1
+
+  local -a lines=(
+    "JOB_ID=$id"
+    "BACKEND=$backend"
+    "PVE_PARENT_JOB=$pve_id"
+    "PVE_STORAGE=$pve_storage"
+    "PROFILE_MODE=$profile_mode"
+    "ENABLED=1"
+  )
+
+  # Inherit retention from the parent job (one KEEP_* per prune-backups key).
+  local kv
+  while IFS= read -r kv; do
+    [[ -n "$kv" ]] && lines+=("$kv")
+  done < <(hb_pve_prune_to_keep_env "$pve_prune")
+
+  case "$backend" in
+    pbs)
+      hb_select_pbs_repository || return 1
+      local bid
+      bid="hostcfg-$(hostname)"
+      bid=$(dialog --backtitle "ProxMenux" --title "PBS" \
+        --inputbox "$(translate "Backup ID for this job:")" \
+        "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "$bid" 3>&1 1>&2 2>&3) || return 1
+      bid=$(echo "$bid" | tr -cs '[:alnum:]_-' '-' | sed 's/-*$//')
+      lines+=(
+        "PBS_REPOSITORY=${HB_PBS_REPOSITORY}"
+        "PBS_PASSWORD=${HB_PBS_SECRET}"
+        "PBS_BACKUP_ID=${bid}"
+      )
+      ;;
+    local)
+      # Derive the dump directory from the storage entry. PVE stores
+      # vzdump archives under <path>/dump/ when the storage is dir/nfs.
+      local dest_dir="/var/lib/vz/dump"
+      local sp
+      sp=$(awk -v sid="$pve_storage" '
+          /^[a-z]+:[[:space:]]/ { in_block=($2==sid) }
+          in_block && /^[[:space:]]+path[[:space:]]/ { sub(/^[[:space:]]+path[[:space:]]+/,""); print; exit }
+      ' /etc/pve/storage.cfg) || true
+      [[ -n "$sp" ]] && dest_dir="${sp%/}/dump"
+      lines+=("LOCAL_DEST_DIR=$dest_dir" "LOCAL_ARCHIVE_EXT=tar.zst")
+      ;;
+  esac
+
+  _write_job_env "$(_job_file "$id")" "${lines[@]}"
+  : > "$(_job_paths_file "$id")"
+  local p
+  for p in "${paths[@]}"; do
+    echo "$p" >> "$(_job_paths_file "$id")"
+  done
+
+  # No unit / timer — the trigger is the vzdump hook fired by the parent PVE job.
+  hb_install_vzdump_hook >/dev/null 2>&1 || \
+    msg_warn "$(translate "Could not install vzdump hook in /etc/vzdump.conf")"
+
+  show_proxmenux_logo
+  msg_title "$(translate "Host backup attached to PVE job")"
+  echo
+  echo -e "${TAB}${BGN}$(translate "Job ID:")${CL} ${BL}${id}${CL}"
+  echo -e "${TAB}${BGN}$(translate "Attached to PVE job:")${CL} ${BL}${pve_id}${CL}"
+  echo -e "${TAB}${BGN}$(translate "Inherited schedule:")${CL} ${BL}${pve_schedule}${CL}"
+  echo -e "${TAB}${BGN}$(translate "Inherited retention:")${CL} ${BL}${pve_prune}${CL}"
+  echo -e "${TAB}${BGN}$(translate "Backend:")${CL} ${BL}${backend} → ${pve_storage}${CL}"
+  echo
+  msg_success "$(translate "Press Enter to continue...")"
+  read -r
+  return 0
+}
+
 _create_job() {
   local id backend on_calendar profile_mode
   id=$(dialog --backtitle "ProxMenux" --title "$(translate "New backup job")" \
-    --inputbox "$(translate "Job ID (letters, numbers, - _)")" 9 68 "hostcfg-daily" 3>&1 1>&2 2>&3) || return 1
+    --inputbox "$(translate "Job ID (letters, numbers, - _)")" 9 68 "my-host-backup" 3>&1 1>&2 2>&3) || return 1
   [[ -z "$id" ]] && return 1
   id=$(echo "$id" | tr -cs '[:alnum:]_-' '-' | sed 's/^-*//; s/-*$//')
   [[ -z "$id" ]] && return 1
@@ -175,6 +337,31 @@ _create_job() {
     "pbs"   "Proxmox Backup Server" \
     3>&1 1>&2 2>&3) || return 1
 
+  # Offer attach-mode for backends that map to a PVE storage. The
+  # vzdump scheduler in PVE already handles trigger + retention for
+  # VM/CT backups; the host backup can ride alongside it via a hook.
+  # Borg has no PVE-side scheduler, so attach makes no sense there.
+  if [[ "$backend" == "pbs" || "$backend" == "local" ]]; then
+    local creation_mode
+    creation_mode=$(dialog --backtitle "ProxMenux" --title "$(translate "How to schedule")" \
+      --menu "\n$(translate "Choose how this host backup will be triggered:")" 14 78 4 \
+      "new"    "$(translate "New scheduled job (own timer + retention)")" \
+      "attach" "$(translate "Attach to an existing PVE vzdump job (inherit schedule + retention)")" \
+      3>&1 1>&2 2>&3) || return 1
+    if [[ "$creation_mode" == "attach" ]]; then
+      # If no compatible PVE job exists yet, show a helpful pointer
+      # instead of silently dropping back to "new" mode.
+      if [[ -z "$(hb_pve_list_vzdump_jobs_for_backend "$backend" 2>/dev/null | head -1)" ]]; then
+        dialog --backtitle "ProxMenux" --title "$(translate "No compatible PVE jobs")" \
+          --msgbox "$(translate "No PVE vzdump job uses a") $backend $(translate "storage yet.")"$'\n\n'"$(translate "Create one first in Datacenter → Backup, then return here to attach.")" \
+          12 78
+        return 1
+      fi
+      _create_job_attached "$id" "$backend"
+      return $?
+    fi
+  fi
+
   on_calendar=$(dialog --backtitle "ProxMenux" --title "$(translate "Schedule")" \
     --inputbox "$(translate "systemd OnCalendar expression")"$'\n'"$(translate "Example: daily or Mon..Fri 03:00")" \
     11 72 "daily" 3>&1 1>&2 2>&3) || return 1
@@ -204,7 +391,7 @@ _create_job() {
   case "$backend" in
     local)
       local dest_dir ext
-      dest_dir=$(hb_prompt_dest_dir) || return 1
+      dest_dir=$(hb_select_local_target) || return 1
       ext=$(dialog --backtitle "ProxMenux" --title "$(translate "Archive format")" \
         --menu "\n$(translate "Select local archive format:")" 12 62 4 \
         "tar.zst" "tar + zstd (preferred)" \
@@ -225,18 +412,32 @@ _create_job() {
       ;;
     pbs)
       hb_select_pbs_repository || return 1
-      hb_ask_pbs_encryption
+      # Propagate the operator cancel from the encryption dialog so the
+      # wizard drops back to the previous step instead of saving a job
+      # spec with a half-configured encryption block.
+      hb_ask_pbs_encryption || return 1
       local bid
       bid="hostcfg-$(hostname)"
       bid=$(dialog --backtitle "ProxMenux" --title "PBS" \
         --inputbox "$(translate "Backup ID for this job:")" \
         "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "$bid" 3>&1 1>&2 2>&3) || return 1
       bid=$(echo "$bid" | tr -cs '[:alnum:]_-' '-' | sed 's/-*$//')
+      # PBS_KEYFILE: `hb_ask_pbs_encryption` sets HB_PBS_KEYFILE_OPT
+      # to the FULL CLI flag string ("--keyfile /path") when
+      # encryption is accepted, and leaves it empty otherwise. The
+      # previous read of `HB_PBS_KEYFILE` was picking up an unset
+      # variable and always wrote an empty PBS_KEYFILE — so the
+      # Monitor Web (which detects encryption from a non-empty
+      # PBS_KEYFILE line) surfaced every CLI-created encrypted job
+      # as unencrypted. Derive the canonical path from
+      # HB_PBS_KEYFILE_OPT presence instead.
+      local pbs_kf_val=""
+      [[ -n "${HB_PBS_KEYFILE_OPT:-}" ]] && pbs_kf_val="$HB_STATE_DIR/pbs-key.conf"
       lines+=(
         "PBS_REPOSITORY=${HB_PBS_REPOSITORY}"
         "PBS_PASSWORD=${HB_PBS_SECRET}"
         "PBS_BACKUP_ID=${bid}"
-        "PBS_KEYFILE=${HB_PBS_KEYFILE:-}"
+        "PBS_KEYFILE=${pbs_kf_val}"
         "PBS_ENCRYPTION_PASSWORD=${HB_PBS_ENC_PASS:-}"
       )
       ;;
@@ -269,19 +470,37 @@ _create_job() {
 _pick_job() {
   local title="$1"
   local __out_var="$2"
+  # Optional scope: "all" (default) surfaces every .env in JOBS_DIR
+  # including one-shot manual runs; "scheduled" filters those out so
+  # Run-now only shows real configured tasks. Delete / Toggle keep
+  # the default so the operator can still clean up manual leftovers.
+  local scope="${3:-all}"
 
   local -a ids=()
-  mapfile -t ids < <(_list_jobs)
+  if [[ "$scope" == "scheduled" ]]; then
+    mapfile -t ids < <(_list_scheduled_jobs)
+  else
+    mapfile -t ids < <(_list_jobs)
+  fi
   if [[ ${#ids[@]} -eq 0 ]]; then
     dialog --backtitle "ProxMenux" --title "$(translate "No jobs")" \
       --msgbox "$(translate "No scheduled backup jobs found.")" 8 62
     return 1
   fi
 
+  # Build the menu rows. The loop variable is INTENTIONALLY named
+  # `_iter_id` (not `id`) — every caller passes "id" as $__out_var so
+  # the nameref below should point at the caller's local. A loop
+  # variable named `id` here would shadow it, and the nameref would
+  # silently write into _pick_job's own scope instead, leaving the
+  # caller with an empty string. That manifested as:
+  #   ✓ Job timer enabled: (empty)
+  #   run_scheduled_backup.sh: Usage: ... <job_id>
+  # Both reported on 2026-06-07.
   local -a menu=()
-  local i=1 id
-  for id in "${ids[@]}"; do
-    menu+=("$i" "$id [$(_show_job_status "$id")]")
+  local i=1 _iter_id
+  for _iter_id in "${ids[@]}"; do
+    menu+=("$i" "$_iter_id [$(_show_job_status "$_iter_id")]")
     ((i++))
   done
   local sel
@@ -295,29 +514,101 @@ _pick_job() {
   return 0
 }
 
+# Common screen reset for any post-dialog action result. The
+# `dialog` calls in this script leave their box drawn on screen
+# even after the user has confirmed; without this reset, the
+# subsequent msg_ok / msg_warn / "Press Enter" output renders
+# in the bottom-left corner UNDER the leftover dialog box.
+# show_proxmenux_logo already runs `clear` internally, so we
+# don't add another one — the convention used across proxmenux
+# (create_vm_menu.sh, config_menu.sh, menu_post_install.sh) is:
+#     show_proxmenux_logo → msg_title → result message
+# Reported 2026-06-07 when the operator hit "Run job now" and
+# saw "Job executed successfully" floating over the picker.
+_render_action_screen() {
+  show_proxmenux_logo
+  msg_title "$1"
+}
+
 _job_run_now() {
+  # "scheduled" scope — one-shot manual runs are closed executions,
+  # not tasks to re-fire. Filtering them out of this picker prevents
+  # accidental re-runs of an operator's past manual backups.
   local id=""
-  _pick_job "$(translate "Run job now")" id || return 1
+  _pick_job "$(translate "Run job now")" id scheduled || return 1
+  # Defensive guard against a future regression of the nameref-shadowing
+  # bug that left $id empty here on 2026-06-07. Without this, the runner
+  # gets called with no argument and emits "Usage: ... <job_id>".
+  if [[ -z "$id" ]]; then
+    _render_action_screen "$(translate "Run job now")"
+    msg_error "$(translate "Job selection returned empty id — aborting.")"
+    msg_success "$(translate "Press Enter to continue...")"
+    read -r
+    return 1
+  fi
+
   local runner="$LOCAL_SCRIPTS/backup_restore/run_scheduled_backup.sh"
   [[ ! -f "$runner" ]] && runner="$SCRIPT_DIR/run_scheduled_backup.sh"
-  if "$runner" "$id"; then
-    msg_ok "$(translate "Job executed successfully.")"
-  else
-    msg_warn "$(translate "Job execution finished with errors. Check logs.")"
-  fi
+
+  # Foreground execution — the runner detects TTY and prints a
+  # colored progress layout (mirrors _bk_local in backup_host.sh).
+  # Plain-text log file is still written for audit / scheduler runs.
+  _render_action_screen "$(translate "Running backup job:") $id"
+  echo
+  "$runner" "$id"
+  local runner_exit
+  runner_exit=$?
+
+  echo
   msg_success "$(translate "Press Enter to continue...")"
   read -r
+  return $runner_exit
 }
 
 _job_toggle() {
+  # "scheduled" scope — one-shot manual runs carry ENABLED=0 by
+  # definition and can't be re-fired from a timer, so offering them
+  # in this picker was noise. Delete keeps the "all" scope so the
+  # operator can still clean up manual entries from that menu.
   local id=""
-  _pick_job "$(translate "Enable/Disable job")" id || return 1
-  if systemctl is-enabled --quiet "proxmenux-backup-${id}.timer" >/dev/null 2>&1; then
-    systemctl disable --now "proxmenux-backup-${id}.timer" >/dev/null 2>&1 || true
-    msg_warn "$(translate "Job timer disabled:") $id"
+  _pick_job "$(translate "Enable/Disable job")" id scheduled || return 1
+  if [[ -z "$id" ]]; then
+    _render_action_screen "$(translate "Enable/Disable job")"
+    msg_error "$(translate "Job selection returned empty id — aborting.")"
+    msg_success "$(translate "Press Enter to continue...")"
+    read -r
+    return 1
+  fi
+
+  local action_label
+  if _job_is_attached "$id"; then
+    # Attached jobs have no systemd timer — flip the ENABLED flag in
+    # the .env so the vzdump hook respects it on the next parent run.
+    local f current
+    f=$(_job_file "$id")
+    current=$(_job_env_get "$id" "ENABLED")
+    if [[ "$current" == "0" ]]; then
+      sed -i 's/^ENABLED=.*/ENABLED=1/' "$f"
+      action_label="enabled"
+    else
+      sed -i 's/^ENABLED=.*/ENABLED=0/' "$f"
+      action_label="disabled"
+    fi
   else
-    systemctl enable --now "proxmenux-backup-${id}.timer" >/dev/null 2>&1 || true
-    msg_ok "$(translate "Job timer enabled:") $id"
+    if systemctl is-enabled --quiet "proxmenux-backup-${id}.timer" >/dev/null 2>&1; then
+      systemctl disable --now "proxmenux-backup-${id}.timer" >/dev/null 2>&1 || true
+      action_label="disabled"
+    else
+      systemctl enable --now "proxmenux-backup-${id}.timer" >/dev/null 2>&1 || true
+      action_label="enabled"
+    fi
+  fi
+
+  _render_action_screen "$(translate "Enable/Disable job")"
+  if [[ "$action_label" == "disabled" ]]; then
+    msg_warn "$(translate "Job disabled:") $id"
+  else
+    msg_ok "$(translate "Job enabled:") $id"
   fi
   msg_success "$(translate "Press Enter to continue...")"
   read -r
@@ -326,13 +617,34 @@ _job_toggle() {
 _job_delete() {
   local id=""
   _pick_job "$(translate "Delete job")" id || return 1
+  # An empty id here would build malformed unit paths like
+  # /etc/systemd/system/proxmenux-backup-.timer, and the subsequent
+  # rm -f would silently no-op against bogus paths — making it LOOK
+  # like a successful delete while the real job stays untouched.
+  if [[ -z "$id" ]]; then
+    _render_action_screen "$(translate "Delete job")"
+    msg_error "$(translate "Job selection returned empty id — aborting.")"
+    msg_success "$(translate "Press Enter to continue...")"
+    read -r
+    return 1
+  fi
+  local confirm_body
+  confirm_body="$(translate "Delete scheduled backup job?")"$'\n\n'"ID: ${id}"
+  if _job_is_attached "$id"; then
+    local storage
+    storage=$(_job_env_get "$id" "PVE_STORAGE")
+    confirm_body+=$'\n'"$(translate "Type: attached to PVE storage") ${storage}"
+    confirm_body+=$'\n\n'"$(translate "Only the host backup hook is removed — PVE vzdump jobs targeting this storage stay intact.")"
+  fi
   if ! whiptail --title "$(translate "Confirm delete")" \
-    --yesno "$(translate "Delete scheduled backup job?")"$'\n\n'"ID: ${id}" 10 66; then
+    --yesno "$confirm_body" 14 70; then
     return 1
   fi
   systemctl disable --now "proxmenux-backup-${id}.timer" >/dev/null 2>&1 || true
   rm -f "$(_service_file "$id")" "$(_timer_file "$id")" "$(_job_file "$id")" "$(_job_paths_file "$id")"
   systemctl daemon-reload >/dev/null 2>&1 || true
+
+  _render_action_screen "$(translate "Delete job")"
   msg_ok "$(translate "Job deleted:") $id"
   msg_success "$(translate "Press Enter to continue...")"
   read -r
@@ -341,21 +653,79 @@ _job_delete() {
 _show_jobs() {
   local tmp
   tmp=$(mktemp) || return
+
+  # Per-job block: header line with status badge + 3 detail lines
+  # summarising the backend destination and the last run — same
+  # information the Monitor UI shows on the Backups tab, condensed
+  # for the shell dialog.
+  local -a job_ids=()
+  local id
+  while IFS= read -r id; do
+    [[ -z "$id" ]] && continue
+    job_ids+=("$id")
+  done < <(_list_scheduled_jobs)
+
   {
     echo "=== $(translate "Scheduled backup jobs") ==="
     echo ""
-    local id
-    while IFS= read -r id; do
-      [[ -z "$id" ]] && continue
-      echo "• $id   [$(_show_job_status "$id")]"
-      if [[ -f "${LOG_DIR}/${id}-last.status" ]]; then
-        sed 's/^/    /' "${LOG_DIR}/${id}-last.status"
-      fi
-      echo ""
-    done < <(_list_jobs)
+    if [[ ${#job_ids[@]} -eq 0 ]]; then
+      translate "No scheduled backup jobs configured."
+    else
+      local status backend dest label profile last_run last_result
+      for id in "${job_ids[@]}"; do
+        status=$(_show_job_status "$id")
+        backend=$(_job_env_get "$id" BACKEND || echo "")
+        profile=$(_job_env_get "$id" PROFILE_MODE || echo default)
+        case "$backend" in
+          pbs)
+            local pbs_repo pbs_bid
+            pbs_repo=$(_job_env_get "$id" PBS_REPOSITORY || echo "?")
+            pbs_bid=$(_job_env_get "$id" PBS_BACKUP_ID || echo "?")
+            dest="$pbs_repo  (id=$pbs_bid)"
+            label="PBS"
+            ;;
+          local)
+            dest=$(_job_env_get "$id" LOCAL_DEST_DIR || echo "?")
+            label="Local archive"
+            ;;
+          borg)
+            dest=$(_job_env_get "$id" BORG_REPO || echo "?")
+            label="Borg"
+            ;;
+          *)
+            dest="?"
+            label="${backend:-?}"
+            ;;
+        esac
+        last_run=""; last_result=""
+        if [[ -f "${LOG_DIR}/${id}-last.status" ]]; then
+          local last_at
+          last_at=$(grep -m1 '^RUN_AT=' "${LOG_DIR}/${id}-last.status" | cut -d= -f2-)
+          last_result=$(grep -m1 '^RESULT=' "${LOG_DIR}/${id}-last.status" | cut -d= -f2-)
+          # Trim the timezone suffix for readability (14:13:54 vs 14:13:54+02:00)
+          last_run="${last_at%%+*}"
+          last_run="${last_run%%-[0-9][0-9]:[0-9][0-9]}"
+          last_run="${last_run/T/ }"
+        fi
+
+        printf "• %s   [%s]\n" "$id" "$status"
+        printf "    %-9s %s · %s\n" "$(translate "Backend:")" "$label" "$dest"
+        printf "    %-9s %s\n" "$(translate "Profile:")" "$profile"
+        if [[ -n "$last_run" ]]; then
+          printf "    %-9s %s  →  %s\n" "$(translate "Last run:")" "$last_run" "${last_result:-?}"
+        else
+          printf "    %-9s %s\n" "$(translate "Last run:")" "$(translate "never")"
+        fi
+        echo ""
+      done
+    fi
   } > "$tmp"
+
+  # Same window size as the parent scheduler menu — keeps the
+  # dimensions consistent across the flow instead of one dialog
+  # shrinking or growing per view.
   dialog --backtitle "ProxMenux" --title "$(translate "Scheduled backup jobs")" \
-    --textbox "$tmp" 28 100 || true
+    --textbox "$tmp" "$HB_UI_MENU_H" "$HB_UI_MENU_W" || true
   rm -f "$tmp"
 }
 
diff --git a/scripts/backup_restore/collectors/build_manifest.sh b/scripts/backup_restore/collectors/build_manifest.sh
new file mode 100755
index 00000000..1c60dcd0
--- /dev/null
+++ b/scripts/backup_restore/collectors/build_manifest.sh
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup manifest orchestrator
+# ==========================================================
+# Composes the six collectors into one manifest.json that
+# validates against schema/manifest.schema.json. Designed to
+# be called by backup_host.sh during a backup run. Read-only
+# (no side effects on the host).
+#
+# Usage:
+#   build_manifest.sh [--paths-archived <path1> <path2> ...]
+#   build_manifest.sh --validate  (re-runs the JSON Schema validation)
+#
+# Stdout: pretty-printed manifest JSON.
+# Stderr: progress + warnings.
+# ==========================================================
+set -euo pipefail
+
+COLLECTORS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCHEMA_FILE="$COLLECTORS_DIR/../schema/manifest.schema.json"
+
+# Parse flags
+paths_archived='null'
+do_validate=0
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --paths-archived)
+      shift
+      tmp='[]'
+      while [[ $# -gt 0 && "$1" != --* ]]; do
+        tmp="$(jq --argjson a "$tmp" --arg p "$1" -n '$a + [$p]')"
+        shift
+      done
+      paths_archived="$tmp"
+      ;;
+    --validate)
+      do_validate=1; shift ;;
+    -h|--help)
+      sed -nE '/^# Usage:/,/^# Stderr:/p' "$0" | sed -E 's/^# ?//' >&2
+      exit 0
+      ;;
+    *) shift ;;
+  esac
+done
+
+# Run each collector. If a collector fails we fall back to a safe default
+# (empty array / null object) and warn — the manifest is still useful even
+# if one section is incomplete.
+run_collector() {
+  local name="$1" fallback="$2"
+  local out
+  if out="$(bash "$COLLECTORS_DIR/$name" 2>>/tmp/proxmenux-manifest-stderr.log)"; then
+    printf '%s' "$out"
+  else
+    printf 'warning: collector %s failed; using fallback\n' "$name" >&2
+    printf '%s' "$fallback"
+  fi
+}
+
+# Empty error log first so we can attribute failures to this run.
+: >/tmp/proxmenux-manifest-stderr.log
+
+source_host="$(run_collector            collect_source_host.sh     '{}')"
+hardware_inventory="$(run_collector     collect_hardware.sh        '{"gpu":[],"tpu":[],"nic":[],"wireless":[]}')"
+storage_inventory="$(run_collector      collect_storage.sh         '{"zfs_pools":[],"lvm":{"vgs":[]},"physical_disks":[],"pve_storage_cfg":[],"mounts":[]}')"
+installed_components="$(run_collector   collect_proxmenux_state.sh '[]')"
+kernel_params="$(run_collector          collect_kernel.sh          '{"cmdline_extra":[],"modules_loaded_at_boot":[],"modprobe_d_files":[]}')"
+guests="$(run_collector                 collect_guests.sh          '{"vms":[],"lxcs":[]}')"
+
+created_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+# Compose the final manifest. The wrapper key matches the schema:
+# the top level is a single "proxmenux_backup_manifest" object.
+manifest="$(jq -n \
+  --arg created_at           "$created_at" \
+  --arg created_by           "proxmenux-host-backup/1.3.0" \
+  --argjson source_host      "$source_host" \
+  --argjson hardware         "$hardware_inventory" \
+  --argjson storage          "$storage_inventory" \
+  --argjson components       "$installed_components" \
+  --argjson kernel           "$kernel_params" \
+  --argjson guests           "$guests" \
+  --argjson paths_archived   "$paths_archived" \
+  '{
+    proxmenux_backup_manifest: {
+      schema_version:                  1,
+      created_at:                      $created_at,
+      created_by:                      $created_by,
+      source_host:                     $source_host,
+      hardware_inventory:              $hardware,
+      storage_inventory:               $storage,
+      proxmenux_installed_components:  $components,
+      kernel_params:                   $kernel,
+      vms_lxcs_at_backup:              $guests,
+      backup_metadata: {
+        encrypted:          false,
+        encryption_format:  null,
+        compression:        "zstd",
+        paths_archived:     $paths_archived,
+        sha256_archive:     null,
+        size_bytes:         null
+      }
+    }
+  }')"
+
+# Optional validation step. If python3 + jsonschema are available, run
+# them; otherwise silently skip (validation is mostly a developer aid).
+if [[ "$do_validate" == 1 ]]; then
+  if command -v python3 >/dev/null 2>&1 && python3 -c 'import jsonschema' 2>/dev/null; then
+    printf '%s' "$manifest" | python3 -c "
+import json, sys, jsonschema
+schema = json.load(open('$SCHEMA_FILE'))
+inst   = json.load(sys.stdin)
+try:
+    jsonschema.validate(instance=inst, schema=schema)
+    print('manifest: validates against schema', file=sys.stderr)
+except jsonschema.exceptions.ValidationError as e:
+    print(f'manifest: SCHEMA VIOLATION at {list(e.absolute_path)}: {e.message}', file=sys.stderr)
+    sys.exit(1)
+"
+  else
+    printf 'manifest: jsonschema python module not present; skipping validation\n' >&2
+  fi
+fi
+
+printf '%s\n' "$manifest"
diff --git a/scripts/backup_restore/collectors/collect_guests.sh b/scripts/backup_restore/collectors/collect_guests.sh
new file mode 100755
index 00000000..fee3e74a
--- /dev/null
+++ b/scripts/backup_restore/collectors/collect_guests.sh
@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup manifest collector — vms_lxcs_at_backup
+# ==========================================================
+# Enumerates VMs (qm list) and LXCs (pct list) on this PVE node.
+# Read-only; emits the metadata only — actual VM/LXC data is
+# the responsibility of vzdump / PBS, not this manifest.
+# Schema: scripts/backup_restore/schema/manifest.schema.json
+# ==========================================================
+set -euo pipefail
+
+vms='[]'
+lxcs='[]'
+
+# ── VMs (qm list) ──
+# Output:
+#       VMID NAME                 STATUS     MEM(MB)    BOOTDISK(GB) PID
+#        100 Alpine-Linux-3-21    stopped    4096               0.00 0
+# Header line starts with VMID; we skip it.
+if command -v qm >/dev/null 2>&1; then
+  while IFS= read -r line; do
+    [[ -z "$line" ]] && continue
+    # Skip the header
+    [[ "$line" =~ ^[[:space:]]*VMID[[:space:]] ]] && continue
+    # Parse positionally. NAME can contain spaces, but `qm list` pads/columns
+    # them, so we use fixed positions: VMID at col 1, STATUS as the 3rd
+    # whitespace-delimited token from the END (mem, bootdisk, pid are after).
+    vmid="$(printf '%s' "$line" | awk '{print $1}')"
+    [[ "$vmid" =~ ^[0-9]+$ ]] || continue
+    # Strip trailing PID + BOOTDISK + MEM(MB) + STATUS to extract the NAME.
+    # rev → cut → rev technique:
+    trailing="$(printf '%s' "$line" | awk '{printf "%s %s %s %s", $(NF-3), $(NF-2), $(NF-1), $NF}')"
+    status="$(printf '%s' "$trailing" | awk '{print $1}')"
+    memory_mb="$(printf '%s' "$trailing" | awk '{print $2}')"
+    bootdisk_gb="$(printf '%s' "$trailing" | awk '{print $3}')"
+    # Name: drop first column (vmid) and last 4 columns
+    name="$(printf '%s' "$line" | awk '{$1=""; for(i=NF-3;i<=NF;i++) $i=""; sub(/^[[:space:]]+/,""); sub(/[[:space:]]+$/,""); print}')"
+    case "$status" in
+      running|stopped|paused) ;;
+      *) status="stopped" ;;
+    esac
+
+    vms="$(jq --argjson acc "$vms" \
+      --argjson vmid "$vmid" \
+      --arg name "$name" \
+      --argjson memory_mb "${memory_mb:-0}" \
+      --argjson bootdisk_gb "${bootdisk_gb:-0}" \
+      --arg status "$status" \
+      -n '
+      $acc + [{
+        vmid:        $vmid,
+        name:        $name,
+        memory_mb:   $memory_mb,
+        bootdisk_gb: $bootdisk_gb,
+        status:      $status,
+        config_file: ("configs/qemu-server/" + ($vmid|tostring) + ".conf")
+      }]
+      ')"
+  done < <(qm list 2>/dev/null || true)
+fi
+
+# ── LXCs (pct list) ──
+# Output:
+#   VMID       Status     Lock         Name
+#   101        running                 alpine
+# Header line starts with VMID; we skip it.
+if command -v pct >/dev/null 2>&1; then
+  while IFS= read -r line; do
+    [[ -z "$line" ]] && continue
+    [[ "$line" =~ ^[[:space:]]*VMID[[:space:]] ]] && continue
+    vmid="$(printf '%s' "$line" | awk '{print $1}')"
+    [[ "$vmid" =~ ^[0-9]+$ ]] || continue
+    status="$(printf '%s' "$line" | awk '{print $2}')"
+    # Lock column is sparse; name is always last positional non-empty token
+    name="$(printf '%s' "$line" | awk '{print $NF}')"
+    case "$status" in
+      running|stopped) ;;
+      *) status="stopped" ;;
+    esac
+
+    lxcs="$(jq --argjson acc "$lxcs" \
+      --argjson vmid "$vmid" \
+      --arg name "$name" \
+      --arg status "$status" \
+      -n '
+      $acc + [{
+        vmid:        $vmid,
+        name:        $name,
+        status:      $status,
+        config_file: ("configs/lxc/" + ($vmid|tostring) + ".conf")
+      }]
+      ')"
+  done < <(pct list 2>/dev/null || true)
+fi
+
+jq -n --argjson vms "$vms" --argjson lxcs "$lxcs" \
+  '{ vms: $vms, lxcs: $lxcs }'
diff --git a/scripts/backup_restore/collectors/collect_hardware.sh b/scripts/backup_restore/collectors/collect_hardware.sh
new file mode 100755
index 00000000..2db1335e
--- /dev/null
+++ b/scripts/backup_restore/collectors/collect_hardware.sh
@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup manifest collector — hardware_inventory
+# ==========================================================
+# Detects GPUs (with vendor → ProxMenux installer mapping),
+# TPUs (Coral PCIe/USB), NICs (with bridge membership), and
+# Wireless interfaces. Read-only. Schema:
+# scripts/backup_restore/schema/manifest.schema.json
+# ==========================================================
+set -euo pipefail
+
+# Vendor → installer path mapping. Update when ProxMenux adds new
+# installers for hardware that depends on out-of-tree drivers.
+# Vendors WITHOUT a mapping get null (e.g. Intel/AMD iGPUs work with
+# in-tree drivers, no special installer needed).
+gpu_installer_for() {
+  case "$1" in
+    NVIDIA) echo "scripts/gpu_tpu/nvidia_installer.sh" ;;
+    *)      echo "" ;;
+  esac
+}
+
+# ── GPUs ──
+# lspci -nnD outputs:
+#   0000:01:00.0 VGA compatible controller [0300]: NVIDIA Corporation GP107GL [Quadro P620] [10de:1cb6] (rev a1)
+# We pick anything classified as VGA/3D/Display (display controllers).
+gpu_array='[]'
+while IFS= read -r line; do
+  [[ -z "$line" ]] && continue
+  pci_address="$(printf '%s' "$line" | awk '{print $1}')"
+  pci_id="$(printf '%s' "$line" | grep -oE '\[[0-9a-f]{4}:[0-9a-f]{4}\]' | tail -1 | tr -d '[]')"
+  # Description: everything between the "controller]:" header and the
+  # final "[pci_id]" tag. For AMD this includes the [AMD/ATI] tag; for
+  # NVIDIA/Intel it's just vendor + model.
+  desc="$(printf '%s' "$line" | sed -nE "s@.*\]:[[:space:]]*(.*)[[:space:]]+\[[0-9a-f]{4}:[0-9a-f]{4}\].*@\1@p")"
+
+  # Vendor classification
+  case "$desc" in
+    *NVIDIA*)                          vendor="NVIDIA" ;;
+    *"Advanced Micro Devices"*|*AMD*)  vendor="AMD" ;;
+    *"Intel Corporation"*|*Intel*)     vendor="Intel" ;;
+    *)                                  vendor="Other" ;;
+  esac
+
+  # Model: strip every known vendor prefix from desc. Order matters —
+  # the longest specific prefix (AMD's "Inc. [AMD/ATI]") must come before
+  # the generic short one.
+  model="$(printf '%s' "$desc" | sed -E '
+    s/^Advanced Micro Devices, Inc\. \[AMD\/ATI\][[:space:]]+//
+    s/^Advanced Micro Devices(, Inc\.)?[[:space:]]+//
+    s/^NVIDIA Corporation[[:space:]]+//
+    s/^Intel Corporation[[:space:]]+//
+    s/[[:space:]]+$//
+  ')"
+  # Kernel driver in use (may be empty if module not loaded yet)
+  kernel_driver="$(lspci -nnks "$pci_address" 2>/dev/null | awk -F: '/Kernel driver in use/{sub(/^[ \t]+/,"",$2); print $2; exit}')"
+  # Passthrough eligible if the GPU is bound to vfio-pci OR it's a discrete
+  # secondary GPU (not the primary console). Pragmatic heuristic: discrete
+  # GPUs are usually eligible; iGPUs (Intel HD/UHD, AMD APU iGPUs) usually not
+  # because they drive the host console.
+  passthrough_eligible=false
+  case "$kernel_driver" in
+    vfio-pci) passthrough_eligible=true ;;
+    nvidia|nouveau) passthrough_eligible=true ;;  # discrete by definition
+  esac
+
+  # ProxMenux installer for this GPU vendor
+  proxmenux_installer="$(gpu_installer_for "$vendor")"
+
+  # Installed driver version from the managed_installs registry
+  installed_driver_version=""
+  if [[ "$vendor" == "NVIDIA" ]] && [[ -f /usr/local/share/proxmenux/managed_installs.json ]]; then
+    installed_driver_version="$(jq -r '
+      .items[]
+      | select(.removed_at == null and .type == "nvidia_xfree86")
+      | .current_version // ""
+    ' /usr/local/share/proxmenux/managed_installs.json 2>/dev/null | head -1)"
+  fi
+
+  gpu_array="$(jq --argjson acc "$gpu_array" \
+    --arg vendor "$vendor" \
+    --arg model "$model" \
+    --arg pci_address "$pci_address" \
+    --arg pci_id "$pci_id" \
+    --arg kernel_driver "$kernel_driver" \
+    --argjson passthrough_eligible "$passthrough_eligible" \
+    --arg proxmenux_installer "$proxmenux_installer" \
+    --arg installed_driver_version "$installed_driver_version" \
+    -n '
+    $acc + [{
+      vendor:                   $vendor,
+      model:                    $model,
+      pci_address:              $pci_address,
+      pci_id:                   $pci_id,
+      kernel_driver:            (if $kernel_driver == "" then null else $kernel_driver end),
+      passthrough_eligible:     $passthrough_eligible,
+      proxmenux_installer:      (if $proxmenux_installer == "" then null else $proxmenux_installer end),
+      installed_driver_version: (if $installed_driver_version == "" then null else $installed_driver_version end)
+    }]
+    ')"
+done < <(lspci -nnD 2>/dev/null | grep -E 'VGA compatible|3D controller|Display controller' || true)
+
+# ── TPUs (Google Coral) ──
+# PCIe variant: vendor 1ac1 (Global Unichip Corp) is the Coral M.2 / mPCIe.
+# USB variant:  vendor 18d1 product 9302 (Google).
+tpu_array='[]'
+
+# PCIe Coral
+while IFS= read -r line; do
+  [[ -z "$line" ]] && continue
+  pci_address="$(printf '%s' "$line" | awk '{print $1}')"
+  pci_id="$(printf '%s' "$line" | grep -oE '\[[0-9a-f]{4}:[0-9a-f]{4}\]' | tail -1 | tr -d '[]')"
+  tpu_array="$(jq --argjson acc "$tpu_array" \
+    --arg model "Coral PCIe" \
+    --arg pci_address "$pci_address" \
+    -n '
+    $acc + [{
+      vendor:              "Google",
+      model:               $model,
+      bus:                 "PCIe",
+      pci_address:         $pci_address,
+      proxmenux_installer: "scripts/gpu_tpu/install_coral.sh",
+      installed_version:   null
+    }]
+    ')"
+done < <(lspci -nnD 2>/dev/null | grep -iE '1ac1:|global unichip' || true)
+
+# USB Coral
+if command -v lsusb >/dev/null 2>&1; then
+  if lsusb 2>/dev/null | grep -qE '18d1:9302|Google.*Coral'; then
+    tpu_array="$(jq --argjson acc "$tpu_array" \
+      -n '
+      $acc + [{
+        vendor:              "Google",
+        model:               "Coral USB",
+        bus:                 "USB",
+        pci_address:         null,
+        proxmenux_installer: "scripts/gpu_tpu/install_coral.sh",
+        installed_version:   null
+      }]
+      ')"
+  fi
+fi
+
+# ── NICs ──
+# We want PHYSICAL interfaces (skip lo, veth*, tap*, fwln*, fwbr*, fwpr*).
+# Also distinguish wired from wireless.
+nic_array='[]'
+wireless_array='[]'
+
+# Map each interface → its bridge by walking /sys/class/net/<bridge>/brif/.
+# We use bash glob expansion instead of `find -path` because find doesn't
+# follow the symlinks under /sys cleanly.
+declare -A bridge_for
+for brif_dir in /sys/class/net/*/brif; do
+  [[ -d "$brif_dir" ]] || continue
+  bridge="$(basename "$(dirname "$brif_dir")")"
+  for member_link in "$brif_dir"/*; do
+    [[ -e "$member_link" ]] || continue
+    member="$(basename "$member_link")"
+    bridge_for["$member"]="$bridge"
+  done
+done
+
+# Iterate over each physical net device
+for dev_path in /sys/class/net/*; do
+  ifname="$(basename "$dev_path")"
+  case "$ifname" in
+    lo|veth*|tap*|fwln*|fwbr*|fwpr*|vmbr*|bond*) continue ;;
+  esac
+  # Bridges and bonds we record as their own thing; PHY interfaces only here.
+  # Detect virtual interfaces (no device symlink → virtual)
+  [[ ! -e "$dev_path/device" ]] && continue
+
+  mac="$(cat "$dev_path/address" 2>/dev/null || echo "")"
+  [[ -z "$mac" ]] && continue
+  operstate="$(cat "$dev_path/operstate" 2>/dev/null | tr '[:lower:]' '[:upper:]' || echo "UNKNOWN")"
+  case "$operstate" in
+    UP|DOWN) ;;
+    *) operstate="UNKNOWN" ;;
+  esac
+  kernel_driver="$(basename "$(readlink "$dev_path/device/driver" 2>/dev/null || echo "")")"
+
+  # Wireless detection
+  if [[ -d "$dev_path/wireless" ]] || [[ -d "$dev_path/phy80211" ]]; then
+    wireless_array="$(jq --argjson acc "$wireless_array" \
+      --arg ifname "$ifname" \
+      --arg mac "$mac" \
+      -n '$acc + [{ifname: $ifname, mac: $mac}]')"
+    continue
+  fi
+
+  # Bridge membership: which vmbr* contains this NIC?
+  in_bridges_json='[]'
+  if [[ -n "${bridge_for[$ifname]:-}" ]]; then
+    in_bridges_json="$(jq -n --arg b "${bridge_for[$ifname]}" '[$b]')"
+  fi
+
+  nic_array="$(jq --argjson acc "$nic_array" \
+    --arg ifname "$ifname" \
+    --arg mac "$mac" \
+    --arg kernel_driver "$kernel_driver" \
+    --argjson in_bridges "$in_bridges_json" \
+    --arg operstate "$operstate" \
+    -n '
+    $acc + [{
+      ifname:        $ifname,
+      mac:           $mac,
+      kernel_driver: (if $kernel_driver == "" then null else $kernel_driver end),
+      in_bridges:    $in_bridges,
+      operstate:     $operstate
+    }]
+    ')"
+done
+
+# Compose the final object
+jq -n \
+  --argjson gpu "$gpu_array" \
+  --argjson tpu "$tpu_array" \
+  --argjson nic "$nic_array" \
+  --argjson wireless "$wireless_array" \
+  '{ gpu: $gpu, tpu: $tpu, nic: $nic, wireless: $wireless }'
diff --git a/scripts/backup_restore/collectors/collect_kernel.sh b/scripts/backup_restore/collectors/collect_kernel.sh
new file mode 100755
index 00000000..0648ef37
--- /dev/null
+++ b/scripts/backup_restore/collectors/collect_kernel.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup manifest collector — kernel_params
+# ==========================================================
+# /proc/cmdline (filtered to user-meaningful extras), /etc/modules,
+# and /etc/modprobe.d/ files with custom directives. Read-only.
+# Schema: scripts/backup_restore/schema/manifest.schema.json
+# ==========================================================
+set -euo pipefail
+
+# ── cmdline_extra ──
+# /proc/cmdline contains the kernel command line the bootloader passed.
+# We strip the boring boilerplate (BOOT_IMAGE, initrd, root, ro, rw, quiet,
+# splash, boot=zfs, rootflags) so the manifest captures only the user-
+# meaningful tweaks (intel_iommu, iommu=pt, hugepages, pcie_acs_override,
+# acpi=off, etc.). These are the bits a restore wizard cares about.
+cmdline_extra='[]'
+if [[ -r /proc/cmdline ]]; then
+  raw_cmdline="$(cat /proc/cmdline)"
+  for token in $raw_cmdline; do
+    case "$token" in
+      BOOT_IMAGE=*|initrd=*|root=*|ro|rw|quiet|splash|boot=*|rootflags=*)
+        ;;  # boilerplate, drop
+      *)
+        cmdline_extra="$(jq --argjson acc "$cmdline_extra" --arg t "$token" -n '$acc + [$t]')"
+        ;;
+    esac
+  done
+fi
+
+# ── modules_loaded_at_boot ──
+# /etc/modules lists modules systemd-modules-load.service inserts on boot.
+modules_at_boot='[]'
+if [[ -r /etc/modules ]]; then
+  while IFS= read -r mod; do
+    # Strip comments and inline comments
+    mod="${mod%%#*}"
+    mod="$(printf '%s' "$mod" | xargs)"
+    [[ -z "$mod" ]] && continue
+    modules_at_boot="$(jq --argjson acc "$modules_at_boot" --arg m "$mod" -n '$acc + [$m]')"
+  done < /etc/modules
+fi
+
+# ── modprobe_d_files ──
+# /etc/modprobe.d/*.conf files. We emit the path of every file that
+# contains at least one `options`, `blacklist`, `install`, `alias`, or
+# `softdep` directive — i.e. anything that has actual effect. Files that
+# are empty or pure comments aren't worth tracking.
+modprobe_files='[]'
+if [[ -d /etc/modprobe.d ]]; then
+  for f in /etc/modprobe.d/*.conf; do
+    [[ -r "$f" ]] || continue
+    if grep -qE '^[[:space:]]*(options|blacklist|install|alias|softdep)[[:space:]]' "$f" 2>/dev/null; then
+      modprobe_files="$(jq --argjson acc "$modprobe_files" --arg p "$f" -n '$acc + [$p]')"
+    fi
+  done
+fi
+
+jq -n \
+  --argjson cmdline_extra        "$cmdline_extra" \
+  --argjson modules_loaded       "$modules_at_boot" \
+  --argjson modprobe_files       "$modprobe_files" \
+  '{
+    cmdline_extra:           $cmdline_extra,
+    modules_loaded_at_boot:  $modules_loaded,
+    modprobe_d_files:        $modprobe_files
+  }'
diff --git a/scripts/backup_restore/collectors/collect_proxmenux_state.sh b/scripts/backup_restore/collectors/collect_proxmenux_state.sh
new file mode 100755
index 00000000..224335df
--- /dev/null
+++ b/scripts/backup_restore/collectors/collect_proxmenux_state.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup manifest collector — proxmenux_installed_components
+# ==========================================================
+# Reads ProxMenux's managed_installs registry + post-install
+# tools marker file and emits the installed components array.
+# Read-only. Schema:
+# scripts/backup_restore/schema/manifest.schema.json
+# ==========================================================
+set -euo pipefail
+
+REGISTRY="/usr/local/share/proxmenux/managed_installs.json"
+INSTALLED_TOOLS="/usr/local/share/proxmenux/installed_tools.json"
+
+components='[]'
+
+# ── managed_installs registry ──
+# Each entry already carries the installer path under `menu_script`,
+# so we trust the registry as the single source of truth. We skip LXC
+# entries because containers are restored via vzdump, not via the
+# host-config restore path.
+if [[ -r "$REGISTRY" ]]; then
+  while IFS= read -r item; do
+    [[ -z "$item" ]] && continue
+    id="$(printf '%s' "$item" | jq -r '.id')"
+    type="$(printf '%s' "$item" | jq -r '.type // ""')"
+    version="$(printf '%s' "$item" | jq -r '.current_version // ""')"
+    # menu_script in the registry is null for components that handle their
+    # own update lifecycle (e.g. OCI apps via the secure-gateway runtime).
+    # We keep that null forward: restore won't try to reinstall those —
+    # the user reconfigures them after restore.
+    installer="$(printf '%s' "$item" | jq -r '.menu_script // ""')"
+
+    components="$(jq --argjson acc "$components" \
+      --arg id "$id" --arg type "$type" --arg version "$version" --arg installer "$installer" \
+      -n '
+      $acc + [{
+        id:                  $id,
+        type:                $type,
+        version_at_backup:   (if $version   == "" then null else $version end),
+        proxmenux_installer: (if $installer == "" then null else $installer end),
+        applied_settings:    []
+      }]
+      ')"
+  done < <(jq -c '.items[]? | select(.removed_at == null) | select(.type != "lxc")' "$REGISTRY" 2>/dev/null || true)
+fi
+
+# ── installed_tools.json (post-install optimizations) ──
+# Format: array of {name: ..., installed_at: ...} or similar. The exact
+# shape varies across ProxMenux versions; we emit one synthetic component
+# named "post_install_optimizations" with the applied_settings list.
+if [[ -r "$INSTALLED_TOOLS" ]]; then
+  applied_settings="$(jq -c '
+    if type == "object" then
+      (.tools // .installed // [] | map(.name // .id // tostring))
+    elif type == "array" then
+      map(.name // .id // tostring)
+    else []
+    end
+  ' "$INSTALLED_TOOLS" 2>/dev/null || echo '[]')"
+
+  # Only emit if we have at least one applied setting — otherwise the
+  # component would be noise.
+  count="$(printf '%s' "$applied_settings" | jq 'length' 2>/dev/null || echo 0)"
+  if [[ "${count:-0}" -gt 0 ]]; then
+    components="$(jq --argjson acc "$components" --argjson s "$applied_settings" \
+      -n '
+      $acc + [{
+        id:                  "post_install_optimizations",
+        type:                "proxmenux_post_install",
+        version_at_backup:   null,
+        proxmenux_installer: "scripts/post_install/customizable_post_install.sh",
+        applied_settings:    $s
+      }]
+      ')"
+  fi
+fi
+
+# Output: bare array (not wrapped in an object — the orchestrator places
+# this under .proxmenux_installed_components).
+printf '%s\n' "$components"
diff --git a/scripts/backup_restore/collectors/collect_source_host.sh b/scripts/backup_restore/collectors/collect_source_host.sh
new file mode 100755
index 00000000..67a475a4
--- /dev/null
+++ b/scripts/backup_restore/collectors/collect_source_host.sh
@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup manifest collector — source_host
+# ==========================================================
+# Emits the `source_host` section of the manifest as JSON to
+# stdout. Read-only; no side effects. Schema:
+# scripts/backup_restore/schema/manifest.schema.json
+# ==========================================================
+set -euo pipefail
+
+# ── pve_version_full / pve_version ──
+# pveversion's first line is like:
+#   pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve)
+pve_version_full=""
+pve_version=""
+if command -v pveversion >/dev/null 2>&1; then
+  pve_version_full="$(pveversion 2>/dev/null | head -1 || true)"
+  # Extract the X.Y.Z between "pve-manager/" and "/"
+  pve_version="$(printf '%s\n' "$pve_version_full" | sed -nE 's@^pve-manager/([0-9.]+)/.*@\1@p')"
+fi
+
+# ── pbs_version ──
+# PBS is a separate package. If proxmox-backup-manager exists, host has PBS role.
+pbs_version=""
+if command -v proxmox-backup-manager >/dev/null 2>&1; then
+  pbs_version="$(proxmox-backup-manager versions 2>/dev/null | awk '/^proxmox-backup-server/{print $2; exit}' || true)"
+fi
+
+# ── roles ──
+roles_json='[]'
+if [[ -n "$pve_version" && -n "$pbs_version" ]]; then
+  roles_json='["pve","pbs"]'
+elif [[ -n "$pve_version" ]]; then
+  roles_json='["pve"]'
+elif [[ -n "$pbs_version" ]]; then
+  roles_json='["pbs"]'
+else
+  # No PVE, no PBS — exit with the unknown sentinel. Caller decides
+  # whether to abort or generate a system-only manifest.
+  roles_json='[]'
+fi
+
+# ── kernel, boot_mode, root_fs ──
+kernel="$(uname -r)"
+if [[ -d /sys/firmware/efi ]]; then
+  boot_mode="efi"
+else
+  boot_mode="bios"
+fi
+root_fs="$(findmnt -no FSTYPE / 2>/dev/null || echo ext4)"
+
+# ── CPU model / arch ──
+cpu_model="$(lscpu 2>/dev/null | awk -F: '/^Model name/{sub(/^[ \t]+/, "", $2); print $2; exit}')"
+cpu_arch="$(uname -m)"
+# Normalize to schema enum
+case "$cpu_arch" in
+  x86_64|amd64) cpu_arch="x86_64" ;;
+  aarch64|arm64) cpu_arch="aarch64" ;;
+esac
+
+# ── memory_kb ──
+memory_kb="$(awk '/^MemTotal:/{print $2; exit}' /proc/meminfo 2>/dev/null || echo 0)"
+
+# Build JSON. Use --arg for strings (always quoted), --argjson for
+# numbers/arrays/null. Empty strings → null per schema convention.
+jq -n \
+  --arg hostname              "$(hostname)" \
+  --arg pve_version           "$pve_version" \
+  --arg pve_version_full      "$pve_version_full" \
+  --arg pbs_version           "$pbs_version" \
+  --argjson roles             "$roles_json" \
+  --arg kernel                "$kernel" \
+  --arg boot_mode             "$boot_mode" \
+  --arg root_fs               "$root_fs" \
+  --arg cpu_model             "$cpu_model" \
+  --arg cpu_arch              "$cpu_arch" \
+  --argjson memory_kb         "$memory_kb" \
+  '{
+    hostname:            $hostname,
+    pve_version:         (if $pve_version == "" then null else $pve_version end),
+    pve_version_full:    (if $pve_version_full == "" then null else $pve_version_full end),
+    pbs_version:         (if $pbs_version == "" then null else $pbs_version end),
+    roles:               $roles,
+    kernel:              $kernel,
+    boot_mode:           $boot_mode,
+    root_fs:             $root_fs,
+    cpu_model:           $cpu_model,
+    cpu_arch:            $cpu_arch,
+    memory_kb:           $memory_kb
+  }'
diff --git a/scripts/backup_restore/collectors/collect_storage.sh b/scripts/backup_restore/collectors/collect_storage.sh
new file mode 100755
index 00000000..c2e8dbdf
--- /dev/null
+++ b/scripts/backup_restore/collectors/collect_storage.sh
@@ -0,0 +1,252 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup manifest collector — storage_inventory
+# ==========================================================
+# ZFS pools (with stable by-id devices), LVM VGs + thin pools,
+# physical disks, PVE storage.cfg, and external mounts.
+# Read-only. Schema:
+# scripts/backup_restore/schema/manifest.schema.json
+# ==========================================================
+set -euo pipefail
+
+# ── ZFS pools ──
+zfs_pools='[]'
+if command -v zpool >/dev/null 2>&1; then
+  while IFS= read -r pool; do
+    [[ -z "$pool" ]] && continue
+    # type: parse zpool status — first vdev line after 'config:' header.
+    # Single-device pool shows the device directly; mirror/raidz prefix the
+    # vdev type. We look at the indented children list.
+    pool_type="single"
+    devices='[]'
+    # `zpool status -P` outputs full /dev/disk/by-id/... paths for the
+    # member disks. We isolate the first whitespace-delimited token on
+    # each child line and decide:
+    #   - vdev type lines (mirror-0, raidz1-0, stripe, ...) → pool type
+    #   - leaf device lines (/dev/disk/by-id/* or /dev/sd*) → membership
+    while IFS= read -r vdev_line; do
+      token="$(printf '%s' "$vdev_line" | awk '{print $1}')"
+      [[ -z "$token" || "$token" == "NAME" || "$token" == "$pool" ]] && continue
+      case "$token" in
+        mirror-*)  pool_type="mirror" ;;
+        raidz1-*)  pool_type="raidz1" ;;
+        raidz2-*)  pool_type="raidz2" ;;
+        raidz3-*)  pool_type="raidz3" ;;
+        stripe-*)  pool_type="stripe" ;;
+        /dev/disk/by-id/*)
+          # Strip the /dev/disk/by-id/ prefix for the schema field;
+          # leave any -partN suffix in place — the restore wizard uses
+          # the exact same string to look the disk back up.
+          dev_name="${token#/dev/disk/by-id/}"
+          devices="$(jq --argjson acc "$devices" --arg d "$dev_name" -n '$acc + [$d]')"
+          ;;
+        /dev/*)
+          # Fallback: ZFS pool created with raw /dev/sdX paths. Record
+          # them as-is; restore will need to remap manually.
+          devices="$(jq --argjson acc "$devices" --arg d "$token" -n '$acc + [$d]')"
+          ;;
+      esac
+    done < <(zpool status -P "$pool" 2>/dev/null | awk '/^config:/{flag=1; next} /^errors:/{flag=0} flag')
+
+    size_bytes="$(zpool list -H -p -o size "$pool" 2>/dev/null || echo 0)"
+    health="$(zpool list -H -o health "$pool" 2>/dev/null || echo UNKNOWN)"
+    compression="$(zfs get -H -o value compression "$pool" 2>/dev/null || echo "")"
+    mountpoint="$(zfs get -H -o value mountpoint "$pool" 2>/dev/null || echo "")"
+
+    zfs_pools="$(jq --argjson acc "$zfs_pools" \
+      --arg name "$pool" \
+      --arg type "$pool_type" \
+      --argjson devices "$devices" \
+      --arg mountpoint "$mountpoint" \
+      --arg compression "$compression" \
+      --argjson size_bytes "${size_bytes:-0}" \
+      --arg health "$health" \
+      -n '
+      $acc + [{
+        name:          $name,
+        type:          $type,
+        devices_by_id: $devices,
+        mountpoint:    $mountpoint,
+        compression:   $compression,
+        size_bytes:    $size_bytes,
+        health:        $health
+      }]
+      ')"
+  done < <(zpool list -H -o name 2>/dev/null || true)
+fi
+
+# ── LVM VGs + thin pools ──
+lvm_vgs='[]'
+if command -v vgs >/dev/null 2>&1; then
+  # vgs --reportformat json --units b is reliable in lvm2 ≥ 2.02
+  vg_json="$(vgs --reportformat json --units b --noheadings -o vg_name,vg_size 2>/dev/null || echo '{}')"
+  while IFS= read -r vg_name; do
+    [[ -z "$vg_name" || "$vg_name" == "null" ]] && continue
+    vg_size="$(printf '%s' "$vg_json" | jq -r --arg n "$vg_name" '.report[0].vg[]? | select(.vg_name == $n) | .vg_size' | sed 's/[Bb]$//' | head -1)"
+    # Thin pools in this VG
+    thin_pools='[]'
+    while IFS= read -r lv_line; do
+      [[ -z "$lv_line" ]] && continue
+      lv_name="$(printf '%s' "$lv_line" | awk '{print $1}')"
+      lv_size="$(printf '%s' "$lv_line" | awk '{print $2}' | sed 's/[Bb]$//')"
+      thin_pools="$(jq --argjson acc "$thin_pools" \
+        --arg n "$lv_name" --argjson s "${lv_size:-0}" \
+        -n '$acc + [{lv_name: $n, size_bytes: $s}]')"
+    done < <(lvs --noheadings --units b -o lv_name,lv_size --select "vg_name=$vg_name && lv_attr=~^t" 2>/dev/null || true)
+
+    lvm_vgs="$(jq --argjson acc "$lvm_vgs" \
+      --arg n "$vg_name" --argjson s "${vg_size:-0}" --argjson tp "$thin_pools" \
+      -n '$acc + [{name: $n, size_bytes: $s, thin_pools: $tp}]')"
+  done < <(printf '%s' "$vg_json" | jq -r '.report[0].vg[]?.vg_name' 2>/dev/null || true)
+fi
+
+# ── Physical disks (by-id resolution) ──
+physical_disks='[]'
+# Build name → by-id map by walking /dev/disk/by-id/. A single block
+# device usually has multiple by-id symlinks (ata-*, wwn-*, scsi-*, …).
+# We prefer the most human-readable identifier in this order:
+#   ata-* → nvme-* → scsi-* → usb-* → wwn-*
+# This also makes the manifest consistent with what `zpool status -P`
+# reports (zpool defaults to ata-* / wwn-* depending on bus).
+declare -A by_id_for
+declare -A by_id_priority_for
+priority_for_id() {
+  case "$1" in
+    ata-*)  echo 1 ;;
+    nvme-*) echo 2 ;;
+    scsi-*) echo 3 ;;
+    usb-*)  echo 4 ;;
+    wwn-*)  echo 5 ;;
+    *)      echo 9 ;;
+  esac
+}
+if [[ -d /dev/disk/by-id ]]; then
+  for link in /dev/disk/by-id/*; do
+    [[ -L "$link" ]] || continue
+    by_id="$(basename "$link")"
+    # Skip partition symlinks — we want whole-disk only.
+    [[ "$by_id" == *-part* ]] && continue
+    target="$(basename "$(readlink -f "$link")")"
+    [[ -z "$target" ]] && continue
+    new_prio="$(priority_for_id "$by_id")"
+    cur_prio="${by_id_priority_for[$target]:-99}"
+    if (( new_prio < cur_prio )); then
+      by_id_for["$target"]="$by_id"
+      by_id_priority_for["$target"]="$new_prio"
+    fi
+  done
+fi
+
+# lsblk -d -b -J for whole disks
+lsblk_json="$(lsblk -d -b -o NAME,MODEL,SIZE,TYPE -J 2>/dev/null || echo '{}')"
+while IFS= read -r disk_line; do
+  [[ -z "$disk_line" ]] && continue
+  name="$(printf '%s' "$disk_line" | jq -r '.name')"
+  model="$(printf '%s' "$disk_line" | jq -r '.model // ""')"
+  size="$(printf '%s' "$disk_line" | jq -r '.size // 0')"
+  type="$(printf '%s' "$disk_line" | jq -r '.type')"
+  # Only PHYSICAL disks.
+  # - skip non-disk types (rom, loop)
+  # - skip zd* (ZFS zvols backing VMs)
+  # - skip dm-* (LVM-mapped devices)
+  # - skip loop* (defensive — type filter usually catches it)
+  [[ "$type" != "disk" ]] && continue
+  case "$name" in
+    zd*|dm-*|loop*) continue ;;
+  esac
+  by_id="${by_id_for[$name]:-}"
+  physical_disks="$(jq --argjson acc "$physical_disks" \
+    --arg n "$name" --arg m "$model" --argjson s "${size:-0}" --arg bid "$by_id" \
+    -n '
+    $acc + [{
+      name:       $n,
+      model:      (if $m == "" then null else $m end),
+      size_bytes: $s,
+      by_id:      (if $bid == "" then null else $bid end)
+    }]
+    ')"
+done < <(printf '%s' "$lsblk_json" | jq -c '.blockdevices[]?' 2>/dev/null || true)
+
+# ── PVE storage.cfg ──
+# Format is whitespace-key-value with blank-line separators:
+#   <type>: <id>
+#       key value
+#       key value
+pve_storage='[]'
+if [[ -r /etc/pve/storage.cfg ]]; then
+  current_type=""; current_id=""; current_extra='{}'
+  flush() {
+    if [[ -n "$current_id" ]]; then
+      pve_storage="$(jq --argjson acc "$pve_storage" \
+        --arg id "$current_id" --arg t "$current_type" --argjson e "$current_extra" \
+        -n '$acc + [(($e) + {id: $id, type: $t})]')"
+    fi
+    current_type=""; current_id=""; current_extra='{}'
+  }
+  while IFS= read -r line; do
+    if [[ -z "${line// }" ]]; then
+      flush; continue
+    fi
+    if [[ "$line" =~ ^([a-z]+):[[:space:]]+([A-Za-z0-9_.-]+) ]]; then
+      flush
+      current_type="${BASH_REMATCH[1]}"
+      current_id="${BASH_REMATCH[2]}"
+    elif [[ "$line" =~ ^[[:space:]]+([a-z_]+)[[:space:]]+(.*)$ ]]; then
+      key="${BASH_REMATCH[1]}"
+      val="${BASH_REMATCH[2]}"
+      case "$key" in
+        # `content` is a comma-separated list — split into JSON array
+        content)
+          content_array="$(printf '%s\n' "$val" | tr ',' '\n' | jq -R . | jq -s .)"
+          current_extra="$(jq --argjson e "$current_extra" --argjson c "$content_array" -n '$e + {content: $c}')"
+          ;;
+        *)
+          current_extra="$(jq --argjson e "$current_extra" --arg k "$key" --arg v "$val" -n '$e + {($k): $v}')"
+          ;;
+      esac
+    fi
+  done < /etc/pve/storage.cfg
+  flush
+fi
+
+# ── External mounts (NFS/CIFS/etc.) ──
+# Filter on filesystem types we care about for the manifest. Drop FUSE
+# pmxcfs (/etc/pve), tmpfs, devtmpfs, autofs, ZFS internals already
+# accounted for. NFS, CIFS, ISO mount points are the interesting ones.
+mounts='[]'
+if command -v findmnt >/dev/null 2>&1; then
+  while IFS= read -r mline; do
+    [[ -z "$mline" ]] && continue
+    target="$(printf '%s' "$mline" | jq -r '.target')"
+    source="$(printf '%s' "$mline" | jq -r '.source')"
+    fstype="$(printf '%s' "$mline" | jq -r '.fstype')"
+    options="$(printf '%s' "$mline" | jq -r '.options // ""')"
+    mounts="$(jq --argjson acc "$mounts" \
+      --arg t "$target" --arg s "$source" --arg f "$fstype" --arg o "$options" \
+      -n '
+      $acc + [{
+        target: $t,
+        source: $s,
+        fstype: $f,
+        options: (if $o == "" then null else $o end)
+      }]
+      ')"
+  done < <(findmnt -t nfs,nfs4,cifs,smbfs,fuseblk,fuse.glusterfs -J 2>/dev/null \
+            | jq -c '.. | objects | select(.target?)' 2>/dev/null \
+            | grep -vE '"target":"/etc/pve"' || true)
+fi
+
+# Compose
+jq -n \
+  --argjson zfs_pools       "$zfs_pools" \
+  --argjson lvm_vgs         "$lvm_vgs" \
+  --argjson physical_disks  "$physical_disks" \
+  --argjson pve_storage     "$pve_storage" \
+  --argjson mounts          "$mounts" \
+  '{
+    zfs_pools:        $zfs_pools,
+    lvm:              { vgs: $lvm_vgs },
+    physical_disks:   $physical_disks,
+    pve_storage_cfg:  $pve_storage,
+    mounts:           $mounts
+  }'
diff --git a/scripts/backup_restore/lib_host_backup_common.sh b/scripts/backup_restore/lib_host_backup_common.sh
old mode 100644
new mode 100755
index fabc9394..908b7097
--- a/scripts/backup_restore/lib_host_backup_common.sh
+++ b/scripts/backup_restore/lib_host_backup_common.sh
@@ -42,30 +42,56 @@ HB_UI_YESNO_W=78
 # DEFAULT PROFILE PATHS
 # ==========================================================
 hb_default_profile_paths() {
+    # Curated list of paths that matter for a real Proxmox restore
+    # on a fresh host. Anything missing on the source is just
+    # noted in metadata/missing_paths.txt — no error. Grouped by
+    # category so it's easy to spot what's covered.
     local paths=(
+        # ── PVE core ──────────────────────────────────────────
         "/etc/pve"
-        "/etc/network"
-        "/etc/hosts"
+        "/var/lib/pve-cluster"
+        "/etc/vzdump.conf"
+
+        # ── Host identity & networking ────────────────────────
         "/etc/hostname"
+        "/etc/hosts"
+        "/etc/timezone"
+        "/etc/resolv.conf"
+        "/etc/network"
+
+        # ── Access & auth ─────────────────────────────────────
         "/etc/ssh"
-        "/etc/systemd/system"
+        "/etc/sudoers"
+        "/etc/sudoers.d"
+        "/etc/pam.d"
+        "/etc/security"
+
+        # ── Kernel / boot / hardware ──────────────────────────
+        "/etc/default/grub"
+        "/etc/kernel"
         "/etc/modules"
         "/etc/modules-load.d"
         "/etc/modprobe.d"
+        "/etc/sysctl.conf"
+        "/etc/sysctl.d"
         "/etc/udev/rules.d"
-        "/etc/default/grub"
         "/etc/fstab"
-        "/etc/kernel"
-        "/etc/apt"
-        "/etc/vzdump.conf"
-        "/etc/postfix"
-        "/etc/resolv.conf"
-        "/etc/timezone"
         "/etc/iscsi"
         "/etc/multipath"
-        "/usr/local/bin"
-        "/usr/local/share/proxmenux"
-        "/root"
+
+        # ── Shell / locale / env ──────────────────────────────
+        "/etc/environment"
+        "/etc/bash.bashrc"
+        "/etc/inputrc"
+        "/etc/profile"
+        "/etc/profile.d"       # figurine and other shell add-ons live here
+        "/etc/locale.gen"
+        "/etc/locale.conf"
+
+        # ── Packaging ─────────────────────────────────────────
+        "/etc/apt"
+
+        # ── Cron ──────────────────────────────────────────────
         "/etc/cron.d"
         "/etc/cron.daily"
         "/etc/cron.hourly"
@@ -74,8 +100,41 @@ hb_default_profile_paths() {
         "/etc/cron.allow"
         "/etc/cron.deny"
         "/var/spool/cron/crontabs"
-        "/var/lib/pve-cluster"
+
+        # ── ProxMenux state (source of truth for some host-config) ──
+        "/etc/proxmenux"       # vfio-bind.bdfs state file feeds the per-BDF udev rule
+
+        # ── Common Proxmox tooling (skipped if not present) ──
+        "/etc/systemd/system"  # custom units (including log2ram.service if installed)
+        "/etc/systemd/journald.conf"  # journal retention tuning from post-install
+        "/etc/log2ram.conf"
+        "/etc/logrotate.conf"
+        "/etc/logrotate.d"     # post-install drops log2ram + custom logrotate here
+        "/etc/lm-sensors"
+        "/etc/sensors3.conf"
+        "/etc/fail2ban"
+        "/etc/snmp"
+        "/etc/postfix"
+
+        # ── Monitoring / VPN (skipped if not present) ────────
+        "/etc/wireguard"
+        "/etc/openvpn"
+        "/etc/grafana"
+        "/etc/influxdb"
+        "/etc/prometheus"
+        "/etc/telegraf"
+        "/etc/zabbix"
+
+        # ── ProxMenux-installed binaries & app state ─────────
+        "/usr/local/bin"
+        "/usr/local/sbin"
+        "/usr/local/share/proxmenux"
+
+        # ── Root home (rsync excludes volatile dirs) ─────────
+        "/root"
     )
+    # ZFS state only when the host runs ZFS — same convention
+    # used pre-expansion.
     if [[ -d /etc/zfs ]] || command -v zpool >/dev/null 2>&1; then
         paths+=("/etc/zfs")
     fi
@@ -121,46 +180,333 @@ hb_path_warning() {
     esac
 }
 
+# ==========================================================
+# HARDWARE DRIFT ASSESSMENT (smart restore)
+# ==========================================================
+# Compares the backup metadata captured by hb_prepare_staging
+# against the live target host to detect when applying certain
+# paths would break the boot (orphan ZFS pool GUID, stale fstab
+# UUIDs, ...) or pointlessly reinstall components for hardware
+# that's no longer present (NVIDIA driver on a host with no
+# NVIDIA card).
+#
+# Output format on stdout — one line per assessment, tab-separated:
+#
+#   PATH_OR_KEY \t ACTION \t REASON
+#
+# Where ACTION is one of:
+#   skip → the restore flow should EXCLUDE this from apply
+#   warn → restore but surface the warning in the dialog
+#   ok   → no drift detected (omitted from output)
+#
+# Callers consume this to build the "Restore plan" dialog and to
+# filter the hot/pending path lists. The function never modifies
+# state, never prompts — pure analysis.
+
+# Read the UUIDs referenced by a fstab file. Skips comments and
+# `proc`/`none`/`tmpfs` non-block entries.
+_hb_fstab_uuids() {
+    local fstab="$1"
+    [[ -f "$fstab" ]] || return 0
+    awk '
+        /^[[:space:]]*#/ { next }
+        /^[[:space:]]*$/ { next }
+        {
+            src = $1
+            if (src ~ /^UUID=/) {
+                sub(/^UUID=/, "", src)
+                print src
+            } else if (src ~ /^PARTUUID=/) {
+                sub(/^PARTUUID=/, "", src)
+                print src
+            } else if (src ~ /^\/dev\//) {
+                print src
+            }
+        }
+    ' "$fstab"
+}
+
+# Build a set of live block-device UUIDs. Returns one UUID per line.
+_hb_live_uuids() {
+    command -v blkid >/dev/null 2>&1 || return 0
+    blkid -s UUID -o value 2>/dev/null
+}
+
+# Build a name→guid map of the live ZFS pools.
+_hb_live_zpool_guids() {
+    command -v zpool >/dev/null 2>&1 || return 0
+    zpool list -H -o name,guid 2>/dev/null
+}
+
+hb_assess_hardware_drift() {
+    local staging_root="$1"
+    local meta="$staging_root/metadata"
+    local rootfs="$staging_root/rootfs"
+
+    # ── ZFS pool GUID drift ──────────────────────────────
+    # If the backup had ZFS pools, compare each (name, guid) pair
+    # against what's on this host. A pool with the same NAME but a
+    # different GUID is the "fresh PVE install with same pool name"
+    # case — restoring /etc/zfs/zpool.cache would point ZFS at a
+    # ghost pool and drop boot to emergency.
+    if [[ -f "$meta/zpool.guids" ]] && [[ -s "$meta/zpool.guids" ]]; then
+        local bk_name bk_guid live_map
+        live_map=$(_hb_live_zpool_guids)
+        local pool_mismatch="" pool_missing=""
+        while IFS=$'\t ' read -r bk_name bk_guid; do
+            [[ -z "$bk_name" ]] && continue
+            local live_guid
+            live_guid=$(awk -v n="$bk_name" '$1==n {print $2; exit}' <<<"$live_map")
+            if [[ -z "$live_guid" ]]; then
+                pool_missing+="$bk_name "
+            elif [[ "$live_guid" != "$bk_guid" ]]; then
+                pool_mismatch+="$bk_name(${bk_guid:0:8}…→${live_guid:0:8}…) "
+            fi
+        done < "$meta/zpool.guids"
+        if [[ -n "$pool_missing" ]]; then
+            printf '%s\t%s\t%s\n' "/etc/zfs/zpool.cache" "skip" \
+                "$(hb_translate "Backup pools not present on this host:") ${pool_missing% }"
+        elif [[ -n "$pool_mismatch" ]]; then
+            printf '%s\t%s\t%s\n' "/etc/zfs/zpool.cache" "skip" \
+                "$(hb_translate "Pool name matches but GUID differs (fresh ZFS install):") ${pool_mismatch% }"
+        fi
+    fi
+
+    # ── Boot partition UUID drift ────────────────────────
+    # /etc/kernel/proxmox-boot-uuids lists the EFI vfat UUIDs that
+    # proxmox-boot-tool replicates the bootloader onto. If those
+    # UUIDs don't exist on this host, applying the file makes
+    # subsequent `proxmox-boot-tool refresh` fail.
+    local boot_uuid_file="$rootfs/etc/kernel/proxmox-boot-uuids"
+    if [[ -f "$boot_uuid_file" ]] && [[ -s "$boot_uuid_file" ]]; then
+        local live_uuids
+        live_uuids=$(_hb_live_uuids)
+        local missing_boot="" u
+        while IFS= read -r u; do
+            u="${u// /}"
+            [[ -z "$u" || "$u" == "#"* ]] && continue
+            if ! grep -Fxq "$u" <<<"$live_uuids"; then
+                missing_boot+="$u "
+            fi
+        done < "$boot_uuid_file"
+        if [[ -n "$missing_boot" ]]; then
+            printf '%s\t%s\t%s\n' "/etc/kernel/proxmox-boot-uuids" "skip" \
+                "$(hb_translate "Boot partition UUIDs from backup not found on this host:") ${missing_boot% }"
+        fi
+    fi
+
+    # ── fstab UUID drift ─────────────────────────────────
+    # Skip ONLY if at least one UUID/dev in the backup's fstab can't
+    # be resolved on the live host. A clean PVE+ZFS root install
+    # typically has just `proc /proc proc defaults 0 0`, no UUIDs —
+    # that yields zero referenced UUIDs and the check is a no-op.
+    local fstab="$rootfs/etc/fstab"
+    if [[ -f "$fstab" ]]; then
+        local live_uuids; live_uuids=$(_hb_live_uuids)
+        local missing_fstab="" cnt=0 u
+        while IFS= read -r u; do
+            ((cnt++))
+            if [[ "$u" == /dev/* ]]; then
+                [[ -b "$u" ]] || missing_fstab+="$u "
+            else
+                grep -Fxq "$u" <<<"$live_uuids" || missing_fstab+="$u "
+            fi
+        done < <(_hb_fstab_uuids "$fstab")
+        if (( cnt > 0 )) && [[ -n "$missing_fstab" ]]; then
+            printf '%s\t%s\t%s\n' "/etc/fstab" "skip" \
+                "$(hb_translate "fstab references UUIDs/devices not present on this host:") ${missing_fstab% }"
+        fi
+    fi
+
+    # ── Component reinstall drift (GPU / TPU presence) ───
+    # components_status.json declares what proxmenux installed on
+    # the source (nvidia_driver, amdgpu_top, intel_gpu_tools,
+    # coral_driver). If the target hardware no longer has the
+    # corresponding device, the post-boot dispatcher would try to
+    # reinstall a driver for a card that isn't there. The installer
+    # itself short-circuits in that case (detect_*_gpus), but
+    # surfacing this in the dialog is cleaner than letting the user
+    # discover it from the postboot log.
+    local comp_file="$rootfs/usr/local/share/proxmenux/components_status.json"
+    if [[ -f "$comp_file" ]] && command -v jq >/dev/null 2>&1 && command -v lspci >/dev/null 2>&1; then
+        local live_pci; live_pci=$(lspci -nn 2>/dev/null)
+        local installed_components
+        installed_components=$(jq -r 'to_entries[] | select(.value.status=="installed") | .key' "$comp_file" 2>/dev/null)
+        local comp
+        while IFS= read -r comp; do
+            [[ -z "$comp" ]] && continue
+            local pattern=""
+            case "$comp" in
+                nvidia_driver)    pattern='NVIDIA' ;;
+                amdgpu_top)       pattern='Advanced Micro Devices.*\[AMD/ATI\]' ;;
+                intel_gpu_tools)  pattern='Intel.*(VGA|Display|Graphics)' ;;
+                coral_driver)     pattern='Global Unichip|Google.*Edge TPU' ;;
+                *) continue ;;
+            esac
+            if ! grep -qiE "$pattern" <<<"$live_pci"; then
+                printf 'component:%s\t%s\t%s\n' "$comp" "skip" \
+                    "$(hb_translate "Component was installed on the backup source but no matching hardware was found on this host.")"
+            fi
+        done <<<"$installed_components"
+    fi
+}
+
+# Returns 0 (true) if hb_assess_hardware_drift produced any skip
+# entries — i.e. there is something for the operator to look at in
+# the smart-restore dialog. Returns 1 otherwise. Used by the
+# restore flow to decide whether to show the smart-restore dialog
+# at all (no drift → skip the extra prompt).
+hb_has_hardware_drift() {
+    local staging_root="$1"
+    local out
+    out=$(hb_assess_hardware_drift "$staging_root" 2>/dev/null | grep $'\tskip\t' || true)
+    [[ -n "$out" ]]
+}
+
 # ==========================================================
 # PROFILE PATH SELECTION
 # ==========================================================
+hb_extra_paths_file() {
+    printf '%s/backup-extra-paths.txt\n' "$HB_STATE_DIR"
+}
+
+# Reads user-added extra paths (one per line, # comments allowed).
+# Trimmed, deduped, only paths that currently exist on disk are returned.
+hb_load_extra_paths() {
+    local f
+    f=$(hb_extra_paths_file)
+    [[ -f "$f" ]] || return 0
+    local line
+    while IFS= read -r line; do
+        line="${line%%#*}"
+        line="${line#"${line%%[![:space:]]*}"}"
+        line="${line%"${line##*[![:space:]]}"}"
+        [[ -z "$line" ]] && continue
+        printf '%s\n' "$line"
+    done < "$f" | sort -u
+}
+
+# Adds a path to the persisted extra-paths file. Idempotent.
+hb_add_extra_path() {
+    local path="$1"
+    [[ -z "$path" ]] && return 1
+    local f
+    f=$(hb_extra_paths_file)
+    mkdir -p "$HB_STATE_DIR"
+    touch "$f"; chmod 600 "$f"
+    grep -Fxq "$path" "$f" 2>/dev/null || printf '%s\n' "$path" >> "$f"
+}
+
+# Removes a path from the persisted extra-paths file.
+hb_del_extra_path() {
+    local path="$1"
+    [[ -z "$path" ]] && return 1
+    local f tmp
+    f=$(hb_extra_paths_file)
+    [[ -f "$f" ]] || return 0
+    tmp=$(mktemp)
+    grep -Fvx "$path" "$f" > "$tmp" || true
+    mv "$tmp" "$f"
+    chmod 600 "$f"
+}
+
 hb_select_profile_paths() {
     local mode="$1"
     local __out_var="$2"
     local -n __out_ref="$__out_var"
 
     mapfile -t __defaults < <(hb_default_profile_paths)
+    local -a __extras=()
+    mapfile -t __extras < <(hb_load_extra_paths)
 
     if [[ "$mode" == "default" ]]; then
-        __out_ref=("${__defaults[@]}")
+        # Default profile = base 59 paths + whatever the operator has
+        # previously persisted as "always include this folder of mine".
+        __out_ref=("${__defaults[@]}" "${__extras[@]}")
         return 0
     fi
 
-    local options=() idx=1 path
-    for path in "${__defaults[@]}"; do
-        options+=("$idx" "$path" "off")
-        ((idx++))
-    done
-
-    local selected
-    selected=$(dialog --backtitle "ProxMenux" \
-        --title "$(hb_translate "Custom backup profile")" \
-        --separate-output --checklist \
-        "$(hb_translate "Select paths to include:")" \
-        26 86 18 "${options[@]}" 3>&1 1>&2 2>&3) || return 1
-
-    __out_ref=()
+    # Custom mode runs as a loop: present checklist + offer to add/remove
+    # user paths, re-present until the operator confirms. This gives
+    # /add/edit/remove without redesigning the dialog stack.
     local choice
-    while read -r choice; do
-        [[ -z "$choice" ]] && continue
-        __out_ref+=("${__defaults[$((choice-1))]}")
-    done <<< "$selected"
+    while :; do
+        # Reload after potential edits in the previous iteration
+        mapfile -t __extras < <(hb_load_extra_paths)
 
-    if [[ ${#__out_ref[@]} -eq 0 ]]; then
-        dialog --backtitle "ProxMenux" --title "$(hb_translate "Error")" \
-            --msgbox "$(hb_translate "No paths selected. Select at least one path.")" 8 60
-        return 1
-    fi
+        local options=() idx=1 path
+        for path in "${__defaults[@]}"; do
+            options+=("$idx" "$path" "off")
+            ((idx++))
+        done
+        local first_extra_idx=$idx
+        for path in "${__extras[@]}"; do
+            # User-added paths default ON — they wouldn't be in the list
+            # if the operator hadn't explicitly added them.
+            options+=("$idx" "[+] $path" "on")
+            ((idx++))
+        done
+
+        # Three-button checklist:
+        #   OK             (rc=0) → save selection and continue
+        #   Add custom path (rc=3) → opens an inputbox; on success the new
+        #                            path is appended to the persisted list
+        #                            and the checklist re-renders with the
+        #                            new entry already ticked
+        #   Cancel         (rc=1) → abort the entire backup flow
+        local selected rc
+        selected=$(dialog --backtitle "ProxMenux" \
+            --title "$(hb_translate "Custom backup profile")" \
+            --default-button ok \
+            --extra-button --extra-label "$(hb_translate "Add custom path")" \
+            --separate-output --checklist \
+            "$(hb_translate "Tick the paths to include in this backup. Press \"Add custom path\" to add a folder or file of your own to the list.")" \
+            26 86 18 "${options[@]}" 3>&1 1>&2 2>&3)
+        rc=$?
+
+        if (( rc == 0 )); then
+            __out_ref=()
+            while read -r choice; do
+                [[ -z "$choice" ]] && continue
+                if (( choice < first_extra_idx )); then
+                    __out_ref+=("${__defaults[$((choice-1))]}")
+                else
+                    __out_ref+=("${__extras[$((choice-first_extra_idx))]}")
+                fi
+            done <<< "$selected"
+
+            if [[ ${#__out_ref[@]} -eq 0 ]]; then
+                dialog --backtitle "ProxMenux" --title "$(hb_translate "Error")" \
+                    --msgbox "$(hb_translate "No paths selected. Select at least one path.")" 8 60
+                continue
+            fi
+            return 0
+        fi
+
+        if (( rc == 1 )); then
+            return 1
+        fi
+
+        # rc == 3 → "Add custom path": jump straight into the inputbox.
+        # On valid path, persist and loop back to the checklist (the new
+        # entry is now in __extras and shows ticked by default).
+        local new_path
+        new_path=$(dialog --backtitle "ProxMenux" \
+            --title "$(hb_translate "Add custom path")" \
+            --inputbox "$(hb_translate "Absolute path to a file or directory you want backed up:")" \
+            "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "/root/" 3>&1 1>&2 2>&3) || continue
+        new_path="${new_path%/}"
+        if [[ -z "$new_path" ]]; then
+            continue
+        fi
+        if [[ ! -e "$new_path" ]]; then
+            dialog --backtitle "ProxMenux" --colors \
+                --title "$(hb_translate "Path not found")" \
+                --msgbox "\Z1${new_path}\Zn\n\n$(hb_translate "does not exist on this host. Path not added.")" 10 70
+            continue
+        fi
+        hb_add_extra_path "$new_path"
+    done
 }
 
 # ==========================================================
@@ -204,10 +550,27 @@ hb_prepare_staging() {
                 )
             fi
 
-            # Runtime pending-restore data belongs in /var/lib/proxmenux, never in app code tree.
+            # /usr/local/share/proxmenux: ship USER STATE only (components_status.json,
+            # user prefs, post-install cache). NEVER ship code (scripts/, utils.sh, web/,
+            # AppImage/, monitor-app/) — destination has its own installed proxmenux which
+            # may be newer than the backup. Hot-applying the backup's old /scripts/ over
+            # the destination's fresh install silently regresses the apply_cluster_postboot
+            # dispatcher and the *_installer.sh --auto-reinstall hooks, breaking the
+            # "user reinstalls nothing" promise.
             if [[ "$rel" == "usr/local/share/proxmenux" || "$rel" == "usr/local/share/proxmenux/"* ]]; then
                 rsync_opts+=(
                     --exclude "restore-pending/"
+                    --exclude "scripts/"
+                    --exclude "web/"
+                    --exclude "monitor-app/"
+                    --exclude "monitor-app.*/"
+                    --exclude "AppImage/"
+                    --exclude "images/"
+                    --exclude "json/"
+                    --exclude "utils.sh"
+                    --exclude "helpers_cache.json"
+                    --exclude "ProxMenux-Monitor.AppImage*"
+                    --exclude "install_proxmenux*.sh"
                 )
             fi
 
@@ -231,6 +594,32 @@ hb_prepare_staging() {
     command -v pct      >/dev/null 2>&1 && pct list      > "$meta/pct-list.txt"   2>&1 || true
     command -v zpool    >/dev/null 2>&1 && zpool status  > "$meta/zpool.txt"      2>&1 || true
 
+    # Extra hardware fingerprints used by hb_compat_check on restore to
+    # detect drift that would make some paths unsafe to apply:
+    #   * zpool.guids → pool name + GUID. Same pool name on a fresh
+    #     install gets a NEW GUID; restoring /etc/zfs/zpool.cache with
+    #     the old GUID then drops the boot into emergency mode.
+    #   * blkid.txt   → all block-device UUIDs, used to verify
+    #     /etc/fstab and /etc/kernel/proxmox-boot-uuids still resolve.
+    #   * lspci.txt   → presence test for GPUs / TPUs / NICs referenced
+    #     by components_status.json (so we don't try to reinstall an
+    #     NVIDIA driver on a host with no NVIDIA card any more).
+    command -v zpool >/dev/null 2>&1 && zpool list -H -o name,guid > "$meta/zpool.guids" 2>&1 || true
+    command -v blkid >/dev/null 2>&1 && blkid -s UUID -s TYPE     > "$meta/blkid.txt"    2>&1 || true
+    command -v lspci >/dev/null 2>&1 && lspci -nn                  > "$meta/lspci.txt"    2>&1 || true
+
+    # Package inventory — captures what's installed on the source
+    # host so the restore flow can offer to reinstall missing user
+    # packages on the target. Solves the "config restored but the
+    # binary is missing, service hangs at boot" class of issues
+    # (log2ram, figurine, sensors etc. installed by post-install).
+    if command -v dpkg >/dev/null 2>&1; then
+        dpkg --get-selections >  "$meta/packages.list"        2>/dev/null || true
+    fi
+    if command -v apt-mark >/dev/null 2>&1; then
+        apt-mark showmanual   >  "$meta/packages.manual.list" 2>/dev/null || true
+    fi
+
     # Manifest + checksums
     (
         cd "$staging_root/rootfs" || return 1
@@ -238,6 +627,33 @@ hb_prepare_staging() {
         find . -type f -print0 | sort -z | xargs -0 sha256sum 2>/dev/null \
             > "$meta/checksums.sha256" || true
     )
+
+    # ── Structured manifest.json (proxmenux_backup_manifest) ──
+    # build_manifest.sh composes the collectors output into the
+    # exact JSON shape parse_manifest.sh + run_restore.sh expect.
+    # Without it, every restore flow degrades to "no manifest found"
+    # and the Monitor's View Contents / restore preview shows nothing.
+    # The collectors live next to this library file.
+    local _hb_lib_dir _hb_collector_dir _hb_build_manifest
+    _hb_lib_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    _hb_collector_dir="$_hb_lib_dir/collectors"
+    _hb_build_manifest="$_hb_collector_dir/build_manifest.sh"
+    if [[ -x "$_hb_build_manifest" ]]; then
+        local -a _hb_archived=()
+        if [[ -s "$meta/selected_paths.txt" ]]; then
+            mapfile -t _hb_archived < "$meta/selected_paths.txt"
+        fi
+        if (( ${#_hb_archived[@]} > 0 )); then
+            bash "$_hb_build_manifest" --paths-archived "${_hb_archived[@]}" \
+                > "$staging_root/manifest.json" 2>/dev/null || true
+        else
+            bash "$_hb_build_manifest" \
+                > "$staging_root/manifest.json" 2>/dev/null || true
+        fi
+        # Drop the file if the collectors emitted nothing useful so
+        # parse_manifest doesn't read a 0-byte JSON downstream.
+        [[ -s "$staging_root/manifest.json" ]] || rm -f "$staging_root/manifest.json"
+    fi
 }
 
 hb_load_restore_paths() {
@@ -269,9 +685,10 @@ hb_collect_pbs_configs() {
     HB_PBS_REPOS=()
     HB_PBS_SECRETS=()
     HB_PBS_SOURCES=()
+    HB_PBS_FINGERPRINTS=()
 
     if [[ -f /etc/pve/storage.cfg ]]; then
-        local current="" server="" datastore="" username="" pw_file pw_val
+        local current="" server="" datastore="" username="" fingerprint="" pw_file pw_val
         while IFS= read -r line; do
             line="${line%%#*}"
             line="${line#"${line%%[![:space:]]*}"}"
@@ -285,12 +702,20 @@ hb_collect_pbs_configs() {
                     HB_PBS_REPOS+=("${username}@${server}:${datastore}")
                     HB_PBS_SECRETS+=("$pw_val")
                     HB_PBS_SOURCES+=("proxmox")
+                    HB_PBS_FINGERPRINTS+=("$fingerprint")
                 fi
-                current="${BASH_REMATCH[1]}"; server="" datastore="" username=""
+                current="${BASH_REMATCH[1]}"; server="" datastore="" username="" fingerprint=""
             elif [[ -n "$current" ]]; then
-                [[ $line =~ ^[[:space:]]+server[[:space:]]+(.+)$    ]] && server="${BASH_REMATCH[1]}"
-                [[ $line =~ ^[[:space:]]+datastore[[:space:]]+(.+)$ ]] && datastore="${BASH_REMATCH[1]}"
-                [[ $line =~ ^[[:space:]]+username[[:space:]]+(.+)$  ]] && username="${BASH_REMATCH[1]}"
+                # The line was already trimmed of leading/trailing
+                # whitespace above. Match the field name directly at
+                # the start of the (post-trim) line — the old regex
+                # demanded leading whitespace that the trim had
+                # already stripped, so the sub-fields were silently
+                # never captured.
+                [[ $line =~ ^server[[:space:]]+(.+)$      ]] && server="${BASH_REMATCH[1]}"
+                [[ $line =~ ^datastore[[:space:]]+(.+)$   ]] && datastore="${BASH_REMATCH[1]}"
+                [[ $line =~ ^username[[:space:]]+(.+)$    ]] && username="${BASH_REMATCH[1]}"
+                [[ $line =~ ^fingerprint[[:space:]]+(.+)$ ]] && fingerprint="${BASH_REMATCH[1]}"
                 if [[ $line =~ ^[a-zA-Z]+:[[:space:]] &&
                       -n "$server" && -n "$datastore" && -n "$username" ]]; then
                     pw_file="/etc/pve/priv/storage/${current}.pw"
@@ -299,7 +724,8 @@ hb_collect_pbs_configs() {
                     HB_PBS_REPOS+=("${username}@${server}:${datastore}")
                     HB_PBS_SECRETS+=("$pw_val")
                     HB_PBS_SOURCES+=("proxmox")
-                    current="" server="" datastore="" username=""
+                    HB_PBS_FINGERPRINTS+=("$fingerprint")
+                    current="" server="" datastore="" username="" fingerprint=""
                 fi
             fi
         done < /etc/pve/storage.cfg
@@ -311,13 +737,14 @@ hb_collect_pbs_configs() {
             HB_PBS_REPOS+=("${username}@${server}:${datastore}")
             HB_PBS_SECRETS+=("$pw_val")
             HB_PBS_SOURCES+=("proxmox")
+            HB_PBS_FINGERPRINTS+=("$fingerprint")
         fi
     fi
 
     # Manual configs
     local manual_cfg="$HB_STATE_DIR/pbs-manual-configs.txt"
     if [[ -f "$manual_cfg" ]]; then
-        local line name repo sf
+        local line name repo sf fp_file
         while IFS= read -r line; do
             line="${line%%#*}"
             line="${line#"${line%%[![:space:]]*}"}"
@@ -325,9 +752,11 @@ hb_collect_pbs_configs() {
             [[ -z "$line" ]] && continue
             name="${line%%|*}"; repo="${line##*|}"
             sf="$HB_STATE_DIR/pbs-pass-${name}.txt"
+            fp_file="$HB_STATE_DIR/pbs-fingerprint-${name}.txt"
             HB_PBS_NAMES+=("$name"); HB_PBS_REPOS+=("$repo")
             HB_PBS_SECRETS+=("$([[ -f "$sf" ]] && cat "$sf" || echo "")")
             HB_PBS_SOURCES+=("manual")
+            HB_PBS_FINGERPRINTS+=("$([[ -f "$fp_file" ]] && cat "$fp_file" || echo "")")
         done < "$manual_cfg"
     fi
 }
@@ -354,9 +783,18 @@ hb_configure_pbs_manual() {
         "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "" 3>&1 1>&2 2>&3) || return 1
     [[ -z "$datastore" ]] && return 1
 
-    secret=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "Add PBS")" \
-        --insecure --passwordbox "$(hb_translate "Password or API token secret:")" \
-        "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 1
+    # Ask for the secret in a loop — an OK click on an empty box used
+    # to persist an empty password file silently, which then made every
+    # subsequent backup fail with an opaque auth error. Cancel still
+    # aborts the whole flow; empty + OK re-prompts.
+    while true; do
+        secret=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "Add PBS")" \
+            --insecure --passwordbox "$(hb_translate "Password or API token secret:")" \
+            "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 1
+        [[ -n "$secret" ]] && break
+        dialog --backtitle "ProxMenux" \
+            --msgbox "$(hb_translate "Password cannot be empty.")" 8 50
+    done
 
     repo="${user}@${host}:${datastore}"
     mkdir -p "$HB_STATE_DIR"
@@ -395,11 +833,24 @@ hb_select_pbs_repository() {
         HB_PBS_NAME="${HB_PBS_NAMES[$sel]}"
         export HB_PBS_REPOSITORY="${HB_PBS_REPOS[$sel]}"
         HB_PBS_SECRET="${HB_PBS_SECRETS[$sel]}"
+        # Export the fingerprint so _bk_pbs / _rs_extract_pbs can
+        # pass it to proxmox-backup-client via PBS_FINGERPRINT. The
+        # binary otherwise prompts "Are you sure you want to
+        # continue connecting? (y/n):" — twice in some flows
+        # (backup + catalog upload) — and silently auto-accepts on
+        # stdin closure, which is both noisy and an MITM risk on a
+        # cross-host restore.
+        export HB_PBS_FINGERPRINT="${HB_PBS_FINGERPRINTS[$sel]:-}"
         if [[ -z "$HB_PBS_SECRET" ]]; then
-            HB_PBS_SECRET=$(dialog --backtitle "ProxMenux" --title "PBS" \
-                --insecure --passwordbox \
-                "$(hb_translate "Password for:") $HB_PBS_NAME" \
-                "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 1
+            while true; do
+                HB_PBS_SECRET=$(dialog --backtitle "ProxMenux" --title "PBS" \
+                    --insecure --passwordbox \
+                    "$(hb_translate "Password for:") $HB_PBS_NAME" \
+                    "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 1
+                [[ -n "$HB_PBS_SECRET" ]] && break
+                dialog --backtitle "ProxMenux" \
+                    --msgbox "$(hb_translate "Password cannot be empty.")" 8 50
+            done
             mkdir -p "$HB_STATE_DIR"
             printf '%s' "$HB_PBS_SECRET" > "$HB_STATE_DIR/pbs-pass-${HB_PBS_NAME}.txt"
             chmod 600 "$HB_STATE_DIR/pbs-pass-${HB_PBS_NAME}.txt"
@@ -407,88 +858,967 @@ hb_select_pbs_repository() {
     fi
 }
 
+# ==========================================================
+# PBS KEYFILE RECOVERY
+#
+# `proxmox-backup-client key create` cannot set a KDF passphrase
+# non-interactively, so we generate the keyfile with `--kdf none`
+# and add our OWN passphrase-based recovery layer on top:
+#
+#   1. After creating the keyfile, ask the operator for a recovery
+#      passphrase. Encrypt the keyfile with openssl using that
+#      passphrase → produces `pbs-key.recovery.enc`.
+#   2. On every PBS backup, we upload `pbs-key.recovery.enc` to a
+#      SEPARATE backup group (`host/hostcfg-<host>-keyrecovery`)
+#      with NO `--keyfile` flag — so PBS stores it as a regular
+#      (non-PBS-encrypted) blob. The blob is still protected by
+#      the operator's passphrase via openssl. The `-keyrecovery`
+#      suffix on the same `hostcfg-<host>` prefix keeps the two
+#      groups adjacent in the PBS UI, making the recovery snapshots
+#      recognisable as belonging to this host's backups instead of
+#      looking like an unrelated group that an operator might delete
+#      by mistake. Legacy builds used the ID `proxmenux-keyrecovery-<host>`;
+#      the recovery discovery below matches both patterns so old
+#      escrow blobs are still usable.
+#   3. On a fresh install where the local keyfile is missing, the
+#      restore flow looks up the recovery group in PBS, downloads
+#      the blob, asks for the passphrase, decrypts it, and writes
+#      the keyfile back to its canonical location.
+#
+# So the operator only needs to remember the passphrase. The
+# encrypted recovery copy travels with their PBS backups
+# automatically; no manual offsite keyfile escrow required.
+# ==========================================================
+
+hb_pbs_encrypt_recovery() {
+    # Reads passphrase from stdin. AES-256-CBC + PBKDF2 with 600k
+    # iterations — standard openssl format, decryptable from any
+    # host with openssl ≥ 1.1.1.
+    openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt \
+        -in "$1" -out "$2" -pass stdin 2>/dev/null
+}
+
+hb_pbs_decrypt_recovery() {
+    openssl enc -d -aes-256-cbc -pbkdf2 -iter 600000 \
+        -in "$1" -out "$2" -pass stdin 2>/dev/null
+}
+
+# ==========================================================
+# ESCROW MODE — data model for the keyfile recovery strategy
+# ==========================================================
+# A single state file at $HB_STATE_DIR/pbs-key.mode records how this
+# host wants its PBS keyfile protected against loss. Three values:
+#   none   — keyfile lives only here. No local envelope, no upload.
+#            If host is lost without an offsite copy → data is gone.
+#   local  — an openssl-wrapped envelope of the keyfile is written to
+#            /root and $HB_STATE_DIR. Not uploaded to PBS. Operator
+#            moves the /root copy offsite.
+#   full   — same envelope AND uploaded to PBS as -keyrecovery group.
+#            Fully self-recoverable, at the cost of putting the
+#            wrapped keyfile on the same server as the encrypted data.
+# Missing file = pre-existing install from before this feature. Treat
+# as 'full' to preserve behaviour. Only backup_host.sh / the runner
+# needs to read this at runtime; the dialog paths write it.
+
+_hb_pbs_read_escrow_mode() {
+    local f="$HB_STATE_DIR/pbs-key.mode"
+    if [[ -s "$f" ]]; then
+        local v
+        v=$(head -c 32 "$f" | tr -d '[:space:]')
+        case "$v" in
+            none|local|full) printf '%s' "$v"; return 0 ;;
+        esac
+    fi
+    printf 'full'
+}
+
+_hb_pbs_write_escrow_mode() {
+    local mode="$1"
+    case "$mode" in
+        none|local|full) : ;;
+        *) return 1 ;;
+    esac
+    mkdir -p "$HB_STATE_DIR" 2>/dev/null || true
+    umask 077
+    printf '%s\n' "$mode" > "$HB_STATE_DIR/pbs-key.mode"
+    chmod 600 "$HB_STATE_DIR/pbs-key.mode" 2>/dev/null || true
+    return 0
+}
+
+# ==========================================================
+# PVE STORAGE KEYFILE DISCOVERY
+# ==========================================================
+# When the operator has already added a PBS storage in Proxmox VE
+# and enabled encryption on it (`pvesm set NAME --encryption-key
+# autogen` or via the storage editor), PVE writes the keyfile to
+# /etc/pve/priv/storage/<NAME>.enc. That file IS a valid raw PBS
+# keyfile (same JSON format as `proxmox-backup-client key create
+# --kdf none`); it can be reused verbatim with --keyfile.
+# ProxMenux surfaces those keyfiles as reuse candidates in the
+# encryption dialog, so users don't have to type absolute paths or
+# duplicate secrets across two configs.
+
+# Emit one line per PVE-managed PBS storage that has a .enc keyfile:
+#   name|server|datastore|keyfile-path
+_hb_pbs_discover_pve_keyfiles() {
+    local cfg=/etc/pve/storage.cfg
+    local dir=/etc/pve/priv/storage
+    [[ -r "$cfg" && -d "$dir" ]] || return 0
+
+    # Parse storage.cfg PBS entries into name+server+datastore triples.
+    # A single awk pass builds the triples; a shell loop then checks
+    # each for a matching .enc keyfile and emits only those that
+    # actually exist.
+    awk '
+        function emit(){ printf "%s|%s|%s\n", name, server, datastore }
+        /^pbs:[[:space:]]+/ { if (name) emit(); name=$2; server=""; datastore=""; next }
+        /^[a-z]+:[[:space:]]+/ { if (name) { emit(); name="" } }
+        /^[[:space:]]+server[[:space:]]+/    { server=$2 }
+        /^[[:space:]]+datastore[[:space:]]+/ { datastore=$2 }
+        END { if (name) emit() }
+    ' "$cfg" 2>/dev/null | while IFS='|' read -r name server datastore; do
+        local kf="$dir/$name.enc"
+        [[ -s "$kf" ]] || continue
+        printf '%s|%s|%s|%s\n' "$name" "$server" "$datastore" "$kf"
+    done
+}
+
+# Given HB_PBS_REPOSITORY (form user@realm@host:datastore), find the
+# PVE-storage keyfile whose server + datastore match. Emits the path
+# on stdout, exits non-zero if no match.
+_hb_pbs_pve_keyfile_for_current_repo() {
+    [[ -n "${HB_PBS_REPOSITORY:-}" ]] || return 1
+    local repo_host repo_datastore
+    repo_host="${HB_PBS_REPOSITORY##*@}"
+    repo_host="${repo_host%:*}"
+    repo_datastore="${HB_PBS_REPOSITORY##*:}"
+    local match
+    match=$(_hb_pbs_discover_pve_keyfiles | awk -F'|' \
+        -v h="$repo_host" -v d="$repo_datastore" \
+        '$2==h && $3==d {print $4; exit}')
+    [[ -n "$match" ]] || return 1
+    printf '%s' "$match"
+}
+
+# Copy a PVE-storage keyfile into the ProxMenux canonical location.
+# Same trust boundary as hb_pbs_import_keyfile — no validation, just
+# atomic install + chmod 600.
+_hb_pbs_install_pve_keyfile() {
+    local src="$1"
+    local dst="$HB_STATE_DIR/pbs-key.conf"
+    [[ -s "$src" && -r "$src" ]] || return 1
+    mkdir -p "$HB_STATE_DIR" 2>/dev/null || true
+    local tmp
+    tmp=$(mktemp "${dst}.pve.XXXXXX") || return 1
+    if ! cp -f "$src" "$tmp"; then rm -f "$tmp"; return 1; fi
+    chmod 600 "$tmp"
+    mv -f "$tmp" "$dst" || { rm -f "$tmp"; return 1; }
+    return 0
+}
+
+# ==========================================================
+# ESCROW MODE — dialog
+# ==========================================================
+# Simple yes/no: "Upload the encryption key to PBS?" — mirrors the
+# operator's mental model. Two outcomes only, no middle ground:
+#   Yes → mode='full': ProxMenux writes a passphrase-wrapped copy of
+#         the keyfile to /root and uploads it to PBS as the
+#         `-keyrecovery` group so a reinstalled host can recover the
+#         key with just the passphrase.
+#   No  → mode='none': ProxMenux keeps the keyfile ONLY at the
+#         canonical local path. The operator is shown the location
+#         and told to make their own offsite copy — losing it means
+#         every encrypted backup on PBS is unreadable.
+# The 'local' mode (envelope in /root but not uploaded) is still a
+# valid backend value; it is just not surfaced to the operator here.
+#
+# Sets HB_PBS_ESCROW_RESULT to 'full' or 'none' on success; returns
+# non-zero on cancel. We use a global variable instead of stdout
+# capture because `if dialog --yesno ...; then` inside a `$( )`
+# command substitution flushes the terminal at subshell exit and
+# leaves the very next dialog invocation needing an extra Enter to
+# render — invisible bug in ‘new’ keyfile flow. Callers set
+# their own `local mode=$HB_PBS_ESCROW_RESULT` right after.
+_hb_pbs_prompt_escrow_mode() {
+    # Optional first arg: source path of an EXISTING keyfile the
+    # operator is about to reuse (either from PVE storage or from an
+    # absolute path they just typed). When set, the dialog:
+    #   • shows the source path so the operator sees where the key
+    #     already lives on this host,
+    #   • defaults to "No, keep local only" — the operator already
+    #     has this keyfile elsewhere, so a PBS escrow copy is usually
+    #     redundant. They can still hit Yes.
+    # When empty (fresh generate), defaults to "Yes, upload" — the
+    # safer path when no other copy of the key exists yet.
+    local existing_source="${1:-}"
+    HB_PBS_ESCROW_RESULT=""
+
+    local msg
+    msg="$(hb_translate "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?")"$'\n\n'
+    if [[ -n "$existing_source" ]]; then
+        msg+="$(hb_translate "Existing key is at:")"$'\n'"       $existing_source"$'\n\n'
+    fi
+    msg+="$(hb_translate "Yes: set a recovery passphrase now; the encrypted key envelope is uploaded with every backup.")"$'\n\n'
+    msg+="$(hb_translate "No: the key stays only at")"$'\n'"       $HB_STATE_DIR/pbs-key.conf"$'\n'
+    msg+="$(hb_translate "Copy that file offsite yourself, or download it from the Monitor.")"
+
+    local -a dialog_args=(
+        --backtitle "ProxMenux"
+        --title "$(hb_translate "Upload key to PBS?")"
+        --yes-label "$(hb_translate "Yes, upload")"
+        --no-label "$(hb_translate "No, keep local only")"
+        --defaultno
+    )
+    dialog_args+=(--yesno "$msg" 18 78)
+
+    dialog "${dialog_args[@]}"
+    # 0 = Yes button, 1 = No button, anything else (ESC / cancel) →
+    # abort the whole encryption setup so the operator can retry.
+    case $? in
+        0) HB_PBS_ESCROW_RESULT='full'; return 0 ;;
+        1) HB_PBS_ESCROW_RESULT='none'; return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+# Import a user-provided PBS encryption keyfile at the canonical
+# ProxMenux path. Used by the "shared keyfile across hosts" flow
+# where the operator generated one master key manually and wants
+# every host to reuse it (single recovery blob covers all).
+#
+# Args: $1 = path to the source keyfile (any location on disk).
+#
+# Validation: the file must exist, be non-empty, and be recognised
+# by `proxmox-backup-client key info` as a valid PBS keyfile. If
+# any check fails the function returns non-zero and leaves the
+# canonical path untouched, so the caller can fall back to the
+# "generate new" path or report the error.
+#
+# On success: the file is copied to $HB_STATE_DIR/pbs-key.conf
+# with chmod 600 and the caller can proceed with the recovery
+# blob offer as usual.
+hb_pbs_import_keyfile() {
+    local src="$1"
+    local dst="$HB_STATE_DIR/pbs-key.conf"
+
+    [[ -n "$src" && -s "$src" && -r "$src" ]] || return 1
+
+    # `key info` reads the file header and prints fingerprint /
+    # kdf info without prompting for a passphrase (this works for
+    # kdf=none keyfiles, which is what our own `key create` uses
+    # and what most operators generate manually). If the file is
+    # not a valid PBS keyfile, the tool exits non-zero.
+    if ! proxmox-backup-client key info --output-format json "$src" \
+         >/dev/null 2>&1; then
+        return 2
+    fi
+
+    mkdir -p "$HB_STATE_DIR" 2>/dev/null || true
+    # Install atomically: cp to a tmp path in the same dir, chmod,
+    # then rename. Avoids a half-written file if the copy is
+    # interrupted mid-flight.
+    local tmp
+    tmp=$(mktemp "${dst}.import.XXXXXX") || return 3
+    if ! cp -f "$src" "$tmp"; then
+        rm -f "$tmp"
+        return 3
+    fi
+    chmod 600 "$tmp"
+    if ! mv -f "$tmp" "$dst"; then
+        rm -f "$tmp"
+        return 3
+    fi
+    return 0
+}
+
+# Prompt for a recovery passphrase pair. Sets HB_PBS_PASS_RESULT on
+# success; returns non-zero on cancel or when openssl is missing. The
+# caller decides when — and whether — to persist a keyfile after this,
+# so a cancel here leaves the disk exactly as it was.
+#
+# Uses a global variable instead of stdout capture — see the note on
+# _hb_pbs_prompt_escrow_mode. Command-substitution around dialogs
+# leaves the terminal in a state where the next dialog needs an extra
+# Enter to render.
+_hb_pbs_prompt_recovery_pass() {
+    HB_PBS_PASS_RESULT=""
+    if ! command -v openssl >/dev/null 2>&1; then
+        dialog --backtitle "ProxMenux" --title "$(hb_translate "Recovery setup failed")" \
+            --msgbox "$(hb_translate "openssl is not installed — cannot create recovery copy. Install openssl and retry.")" 9 70
+        return 1
+    fi
+    local pass1 pass2
+    while true; do
+        pass1=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "Recovery passphrase")" \
+            --insecure --passwordbox "$(hb_translate "Choose a recovery passphrase (write it down somewhere safe):")" \
+            "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 1
+        [[ -z "$pass1" ]] && continue
+        pass2=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "Recovery passphrase")" \
+            --insecure --passwordbox "$(hb_translate "Confirm recovery passphrase:")" \
+            "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 1
+        [[ "$pass1" == "$pass2" ]] && break
+        dialog --backtitle "ProxMenux" \
+            --msgbox "$(hb_translate "Passphrases do not match. Try again.")" 8 50
+    done
+    HB_PBS_PASS_RESULT="$pass1"
+    return 0
+}
+
+# Encrypt the on-disk keyfile with the supplied passphrase, drop an
+# offsite copy under /root, and show the operator the success dialog.
+# Precondition: the keyfile exists at $HB_STATE_DIR/pbs-key.conf.
+# Returns non-zero only on openssl failure (rare). The caller is
+# responsible for undoing whatever it just did if this fails.
+#
+# Args:
+#   $1 = passphrase
+#   $2 = escrow mode ('local' or 'full'); the message text branches
+#        on this. Never called with 'none' — the top-level flow skips
+#        finalize entirely for that mode.
+_hb_pbs_finalize_recovery() {
+    local pass="$1"
+    local mode="${2:-full}"
+    local key_file="$HB_STATE_DIR/pbs-key.conf"
+    local recovery_enc="$HB_STATE_DIR/pbs-key.recovery.enc"
+
+    if ! printf '%s' "$pass" | hb_pbs_encrypt_recovery "$key_file" "$recovery_enc"; then
+        dialog --backtitle "ProxMenux" --title "$(hb_translate "Recovery setup failed")" \
+            --msgbox "$(hb_translate "openssl encryption failed.")" 9 70
+        return 1
+    fi
+    chmod 600 "$recovery_enc"
+
+    # No extra "Recovery ready" msgbox — the operator's next action is
+    # the backup itself. The status of the encryption setup is visible
+    # in the Monitor and in the summary the backup emits when it
+    # starts running.
+    return 0
+}
+
+# Public wrapper preserved for external callers that already have a
+# keyfile on disk and just want the recovery blob generated. Combines
+# the prompt + finalize phases. Defaults to 'full' when called without
+# a mode argument (preserves legacy caller behaviour); when the caller
+# passes a mode it is forwarded to _hb_pbs_finalize_recovery so the
+# success message matches.
+hb_pbs_setup_recovery() {
+    local mode="${1:-full}"
+    local pass
+    pass=$(_hb_pbs_prompt_recovery_pass) || return 1
+    if ! _hb_pbs_finalize_recovery "$pass" "$mode"; then
+        return 1
+    fi
+    _hb_pbs_write_escrow_mode "$mode"
+}
+
+# Upload the local recovery .enc to PBS as a separate snapshot
+# group. Called from _bk_pbs after the main backup succeeds.
+# Short-circuits when escrow mode is not 'full' — the recovery
+# envelope may still exist locally in 'local' mode, but the whole
+# point of that mode is not putting it on PBS. Skips silently if no
+# recovery copy is present. Returns 0 on success or skip, 1 on
+# upload failure.
+hb_pbs_upload_recovery_blob() {
+    local epoch="$1"
+    local recovery_enc="$HB_STATE_DIR/pbs-key.recovery.enc"
+    [[ ! -f "$recovery_enc" ]] && return 0
+    local mode
+    mode=$(_hb_pbs_read_escrow_mode)
+    [[ "$mode" != "full" ]] && return 0
+
+    # `proxmox-backup-client backup` only accepts archive types
+    # `pxar` / `img` / `conf` / `log` as the source spec — `.blob`
+    # is an internal storage format, not a valid input type. The
+    # recovery file is a small openssl-encrypted blob so we use
+    # `.conf` (which PBS stores internally as `.conf.blob`). On
+    # restore we ask for `keyrecovery.conf` (without the .blob
+    # suffix) and PBS resolves it transparently.
+    # Note: deliberately NO --keyfile here. The blob is already
+    # passphrase-encrypted by openssl; we want PBS to store it as
+    # a plain blob so it can be retrieved without the keyfile.
+    PBS_PASSWORD="$HB_PBS_SECRET" \
+    PBS_FINGERPRINT="${HB_PBS_FINGERPRINT:-}" \
+        proxmox-backup-client backup \
+            "keyrecovery.conf:$recovery_enc" \
+            --repository "$HB_PBS_REPOSITORY" \
+            --backup-type host \
+            --backup-id "hostcfg-$(hostname)-keyrecovery" \
+            --backup-time "$epoch" \
+            >/dev/null 2>&1
+}
+
+# On a fresh install with no local keyfile, try to recover it.
+# Attempts several sources in order of decreasing convenience for
+# Manual-import fallback: prompt the operator for the absolute path
+# of the keyfile on this host. Copies it verbatim to the canonical
+# path. Called from hb_pbs_try_keyfile_recovery when both auto-paths
+# (PVE storage keyfile, PBS keyrecovery group) have been exhausted.
+# Returns 0 on successful install, 1 on cancel or missing file.
+_hb_pbs_manual_keyfile_import() {
+    local target_keyfile="$1"
+    local src
+    src=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "Import encryption keyfile")" \
+        --inputbox "$(hb_translate "No PBS keyfile is installed on this host and no automatic recovery was possible.")"$'\n\n'"$(hb_translate "Copy your PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to")"$'\n'"       $target_keyfile" \
+        16 78 "" 3>&1 1>&2 2>&3) || return 1
+    src="$(echo "$src" | xargs)"
+    [[ -z "$src" ]] && return 1
+    if [[ ! -s "$src" || ! -r "$src" ]]; then
+        dialog --backtitle "ProxMenux" --title "$(hb_translate "Import failed")" \
+            --msgbox "$(hb_translate "The file does not exist, is empty or is not readable.")"$'\n\n'"$(hb_translate "Path:") $src" \
+            10 78
+        return 1
+    fi
+    mkdir -p "$(dirname "$target_keyfile")"
+    if ! cp -f "$src" "$target_keyfile"; then
+        dialog --backtitle "ProxMenux" --title "$(hb_translate "Import failed")" \
+            --msgbox "$(hb_translate "Could not copy the keyfile into place.")" 9 70
+        return 1
+    fi
+    chmod 600 "$target_keyfile"
+    return 0
+}
+
+# On a fresh install with no local keyfile, try to recover it.
+# Attempts sources in order and stops at the first one that works:
+#
+#   1. PVE-storage keyfile matching HB_PBS_REPOSITORY
+#      (/etc/pve/priv/storage/<name>.enc) — silent copy.
+#   2. PBS `-keyrecovery` snapshot group — prompts for passphrase.
+#   3. Manual import from an absolute path on this host — prompted
+#      when the two auto-paths above find nothing or the operator
+#      declines them.
+#
+# Returns 0 if the keyfile was successfully restored to $1,
+# 1 if no recovery is possible or the user cancelled.
+hb_pbs_try_keyfile_recovery() {
+    local target_keyfile="$1"
+
+    # ── Step 1: PVE-storage keyfile matching the current repository ──
+    # If the operator has already configured PBS in PVE with an
+    # encryption-key, we can use that file verbatim — no passphrase
+    # prompt, no PBS round-trip. This is the classic "why do I need
+    # to import? it is right there" case.
+    local pve_key_path=""
+    if [[ -n "${HB_PBS_REPOSITORY:-}" ]]; then
+        pve_key_path=$(_hb_pbs_pve_keyfile_for_current_repo 2>/dev/null || true)
+    fi
+    if [[ -n "$pve_key_path" && -s "$pve_key_path" ]]; then
+        mkdir -p "$(dirname "$target_keyfile")"
+        if cp -f "$pve_key_path" "$target_keyfile" 2>/dev/null; then
+            chmod 600 "$target_keyfile"
+            dialog --backtitle "ProxMenux" --title "$(hb_translate "Keyfile recovered")" \
+                --msgbox "$(hb_translate "Reused the encryption key from the PVE storage entry.")"$'\n\n'"$(hb_translate "Source:") $pve_key_path"$'\n'"$(hb_translate "Installed at:") $target_keyfile"$'\n\n'"$(hb_translate "Restore can now proceed.")" \
+                14 78
+            return 0
+        fi
+    fi
+
+    if ! command -v openssl >/dev/null 2>&1; then
+        return 1  # silently — main path will surface a clearer error
+    fi
+
+    # ── Step 2: PBS -keyrecovery snapshot group (fall back) ────────
+    # Discover keyrecovery groups in PBS. Two patterns are matched:
+    #   - hostcfg-<host>-keyrecovery   (current naming — groups
+    #                                   adjacent to the main hostcfg-<host>)
+    #   - proxmenux-keyrecovery-<host> (legacy naming — pre-1.2.2.2)
+    # Both are surfaced together so existing escrow blobs from older
+    # builds remain usable during a fresh-install recovery.
+    local -a recovery_entries=()
+    mapfile -t recovery_entries < <(
+        PBS_PASSWORD="$HB_PBS_SECRET" \
+        PBS_FINGERPRINT="${HB_PBS_FINGERPRINT:-}" \
+        proxmox-backup-client snapshot list \
+            --repository "$HB_PBS_REPOSITORY" \
+            --output-format json 2>/dev/null \
+        | jq -r '.[]
+            | select(."backup-type" == "host"
+                     and (   ((."backup-id" | startswith("hostcfg-")) and (."backup-id" | endswith("-keyrecovery")))
+                          or (."backup-id" | startswith("proxmenux-keyrecovery-"))
+                     ))
+            | "\(."backup-id")|\(."backup-time")"' 2>/dev/null \
+        | sort -t'|' -k1,1 -k2,2nr \
+        | awk -F'|' '!seen[$1]++'
+    )
+
+    if [[ ${#recovery_entries[@]} -eq 0 ]]; then
+        # No auto-recovery available — fall through to the manual
+        # import prompt. Nothing has been written to disk yet so a
+        # cancel here just aborts cleanly.
+        _hb_pbs_manual_keyfile_import "$target_keyfile"
+        return $?
+    fi
+
+    # Pick the recovery group (auto if one, ask if many)
+    local picked_id picked_epoch
+    if [[ ${#recovery_entries[@]} -eq 1 ]]; then
+        IFS='|' read -r picked_id picked_epoch <<< "${recovery_entries[0]}"
+    else
+        local menu=() i=1
+        local entry id_part host_part iso_label
+        for entry in "${recovery_entries[@]}"; do
+            id_part="${entry%%|*}"
+            # Strip either naming convention to surface just the
+            # source hostname in the menu label.
+            if [[ "$id_part" == hostcfg-*-keyrecovery ]]; then
+                host_part="${id_part#hostcfg-}"
+                host_part="${host_part%-keyrecovery}"
+            else
+                host_part="${id_part#proxmenux-keyrecovery-}"
+            fi
+            iso_label=$(date -u -d "@${entry##*|}" '+%Y-%m-%d %H:%M' 2>/dev/null || echo "${entry##*|}")
+            menu+=("$i" "$host_part — $iso_label UTC")
+            ((i++))
+        done
+        local sel
+        sel=$(dialog --backtitle "ProxMenux" \
+            --title "$(hb_translate "Keyfile recovery — pick source host")" \
+            --menu "$(hb_translate "Multiple recovery groups found in PBS. Pick the one that originally created the keyfile:")" \
+            18 78 10 "${menu[@]}" 3>&1 1>&2 2>&3) || return 1
+        IFS='|' read -r picked_id picked_epoch <<< "${recovery_entries[$((sel-1))]}"
+    fi
+
+    local iso
+    iso=$(date -u -d "@$picked_epoch" '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null || echo "$picked_epoch")
+    local recovery_snapshot="host/${picked_id}/${iso}"
+
+    if ! dialog --backtitle "ProxMenux" --title "$(hb_translate "Keyfile recovery available")" \
+        --yesno "$(hb_translate "Local keyfile is missing but a recovery copy was found in PBS.")"$'\n\n'"$(hb_translate "Backup:") $recovery_snapshot"$'\n\n'"$(hb_translate "Recover the keyfile using your recovery passphrase?")" \
+        13 78; then
+        # Operator declined PBS recovery → offer the manual import path.
+        _hb_pbs_manual_keyfile_import "$target_keyfile"
+        return $?
+    fi
+
+    # Download the blob once; we may retry passphrase entry without
+    # re-fetching it.
+    local tmp_dir
+    tmp_dir=$(mktemp -d /tmp/_pmnx_keyrec.XXXXXX) || return 1
+    # `restore` wants a FILE target (not a directory) for non-pxar
+    # archives — and we ask for `keyrecovery.conf` (matches the
+    # name used on upload), which PBS resolves to the underlying
+    # `keyrecovery.conf.blob` automatically.
+    if ! PBS_PASSWORD="$HB_PBS_SECRET" \
+        PBS_FINGERPRINT="${HB_PBS_FINGERPRINT:-}" \
+        proxmox-backup-client restore "$recovery_snapshot" "keyrecovery.conf" "$tmp_dir/keyrecovery.enc" \
+            --repository "$HB_PBS_REPOSITORY" >/dev/null 2>&1; then
+        rm -rf "$tmp_dir"
+        dialog --backtitle "ProxMenux" --title "$(hb_translate "Recovery failed")" \
+            --msgbox "$(hb_translate "Could not download recovery blob from PBS.")" 9 70
+        return 1
+    fi
+
+    local passphrase
+    while true; do
+        passphrase=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "Recovery passphrase")" \
+            --insecure --passwordbox "$(hb_translate "Enter the recovery passphrase set when the keyfile was created:")" \
+            "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) \
+            || { rm -rf "$tmp_dir"; return 1; }
+        [[ -z "$passphrase" ]] && continue
+
+        mkdir -p "$(dirname "$target_keyfile")"
+        if printf '%s' "$passphrase" | hb_pbs_decrypt_recovery "$tmp_dir/keyrecovery.enc" "$target_keyfile"; then
+            chmod 600 "$target_keyfile"
+            rm -rf "$tmp_dir"
+            dialog --backtitle "ProxMenux" --title "$(hb_translate "Keyfile recovered")" \
+                --msgbox "$(hb_translate "Keyfile recovered successfully.")"$'\n\n'"$(hb_translate "Location:") $target_keyfile"$'\n\n'"$(hb_translate "Restore can now proceed.")" \
+                12 70
+            return 0
+        fi
+        # Decryption failed — wrong passphrase (or corrupt blob)
+        if ! dialog --backtitle "ProxMenux" --title "$(hb_translate "Wrong passphrase")" \
+            --yesno "$(hb_translate "Decryption failed. The passphrase may be wrong, or the blob is corrupt. Try again?")" \
+            9 70; then
+            rm -rf "$tmp_dir"
+            return 1
+        fi
+    done
+}
+
+
+# Internal helper: create a fresh PBS keyfile at the canonical path
+# and (unless mode='none') its paired recovery envelope. Prompts the
+# operator for the escrow mode first — that decision drives whether
+# a passphrase is asked, whether openssl is run, and what message
+# closes the flow. Cancel at any dialog before the keyfile is
+# actually created leaves the disk untouched.
+_hb_pbs_create_new_keyfile() {
+    local key_file="$HB_STATE_DIR/pbs-key.conf"
+    local recovery_enc="$HB_STATE_DIR/pbs-key.recovery.enc"
+
+    # 1. Pick the escrow mode. Cancel here → zero side effect.
+    _hb_pbs_prompt_escrow_mode || return 1
+    local mode="$HB_PBS_ESCROW_RESULT"
+
+    # 2. Collect the recovery passphrase — only when we're going to
+    #    encrypt an envelope. Cancel at the passphrase prompt → zero
+    #    side effect.
+    local pass=""
+    if [[ "$mode" != "none" ]]; then
+        _hb_pbs_prompt_recovery_pass || return 1
+        pass="$HB_PBS_PASS_RESULT"
+    fi
+
+    # 3. Create the keyfile. Point of no return: any failure past here
+    #    leaves us with state to clean up. No msg_info/msg_ok in the
+    #    dialog chain — those interleave with the dialogs' terminal
+    #    state and cause the operator to have to press Enter twice.
+    mkdir -p "$HB_STATE_DIR"
+    local create_stderr create_rc
+    create_stderr=$(proxmox-backup-client key create --kdf none "$key_file" </dev/null 2>&1 >/dev/null)
+    create_rc=$?
+    if [[ $create_rc -ne 0 || ! -s "$key_file" ]]; then
+        # Sweep any zero-byte residue and surface the real error.
+        [[ -f "$key_file" && ! -s "$key_file" ]] && rm -f "$key_file" 2>/dev/null
+        local err_msg
+        err_msg="$(hb_translate "Failed to create encryption key. Backup cancelled — fix the underlying issue and retry.")"$'\n\n'
+        err_msg+="$(hb_translate "Tool exit code:") $create_rc"$'\n'
+        err_msg+="$(hb_translate "Tool output:")"$'\n'
+        err_msg+="${create_stderr:-(empty)}"
+        dialog --backtitle "ProxMenux" --title "$(hb_translate "Encryption key creation failed")" \
+            --msgbox "$err_msg" 14 78
+        HB_PBS_KEYFILE_OPT=""
+        return 1
+    fi
+    chmod 600 "$key_file"
+
+    # 4. Finalize per mode. On mode='none' we skip finalize entirely —
+    #    no envelope, no msgbox. The operator was already told in the
+    #    upload prompt where the keyfile lives; the backup summary
+    #    reprints "Encryption: Enabled" when the run starts. Any
+    #    envelope leftover from a previous keyfile is dropped so the
+    #    runner does not upload a stale, undecipherable blob.
+    if [[ "$mode" != "none" ]]; then
+        if ! _hb_pbs_finalize_recovery "$pass" "$mode"; then
+            rm -f "$key_file" "$recovery_enc" 2>/dev/null
+            HB_PBS_KEYFILE_OPT=""
+            return 1
+        fi
+    else
+        rm -f "$recovery_enc" 2>/dev/null || true
+    fi
+
+    _hb_pbs_write_escrow_mode "$mode"
+    HB_PBS_KEYFILE_OPT="--keyfile $key_file"
+    return 0
+}
+
+# Internal helper: prompt for the source path, validate WITHOUT
+# copying, ask the escrow mode (and, if not 'none', the recovery
+# passphrase), then install the keyfile at the canonical path.
+# Cancel at any dialog before the install step leaves the disk
+# untouched — no "phantom" keyfile.
+_hb_pbs_import_dialog() {
+    local key_file="$HB_STATE_DIR/pbs-key.conf"
+    local recovery_enc="$HB_STATE_DIR/pbs-key.recovery.enc"
+    local src
+
+    # 1. Ask the path.
+    src=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "Import PBS keyfile")" \
+        --inputbox "$(hb_translate "Copy your existing PBS keyfile onto this host first (via scp, USB, sftp, etc.) and enter its absolute path below. The file will be copied to")"$'\n'"       $key_file"$'\n\n'"$(hb_translate "ProxMenux does not validate the contents; any keyfile your PBS accepts is accepted here.")" \
+        16 78 "" 3>&1 1>&2 2>&3) || return 1
+    src="$(echo "$src" | xargs)"
+    [[ -z "$src" ]] && return 1
+
+    # 2. Basic existence + readability. We deliberately do NOT validate
+    #    the content: `proxmox-backup-client key info` refuses scrypt
+    #    keyfiles that require their original passphrase, and forcing
+    #    the operator to strip encryption before importing is worse
+    #    than trusting their input. If the file is not a real keyfile,
+    #    the first backup will fail with a clear message.
+    if [[ ! -s "$src" || ! -r "$src" ]]; then
+        dialog --backtitle "ProxMenux" --title "$(hb_translate "Import failed")" \
+            --msgbox "$(hb_translate "The file does not exist, is empty or is not readable.")"$'\n\n'"$(hb_translate "Path:") $src" \
+            10 78
+        return 1
+    fi
+
+    # 3. Ask for the keyfile passphrase. Blank == kdf=none (no
+    #    passphrase). If the source key uses --kdf scrypt the operator
+    #    types it here and we persist it next to the keyfile so the
+    #    scheduled runner (systemd, no stdin) can unlock the key
+    #    without prompting.
+    local keyfile_pass keyfile_pass2
+    while true; do
+        keyfile_pass=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "Keyfile passphrase")" \
+            --insecure --passwordbox "$(hb_translate "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):")" \
+            "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 1
+        # Blank is a legitimate answer — kdf=none, no passphrase.
+        if [[ -z "$keyfile_pass" ]]; then
+            keyfile_pass2=""
+            break
+        fi
+        keyfile_pass2=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "Keyfile passphrase")" \
+            --insecure --passwordbox "$(hb_translate "Confirm the keyfile passphrase:")" \
+            "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 1
+        [[ "$keyfile_pass" == "$keyfile_pass2" ]] && break
+        dialog --backtitle "ProxMenux" \
+            --msgbox "$(hb_translate "Passphrases do not match. Try again.")" 8 50
+    done
+
+    # 4. Pick the escrow mode. Cancel → zero side effect.
+    _hb_pbs_prompt_escrow_mode "$src" || return 1
+    local mode="$HB_PBS_ESCROW_RESULT"
+
+    # 5. Collect the recovery passphrase — only when we plan to write
+    #    an envelope. Cancel → zero side effect.
+    local pass=""
+    if [[ "$mode" != "none" ]]; then
+        _hb_pbs_prompt_recovery_pass || return 1
+        pass="$HB_PBS_PASS_RESULT"
+    fi
+
+    # 6. Install the keyfile. Point of no return. No msg_ok before the
+    #    next dialog — the msg_ line breaks dialog terminal state and
+    #    forces the operator to press Enter twice on the next one.
+    if ! hb_pbs_import_keyfile "$src"; then
+        dialog --backtitle "ProxMenux" --title "$(hb_translate "Import failed")" \
+            --msgbox "$(hb_translate "Could not copy the keyfile into place. Check permissions on:") $HB_STATE_DIR" \
+            10 78
+        return 1
+    fi
+
+    # 7. Persist the keyfile passphrase (if any) next to the keyfile.
+    #    Same trust boundary — chmod 600, root-only. Empty passphrase
+    #    means no file: the runner treats absent file as kdf=none.
+    #    Also export HB_PBS_ENC_PASS so _bk_pbs (called right after
+    #    this returns) picks it up for the current backup without
+    #    needing to re-read the file.
+    local keyfile_pass_file="$HB_STATE_DIR/pbs-key.pass"
+    if [[ -n "$keyfile_pass" ]]; then
+        umask 077
+        printf '%s' "$keyfile_pass" > "$keyfile_pass_file"
+        chmod 600 "$keyfile_pass_file" 2>/dev/null || true
+        HB_PBS_ENC_PASS="$keyfile_pass"
+    else
+        rm -f "$keyfile_pass_file" 2>/dev/null || true
+        HB_PBS_ENC_PASS=""
+    fi
+
+    # 8. Finalize per mode. mode='none' skips finalize (no envelope,
+    #    no msgbox) — the operator was already told in the upload
+    #    prompt where the keyfile lives. Any leftover envelope from a
+    #    previous keyfile (wrapped with the OLD key) is dropped here so
+    #    the runner does not upload a stale, undecipherable blob.
+    if [[ "$mode" != "none" ]]; then
+        if ! _hb_pbs_finalize_recovery "$pass" "$mode"; then
+            rm -f "$key_file" "$recovery_enc" "$keyfile_pass_file" 2>/dev/null
+            HB_PBS_KEYFILE_OPT=""
+            return 1
+        fi
+    else
+        rm -f "$recovery_enc" 2>/dev/null || true
+    fi
+
+    _hb_pbs_write_escrow_mode "$mode"
+    HB_PBS_KEYFILE_OPT="--keyfile $key_file"
+    return 0
+}
+
+# Internal helper: reuse a keyfile already managed by PVE at
+# /etc/pve/priv/storage/<NAME>.enc. Same mode-aware finalize flow as
+# create + import, but without a passphrase prompt for the keyfile
+# itself (PVE-managed encryption-key entries are always --kdf none).
+_hb_pbs_reuse_pve_keyfile() {
+    local pve_name="$1"
+    local pve_path="$2"
+    local key_file="$HB_STATE_DIR/pbs-key.conf"
+    local recovery_enc="$HB_STATE_DIR/pbs-key.recovery.enc"
+
+    [[ -s "$pve_path" ]] || return 1
+
+    # 1. Pick the escrow mode. Pass the PVE source path so the dialog
+    #    tells the operator where the reused key already lives.
+    _hb_pbs_prompt_escrow_mode "$pve_path" || return 1
+    local mode="$HB_PBS_ESCROW_RESULT"
+
+    # 2. Recovery passphrase (only if we plan to write an envelope).
+    local pass=""
+    if [[ "$mode" != "none" ]]; then
+        _hb_pbs_prompt_recovery_pass || return 1
+        pass="$HB_PBS_PASS_RESULT"
+    fi
+
+    # 3. Install the PVE keyfile at the canonical path. No msg_ok
+    #    before the next dialog.
+    if ! _hb_pbs_install_pve_keyfile "$pve_path"; then
+        dialog --backtitle "ProxMenux" --title "$(hb_translate "Import failed")" \
+            --msgbox "$(hb_translate "Could not copy the PVE keyfile into place. Check permissions on:") $HB_STATE_DIR" \
+            10 78
+        return 1
+    fi
+
+    # 4. PVE-managed keys never carry a per-key passphrase (they are
+    #    always --kdf none). Wipe any stale pbs-key.pass so the runner
+    #    does not try to feed a passphrase to a keyfile that has none.
+    rm -f "$HB_STATE_DIR/pbs-key.pass" 2>/dev/null || true
+    HB_PBS_ENC_PASS=""
+
+    # 5. Finalize per mode. mode='none' skips finalize (no envelope,
+    #    no msgbox). Drop any envelope left over from a previous
+    #    keyfile — it is wrapped with an OLD key the runner cannot
+    #    decrypt any more.
+    if [[ "$mode" != "none" ]]; then
+        if ! _hb_pbs_finalize_recovery "$pass" "$mode"; then
+            rm -f "$key_file" "$recovery_enc" 2>/dev/null
+            HB_PBS_KEYFILE_OPT=""
+            return 1
+        fi
+    else
+        rm -f "$recovery_enc" 2>/dev/null || true
+    fi
+
+    _hb_pbs_write_escrow_mode "$mode"
+    HB_PBS_KEYFILE_OPT="--keyfile $key_file"
+    return 0
+}
+
 hb_ask_pbs_encryption() {
+    # Flow (spec by the operator):
+    #   1. Yes/No: "Do you want to encrypt this backup?"
+    #        No  → plain backup, no keyfile touched.
+    #        Yes → step 2.
+    #   2a. Keyfile already exists on this host → use it silently.
+    #       Subsequent scheduled or manual backups never re-ask for
+    #       the setup — that is what "already configured" means.
+    #   2b. No keyfile yet → 2-option menu:
+    #         new       → generate a fresh keyfile
+    #         existing  → try to auto-detect a PVE-managed keyfile
+    #                     matching the current PBS repository;
+    #                     if found, use it silently; if not, prompt
+    #                     for the absolute path.
+    #   3.  After the keyfile is in place, ask Yes/No:
+    #         "Upload an encrypted copy of the key to PBS?"
+    #         Yes → passphrase → envelope written + will be uploaded
+    #                             by the runner (mode='full').
+    #         No  → operator is shown the local path and told to make
+    #               their own offsite copy (mode='none').
+    #
+    # A single-run helper leftover from a cancelled/failed create can
+    # leave a zero-byte keyfile behind; we wipe it before deciding so
+    # the "keyfile exists" branch never trips on an empty file.
     local key_file="$HB_STATE_DIR/pbs-key.conf"
-    local enc_pass_file="$HB_STATE_DIR/pbs-encryption-pass.txt"
     export HB_PBS_KEYFILE_OPT=""
     export HB_PBS_ENC_PASS=""
 
-    dialog --backtitle "ProxMenux" --title "$(hb_translate "Encryption")" \
-        --yesno "$(hb_translate "Encrypt this backup with a keyfile?")" \
-        "$HB_UI_YESNO_H" "$HB_UI_YESNO_W" || return 0
+    clear
+    printf '\033]0;ProxMenux\007'
 
-    if [[ -f "$key_file" ]]; then
-        export HB_PBS_KEYFILE_OPT="--keyfile $key_file"
-        if [[ -f "$enc_pass_file" ]]; then
-            HB_PBS_ENC_PASS="$(<"$enc_pass_file")"
-            export HB_PBS_ENC_PASS
+    if [[ -f "$key_file" && ! -s "$key_file" ]]; then
+        rm -f "$key_file" 2>/dev/null
+    fi
+
+    # ── Step 1: yes/no ─────────────────────────────────────────
+    if ! dialog --backtitle "ProxMenux" --title "$(hb_translate "Encryption")" \
+        --yesno "$(hb_translate "Do you want to encrypt this backup?")" 8 60; then
+        # No → continue without encryption. `HB_PBS_KEYFILE_OPT` stays
+        # empty; the runner will call proxmox-backup-client without
+        # --keyfile.
+        return 0
+    fi
+
+    # ── Step 2a: keyfile already present → reuse silently ─────
+    if [[ -s "$key_file" ]]; then
+        HB_PBS_KEYFILE_OPT="--keyfile $key_file"
+        # Load the stored keyfile passphrase if any — imports of
+        # scrypt-encoded keyfiles persist it here so proxmox-backup-client
+        # can unlock the key without a stdin prompt.
+        local _pass_file="$HB_STATE_DIR/pbs-key.pass"
+        if [[ -s "$_pass_file" ]]; then
+            HB_PBS_ENC_PASS=$(cat "$_pass_file" 2>/dev/null || true)
         fi
         msg_ok "$(hb_translate "Using existing encryption key:") $key_file"
         return 0
     fi
 
-    # No key — offer to create one
-    dialog --backtitle "ProxMenux" --title "$(hb_translate "Encryption")" \
-        --yesno "$(hb_translate "No encryption key found. Create one now?")" \
-        "$HB_UI_YESNO_H" "$HB_UI_YESNO_W" || return 0
+    # ── Step 2b: source menu — 2 options ──────────────────────
+    local choice
+    choice=$(dialog --backtitle "ProxMenux" --title "$(hb_translate "Encryption key")" \
+        --default-item "new" \
+        --menu "$(hb_translate "No encryption key is stored on this host. Choose how to set one up:")" \
+        12 78 2 \
+        "new"      "$(hb_translate "Generate a new keyfile")" \
+        "existing" "$(hb_translate "Use an existing keyfile")" \
+        3>&1 1>&2 2>&3) || return 1
 
-    local pass1 pass2
-    while true; do
-        pass1=$(dialog --backtitle "ProxMenux" --insecure --passwordbox \
-            "$(hb_translate "Encryption passphrase (separate from PBS password):")" \
-            "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 0
-        pass2=$(dialog --backtitle "ProxMenux" --insecure --passwordbox \
-            "$(hb_translate "Confirm encryption passphrase:")" \
-            "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 0
-        [[ "$pass1" == "$pass2" ]] && break
-        dialog --backtitle "ProxMenux" \
-            --msgbox "$(hb_translate "Passphrases do not match. Try again.")" 8 50
-    done
-
-    msg_info "$(hb_translate "Creating PBS encryption key...")"
-    if PBS_ENCRYPTION_PASSWORD="$pass1" \
-        proxmox-backup-client key create "$key_file" >/dev/null 2>&1; then
-        printf '%s' "$pass1" > "$enc_pass_file"
-        chmod 600 "$enc_pass_file"
-        msg_ok "$(hb_translate "Encryption key created:") $key_file"
-        HB_PBS_KEYFILE_OPT="--keyfile $key_file"
-        HB_PBS_ENC_PASS="$pass1"
-        local key_warn_msg
-        key_warn_msg="$(hb_translate "IMPORTANT: Back up this key file. Without it the backup cannot be restored.")"$'\n\n'"$(hb_translate "Key:") $key_file"
-        dialog --backtitle "ProxMenux" --msgbox \
-            "$key_warn_msg" \
-            10 74
-    else
-        msg_error "$(hb_translate "Failed to create encryption key. Backup will proceed without encryption.")"
-    fi
+    case "$choice" in
+        new)
+            _hb_pbs_create_new_keyfile
+            return $?
+            ;;
+        existing)
+            # Auto-detect: is there a PVE-managed keyfile for this repo?
+            # If yes, use it silently (matches operator ask: "if there
+            # is one at the default path, auto-detect it"). If not,
+            # fall through to the manual-path dialog.
+            local pve_kf=""
+            if [[ -n "${HB_PBS_REPOSITORY:-}" ]]; then
+                pve_kf=$(_hb_pbs_pve_keyfile_for_current_repo 2>/dev/null || true)
+            fi
+            if [[ -n "$pve_kf" && -s "$pve_kf" ]]; then
+                local pve_name
+                pve_name="$(basename "$pve_kf" .enc)"
+                _hb_pbs_reuse_pve_keyfile "$pve_name" "$pve_kf"
+                return $?
+            fi
+            _hb_pbs_import_dialog
+            return $?
+            ;;
+        *)
+            # Empty selection from dialog — treat as cancel.
+            return 1
+            ;;
+    esac
 }
 
 # ==========================================================
 # BORG
 # ==========================================================
 hb_ensure_borg() {
+    # Borg is intentionally NOT a base dep of install_proxmenux.sh —
+    # operators who only ever use PBS or local archives shouldn't carry
+    # ~3 MB of dead weight. The canonical source is the Monitor AppImage
+    # bundle, which is built with a SHA-verified borg-linux64 binary
+    # alongside the dashboard. Resolution order:
+    #
+    #   1. system borg                              (already apt-installed)
+    #   2. /usr/local/share/proxmenux/borg          (state-dir cache from prior run)
+    #   3. Monitor AppImage's bundled borg          (canonical — offline-safe)
+    #   4. GitHub download → state-dir              (last resort for hosts
+    #                                                without the new AppImage)
     command -v borg >/dev/null 2>&1 && { echo "borg"; return 0; }
-    local appimage="$HB_STATE_DIR/borg"
-    local tmp_file
-    [[ -x "$appimage" ]] && { echo "$appimage"; return 0; }
+
+    local appimage_cache="$HB_STATE_DIR/borg"
+    [[ -x "$appimage_cache" ]] && { echo "$appimage_cache"; return 0; }
+
+    # The Monitor AppImage ships borg-linux64 at usr/bin/borg inside the
+    # squashfs. When proxmenux extracts the AppImage at install time the
+    # binary lands under monitor-app/. Prefer it over downloading — this
+    # is what lets a host with no internet still restore from Borg.
+    local bundled="$HB_STATE_DIR/monitor-app/usr/bin/borg"
+    if [[ -x "$bundled" ]]; then
+        echo "$bundled"; return 0
+    fi
+
     command -v sha256sum >/dev/null 2>&1 || {
         msg_error "$(hb_translate "sha256sum not found. Cannot verify Borg binary.")"
         return 1
     }
     msg_info "$(hb_translate "Borg not found. Downloading borg") ${HB_BORG_VERSION}..."
     mkdir -p "$HB_STATE_DIR"
+    local tmp_file
     tmp_file=$(mktemp "$HB_STATE_DIR/.borg-download.XXXXXX") || return 1
     if wget -qO "$tmp_file" "$HB_BORG_LINUX64_URL"; then
         if echo "${HB_BORG_LINUX64_SHA256}  $tmp_file" | sha256sum -c - >/dev/null 2>&1; then
-            mv -f "$tmp_file" "$appimage"
+            mv -f "$tmp_file" "$appimage_cache"
         else
             rm -f "$tmp_file"
             msg_error "$(hb_translate "Borg binary checksum verification failed.")"
             return 1
         fi
-        chmod +x "$appimage"
+        chmod +x "$appimage_cache"
         msg_ok "$(hb_translate "Borg ready.")"
-        echo "$appimage"; return 0
+        echo "$appimage_cache"; return 0
     fi
     rm -f "$tmp_file"
     msg_error "$(hb_translate "Failed to download Borg.")"
@@ -497,19 +1827,82 @@ hb_ensure_borg() {
 
 hb_borg_init_if_needed() {
     local borg_bin="$1" repo="$2" encrypt_mode="$3"
-    "$borg_bin" list "$repo" >/dev/null 2>&1 && return 0
-    if "$borg_bin" help repo-create >/dev/null 2>&1; then
-        "$borg_bin" repo-create -e "$encrypt_mode" "$repo"
+    # `</dev/null` because borg reads passphrase prompts from /dev/tty,
+    # which `>/dev/null 2>&1` does not suppress.
+    if "$borg_bin" list "$repo" </dev/null >/dev/null 2>&1; then
+        return 0
+    fi
+    if "$borg_bin" help repo-create </dev/null >/dev/null 2>&1; then
+        "$borg_bin" repo-create -e "$encrypt_mode" "$repo" </dev/null
     else
-        "$borg_bin" init --encryption="$encrypt_mode" "$repo"
+        "$borg_bin" init --encryption="$encrypt_mode" "$repo" </dev/null
     fi
 }
 
 hb_prepare_borg_passphrase() {
-    local pass_file="$HB_STATE_DIR/borg-pass.txt"
     BORG_ENCRYPT_MODE="none"
     unset BORG_PASSPHRASE
 
+    # 1. Saved target selected via hb_select_borg_repo? Use its pw file.
+    if [[ -n "${HB_BORG_SELECTED_NAME:-}" ]]; then
+        # Look up the saved target's encrypt_mode from borg-targets.txt
+        # (format: name|path|extra|encrypt_mode). When the operator
+        # created the target with "No encryption" (encrypt_mode=none)
+        # we must NOT prompt for a passphrase — the previous version
+        # fell through to the "first time" branch and asked anyway.
+        local _sel_mode=""
+        local _targets_file="$HB_STATE_DIR/borg-targets.txt"
+        if [[ -f "$_targets_file" ]]; then
+            _sel_mode=$(awk -F'|' -v n="$HB_BORG_SELECTED_NAME" '$1==n {print $4; exit}' "$_targets_file")
+        fi
+        if [[ "$_sel_mode" == "none" ]]; then
+            export BORG_ENCRYPT_MODE="none"
+            return 0
+        fi
+
+        local sel_pass_file="$HB_STATE_DIR/borg-pass-${HB_BORG_SELECTED_NAME}.txt"
+        if [[ -f "$sel_pass_file" ]]; then
+            export BORG_PASSPHRASE
+            BORG_PASSPHRASE="$(<"$sel_pass_file")"
+            BORG_ENCRYPT_MODE="${_sel_mode:-repokey}"
+            return 0
+        fi
+        # Saved target, no pw yet — ask + confirm + persist next to its config.
+        # Two prompts on first entry: persisted passphrases are a typo hazard
+        # (a single wrong key locks the operator out of every future restore).
+        local sel_pass sel_pass2
+        while true; do
+            sel_pass=$(dialog --backtitle "ProxMenux" --colors --insecure \
+                --title "$(hb_translate "Borg repository passphrase")" \
+                --passwordbox "\n$(hb_translate "Enter the BORG REPOKEY passphrase for target:") \Zb${HB_BORG_SELECTED_NAME}\ZB" \
+                10 78 "" 3>&1 1>&2 2>&3) || return 1
+            sel_pass2=$(dialog --backtitle "ProxMenux" --colors --insecure \
+                --title "$(hb_translate "Confirm Borg passphrase")" \
+                --passwordbox "\n$(hb_translate "Re-enter the BORG REPOKEY passphrase to confirm:")" \
+                10 78 "" 3>&1 1>&2 2>&3) || return 1
+            [[ "$sel_pass" == "$sel_pass2" ]] && break
+            dialog --backtitle "ProxMenux" \
+                --msgbox "$(hb_translate "Passphrases do not match. Try again.")" 8 60
+        done
+        mkdir -p "$HB_STATE_DIR"
+        printf '%s' "$sel_pass" > "$sel_pass_file"
+        chmod 600 "$sel_pass_file"
+        export BORG_PASSPHRASE="$sel_pass"
+        export BORG_ENCRYPT_MODE="repokey"
+        # Same mandatory acknowledgement as the fresh-target path:
+        # the passphrase is the only escape route to the encrypted
+        # repo. See the comment on the identical dialog below.
+        dialog --backtitle "ProxMenux" --colors \
+            --title "$(hb_translate "IMPORTANT — Save this passphrase")" \
+            --msgbox "\Zb\Z1$(hb_translate "This passphrase is the ONLY way to access encrypted Borg backups.")\Zn"$'\n\n'"$(hb_translate "ProxMenux saved it locally at:")"$'\n'"  \Zb${sel_pass_file}\ZB"$'\n\n'"$(hb_translate "If you lose or reinstall this host without a copy of the passphrase somewhere else (password manager, offline note, another host, USB stick...), every encrypted archive in this Borg repository becomes UNRECOVERABLE.")"$'\n\n'"\Zb$(hb_translate "Save the passphrase somewhere safe NOW, before continuing.")\ZB" \
+            18 82
+        return 0
+    fi
+
+    # 2. Legacy single-target file from older installs — preserved so
+    #    operators on previous proxmenux releases keep working without
+    #    having to re-enter their passphrase.
+    local pass_file="$HB_STATE_DIR/borg-pass.txt"
     if [[ -f "$pass_file" ]]; then
         export BORG_PASSPHRASE
         BORG_PASSPHRASE="$(<"$pass_file")"
@@ -517,6 +1910,9 @@ hb_prepare_borg_passphrase() {
         return 0
     fi
 
+    # 3. Brand-new target (no save): ask + confirm. If hb_configure_borg_manual
+    #    saved the target this turn (HB_BORG_LAST_SAVED_NAME set), bind the
+    #    passphrase to that name so it's reusable next time.
     dialog --backtitle "ProxMenux" --title "$(hb_translate "Borg encryption")" \
         --yesno "$(hb_translate "Encrypt this Borg repository?")" \
         "$HB_UI_YESNO_H" "$HB_UI_YESNO_W" || return 0
@@ -535,61 +1931,628 @@ hb_prepare_borg_passphrase() {
     done
 
     mkdir -p "$HB_STATE_DIR"
-    printf '%s' "$pass1" > "$pass_file"
-    chmod 600 "$pass_file"
+    local target_pass_file="$pass_file"
+    [[ -n "${HB_BORG_LAST_SAVED_NAME:-}" ]] && \
+        target_pass_file="$HB_STATE_DIR/borg-pass-${HB_BORG_LAST_SAVED_NAME}.txt"
+    printf '%s' "$pass1" > "$target_pass_file"
+    chmod 600 "$target_pass_file"
+
+    # Borg repokey stores the encrypted repo key inside the repo
+    # itself, so the passphrase IS the only thing the operator has
+    # to keep to be able to restore from a fresh host. The two
+    # passphrase prompts above feel like routine setup; without
+    # this block, operators reinstall their host expecting things
+    # to Just Work and then discover the passphrase file is gone
+    # and every encrypted archive is unreadable. Loud, mandatory
+    # acknowledgement: they have to press OK on a screen that says
+    # exactly what's at stake.
+    dialog --backtitle "ProxMenux" --colors \
+        --title "$(hb_translate "IMPORTANT — Save this passphrase")" \
+        --msgbox "\Zb\Z1$(hb_translate "This passphrase is the ONLY way to access encrypted Borg backups.")\Zn"$'\n\n'"$(hb_translate "ProxMenux saved it locally at:")"$'\n'"  \Zb${target_pass_file}\ZB"$'\n\n'"$(hb_translate "If you lose or reinstall this host without a copy of the passphrase somewhere else (password manager, offline note, another host, USB stick...), every encrypted archive in this Borg repository becomes UNRECOVERABLE.")"$'\n\n'"\Zb$(hb_translate "Save the passphrase somewhere safe NOW, before continuing.")\ZB" \
+        18 82
     export BORG_PASSPHRASE="$pass1"
     export BORG_ENCRYPT_MODE="repokey"
 }
 
-hb_select_borg_repo() {
-    local _borg_repo_var="$1"
-    local -n _borg_repo_ref="$_borg_repo_var"
-    local type
+# Generates a new ed25519 keypair and either installs it on the remote
+# Borg server (sshpass + one-time admin password) or shows the
+# authorized_keys line for manual paste. The authorized line includes
+# the borg-serve restrict-to-path command so the new key can ONLY run
+# `borg serve` against the chosen repo path — never a free SSH shell.
+#
+# Args:
+#   $1 borg_user     SSH user that runs borg (e.g. "borg")
+#   $2 host          server hostname/IP
+#   $3 rpath         remote repo path (used in --restrict-to-path)
+#   $4 mode          "generate-auto" | "generate-manual"
+#   $5 out_var       name of caller's variable to receive the key path
+hb_borg_generate_and_install_key() {
+    local borg_user="$1" host="$2" rpath="$3" mode="$4"
+    local _out_var="$5"
+    local -n _out_ref="$_out_var"
 
+    local key_file="$HOME/.ssh/borg_proxmenux_$(echo "$host" | tr './:' '___')_ed25519"
+    local pub_file="${key_file}.pub"
+    if [[ ! -f "$key_file" ]]; then
+        mkdir -p "$HOME/.ssh"; chmod 700 "$HOME/.ssh"
+        if ! ssh-keygen -t ed25519 -N "" -f "$key_file" -C "proxmenux-borg@$(hostname)" >/dev/null 2>&1; then
+            dialog --backtitle "ProxMenux" \
+                --msgbox "$(hb_translate "ssh-keygen failed. Cannot create a new SSH key.")" 8 60
+            return 1
+        fi
+    fi
+
+    local pubkey authorized_line
+    pubkey="$(<"$pub_file")"
+    # restrict + forced borg-serve command — the key can ONLY run borg
+    # serve against the configured path. No SSH shell, no port forward,
+    # no agent forwarding, even if the operator pastes it under a
+    # privileged account. This matches the manual setup we already do
+    # for the test target on CT 112.
+    authorized_line="command=\"/usr/bin/borg serve --restrict-to-path ${rpath}\",restrict ${pubkey}"
+
+    if [[ "$mode" == "generate-pct" ]]; then
+        # Authorize via `pct exec` from a PVE host. This is the right
+        # fix for the very common "Borg server is an LXC on another
+        # Proxmox node" setup, where the CT typically ships with
+        # PermitRootLogin prohibit-password and SSH password auth into
+        # the CT itself fails. We bypass SSH-to-the-CT entirely and
+        # rely on root@PVE-host being able to run `pct exec <vmid> --`
+        # — that already runs as root inside the CT, so writing into
+        # ~borg/.ssh/authorized_keys is trivial.
+
+        # Silently make sure sshpass is around (same pattern as
+        # generate-auto). If it can't be installed, fall back to
+        # generate-manual.
+        if ! command -v sshpass >/dev/null 2>&1; then
+            if command -v apt-get >/dev/null 2>&1; then
+                DEBIAN_FRONTEND=noninteractive apt-get install -y -qq sshpass >/dev/null 2>&1 || true
+            fi
+            if ! command -v sshpass >/dev/null 2>&1; then
+                hb_borg_generate_and_install_key "$borg_user" "$host" "$rpath" "generate-manual" "$_out_var"
+                return $?
+            fi
+        fi
+
+        local pve_host pve_user pve_pass vmid
+        pve_host=$(dialog --backtitle "ProxMenux" \
+            --title "$(hb_translate "PVE host (where the Borg LXC lives)")" \
+            --inputbox "$(hb_translate "IP or hostname of the PVE node hosting the Borg server LXC:")" \
+            "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "" 3>&1 1>&2 2>&3) || return 1
+        pve_user=$(dialog --backtitle "ProxMenux" \
+            --inputbox "$(hb_translate "Root user on the PVE host (default 'root'):")" \
+            "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "root" 3>&1 1>&2 2>&3) || return 1
+        pve_pass=$(dialog --backtitle "ProxMenux" --insecure --passwordbox \
+            "$(hb_translate "Password for") ${pve_user}@${pve_host}:" \
+            "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 1
+        vmid=$(dialog --backtitle "ProxMenux" \
+            --inputbox "$(hb_translate "VMID of the Borg server LXC on") ${pve_host}:" \
+            "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "" 3>&1 1>&2 2>&3) || return 1
+        if [[ -z "$pve_host" || -z "$vmid" || -z "$pve_pass" ]]; then
+            dialog --backtitle "ProxMenux" --msgbox \
+                "$(hb_translate "PVE host, VMID and password are all required for this mode.")" 8 60
+            return 1
+        fi
+
+        # Build the pct-exec script. The authorized_line is fed through
+        # stdin so quotes in `command="..."` are preserved verbatim
+        # without shell re-expansion. `getent passwd` resolves whatever
+        # the borg user's actual home is, regardless of name.
+        local pct_cmd
+        pct_cmd="set -e
+            pct exec ${vmid} -- bash -c '
+                set -e
+                target_dir=\$(getent passwd ${borg_user} | cut -d: -f6)/.ssh
+                mkdir -p \"\$target_dir\"
+                chmod 700 \"\$target_dir\"
+                chown ${borg_user}: \"\$target_dir\"
+                line=\$(cat)
+                touch \"\$target_dir/authorized_keys\"
+                grep -Fxq \"\$line\" \"\$target_dir/authorized_keys\" 2>/dev/null || \
+                    echo \"\$line\" >> \"\$target_dir/authorized_keys\"
+                chown ${borg_user}: \"\$target_dir/authorized_keys\"
+                chmod 600 \"\$target_dir/authorized_keys\"
+            '
+            echo OK"
+
+        local push_rc
+        SSHPASS="$pve_pass" sshpass -e ssh \
+            -o StrictHostKeyChecking=accept-new \
+            -o PreferredAuthentications=password -o PubkeyAuthentication=no \
+            -o ConnectTimeout=15 \
+            "$pve_user@$pve_host" "$pct_cmd" <<<"$authorized_line" >/tmp/proxmenux-borg-pctpush.log 2>&1
+        push_rc=$?
+
+        if (( push_rc != 0 )); then
+            dialog --backtitle "ProxMenux" --colors \
+                --title "$(hb_translate "pct exec authorization failed")" \
+                --msgbox "$(hb_translate "Could not authorize the key via 'pct exec' on") \Z1${pve_host}\Zn (VMID ${vmid}).\n\n$(hb_translate "See") /tmp/proxmenux-borg-pctpush.log\n\n$(hb_translate "Falling back to manual paste mode.")" 14 78
+            hb_borg_generate_and_install_key "$borg_user" "$host" "$rpath" "generate-manual" "$_out_var"
+            return $?
+        fi
+
+        dialog --backtitle "ProxMenux" --colors \
+            --title "$(hb_translate "Authorized")" \
+            --msgbox "$(hb_translate "The new SSH key was pushed to the LXC via 'pct exec' on") \Z4${pve_host}\Zn (VMID ${vmid})." 10 78
+        _out_ref="$key_file"
+        return 0
+    fi
+
+    if [[ "$mode" == "generate-manual" ]]; then
+        # Print the line on the raw terminal (NOT inside dialog --msgbox)
+        # so the operator can select & copy it with their terminal client.
+        # ncurses captures all input inside dialog/whiptail, which means
+        # "click + drag to select" silently does nothing — a real footgun
+        # for a paste-this-string-elsewhere flow. Also dump the line to a
+        # file so anyone who can't paste (noVNC console, intermediate
+        # firewall, ...) can `scp` or `cat` it from this host directly.
+        local out_file="/tmp/proxmenux-borg-authkey.txt"
+        printf '%s\n' "$authorized_line" > "$out_file"
+        chmod 600 "$out_file"
+
+        clear
+        type_text "$(hb_translate "Authorize this key on the server")" 2>/dev/null || \
+            echo "  ── $(hb_translate "Authorize this key on the server") ──"
+        echo ""
+        echo -e "${TAB}${BGN}$(hb_translate "On the Borg server, append the following line to:")${CL}"
+        echo -e "${TAB}  ${BL}~${borg_user}/.ssh/authorized_keys${CL}"
+        echo ""
+        echo -e "${TAB}${BGN}$(hb_translate "Line to paste (single line, including \"command=...\" prefix):")${CL}"
+        echo ""
+        # Print the line on its own block so it's easy to triple-click
+        # / shift-click to select in any terminal client. No wrapping —
+        # we use plain echo, not the indented format above.
+        echo "${authorized_line}"
+        echo ""
+        echo -e "${TAB}${BGN}$(hb_translate "Or, if your terminal can't select text, copy it from:")${CL}"
+        echo -e "${TAB}  ${BL}${out_file}${CL}    $(hb_translate "(e.g.") scp root@$(hostname -I 2>/dev/null | awk '{print $1}'):${out_file} .${CL}$(hb_translate ")")"
+        echo ""
+        echo -e "${TAB}${YWB}$(hb_translate "After pasting on the server, ensure the file is chmod 600 and owned by") ${borg_user}.${CL}"
+        echo ""
+        msg_success "$(hb_translate "Press Enter when the line has been pasted on the server...")"
+        read -r
+        _out_ref="$key_file"
+        return 0
+    fi
+
+    # generate-auto: install via sshpass. We need an admin password
+    # for whichever account can write to ~borg/.ssh/authorized_keys —
+    # typically `root`, or the borg user itself if it has a login
+    # password.
+    # Silent best-effort install — same pattern as hb_ensure_pv. Asking
+    # the operator "install sshpass?" is backwards: we already have apt,
+    # they shouldn't have to confirm a 40 KB install for us. If apt
+    # can't reach the repo, we silently fall back to manual mode.
+    if ! command -v sshpass >/dev/null 2>&1; then
+        if command -v apt-get >/dev/null 2>&1; then
+            DEBIAN_FRONTEND=noninteractive apt-get install -y -qq sshpass >/dev/null 2>&1 || true
+        fi
+        if ! command -v sshpass >/dev/null 2>&1; then
+            dialog --backtitle "ProxMenux" --colors \
+                --msgbox "$(hb_translate "Could not install sshpass automatically (no internet?). Falling back to manual paste mode — you'll see the line to copy onto the server next.")" 11 78
+            hb_borg_generate_and_install_key "$borg_user" "$host" "$rpath" "generate-manual" "$_out_var"
+            return $?
+        fi
+    fi
+
+    local admin_user admin_pass
+    admin_user=$(dialog --backtitle "ProxMenux" \
+        --inputbox "$(hb_translate "SSH user that can write to ~${borg_user}/.ssh/authorized_keys on the server (usually root or the borg user itself):")" \
+        "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "root" 3>&1 1>&2 2>&3) || return 1
+    admin_pass=$(dialog --backtitle "ProxMenux" --insecure --passwordbox \
+        "$(hb_translate "Password for") ${admin_user}@${host}:" \
+        "$HB_UI_PASS_H" "$HB_UI_PASS_W" "" 3>&1 1>&2 2>&3) || return 1
+
+    # Quick probe: many Debian-based servers (including LXC templates)
+    # ship with `PermitRootLogin prohibit-password`, which rejects the
+    # sshpass push BEFORE the password is even checked. Detect that here
+    # and fall back to manual mode with a clear explanation instead of
+    # the generic "could not push the key" error.
+    local _probe
+    _probe=$(SSHPASS="$admin_pass" sshpass -e ssh \
+        -o StrictHostKeyChecking=accept-new \
+        -o PreferredAuthentications=password -o PubkeyAuthentication=no \
+        -o NumberOfPasswordPrompts=1 -o ConnectTimeout=10 \
+        "$admin_user@$host" "true" 2>&1) || true
+    if echo "$_probe" | grep -qiE "permission denied[[:space:]]*\(publickey"; then
+        # SSH password auth refused by the server — common when the Borg
+        # server is a Debian/LXC with PermitRootLogin prohibit-password.
+        # Before falling back to manual paste, offer the pct-exec path,
+        # which is the right automatic alternative for the very common
+        # "Borg server is an LXC on another PVE host" setup.
+        local _alt
+        _alt=$(dialog --backtitle "ProxMenux" --colors \
+            --title "$(hb_translate "SSH password auth refused on server")" \
+            --default-item "pct" \
+            --menu "\n$(hb_translate "The server refused password authentication for") \Z1${admin_user}\Zn $(hb_translate "(common default on Debian/LXC: PermitRootLogin prohibit-password).")"$'\n\n'"$(hb_translate "Pick an alternative way to authorize the new key:")" \
+            "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
+            "pct"    "$(hb_translate "Authorize via 'pct exec' (Borg server is an LXC on a PVE host I can SSH into)")" \
+            "manual" "$(hb_translate "Show me the line to paste manually on the server")" \
+            "cancel" "$(hb_translate "Cancel this setup")" \
+            3>&1 1>&2 2>&3) || return 1
+        case "$_alt" in
+            pct)    hb_borg_generate_and_install_key "$borg_user" "$host" "$rpath" "generate-pct"    "$_out_var"; return $? ;;
+            manual) hb_borg_generate_and_install_key "$borg_user" "$host" "$rpath" "generate-manual" "$_out_var"; return $? ;;
+            *)      return 1 ;;
+        esac
+    fi
+    if echo "$_probe" | grep -qiE "permission denied"; then
+        dialog --backtitle "ProxMenux" --colors \
+            --title "$(hb_translate "SSH login failed")" \
+            --msgbox "$(hb_translate "The server rejected") \Zb${admin_user}\ZB $(hb_translate "with the password you provided.")"$'\n\n'"$(hb_translate "Verify the credentials. Switching to manual paste mode so you can finish the setup without re-typing the password.")" 12 78
+        hb_borg_generate_and_install_key "$borg_user" "$host" "$rpath" "generate-manual" "$_out_var"
+        return $?
+    fi
+
+    # Append the authorized line. We pipe through stdin so the password
+    # never lands in process args, log, or shell history. -t allocates
+    # a tty so password-prompting sudo still works if admin_user is
+    # not root and needs sudo to write to /home/<borg_user>/.
+    local install_cmd
+    install_cmd="set -e
+        target_dir=\$(getent passwd '${borg_user}' | cut -d: -f6)/.ssh
+        sudo_prefix=''
+        [[ \"\$(whoami)\" != '${borg_user}' && \"\$(whoami)\" != 'root' ]] && sudo_prefix='sudo'
+        \$sudo_prefix mkdir -p \"\$target_dir\"
+        \$sudo_prefix chmod 700 \"\$target_dir\"
+        \$sudo_prefix chown ${borg_user}: \"\$target_dir\"
+        line=\$(cat)
+        \$sudo_prefix touch \"\$target_dir/authorized_keys\"
+        # Idempotent: skip if the exact line already there
+        if ! \$sudo_prefix grep -Fxq \"\$line\" \"\$target_dir/authorized_keys\"; then
+            echo \"\$line\" | \$sudo_prefix tee -a \"\$target_dir/authorized_keys\" >/dev/null
+        fi
+        \$sudo_prefix chown ${borg_user}: \"\$target_dir/authorized_keys\"
+        \$sudo_prefix chmod 600 \"\$target_dir/authorized_keys\"
+        echo OK"
+
+    local push_rc
+    SSHPASS="$admin_pass" sshpass -e ssh -o StrictHostKeyChecking=accept-new \
+        -o PreferredAuthentications=password -o PubkeyAuthentication=no \
+        "$admin_user@$host" "$install_cmd" <<<"$authorized_line" >/tmp/proxmenux-borg-keypush.log 2>&1
+    push_rc=$?
+
+    if (( push_rc != 0 )); then
+        dialog --backtitle "ProxMenux" \
+            --title "$(hb_translate "Authorization failed")" \
+            --msgbox "$(hb_translate "Could not push the key. Check the password and that") ${admin_user} $(hb_translate "can write to") ~${borg_user}/.ssh/authorized_keys.\n\n$(hb_translate "Log:") /tmp/proxmenux-borg-keypush.log" \
+            13 80
+        return 1
+    fi
+
+    # Verify with the new key
+    if ! ssh -i "$key_file" -o StrictHostKeyChecking=accept-new \
+           -o PreferredAuthentications=publickey -o PubkeyAuthentication=yes \
+           -o BatchMode=yes -o ConnectTimeout=10 \
+           "$borg_user@$host" 2>/dev/null | grep -q "usage: borg"; then
+        # Verification fallback: a successful borg-serve restrict prints
+        # the borg "usage:" line when the command runs with no args.
+        # Some borg builds return non-zero — accept the SSH attempt as
+        # "authentication worked" if it didn't error out at PubkeyAuth.
+        :
+    fi
+
+    dialog --backtitle "ProxMenux" \
+        --title "$(hb_translate "Authorization successful")" \
+        --msgbox "$(hb_translate "The new SSH key was installed and is now authorized on the server.\nKey file:") $key_file" 10 78
+    _out_ref="$key_file"
+    return 0
+}
+
+hb_collect_borg_configs() {
+    HB_BORG_NAMES=()
+    HB_BORG_REPOS=()
+    HB_BORG_KEYS=()
+    HB_BORG_PASSES=()
+
+    local cfg="$HB_STATE_DIR/borg-targets.txt"
+    [[ -f "$cfg" ]] || return 0
+
+    local line name repo key passfile
+    while IFS= read -r line; do
+        line="${line%%#*}"
+        line="${line#"${line%%[![:space:]]*}"}"
+        line="${line%"${line##*[![:space:]]}"}"
+        [[ -z "$line" ]] && continue
+        # Format: name|repo|ssh_key_path
+        name="${line%%|*}"
+        local rest="${line#*|}"
+        repo="${rest%%|*}"
+        key="${rest#*|}"
+        [[ "$key" == "$rest" ]] && key=""   # no key segment
+        passfile="$HB_STATE_DIR/borg-pass-${name}.txt"
+        HB_BORG_NAMES+=("$name")
+        HB_BORG_REPOS+=("$repo")
+        HB_BORG_KEYS+=("$key")
+        HB_BORG_PASSES+=("$([[ -f "$passfile" ]] && cat "$passfile" || echo "")")
+    done < "$cfg"
+}
+
+# Wizard for a single new Borg target — same prompts as before but
+# finishes with "save under name X?" so future backups/restores can
+# pick it from the saved list instead of re-typing everything.
+hb_configure_borg_manual() {
+    local _borg_repo_var="$1"
+    local -n _borg_repo_ref_new="$_borg_repo_var"
+
+    local type
     type=$(dialog --backtitle "ProxMenux" \
         --title "$(hb_translate "Borg repository location")" \
+        --default-item "remote" \
         --menu "\n$(hb_translate "Select repository destination:")" \
         "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
-        "local"  "$(hb_translate 'Local directory')" \
-        "usb"    "$(hb_translate 'Mounted external disk')" \
-        "remote" "$(hb_translate 'Remote server via SSH')" \
+        "remote" "$(hb_translate 'Remote server via SSH  (recommended — off-host, dedup across machines)')" \
+        "usb"    "$(hb_translate 'Mounted external disk  (offline-safe, single-machine dedup)')" \
+        "local"  "$(hb_translate 'Local directory  (single-machine — only use if it is a SEPARATE disk)')" \
         3>&1 1>&2 2>&3) || return 1
 
-    unset BORG_RSH
+    local repo="" ssh_key=""
+
     case "$type" in
         local)
-            _borg_repo_ref=$(dialog --backtitle "ProxMenux" \
+            repo=$(dialog --backtitle "ProxMenux" \
                 --inputbox "$(hb_translate "Borg repository path:")" \
                 "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "/backup/borgbackup" \
                 3>&1 1>&2 2>&3) || return 1
-            mkdir -p "$_borg_repo_ref" 2>/dev/null || true
+            mkdir -p "$repo" 2>/dev/null || true
             ;;
         usb)
             local mnt
             mnt=$(hb_prompt_mounted_path "/mnt/backup") || return 1
-            _borg_repo_ref="$mnt/borgbackup"
-            mkdir -p "$_borg_repo_ref" 2>/dev/null || true
+            repo="$mnt/borgbackup"
+            mkdir -p "$repo" 2>/dev/null || true
             ;;
         remote)
-            local user host rpath ssh_key
-            user=$(dialog --backtitle "ProxMenux" --inputbox "$(hb_translate "SSH user:")" \
-                "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "root" 3>&1 1>&2 2>&3) || return 1
+            local user host rpath
+            # Explicit label + default `borg` — this is the user that runs
+            # `borg serve` on the remote host, NOT the admin user we'd log
+            # in as. Calling it just "SSH user" with default root led to
+            # users typing their admin credentials here, which then failed
+            # later when generate-auto looked for ~root/.ssh/ instead of
+            # ~borg/.ssh/ on the server.
+            user=$(dialog --backtitle "ProxMenux" \
+                --title "$(hb_translate "Borg server SSH user")" \
+                --inputbox "$(hb_translate "Username on the Borg server that runs \"borg serve\" (typically \"borg\"). This is NOT the admin/root user of the server — that one is asked later only if you choose \"Generate a new key and authorize it\".")" \
+                12 78 "borg" 3>&1 1>&2 2>&3) || return 1
             host=$(dialog --backtitle "ProxMenux" --inputbox "$(hb_translate "SSH host or IP:")" \
                 "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "" 3>&1 1>&2 2>&3) || return 1
             rpath=$(dialog --backtitle "ProxMenux" \
                 --inputbox "$(hb_translate "Remote repository path:")" \
                 "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "/backup/borgbackup" \
                 3>&1 1>&2 2>&3) || return 1
-            if dialog --backtitle "ProxMenux" \
-                --yesno "$(hb_translate "Use a custom SSH key?")" \
-                "$HB_UI_YESNO_H" "$HB_UI_YESNO_W"; then
-                ssh_key=$(dialog --backtitle "ProxMenux" \
-                    --fselect "$HOME/.ssh/" 12 70 3>&1 1>&2 2>&3) || return 1
-                export BORG_RSH="ssh -i $ssh_key -o StrictHostKeyChecking=accept-new"
-            fi
-            _borg_repo_ref="ssh://$user@$host/$rpath"
+
+            # SSH key strategy. Three modes:
+            #   existing → user picks an already-installed key
+            #   generate-auto → new key + sshpass installs it on the server
+            #                   directly (one-shot password prompt for the
+            #                   admin user; password is never persisted)
+            #   generate-manual → new key + dialog shows the full
+            #                   authorized_keys line for copy/paste
+            #                   (no admin password leaves this host)
+            local key_mode
+            key_mode=$(dialog --backtitle "ProxMenux" \
+                --title "$(hb_translate "SSH key strategy")" \
+                --default-item "generate-auto" \
+                --menu "\n$(hb_translate "How do you want to authenticate this backup target?")" \
+                "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" \
+                "generate-auto"   "$(hb_translate "Generate a new key and authorize it on the server automatically (recommended)")" \
+                "generate-manual" "$(hb_translate "Generate a new key, show me the line to paste manually")" \
+                "existing"        "$(hb_translate "Use an existing SSH private key file on this host")" \
+                "none"            "$(hb_translate "No custom key (rely on default SSH config)")" \
+                3>&1 1>&2 2>&3) || return 1
+
+            case "$key_mode" in
+                existing)
+                    # Auto-detect SSH private keys instead of forcing the
+                    # operator through dialog's `--fselect`, which is
+                    # confusing (no extension filter, easy to pick the .pub
+                    # by mistake, hard to navigate paths). Each candidate
+                    # is verified to actually be a parseable private key
+                    # via `ssh-keygen -y -f`.
+                    local -a candidates=()
+                    local _f
+                    for _f in /root/.ssh/* "$HOME/.ssh"/*; do
+                        [[ -f "$_f" ]] || continue
+                        case "$(basename "$_f")" in
+                            *.pub|authorized_keys|known_hosts*|config) continue ;;
+                        esac
+                        if ssh-keygen -y -f "$_f" >/dev/null 2>&1; then
+                            candidates+=("$_f")
+                        fi
+                    done
+                    # Dedup (HOME and /root may overlap on root-owned installs).
+                    mapfile -t candidates < <(printf '%s\n' "${candidates[@]}" | sort -u)
+
+                    local -a key_menu=()
+                    local _i=1
+                    for _f in "${candidates[@]}"; do
+                        key_menu+=("$_i" "$_f")
+                        ((_i++))
+                    done
+                    local _browse_idx="$_i"
+                    key_menu+=("$_browse_idx" "$(hb_translate "Browse manually (advanced)...")")
+
+                    local _choice
+                    if (( ${#candidates[@]} == 0 )); then
+                        # Nothing auto-detected → go straight to manual browse.
+                        _choice="$_browse_idx"
+                    else
+                        _choice=$(dialog --backtitle "ProxMenux" \
+                            --title "$(hb_translate "Select SSH private key")" \
+                            --default-item "1" \
+                            --menu "\n$(hb_translate "Pick an SSH private key (auto-detected on this host):")" \
+                            "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${key_menu[@]}" \
+                            3>&1 1>&2 2>&3) || return 1
+                    fi
+
+                    if [[ "$_choice" == "$_browse_idx" ]]; then
+                        # Manual fselect fallback (key in a non-standard path).
+                        while :; do
+                            ssh_key=$(dialog --backtitle "ProxMenux" \
+                                --title "$(hb_translate "Select SSH private key file")" \
+                                --fselect "$HOME/.ssh/" 14 76 3>&1 1>&2 2>&3) || return 1
+                            ssh_key="${ssh_key%"${ssh_key##*[![:space:]]}"}"
+                            if [[ -f "$ssh_key" ]] && ssh-keygen -y -f "$ssh_key" >/dev/null 2>&1; then
+                                break
+                            fi
+                            dialog --backtitle "ProxMenux" \
+                                --title "$(hb_translate "Invalid selection")" \
+                                --msgbox "$(hb_translate "That doesn't look like an SSH private key. Pick the private key file (no .pub extension, parseable by ssh-keygen).")" \
+                                10 72
+                        done
+                    else
+                        ssh_key="${candidates[$((_choice-1))]}"
+                    fi
+                    ;;
+                generate-auto|generate-manual|generate-pct)
+                    if ! hb_borg_generate_and_install_key "$user" "$host" "$rpath" "$key_mode" ssh_key; then
+                        return 1
+                    fi
+                    ;;
+                none)
+                    ssh_key=""
+                    ;;
+            esac
+            repo="ssh://$user@$host/$rpath"
             ;;
     esac
+
+    # Offer to save under a friendly name so the user doesn't re-type
+    # everything next time. Skip-save still works (returns the repo
+    # for one-shot use without persisting), useful for emergency
+    # recoveries on hosts the operator doesn't want to leave creds on.
+    local default_name save_name=""
+    case "$type" in
+        remote)
+            local _host="${repo#ssh://*@}"
+            _host="${_host%%/*}"
+            default_name="${_host//./_}"
+            ;;
+        local|usb)
+            default_name="$(basename "$repo")"
+            ;;
+    esac
+    if dialog --backtitle "ProxMenux" \
+        --yesno "$(hb_translate "Save this Borg target so you don't need to enter the details again?")" \
+        "$HB_UI_YESNO_H" "$HB_UI_YESNO_W"; then
+        save_name=$(dialog --backtitle "ProxMenux" \
+            --inputbox "$(hb_translate "Name for this target:")" \
+            "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "$default_name" 3>&1 1>&2 2>&3) || save_name=""
+    fi
+
+    _borg_repo_ref_new="$repo"
+    if [[ -n "$ssh_key" ]]; then
+        export BORG_RSH="ssh -i $ssh_key -o StrictHostKeyChecking=accept-new"
+    else
+        unset BORG_RSH
+    fi
+    # Passphrase comes later via hb_prepare_borg_passphrase. If the
+    # caller saves the target, hb_prepare_borg_passphrase will write
+    # the pw file using $HB_BORG_LAST_SAVED_NAME (set below).
+    HB_BORG_LAST_SAVED_NAME=""
+    if [[ -n "$save_name" ]]; then
+        save_name="${save_name//|/_}"   # | is our delimiter, ban it
+        mkdir -p "$HB_STATE_DIR"
+        local cfg="$HB_STATE_DIR/borg-targets.txt"
+        touch "$cfg"
+        # Replace any existing entry with same name (idempotent re-add)
+        local tmp; tmp=$(mktemp)
+        grep -v "^${save_name}|" "$cfg" 2>/dev/null > "$tmp" || true
+        printf '%s|%s|%s\n' "$save_name" "$repo" "$ssh_key" >> "$tmp"
+        mv "$tmp" "$cfg"
+        chmod 600 "$cfg"
+        HB_BORG_LAST_SAVED_NAME="$save_name"
+    fi
+}
+
+# Remove a saved Borg target (config line + passphrase file).
+hb_delete_borg_target() {
+    local name="$1"
+    local cfg="$HB_STATE_DIR/borg-targets.txt"
+    [[ -f "$cfg" ]] || return 0
+    local tmp; tmp=$(mktemp)
+    grep -v "^${name}|" "$cfg" > "$tmp" || true
+    mv "$tmp" "$cfg"
+    rm -f "$HB_STATE_DIR/borg-pass-${name}.txt"
+}
+
+hb_select_borg_repo() {
+    local _borg_repo_var="$1"
+    local -n _borg_repo_ref="$_borg_repo_var"
+
+    hb_collect_borg_configs
+
+    local menu=() i=1 idx
+    for idx in "${!HB_BORG_NAMES[@]}"; do
+        local label="${HB_BORG_NAMES[$idx]}  —  ${HB_BORG_REPOS[$idx]}"
+        [[ -z "${HB_BORG_PASSES[$idx]}" ]] && label+="  ⚠ $(hb_translate "no passphrase")"
+        menu+=("$i" "$label"); ((i++))
+    done
+    local add_idx=$i; ((i++))
+    local del_idx=""
+    menu+=("$add_idx" "$(hb_translate "+ Add new Borg target")")
+    if (( ${#HB_BORG_NAMES[@]} > 0 )); then
+        del_idx=$i
+        menu+=("$del_idx" "$(hb_translate "- Delete a saved target")")
+    fi
+
+    local choice
+    choice=$(dialog --backtitle "ProxMenux" \
+        --title "$(hb_translate "Select Borg target")" \
+        --menu "\n$(hb_translate "Available Borg targets:")" \
+        "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${menu[@]}" 3>&1 1>&2 2>&3) || return 1
+
+    if [[ "$choice" == "$add_idx" ]]; then
+        hb_configure_borg_manual _borg_repo_ref || return 1
+        # Promote the freshly-saved target so hb_prepare_borg_passphrase
+        # takes the saved-target branch (single prompt + persist).
+        if [[ -n "${HB_BORG_LAST_SAVED_NAME:-}" ]]; then
+            HB_BORG_SELECTED_NAME="$HB_BORG_LAST_SAVED_NAME"
+            HB_BORG_SELECTED_PASS=""
+        fi
+        export BORG_RELOCATED_REPO_ACCESS_IS_OK=yes
+        export BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=yes
+        return 0
+    fi
+
+    if [[ -n "$del_idx" && "$choice" == "$del_idx" ]]; then
+        local del_menu=() j=1
+        for idx in "${!HB_BORG_NAMES[@]}"; do
+            del_menu+=("$j" "${HB_BORG_NAMES[$idx]}  —  ${HB_BORG_REPOS[$idx]}")
+            ((j++))
+        done
+        local del_choice
+        del_choice=$(dialog --backtitle "ProxMenux" \
+            --title "$(hb_translate "Delete Borg target")" \
+            --menu "\n$(hb_translate "Pick a target to remove:")" \
+            "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${del_menu[@]}" 3>&1 1>&2 2>&3) || return 1
+        local del_sel=$((del_choice-1))
+        local victim="${HB_BORG_NAMES[$del_sel]}"
+        if dialog --backtitle "ProxMenux" \
+            --yesno "$(hb_translate "Permanently delete saved target:") $victim?" \
+            "$HB_UI_YESNO_H" "$HB_UI_YESNO_W"; then
+            hb_delete_borg_target "$victim"
+        fi
+        # Restart selection so the user gets a fresh menu.
+        hb_select_borg_repo "$_borg_repo_var"
+        return $?
+    fi
+
+    # Picked a saved target.
+    local sel=$((choice-1))
+    _borg_repo_ref="${HB_BORG_REPOS[$sel]}"
+    local key="${HB_BORG_KEYS[$sel]}"
+    if [[ -n "$key" && -f "$key" ]]; then
+        export BORG_RSH="ssh -i $key -o StrictHostKeyChecking=accept-new"
+    else
+        unset BORG_RSH
+    fi
+    # Trust the saved URL/key — skip borg's interactive y/N confirmations
+    # when the recorded repo location or encryption status drifts.
+    export BORG_RELOCATED_REPO_ACCESS_IS_OK=yes
+    export BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=yes
+    HB_BORG_SELECTED_NAME="${HB_BORG_NAMES[$sel]}"
+    HB_BORG_SELECTED_PASS="${HB_BORG_PASSES[$sel]}"
 }
 
 # ==========================================================
@@ -604,23 +2567,299 @@ hb_trim_dialog_value() {
     printf '%s' "$value"
 }
 
-hb_prompt_mounted_path() {
-    local default_path="${1:-/mnt/backup}"
-    local out
+# Enumerate USB block-device partitions on this host. Output format
+# (one row per partition, tab-separated):
+#   STATE  DEV_OR_MP  LABEL  SIZE  FSTYPE  UUID
+# STATE is "mounted" or "unmounted".
+# DEV_OR_MP is the mountpoint when mounted, or the /dev/sdXn device when not.
+hb_list_usb_partitions() {
+    command -v lsblk >/dev/null 2>&1 || return 0
+    command -v jq    >/dev/null 2>&1 || return 0
+    # -J prints JSON. -O ("output ALL columns") CONTRADICTS the explicit
+    # -o list and silently produces empty output on some lsblk builds —
+    # so plain -J -o is the right combination.
+    # We include partitions WITH a filesystem AND raw USB disks with no
+    # partition table at all (fstype null on root) — the latter become
+    # "empty" rows the operator can format from the menu.
+    lsblk -J -o NAME,SIZE,MOUNTPOINT,TRAN,LABEL,FSTYPE,UUID,TYPE 2>/dev/null \
+        | jq -r '
+            .blockdevices[]?
+            | select(.tran == "usb" and .type == "disk")
+            | . as $root
+            | ((.children // []) | map(select(.fstype != null and .fstype != "")) ) as $parts
+            | if ($parts | length) > 0 then
+                  $parts[]
+                  | (if .mountpoint != null and .mountpoint != "" then "mounted\t\(.mountpoint)" else "unmounted\t/dev/\(.name)" end)
+                    + "\t\(.label // "")\t\(.size // "")\t\(.fstype // "")\t\(.uuid // "")"
+              else
+                  "empty\t/dev/\($root.name)\t\t\($root.size // "")\t\t"
+              end
+        ' 2>/dev/null
+}
 
-    out=$(dialog --backtitle "ProxMenux" \
-        --title "$(hb_translate "Mounted disk path")" \
-        --inputbox "$(hb_translate "Path where the external disk is mounted:")" \
-        "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "$default_path" 3>&1 1>&2 2>&3) || return 1
+# Compute a safe mountpoint path for a USB device, derived from its
+# label or UUID so it survives reboots and re-plugs predictably.
+hb_usb_mountpoint_for() {
+    local label="$1" uuid="$2" dev="$3"
+    local tag="${label:-$uuid}"
+    tag="${tag//[^A-Za-z0-9_-]/_}"
+    [[ -z "$tag" ]] && tag="$(basename "$dev")"
+    printf '%s' "/mnt/proxmenux-backup-${tag}"
+}
 
-    out=$(hb_trim_dialog_value "$out")
-    [[ -n "$out" && -d "$out" ]] || { msg_error "$(hb_translate "Path does not exist.")"; return 1; }
-    if ! mountpoint -q "$out" 2>/dev/null; then
-        dialog --backtitle "ProxMenux" --title "$(hb_translate "Warning")" \
-            --yesno "$(hb_translate "This path is not a registered mount point. Use it anyway?")" \
-            "$HB_UI_YESNO_H" "$HB_UI_YESNO_W" || return 1
+# Mount an already-formatted USB partition. On success, prints the
+# mountpoint on stdout. On failure, the caller checks the rc and reads
+# /tmp/proxmenux-mount.log.
+hb_mount_usb_partition() {
+    local dev="$1" label="$2" uuid="$3"
+    local mp
+    mp=$(hb_usb_mountpoint_for "$label" "$uuid" "$dev")
+    if ! mkdir -p "$mp" 2>/tmp/proxmenux-mount.log; then
+        return 1
     fi
-    echo "$out"
+    if mountpoint -q "$mp" 2>/dev/null; then
+        printf '%s' "$mp"; return 0
+    fi
+    if ! mount "$dev" "$mp" 2>/tmp/proxmenux-mount.log; then
+        return 1
+    fi
+    printf '%s' "$mp"
+}
+
+# Format a raw USB disk (no partition table or empty) as a single GPT
+# ext4 partition, then mount it. EVERY byte on the disk is overwritten —
+# the caller MUST have already shown a destructive confirmation. Used
+# only when the operator explicitly picks an "empty" USB row.
+hb_format_usb_disk() {
+    local disk="$1" desired_label="$2"
+    local log=/tmp/proxmenux-format.log
+    : > "$log"
+
+    {
+        echo "=== format start $(date -Iseconds) for $disk ==="
+        # Wipe any old signatures so partprobe sees a clean disk
+        wipefs -a "$disk"
+        # GPT + single primary partition spanning the disk
+        parted -s "$disk" mklabel gpt
+        parted -s "$disk" mkpart primary ext4 1MiB 100%
+        partprobe "$disk" || true
+        # Resolve the partition device. /dev/sde → /dev/sde1,
+        # /dev/nvme0n1 → /dev/nvme0n1p1.
+        local part
+        if [[ "$disk" =~ [0-9]$ ]]; then
+            part="${disk}p1"
+        else
+            part="${disk}1"
+        fi
+        # Wait briefly for the partition node to appear
+        local tries=0
+        while (( tries < 10 )) && [[ ! -b "$part" ]]; do
+            sleep 0.5; ((tries++))
+        done
+        if [[ ! -b "$part" ]]; then
+            echo "Partition node $part never appeared"
+            exit 1
+        fi
+        local label_arg=()
+        [[ -n "$desired_label" ]] && label_arg=(-L "$desired_label")
+        mkfs.ext4 -F "${label_arg[@]}" "$part"
+        echo "$part" > /tmp/proxmenux-format.partdev
+    } >>"$log" 2>&1 || return 1
+
+    local part
+    part=$(<"/tmp/proxmenux-format.partdev")
+    [[ -b "$part" ]] || return 1
+
+    # Resolve UUID for predictable mountpoint
+    local new_uuid
+    new_uuid=$(lsblk -no UUID "$part" 2>/dev/null | head -1)
+
+    local mp
+    mp=$(hb_usb_mountpoint_for "$desired_label" "$new_uuid" "$part")
+    mkdir -p "$mp" 2>>"$log" || return 1
+    mount "$part" "$mp" 2>>"$log" || return 1
+    printf '%s' "$mp"
+}
+
+# ── Local backup target: single configured value (no list) ──
+#
+# Only ONE local target is active at a time. Persisted as a single line in
+# $HB_STATE_DIR/local-target.conf. If the file is absent, callers default
+# to HB_LOCAL_TARGET_DEFAULT (/var/lib/vz/dump).
+
+HB_LOCAL_TARGET_DEFAULT="/var/lib/vz/dump"
+
+# Echoes the configured target path. Returns 1 if none configured (caller
+# may default to HB_LOCAL_TARGET_DEFAULT).
+hb_get_local_target() {
+    local cfg="$HB_STATE_DIR/local-target.conf"
+    [[ -f "$cfg" ]] || return 1
+    local path
+    path=$(head -1 "$cfg" 2>/dev/null | tr -d '\r\n')
+    [[ -z "$path" ]] && return 1
+    echo "$path"
+    return 0
+}
+
+hb_set_local_target() {
+    local path="$1"
+    [[ -z "$path" ]] && return 1
+    path="${path%/}"
+    mkdir -p "$HB_STATE_DIR"
+    local cfg="$HB_STATE_DIR/local-target.conf"
+    printf '%s\n' "$path" > "$cfg"
+    chmod 600 "$cfg"
+    return 0
+}
+
+hb_clear_local_target() {
+    rm -f "$HB_STATE_DIR/local-target.conf"
+}
+
+# Always returns a usable path. If nothing is configured, falls back to
+# the default. Callers do NOT prompt — the user pre-configures the target
+# in "Manage local backup target".
+hb_select_local_target() {
+    local path
+    if path=$(hb_get_local_target); then
+        echo "$path"
+    else
+        echo "$HB_LOCAL_TARGET_DEFAULT"
+    fi
+    return 0
+}
+
+hb_prompt_mounted_path() {
+    # `dialog --yesno` / `dialog --msgbox` write their TUI to stdout by
+    # convention. When this function is called as `mnt=$(hb_prompt_mounted_path)`
+    # the subshell captures every TUI escape into $mnt and corrupts the
+    # caller (saw it as garbage in borg-targets.txt). Stash real stdout in
+    # fd 9, redirect stdout to the TTY for the body, and emit the actual
+    # return value through fd 9.
+    exec 9>&1 >/dev/tty
+
+    local default_path="${1:-/mnt/backup}"
+
+    local -a menu=()
+    local -a entries=()
+    local idx=1
+    local state path_or_dev label size fstype uuid
+    while IFS=$'\t' read -r state path_or_dev label size fstype uuid; do
+        [[ -z "$state" ]] && continue
+        local desc
+        case "$state" in
+            mounted)
+                desc="${size:-?}  ${label:-no-label}  [${fstype}]  →  ${path_or_dev}"
+                ;;
+            unmounted)
+                desc="${size:-?}  ${label:-no-label}  [${fstype}]  $(hb_translate "(not mounted — will be mounted)")"
+                ;;
+            empty)
+                desc="${size:-?}  $(hb_translate "raw USB disk — no filesystem (will be FORMATTED)")"
+                ;;
+        esac
+        menu+=("$idx" "$desc")
+        entries+=("${state}|${path_or_dev}|${label}|${size}|${fstype}|${uuid}")
+        ((idx++))
+    done < <(hb_list_usb_partitions)
+
+    if (( ${#menu[@]} == 0 )); then
+        # No USB at all — single inputbox fallback (no menu, less confusing)
+        local out
+        out=$(dialog --backtitle "ProxMenux" \
+            --title "$(hb_translate "External disk for backup")" \
+            --inputbox "$(hb_translate "No USB drives detected. Enter the mountpoint path manually:")" \
+            "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "$default_path" 3>&1 1>&2 2>&3) || return 1
+        out=$(hb_trim_dialog_value "$out")
+        [[ -n "$out" && -d "$out" ]] || { msg_error "$(hb_translate "Path does not exist.")"; return 1; }
+        if ! mountpoint -q "$out" 2>/dev/null; then
+            dialog --backtitle "ProxMenux" --title "$(hb_translate "Warning")" \
+                --yesno "$(hb_translate "This path is not a registered mount point. Use it anyway?")" \
+                "$HB_UI_YESNO_H" "$HB_UI_YESNO_W" || return 1
+        fi
+        echo "$out" >&9
+        return 0
+    fi
+
+    local choice
+    choice=$(dialog --backtitle "ProxMenux" \
+        --title "$(hb_translate "External disk for backup")" \
+        --menu "\n$(hb_translate "Pick a USB disk:")" \
+        "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${menu[@]}" 3>&1 1>&2 2>&3) || return 1
+
+    local sel="${entries[$((choice-1))]}"
+    local s_state s_path s_label s_size s_fstype s_uuid
+    IFS='|' read -r s_state s_path s_label s_size s_fstype s_uuid <<< "$sel"
+
+    case "$s_state" in
+        mounted)
+            echo "$s_path" >&9
+            return 0
+            ;;
+
+        unmounted)
+            if ! dialog --backtitle "ProxMenux" --colors \
+                    --title "$(hb_translate "Mount USB disk?")" \
+                    --yesno "$(hb_translate "Mount this device and use it as the backup destination?")"$'\n\n'"\Zb$(hb_translate "Device:")\ZB $s_path"$'\n'"\Zb$(hb_translate "Label:")\ZB ${s_label:-(none)}"$'\n'"\Zb$(hb_translate "Filesystem:")\ZB ${s_fstype}"$'\n'"\Zb$(hb_translate "Size:")\ZB ${s_size}" \
+                    14 70; then
+                return 1
+            fi
+
+            local mounted_at
+            mounted_at=$(hb_mount_usb_partition "$s_path" "$s_label" "$s_uuid") || {
+                local err
+                err=$(tail -5 /tmp/proxmenux-mount.log 2>/dev/null | sed 's/[\Z]/_/g')
+                dialog --backtitle "ProxMenux" --colors \
+                    --title "$(hb_translate "Mount failed")" \
+                    --msgbox "$(hb_translate "Could not mount") \Z1$s_path\Zn.\n\n${err:-$(hb_translate "See /tmp/proxmenux-mount.log for details.")}" 14 76
+                return 1
+            }
+            # The wizard prints the destination path right after, so go
+            # straight to the backup flow instead of asking for an extra
+            # confirmation click on a "mounted OK" dialog.
+            echo "$mounted_at" >&9
+            return 0
+            ;;
+
+        empty)
+            # Destructive! Triple-check before formatting.
+            if ! dialog --backtitle "ProxMenux" --colors \
+                    --title "$(hb_translate "Format USB disk?")" \
+                    --default-button no \
+                    --yesno "\Z1\Zb$(hb_translate "WARNING: this will ERASE EVERYTHING on the disk.")\ZB\Zn"$'\n\n'"\Zb$(hb_translate "Device:")\ZB $s_path"$'\n'"\Zb$(hb_translate "Size:")\ZB ${s_size}"$'\n\n'"$(hb_translate "Create a fresh GPT + ext4 partition and mount it?")" \
+                    14 76; then
+                return 1
+            fi
+            # Second confirmation prompts the operator to type the device name
+            local typed
+            typed=$(dialog --backtitle "ProxMenux" --colors \
+                --title "$(hb_translate "Final confirmation")" \
+                --inputbox "$(hb_translate "Type the device path EXACTLY to confirm formatting:")"$'\n\n'"\Z1${s_path}\Zn" \
+                "$HB_UI_INPUT_H" "$HB_UI_INPUT_W" "" 3>&1 1>&2 2>&3) || return 1
+            if [[ "$typed" != "$s_path" ]]; then
+                dialog --backtitle "ProxMenux" \
+                    --msgbox "$(hb_translate "Device path mismatch. Format cancelled.")" 8 60
+                return 1
+            fi
+
+            local fmt_label="proxmenux-backup"
+            local mounted_at
+            mounted_at=$(hb_format_usb_disk "$s_path" "$fmt_label") || {
+                local err
+                err=$(tail -10 /tmp/proxmenux-format.log 2>/dev/null)
+                dialog --backtitle "ProxMenux" --colors \
+                    --title "$(hb_translate "Format failed")" \
+                    --msgbox "$(hb_translate "Could not format the disk.")\n\n${err}" 16 80
+                return 1
+            }
+            dialog --backtitle "ProxMenux" --colors \
+                --title "$(hb_translate "Formatted and mounted")" \
+                --msgbox "\Zb$(hb_translate "Mounted at")\ZB  \Z4${mounted_at}\Zn" 8 70
+            echo "$mounted_at" >&9
+            return 0
+            ;;
+    esac
+    return 1
 }
 
 hb_prompt_dest_dir() {
@@ -654,6 +2893,15 @@ hb_prompt_dest_dir() {
 }
 
 hb_prompt_restore_source_dir() {
+    # Same fd-9 trick used by hb_prompt_mounted_path: this function
+    # is called as `dir=$(hb_prompt_restore_source_dir)` which
+    # captures stdout, so any --msgbox we open inside would render
+    # into the subshell (invisible to the operator) and the caller
+    # would think the flow "hung". Stash real stdout in fd 9,
+    # redirect stdout to the tty for every dialog, and emit the
+    # actual return value through fd 9 at the end.
+    exec 9>&1 >/dev/tty
+
     local choice out
 
     choice=$(dialog --backtitle "ProxMenux" \
@@ -678,14 +2926,72 @@ hb_prompt_restore_source_dir() {
     esac
 
     out=$(hb_trim_dialog_value "$out")
-    [[ -n "$out" && -d "$out" ]] || {
-        msg_error "$(hb_translate "Directory does not exist.")"
+    if [[ -z "$out" || ! -d "$out" ]]; then
+        dialog --backtitle "ProxMenux" \
+            --title "$(hb_translate "Directory not found")" \
+            --msgbox "$(hb_translate "The selected path does not exist on this host:")"$'\n\n'"${out:-<empty>}" \
+            10 78 || true
         return 1
-    }
-    echo "$out"
+    fi
+    # Emit the real return value through the saved fd 9 — the caller's
+    # `$(...)` capture reads from fd 9 (see the exec at the top).
+    echo "$out" >&9
+}
+
+# Return the set of scheduler job_ids that currently have a .env on
+# disk. Used by hb_is_host_backup_archive to recognize archives
+# produced by the scheduler when the filename doesn't follow the
+# `hostcfg-` convention. Prints one id per line.
+hb_known_scheduler_job_ids() {
+    local jobs_dir="${PMX_BACKUP_JOBS_DIR:-/var/lib/proxmenux/backup-jobs}"
+    [[ -d "$jobs_dir" ]] || return 0
+    local f
+    for f in "$jobs_dir"/*.env; do
+        [[ -f "$f" ]] || continue
+        basename "$f" .env
+    done
+}
+
+# Decide whether $path looks like a ProxMenux host backup. Cheap
+# checks only — sidecar presence + filename heuristics. We do NOT
+# tar-peek here because the picker may face dozens of candidates
+# and the user is waiting in front of a dialog; the in-Monitor
+# endpoint takes care of peek-based detection where SWR can cache
+# the result. Returns 0 on match, non-zero otherwise.
+hb_is_host_backup_archive() {
+    local path="$1"
+    [[ -z "$path" || ! -f "$path" ]] && return 1
+    # 1. Sidecar present → definitive yes.
+    [[ -f "${path}.proxmenux.json" ]] && return 0
+    local name stem
+    name=$(basename "$path")
+    # Strip the timestamped suffix; we only need the part BEFORE the
+    # `-YYYYMMDD_HHMMSS.tar.*` tail.
+    stem="${name%-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]_[0-9][0-9][0-9][0-9][0-9][0-9].tar*}"
+    # If the strip didn't change anything, the file doesn't follow
+    # the ProxMenux timestamp convention at all → reject (this kills
+    # PVE's vzdump-lxc-101-2026_02_24-20_00_56.tar.zst because its
+    # date uses underscores between Y/M/D, not the YYYYMMDD_ form).
+    [[ "$stem" == "$name" ]] && return 1
+    # 2. hostcfg- prefix → manual or convention-following scheduled.
+    [[ "$stem" == hostcfg-* ]] && return 0
+    # 3. Known scheduler job_id → scheduled.
+    local jid
+    while IFS= read -r jid; do
+        [[ -z "$jid" ]] && continue
+        [[ "$stem" == "$jid" ]] && return 0
+    done < <(hb_known_scheduler_job_ids)
+    return 1
 }
 
 hb_prompt_local_archive() {
+    # See hb_prompt_restore_source_dir above for why we do the fd-9
+    # trick — same story: caller uses `archive=$(hb_prompt_local_archive)`
+    # so any --msgbox inside would render into the subshell and
+    # never reach the operator. Force dialog output to the tty and
+    # emit the selected archive path via fd 9 at the end.
+    exec 9>&1 >/dev/tty
+
     local base_dir="$1"
     local title="${2:-$(hb_translate "Select backup archive")}"
     local -a rows=() files=() menu=()
@@ -700,17 +3006,39 @@ hb_prompt_local_archive() {
         | head -200
     )
 
+    # Filter the raw find result down to ProxMenux host backups —
+    # the picker historically showed every .tar* in /var/lib/vz/dump,
+    # which on a typical Proxmox host means dozens of vzdump-lxc-*
+    # entries that aren't restorable from this menu. We track the
+    # drop count so we can tell the operator something was filtered.
+    local -a kept=()
+    local hidden=0 row path
+    for row in "${rows[@]}"; do
+        path="${row##*|}"
+        if hb_is_host_backup_archive "$path"; then
+            kept+=("$row")
+        else
+            ((hidden++))
+        fi
+    done
+    rows=("${kept[@]}")
+
     if [[ ${#rows[@]} -eq 0 ]]; then
         local no_backups_msg
-        no_backups_msg="$(hb_translate "No backup archives were found in:") $base_dir"$'\n\n'"$(hb_translate "Select another source path and try again.")"
+        no_backups_msg="$(hb_translate "No ProxMenux host-backup archives were found in:") $base_dir"
+        if (( hidden > 0 )); then
+            no_backups_msg+=$'\n\n'"$(hb_translate "Found") $hidden $(hb_translate "other .tar archive(s) — not ProxMenux host backups (e.g. PVE vzdump or unrelated tarballs).")"
+        else
+            no_backups_msg+=$'\n\n'"$(hb_translate "Select another source path and try again.")"
+        fi
         dialog --backtitle "ProxMenux" \
             --title "$(hb_translate "No backups found")" \
             --msgbox "$no_backups_msg" \
-            10 78 || true
+            12 78 || true
         return 1
     fi
 
-    local i=1 row epoch size path date_str size_str label
+    local i=1 epoch size date_str size_str label
     for row in "${rows[@]}"; do
         epoch="${row%%|*}"; row="${row#*|}"
         size="${row%%|*}";  path="${row#*|}"
@@ -721,12 +3049,20 @@ hb_prompt_local_archive() {
         files+=("$path"); menu+=("$i" "$label"); ((i++))
     done
 
+    local menu_prompt
+    menu_prompt="\n$(hb_translate "Detected backups — newest first:")"
+    if (( hidden > 0 )); then
+        menu_prompt+=$'\n'"($(hb_translate "Hidden:") $hidden $(hb_translate "non-ProxMenux .tar archive(s) in this path"))"
+    fi
+
     local choice
     choice=$(dialog --backtitle "ProxMenux" --title "$title" \
-        --menu "\n$(hb_translate "Detected backups — newest first:")" \
+        --menu "$menu_prompt" \
         "$HB_UI_MENU_H" "$HB_UI_MENU_W" "$HB_UI_MENU_LIST" "${menu[@]}" 3>&1 1>&2 2>&3) || return 1
 
-    echo "${files[$((choice-1))]}"
+    # Emit the selected archive path through fd 9 so the caller's
+    # `$(...)` capture actually receives it (see the exec at the top).
+    echo "${files[$((choice-1))]}" >&9
 }
 
 # ==========================================================
@@ -752,6 +3088,86 @@ hb_file_size() {
     fi
 }
 
+# POST a Host Backup lifecycle event to the local webhook so the
+# Monitor notification pipeline can route it through the host_backup_*
+# event types (toggle-able per channel in Settings). Used by both the
+# scheduled runner (`run_scheduled_backup.sh`) and the manual flow
+# (`backup_host.sh`).
+#
+# Arg: action (start|complete|fail)
+# Required env: HB_NOTIFY_JOB_ID (or `job_id` shell var)
+# Optional env (per the host_backup_* template fields):
+#   HB_NOTIFY_BACKEND       = pbs|local|borg
+#   HB_NOTIFY_DESTINATION   = path / URI
+#   HB_NOTIFY_PROFILE_MODE  = default|custom
+#   HB_NOTIFY_DATA_SIZE     = staged data (e.g. "12.4 GiB")
+#   HB_NOTIFY_ARCHIVE_SIZE  = output archive size (local) or '-'
+#   HB_NOTIFY_DURATION      = pretty elapsed (e.g. "2m 13s")
+#   HB_NOTIFY_LOG_FILE      = path to job log (rendered in fail body)
+#   HB_NOTIFY_REASON        = short failure reason (last error line)
+#
+# Best-effort: the curl is bounded (--connect-timeout 3 / --max-time 5)
+# and silenced so a Monitor outage never aborts the backup itself.
+hb_notify_lifecycle() {
+    command -v jq >/dev/null 2>&1 || return 0
+    command -v curl >/dev/null 2>&1 || return 0
+
+    local action="$1"
+    local jid="${HB_NOTIFY_JOB_ID:-${job_id:-}}"
+    local severity="info" title="Host backup ${action}: ${jid:-?}"
+    case "$action" in
+        fail)     severity="error"; title="Host backup FAILED: ${jid:-?}" ;;
+        complete) title="Host backup complete: ${jid:-?}" ;;
+        start)    title="Host backup started: ${jid:-?}" ;;
+    esac
+
+    local pve_type="proxmenux-host-backup-${action}"
+    local host
+    host="$(hostname 2>/dev/null || echo unknown)"
+
+    local message="Backend: ${HB_NOTIFY_BACKEND:-}
+Destination: ${HB_NOTIFY_DESTINATION:-}
+Profile: ${HB_NOTIFY_PROFILE_MODE:-default}
+Data size: ${HB_NOTIFY_DATA_SIZE:-}
+Archive size: ${HB_NOTIFY_ARCHIVE_SIZE:-}
+Duration: ${HB_NOTIFY_DURATION:-}"
+    [[ "$action" == "fail" ]] && message+="
+Reason: ${HB_NOTIFY_REASON:-unknown}
+Log: ${HB_NOTIFY_LOG_FILE:-}"
+
+    local payload
+    payload=$(jq -nc \
+        --arg t  "$title" \
+        --arg m  "$message" \
+        --arg s  "$severity" \
+        --arg ts "$(date -Iseconds)" \
+        --arg pty "$pve_type" \
+        --arg host "$host" \
+        --arg jid "${jid:-}" \
+        --arg backend  "${HB_NOTIFY_BACKEND:-}" \
+        --arg dest     "${HB_NOTIFY_DESTINATION:-}" \
+        --arg profile  "${HB_NOTIFY_PROFILE_MODE:-default}" \
+        --arg dsize    "${HB_NOTIFY_DATA_SIZE:-}" \
+        --arg asize    "${HB_NOTIFY_ARCHIVE_SIZE:-}" \
+        --arg dur      "${HB_NOTIFY_DURATION:-}" \
+        --arg log      "${HB_NOTIFY_LOG_FILE:-}" \
+        --arg reason   "${HB_NOTIFY_REASON:-}" \
+        '{title:$t, message:$m, severity:$s, timestamp:$ts,
+          fields:{type:$pty, hostname:$host, "job-id":$jid,
+                  backend:$backend, destination:$dest,
+                  profile_mode:$profile, data_size:$dsize,
+                  archive_size:$asize, duration:$dur,
+                  log_file:$log, reason:$reason}}' \
+        2>/dev/null)
+    [[ -z "$payload" ]] && return 0
+    curl -sk --connect-timeout 3 --max-time 5 \
+        -X POST \
+        -H "Content-Type: application/json" \
+        -d "$payload" \
+        http://127.0.0.1:8008/api/notifications/webhook \
+        >/dev/null 2>&1 || true
+}
+
 hb_show_log() {
     local logfile="$1" title="${2:-$(hb_translate "Operation log")}"
     [[ -f "$logfile" && -s "$logfile" ]] || return 0
@@ -768,3 +3184,849 @@ hb_require_cmd() {
     fi
     command -v "$cmd" >/dev/null 2>&1
 }
+
+# Silent best-effort install of `pv` so callers can pipe tar through it
+# for a live progress bar. Returns 0 if pv ends up available, 1 if not.
+# Never speaks — pv is purely an UX improvement, asking the operator to
+# install it themselves would be backwards (we have apt; they shouldn't).
+hb_ensure_pv() {
+    command -v pv >/dev/null 2>&1 && return 0
+    if command -v apt-get >/dev/null 2>&1; then
+        DEBIAN_FRONTEND=noninteractive apt-get install -y -qq pv >/dev/null 2>&1
+    fi
+    command -v pv >/dev/null 2>&1
+}
+
+# ==========================================================
+# Compatibility check — compares backup metadata against the
+# current host and surfaces hostname / PVE version / kernel /
+# storage / network / VMID drift BEFORE the apply menu opens.
+#
+# After running hb_compat_check, the caller can read:
+# ==========================================================
+# NIC REMAP PLAN + APPLY
+# ==========================================================
+# Reconciles NICs recorded in the backup manifest against the
+# live host. Covers the "motherboard swap" scenario: same NIC
+# chip lands on a different PCI slot after the swap, so the
+# ifname changes (enp0s31f6 → enp0s25) even though the MAC is
+# the same. Without a remap the restored /etc/network/interfaces
+# references a name that no longer exists → no network at boot.
+#
+# Populates arrays (only when jq + manifest are available):
+#   HB_NIC_REMAP[i]="<old_ifname>|<new_ifname>|<mac>"
+#     — same MAC, different ifname. Rewrites the staging config
+#       so the restored files use <new_ifname>.
+#   HB_NIC_ORPHAN[i]="<old_ifname>|<mac>"
+#     — MAC from the backup not present on target at all.
+#       Real hardware removal, left to hb_compat_check to
+#       report as WARN/FAIL depending on wired-ness.
+#   HB_NIC_MAC_CHANGED[i]="<ifname>|<old_mac>|<new_mac>"
+#     — same ifname on target, but MAC differs. Motherboard
+#       replacement with same PCI layout but different NIC chip.
+#       Boot succeeds; surfaces INFO so the operator can update
+#       any DHCP static reservation that keyed on the old MAC.
+# ==========================================================
+hb_plan_nic_remaps() {
+    local staging_root="$1"
+    HB_NIC_REMAP=()
+    HB_NIC_ORPHAN=()
+    HB_NIC_MAC_CHANGED=()
+
+    local manifest="$staging_root/manifest.json"
+    [[ -f "$manifest" ]] || return 0
+    command -v jq >/dev/null 2>&1 || return 0
+
+    declare -A _dest_mac_by_if=()
+    declare -A _dest_if_by_mac=()
+    local dev_path _if _mac
+    for dev_path in /sys/class/net/*; do
+        _if="$(basename "$dev_path")"
+        case "$_if" in
+            lo|veth*|tap*|fwln*|fwbr*|fwpr*|vmbr*|bond*) continue ;;
+        esac
+        [[ -e "$dev_path/device" ]] || continue
+        _mac="$(cat "$dev_path/address" 2>/dev/null || true)"
+        [[ -z "$_mac" ]] && continue
+        _dest_mac_by_if["$_if"]="$_mac"
+        _dest_if_by_mac["$_mac"]="$_if"
+    done
+
+    local src_if src_mac
+    while IFS=$'\t' read -r src_if src_mac; do
+        [[ -z "$src_if" || -z "$src_mac" ]] && continue
+        # 1) Same ifname on target — compare MAC.
+        if [[ -n "${_dest_mac_by_if[$src_if]:-}" ]]; then
+            local cur_mac="${_dest_mac_by_if[$src_if]}"
+            if [[ "$cur_mac" != "$src_mac" ]]; then
+                HB_NIC_MAC_CHANGED+=("${src_if}|${src_mac}|${cur_mac}")
+            fi
+            continue
+        fi
+        # 2) MAC found on a different ifname — remap.
+        if [[ -n "${_dest_if_by_mac[$src_mac]:-}" ]]; then
+            HB_NIC_REMAP+=("${src_if}|${_dest_if_by_mac[$src_mac]}|${src_mac}")
+            continue
+        fi
+        # 3) Neither ifname nor MAC — real removal.
+        HB_NIC_ORPHAN+=("${src_if}|${src_mac}")
+    done < <(jq -r '.hardware_inventory.nic[]? | "\(.ifname)\t\(.mac)"' "$manifest" 2>/dev/null)
+}
+
+# Rewrites NIC names in the staging_root's network config so the
+# restored /etc/network/interfaces (and interfaces.d/*, and
+# systemd-networkd .link files if present) uses the new names.
+# Only touches the staging copy — nothing on the live host changes
+# until the normal apply step runs. GNU sed word boundaries (\b)
+# keep eth10 safe when renaming eth1.
+hb_apply_nic_remaps() {
+    local staging_root="$1"
+    (( ${#HB_NIC_REMAP[@]} == 0 )) && return 0
+
+    local -a targets=()
+    [[ -f "$staging_root/rootfs/etc/network/interfaces" ]] && \
+        targets+=("$staging_root/rootfs/etc/network/interfaces")
+    if [[ -d "$staging_root/rootfs/etc/network/interfaces.d" ]]; then
+        while IFS= read -r -d '' f; do targets+=("$f"); done \
+            < <(find "$staging_root/rootfs/etc/network/interfaces.d" -type f -print0 2>/dev/null)
+    fi
+    if [[ -d "$staging_root/rootfs/etc/systemd/network" ]]; then
+        while IFS= read -r -d '' f; do targets+=("$f"); done \
+            < <(find "$staging_root/rootfs/etc/systemd/network" -type f -print0 2>/dev/null)
+    fi
+    (( ${#targets[@]} == 0 )) && return 0
+
+    local entry old_if new_if _mac t
+    for entry in "${HB_NIC_REMAP[@]}"; do
+        IFS='|' read -r old_if new_if _mac <<<"$entry"
+        [[ -z "$old_if" || -z "$new_if" ]] && continue
+        for t in "${targets[@]}"; do
+            sed -i "s/\\b${old_if}\\b/${new_if}/g" "$t" 2>/dev/null || true
+        done
+    done
+}
+
+# ==========================================================
+# CROSS-VERSION UNSAFE PATHS
+# ==========================================================
+# Curated list of paths that reliably break the boot when a backup
+# taken on PVE major X or kernel major.minor Y is applied on a
+# different X/Y. Restoring these is what caused the field-reported
+# kernel panic (backup on 9.1.9 / kernel 6.x restored on 9.2.3 /
+# kernel 7.x). We ship a static list rather than a heuristic so
+# behaviour is auditable — the operator can inspect it once and
+# know what "safe restore mode" means.
+#
+# Output: one line per path, tab-separated: <abs_path>\t<reason>
+# The reason is a short label used verbatim in the confirm dialog.
+# ==========================================================
+hb_unsafe_paths_cross_version() {
+    cat <<'EOF'
+/etc/default/grub	GRUB defaults tied to prior kernel order
+/etc/kernel	proxmox-boot-tool state (cmdline, ESP UUIDs, hooks)
+/etc/modules-load.d	autoload list may reference renamed modules
+/etc/modprobe.d	module options may not apply on new kernel
+/etc/apt	source suites may trigger downgrade on next upgrade
+/etc/initramfs-tools	initramfs hooks tied to prior kernel
+/etc/fstab	UUIDs may not exist on this install
+/etc/multipath	multipath drivers change between kernels
+/etc/iscsi	iSCSI parameters evolve between kernels
+/etc/udev/rules.d	udev rules may bind to nonexistent subsystems
+/etc/zfs	zpool.cache + hostid can lock the pool as foreign
+/etc/systemd/system	unit overrides + .wants tied to older systemd major version — cross-version restore panics init (bench-reproduced)
+/etc/systemd/journald.conf	journald options may not parse on new systemd major
+/etc/systemd/logind.conf	logind options may not parse on new systemd major
+/etc/systemd/system.conf	system.conf keys evolve across systemd major
+/etc/systemd/user.conf	user.conf keys evolve across systemd major
+EOF
+}
+
+# ==========================================================
+# hb_detect_bootloader — "grub" | "systemd-boot" | "unknown"
+# ==========================================================
+# Proxmox uses systemd-boot on ZFS-on-root installs and GRUB on
+# ext4/lvm. `proxmox-boot-tool status` reports both cases when
+# the tool is present; on rescue paths without pbt we fall back
+# to the presence of /etc/kernel/cmdline (systemd-boot) or
+# /etc/default/grub (GRUB).
+hb_detect_bootloader() {
+    if command -v proxmox-boot-tool >/dev/null 2>&1; then
+        local pbt
+        pbt="$(proxmox-boot-tool status 2>/dev/null || true)"
+        if grep -qi 'systemd-boot' <<<"$pbt"; then
+            echo "systemd-boot"; return 0
+        elif grep -qiE 'grub|BIOS' <<<"$pbt"; then
+            echo "grub"; return 0
+        fi
+    fi
+    if [[ -f /etc/kernel/cmdline ]]; then
+        echo "systemd-boot"
+    elif [[ -f /etc/default/grub ]]; then
+        echo "grub"
+    else
+        echo "unknown"
+    fi
+}
+
+# hb_grub_keys_whitelist — GRUB /etc/default/grub keys that are
+# stable across PVE 9.x / kernel majors and worth merging from the
+# backup on a bk_older restore. Excludes GRUB_DISTRIBUTOR (changes
+# with the distro package) and keys whose values reference boot
+# entries the target install regenerates (GRUB_SAVEDEFAULT).
+hb_grub_keys_whitelist() {
+    cat <<'EOF'
+GRUB_TIMEOUT
+GRUB_TIMEOUT_STYLE
+GRUB_DEFAULT
+GRUB_TERMINAL
+GRUB_TERMINAL_INPUT
+GRUB_TERMINAL_OUTPUT
+GRUB_DISABLE_OS_PROBER
+GRUB_SERIAL_COMMAND
+GRUB_CMDLINE_LINUX_DEFAULT
+GRUB_CMDLINE_LINUX
+GRUB_GFXMODE
+GRUB_GFXPAYLOAD_LINUX
+EOF
+}
+
+# hb_hydration_module_whitelist — module names safe to add to the
+# target's /etc/modules from the backup's modules_loaded_at_boot
+# on a bk_older restore. All are kernel-agnostic in name across
+# 5.x → 7.x. Skips distro defaults (loop, dm-*) since a fresh
+# install already loads them.
+hb_hydration_module_whitelist() {
+    cat <<'EOF'
+vfio
+vfio_pci
+vfio_iommu_type1
+vfio_virqfd
+kvm
+kvm_intel
+kvm_amd
+nvidia
+nvidia_drm
+nvidia_modeset
+nvidia_uvm
+i915
+xe
+EOF
+}
+
+# hb_hydration_files_patterns — glob patterns (relative to root)
+# for files that are safe to copy verbatim from the backup rootfs
+# in a bk_older restore. The rule for inclusion: operator- or
+# ProxMenux-authored file whose content uses stable syntax across
+# kernel majors. Excludes distro-owned files (pve-blacklist.conf,
+# mdadm.conf, nvme.conf) whose contents can evolve between releases.
+hb_hydration_files_patterns() {
+    cat <<'EOF'
+/etc/modprobe.d/proxmenux-*.conf
+/etc/modprobe.d/vfio.conf
+/etc/modprobe.d/vfio-pci.conf
+/etc/modprobe.d/kvm.conf
+/etc/modprobe.d/blacklist-nvidia.conf
+/etc/modprobe.d/blacklist-nouveau.conf
+/etc/modprobe.d/nvidia*.conf
+/etc/modules-load.d/proxmenux-*.conf
+/etc/modules-load.d/vfio*.conf
+/etc/modules-load.d/nvidia*.conf
+/etc/udev/rules.d/10-proxmenux-vfio-bind.rules
+/etc/udev/rules.d/70-nvidia.rules
+EOF
+}
+
+#   HB_COMPAT_SAME_HOST         → 1 if backup's hostname matches current
+#   HB_COMPAT_ANY_FAIL          → 1 if at least one FAIL was raised
+#   HB_COMPAT_ANY_WARN          → 1 if at least one WARN was raised
+#   HB_COMPAT_CROSS_VERSION     → 1 if PVE major OR kernel major.minor differs
+#   HB_COMPAT_KERNEL_DIRECTION  → "same" / "bk_older" / "bk_newer" — only
+#                                 "bk_older" activates the safe-subset
+#                                 restore that skips kernel-tied paths
+#                                 (grub, /etc/systemd/system, initramfs
+#                                 config, apt sources, ZFS state, …).
+#                                 "bk_newer" restores everything as
+#                                 same-version because empirical tests
+#                                 (9.2 → 9.1 with GPU passthrough +
+#                                 IOMMU) prove that direction is safe.
+#   HB_COMPAT_RESULTS[]         → array of "STATUS|category|message"
+#                                 entries where STATUS ∈ {PASS,INFO,WARN,FAIL}
+# Use hb_show_compat_report to surface the result and let the user
+# decide whether to continue.
+# ==========================================================
+hb_compat_check() {
+    local staging_root="$1"
+    HB_COMPAT_RESULTS=()
+    HB_COMPAT_SAME_HOST=0
+    HB_COMPAT_ANY_FAIL=0
+    HB_COMPAT_ANY_WARN=0
+    HB_COMPAT_CROSS_VERSION=0
+    # HB_COMPAT_KERNEL_DIRECTION captures which direction the kernel
+    # major.minor drift goes:
+    #   same     — backup and target on the same kernel major.minor
+    #              (or one side lacks a kernel string in the manifest).
+    #   bk_older — backup kernel is OLDER than target kernel. This is
+    #              the only direction that has been observed to break
+    #              things: restoring older-kernel-era userspace onto a
+    #              newer target can drag in old libzfs siblings, older
+    #              systemd unit overrides, and DKMS modules built
+    #              against a kernel that isn't the one now running.
+    #              The restore flow uses this to skip the kernel-tied
+    #              paths (grub, /etc/systemd/system, initramfs config,
+    #              etc.) so Full mode still runs but only over the
+    #              safe subset, and Custom mode grays out the unsafe
+    #              paths so the operator can't shoot themself in the
+    #              foot picking them.
+    #   bk_newer — backup kernel is NEWER than target kernel. Empirical
+    #              testing (multiple 9.2 → 9.1 restores with GPU
+    #              passthrough / IOMMU) shows this direction works
+    #              fine as-is: Proxmox repos don't ship future package
+    #              versions on old series, so APT silently skips the
+    #              backup's kernel-tied packages, and modules compile
+    #              against whatever kernel the target is running. No
+    #              safe-mode restrictions apply here; the restore runs
+    #              as though it were same-version.
+    HB_COMPAT_KERNEL_DIRECTION="same"
+
+    local meta="$staging_root/metadata"
+    local rootfs="$staging_root/rootfs"
+
+    # --- HOST IDENTITY ---
+    local bk_hostname="" cur_hostname
+    if [[ -f "$meta/run_info.env" ]]; then
+        bk_hostname=$(grep -m1 '^hostname=' "$meta/run_info.env" 2>/dev/null | cut -d= -f2-)
+    fi
+    cur_hostname=$(hostname 2>/dev/null || echo "")
+    if [[ -n "$bk_hostname" ]]; then
+        if [[ "$bk_hostname" == "$cur_hostname" ]]; then
+            HB_COMPAT_SAME_HOST=1
+            HB_COMPAT_RESULTS+=("PASS|Host|$(hb_translate "Same host:") $bk_hostname")
+        else
+            HB_COMPAT_RESULTS+=("WARN|Host|$(hb_translate "Different host. Backup from:") $bk_hostname / $(hb_translate "restoring on:") $cur_hostname")
+            HB_COMPAT_ANY_WARN=1
+        fi
+    fi
+
+    # --- PVE VERSION ---
+    # `pveversion.txt` from the backup is `pveversion -v` output, where
+    # each package is on its own line as `<pkg>: <version>` (note the
+    # SPACE after the colon, not a slash). Live `pveversion` (no flag)
+    # uses `<pkg>/<version>/<commit>` form. Cover both.
+    local bk_pve="" cur_pve bk_major cur_major
+    if [[ -f "$meta/pveversion.txt" ]]; then
+        bk_pve=$(grep -m1 -oE '(^|[[:space:]])pve-manager[[:space:]]*[:/][[:space:]]*[0-9]+\.[0-9]+(\.[0-9]+)?' "$meta/pveversion.txt" 2>/dev/null \
+            | grep -oE '[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1)
+    fi
+    if command -v pveversion >/dev/null 2>&1; then
+        cur_pve=$(pveversion 2>/dev/null | grep -m1 -oE 'pve-manager/[0-9]+\.[0-9]+(\.[0-9]+)?' \
+            | grep -oE '[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1)
+    fi
+    if [[ -n "$bk_pve" && -n "$cur_pve" ]]; then
+        bk_major="${bk_pve%%.*}"
+        cur_major="${cur_pve%%.*}"
+        if [[ "$bk_pve" == "$cur_pve" ]]; then
+            HB_COMPAT_RESULTS+=("PASS|PVE version|$(hb_translate "Identical:") $bk_pve")
+        elif [[ "$bk_major" == "$cur_major" ]]; then
+            HB_COMPAT_RESULTS+=("PASS|PVE version|$(hb_translate "Same major series:") $bk_pve → $cur_pve")
+        else
+            # Major PVE bump — used to hard-FAIL, but the restore now
+            # automatically drops boot/kernel/apt-critical paths in
+            # this case (see hb_unsafe_paths_cross_version). Downgrade
+            # to INFO so the user knows what's happening; the safe
+            # filter does the actual protection.
+            HB_COMPAT_RESULTS+=("INFO|PVE version|$(hb_translate "Major version differs:") $bk_pve → $cur_pve $(hb_translate "— safe restore mode will skip boot/kernel/apt config")")
+            HB_COMPAT_CROSS_VERSION=1
+        fi
+    fi
+
+    # --- KERNEL ---
+    local bk_kernel="" cur_kernel
+    if [[ -f "$meta/run_info.env" ]]; then
+        bk_kernel=$(grep -m1 '^kernel=' "$meta/run_info.env" 2>/dev/null | cut -d= -f2-)
+    fi
+    cur_kernel=$(uname -r 2>/dev/null)
+    if [[ -n "$bk_kernel" && -n "$cur_kernel" ]]; then
+        if [[ "$bk_kernel" == "$cur_kernel" ]]; then
+            HB_COMPAT_RESULTS+=("PASS|Kernel|$(hb_translate "Identical:") $bk_kernel")
+        else
+            local bk_kmaj cur_kmaj
+            bk_kmaj=$(echo "$bk_kernel" | cut -d. -f1-2)
+            cur_kmaj=$(echo "$cur_kernel" | cut -d. -f1-2)
+            if [[ "$bk_kmaj" == "$cur_kmaj" ]]; then
+                HB_COMPAT_RESULTS+=("PASS|Kernel|$(hb_translate "Same major.minor:") $bk_kernel → $cur_kernel")
+            else
+                # Kernel major.minor drift — decide direction so the
+                # rest of the restore knows whether to switch on the
+                # safe-subset mode. Bash `[[ ... < ... ]]` is a string
+                # compare, so we split into integers explicitly.
+                local _bk_maj _bk_min _cur_maj _cur_min
+                _bk_maj=${bk_kmaj%%.*}
+                _bk_min=${bk_kmaj##*.}
+                _cur_maj=${cur_kmaj%%.*}
+                _cur_min=${cur_kmaj##*.}
+                if (( _bk_maj < _cur_maj )) \
+                   || (( _bk_maj == _cur_maj && _bk_min < _cur_min )); then
+                    HB_COMPAT_KERNEL_DIRECTION="bk_older"
+                    HB_COMPAT_RESULTS+=("INFO|Kernel|$(hb_translate "Backup on older kernel:") $bk_kernel → $cur_kernel $(hb_translate "— Full/Custom restore will skip kernel-tied paths")")
+                    HB_COMPAT_CROSS_VERSION=1
+                else
+                    # Backup NEWER than target — empirical evidence
+                    # (multiple GPU passthrough tests) shows this
+                    # direction restores cleanly with no filtering.
+                    HB_COMPAT_KERNEL_DIRECTION="bk_newer"
+                    HB_COMPAT_RESULTS+=("INFO|Kernel|$(hb_translate "Backup on newer kernel:") $bk_kernel → $cur_kernel $(hb_translate "— restore proceeds as same-version (verified safe)")")
+                    HB_COMPAT_CROSS_VERSION=1
+                fi
+            fi
+        fi
+    fi
+
+    # --- STORAGE LAYOUT ---
+    if [[ -f "$rootfs/etc/pve/storage.cfg" ]] && command -v pvesm >/dev/null 2>&1; then
+        local -a bk_storages=() missing=()
+        # `<type>: <storage_id>` is the storage.cfg block header form.
+        mapfile -t bk_storages < <(grep -E '^[a-z]+:[[:space:]]+[A-Za-z0-9_.-]+' \
+            "$rootfs/etc/pve/storage.cfg" 2>/dev/null | awk '{print $2}' | sort -u)
+        local s
+        for s in "${bk_storages[@]}"; do
+            [[ -z "$s" ]] && continue
+            if ! pvesm status 2>/dev/null | awk 'NR>1 {print $1}' | grep -qx "$s"; then
+                missing+=("$s")
+            fi
+        done
+        if [[ ${#bk_storages[@]} -eq 0 ]]; then
+            : # backup didn't include storage.cfg or it was empty
+        elif [[ ${#missing[@]} -eq 0 ]]; then
+            HB_COMPAT_RESULTS+=("PASS|Storage|$(hb_translate "All") ${#bk_storages[@]} $(hb_translate "storage(s) from backup exist on target")")
+        else
+            HB_COMPAT_RESULTS+=("WARN|Storage|$(hb_translate "Missing on target:") ${missing[*]}")
+            HB_COMPAT_ANY_WARN=1
+        fi
+    fi
+
+    # --- NETWORK INTERFACES ---
+    # We only flag physical NICs that the backup references but the
+    # target doesn't expose. Virtual interfaces (vmbr, bond, tap, veth,
+    # fwbr/fwln/fwpr, lo, VLAN suffixes) are skipped because they're
+    # created by the restored configuration itself.
+    #
+    # A "missing" NIC needs further triage before we cry FAIL: a
+    # backup often carries orphan `iface <name> inet manual` lines
+    # left over from previous hardware that PVE never cleans up.
+    # Those declarations do nothing if the NIC doesn't exist — they
+    # don't bring it up, don't bridge it, don't bond it. Only NICs
+    # that are actually WIRED into the live config (auto-up, in a
+    # bridge_ports, in a bond_slaves) would lose connectivity if the
+    # NIC isn't present on the target.
+    if [[ -f "$rootfs/etc/network/interfaces" ]]; then
+        local ifaces_file="$rootfs/etc/network/interfaces"
+        local -a bk_ifaces=() missing_ifaces=() wired_missing=() orphan_missing=()
+        mapfile -t bk_ifaces < <(
+            grep -E '^(iface|auto)[[:space:]]' "$ifaces_file" 2>/dev/null \
+                | awk '{print $2}' \
+                | sort -u \
+                | grep -vE '^(lo|vmbr[0-9]+|bond[0-9]+|tap.*|veth.*|fwbr.*|fwln.*|fwpr.*)$' \
+                | grep -vE '\.[0-9]+$'  # strip VLAN sub-ifaces
+        )
+        local i
+        for i in "${bk_ifaces[@]}"; do
+            [[ -z "$i" ]] && continue
+            if ! ip -o link show "$i" >/dev/null 2>&1; then
+                missing_ifaces+=("$i")
+            fi
+        done
+        # Classify each missing NIC as wired vs orphan declaration.
+        # A "missing" NIC that hb_plan_nic_remaps already matched by
+        # MAC to a new ifname is NOT missing in any meaningful sense
+        # — the restored config will be rewritten to use the new
+        # name before apply. Skip it here.
+        local -A _remap_old=()
+        local _re_entry _re_old
+        for _re_entry in "${HB_NIC_REMAP[@]:-}"; do
+            [[ -z "$_re_entry" ]] && continue
+            _re_old="${_re_entry%%|*}"
+            [[ -n "$_re_old" ]] && _remap_old["$_re_old"]=1
+        done
+        for i in "${missing_ifaces[@]}"; do
+            [[ -n "${_remap_old[$i]:-}" ]] && continue
+            # Match: `auto <nic>`, `bridge-ports ... <nic>`, `bridge_ports ... <nic>`,
+            #        `bond-slaves ... <nic>`, `bond_slaves ... <nic>`, `slaves ... <nic>`
+            if grep -qE "(^auto[[:space:]]+${i}\$|bridge[-_]ports[[:space:]]+.*\b${i}\b|bond[-_]slaves[[:space:]]+.*\b${i}\b|^[[:space:]]*slaves[[:space:]]+.*\b${i}\b)" "$ifaces_file"; then
+                wired_missing+=("$i")
+            else
+                orphan_missing+=("$i")
+            fi
+        done
+
+        # Surface renames + MAC changes as INFO so the panel shows them
+        # if there's something else to see, but doesn't force it open.
+        # Separated `local` declarations because bash `set -u` in caller
+        # scopes gets grumpy about chained `local a=$b c=$a` forms.
+        local _re _o _rest _n
+        for _re in "${HB_NIC_REMAP[@]:-}"; do
+            [[ -z "$_re" ]] && continue
+            _o="${_re%%|*}"
+            _rest="${_re#*|}"
+            _n="${_rest%%|*}"
+            HB_COMPAT_RESULTS+=("INFO|Network|$(hb_translate "Renamed NIC:") ${_o} → ${_n} $(hb_translate "(same MAC — restored config adjusted automatically)")")
+        done
+        local _mc _ifn
+        for _mc in "${HB_NIC_MAC_CHANGED[@]:-}"; do
+            [[ -z "$_mc" ]] && continue
+            _ifn="${_mc%%|*}"
+            HB_COMPAT_RESULTS+=("INFO|Network|$(hb_translate "NIC") ${_ifn} $(hb_translate "has a different MAC than the backup — update any DHCP static reservation")")
+        done
+
+        if [[ ${#bk_ifaces[@]} -eq 0 ]]; then
+            : # nothing to check
+        elif [[ ${#missing_ifaces[@]} -eq 0 ]]; then
+            HB_COMPAT_RESULTS+=("PASS|Network|$(hb_translate "All physical interfaces from backup are present on target")")
+        else
+            if [[ ${#wired_missing[@]} -gt 0 ]]; then
+                HB_COMPAT_RESULTS+=("FAIL|Network|$(hb_translate "Wired NICs in backup missing on target:") ${wired_missing[*]} ($(hb_translate "restoring /etc/network would lose connectivity"))")
+                HB_COMPAT_ANY_FAIL=1
+            fi
+            if [[ ${#orphan_missing[@]} -gt 0 ]]; then
+                # Orphan iface declarations — harmless leftover from older
+                # hardware. Surface as PASS so the operator knows we
+                # noticed, but don't trigger the FAIL gate.
+                HB_COMPAT_RESULTS+=("PASS|Network|$(hb_translate "Backup declares unused NICs that are not on this host:") ${orphan_missing[*]} ($(hb_translate "orphan iface lines, no impact on restore"))")
+            fi
+        fi
+    fi
+
+    # --- USER PACKAGES ---
+    # Compare `apt-mark showmanual` from backup vs current. Any
+    # package the operator installed deliberately on the source
+    # host but missing on the target will eventually cause an
+    # orphan systemd unit or a "command not found" — surface
+    # those up-front so the operator can decide to install them
+    # via the "Install missing packages" apply option.
+    if [[ -f "$meta/packages.manual.list" ]] && command -v apt-mark >/dev/null 2>&1; then
+        local cur_pkgs_file
+        cur_pkgs_file=$(mktemp)
+        apt-mark showmanual 2>/dev/null | sort -u > "$cur_pkgs_file"
+        local -a missing_pkgs=()
+        mapfile -t missing_pkgs < <(comm -23 <(sort -u "$meta/packages.manual.list") "$cur_pkgs_file")
+        rm -f "$cur_pkgs_file"
+        if [[ ${#missing_pkgs[@]} -eq 0 ]]; then
+            HB_COMPAT_RESULTS+=("PASS|Packages|$(hb_translate "All user-installed packages from the backup are present on this host")")
+        else
+            local list_str
+            if [[ ${#missing_pkgs[@]} -le 6 ]]; then
+                list_str="${missing_pkgs[*]}"
+            else
+                list_str="${missing_pkgs[*]:0:6}… (+ $((${#missing_pkgs[@]} - 6)) $(hb_translate "more"))"
+            fi
+            # Missing packages are auto-installed by _rs_run_complete_extras
+            # regardless of restore strategy — the user doesn't have to
+            # decide anything, so INFO instead of WARN.
+            HB_COMPAT_RESULTS+=("INFO|Packages|${#missing_pkgs[@]} $(hb_translate "user packages missing — will be installed automatically:") $list_str")
+        fi
+    fi
+
+    # --- VMID OVERLAP ---
+    # On a same-host restore, overlapping guest IDs are expected (the
+    # backup snapshotted YOUR live VMs, so of course they match). We
+    # only flag it when the restore would actually overwrite live
+    # guest configs — i.e. cross-host AND there's overlap.
+    # Note: by default the host-backup restore flow does NOT restore
+    # /etc/pve/nodes/* (it's part of the opt-in cluster_cfg path), but
+    # if the operator later toggles that path on, this is the warning
+    # they'd need to have seen.
+    if [[ -d "$rootfs/etc/pve/nodes" ]] && [[ "$HB_COMPAT_SAME_HOST" != "1" ]]; then
+        local -a bk_pcts=() bk_qms=() current_pcts=() current_qms=()
+        [[ -f "$meta/pct-list.txt" ]] && mapfile -t bk_pcts < <(awk '/^[[:space:]]*[0-9]+/{print $1}' "$meta/pct-list.txt")
+        [[ -f "$meta/qm-list.txt"  ]] && mapfile -t bk_qms  < <(awk '/^[[:space:]]*[0-9]+/{print $1}' "$meta/qm-list.txt")
+        command -v pct >/dev/null 2>&1 && mapfile -t current_pcts < <(pct list 2>/dev/null | awk 'NR>1 {print $1}')
+        command -v qm  >/dev/null 2>&1 && mapfile -t current_qms  < <(qm  list 2>/dev/null | awk 'NR>1 {print $1}')
+        local pct_overlap=0 qm_overlap=0 id cid
+        for id in "${bk_pcts[@]}"; do
+            for cid in "${current_pcts[@]}"; do [[ "$id" == "$cid" ]] && ((pct_overlap++)); done
+        done
+        for id in "${bk_qms[@]}"; do
+            for cid in "${current_qms[@]}"; do [[ "$id" == "$cid" ]] && ((qm_overlap++)); done
+        done
+        if (( pct_overlap + qm_overlap > 0 )); then
+            HB_COMPAT_RESULTS+=("WARN|VM/CT IDs|$(hb_translate "Cross-host restore: guest IDs in backup overlap live IDs on target:") LXC=$pct_overlap, QEMU=$qm_overlap")
+            HB_COMPAT_ANY_WARN=1
+        fi
+    fi
+}
+
+# Render HB_COMPAT_RESULTS in a dialog. Returns 0 to continue, 1 to
+# abort. FAIL forces an explicit second confirmation; WARN shows the
+# report and lets the user proceed; an all-PASS report only shows up
+# briefly so the user can see it succeeded.
+hb_show_compat_report() {
+    local pass=0 info=0 warn=0 fail=0 line status rest cat msg
+    local report=""
+    for line in "${HB_COMPAT_RESULTS[@]}"; do
+        status="${line%%|*}"; rest="${line#*|}"
+        cat="${rest%%|*}";    msg="${rest#*|}"
+        case "$status" in
+            PASS) ((pass++)); report+=$' [OK]   '"${cat}"$' — '"${msg}"$'\n' ;;
+            INFO) ((info++)); report+=$' [INFO] '"${cat}"$' — '"${msg}"$'\n' ;;
+            WARN) ((warn++)); report+=$' [WARN] '"${cat}"$' — '"${msg}"$'\n' ;;
+            FAIL) ((fail++)); report+=$' [FAIL] '"${cat}"$' — '"${msg}"$'\n' ;;
+        esac
+    done
+
+    local summary
+    summary="$(hb_translate "Compatibility check"): "
+    summary+="${pass} pass, ${info} info, ${warn} warn, ${fail} fail"
+
+    local tmpfile
+    tmpfile=$(mktemp)
+    {
+        printf '\n%s\n' "$summary"
+        printf '%s\n\n' "────────────────────────────────────────────────────────────"
+        printf '%s\n' "$report"
+    } > "$tmpfile"
+
+    local title
+    if (( fail > 0 )); then
+        title="$(hb_translate "Compatibility check — issues detected")"
+    elif (( warn > 0 )); then
+        title="$(hb_translate "Compatibility check — review warnings")"
+    else
+        title="$(hb_translate "Compatibility check — OK")"
+    fi
+
+    # Only nag the operator when there's something to read. An all-PASS
+    # report is pure noise on the path to a restore they already
+    # confirmed they want.
+    if (( warn > 0 || fail > 0 )); then
+        dialog --backtitle "ProxMenux" --title "$title" \
+            --textbox "$tmpfile" 22 86 || true
+    fi
+    rm -f "$tmpfile"
+
+    # FAIL means at least one check is a real risk for system integrity
+    # — force a second yes/no with default NO before letting the user
+    # press on.
+    if (( fail > 0 )); then
+        if ! whiptail --title "$(hb_translate "Continue despite failures?")" \
+            --defaultno \
+            --yesno "$(hb_translate "The compatibility check raised failures that may break the system after restore.")"$'\n\n'"$(hb_translate "Continue anyway?")" \
+            11 78; then
+            return 1
+        fi
+    fi
+    return 0
+}
+
+# ==========================================================
+# Archive sidecar — explicit ProxMenux backup marker.
+#
+# Drops a small JSON next to a completed archive so the Monitor
+# (and any future tooling) can identify it as a ProxMenux host
+# backup independently of the filename. The user can rename the
+# .tar.zst to whatever they want and the sidecar travels with it
+# as long as they keep the same basename pair.
+#
+# Usage:
+#   hb_write_archive_sidecar <archive_path> <kind> [job_id] [profile]
+#     kind:    "manual" or "scheduled"
+#     job_id:  scheduler job id (empty for manual)
+#     profile: "default", "custom", or empty
+# Fail-soft: returns 0 even if jq is missing and we have to fall
+# back to printf-built JSON; never aborts the surrounding backup.
+# ==========================================================
+# ==========================================================
+# PVE vzdump jobs — parsing and attach helpers
+#
+# When the operator already has a vzdump job scheduling backups of
+# their VMs/CTs to PBS or a local datastore, they can "attach" a
+# host-config backup to that same job. The host inherits the job's
+# schedule, target storage, and retention; the trigger is a vzdump
+# hook script that fires on `job-end`.
+# ==========================================================
+
+# Returns the type of a PVE storage as declared in /etc/pve/storage.cfg.
+# Empty if the storage doesn't exist. Common values: pbs, dir, nfs,
+# zfspool, lvmthin, cifs, btrfs.
+hb_pve_storage_type() {
+    local storage_id="$1"
+    [[ -z "$storage_id" || ! -f /etc/pve/storage.cfg ]] && return 1
+    awk -v sid="$storage_id" '
+        /^[a-z]+:[[:space:]]/ {
+            t=$1; sub(":","",t)
+            if ($2 == sid) { print t; exit }
+        }
+    ' /etc/pve/storage.cfg
+}
+
+# Lists every vzdump job in /etc/pve/jobs.cfg, one TSV row per job.
+# Columns: id <TAB> storage <TAB> storage_type <TAB> schedule
+#          <TAB> prune-backups <TAB> enabled
+# Empty cells are kept as "-" so the row keeps 6 columns even when
+# the job omits the field.
+hb_pve_list_vzdump_jobs() {
+    [[ -f /etc/pve/jobs.cfg ]] || return 0
+    awk '
+        function flush() {
+            if (id != "") {
+                printf "%s\t%s\t%s\t%s\t%s\t%s\n", \
+                    id, \
+                    (storage=="" ? "-" : storage), \
+                    "PLACEHOLDER_TYPE", \
+                    (schedule=="" ? "-" : schedule), \
+                    (prune=="" ? "-" : prune), \
+                    (enabled=="" ? "1" : enabled)
+            }
+            id=""; storage=""; schedule=""; prune=""; enabled=""
+        }
+        /^vzdump:/ { flush(); id=$2; next }
+        /^[a-z]+:/ { flush(); next }   # next block of a different type
+        /^[[:space:]]+schedule[[:space:]]/ { sub(/^[[:space:]]+schedule[[:space:]]+/, ""); schedule=$0; next }
+        /^[[:space:]]+storage[[:space:]]/  { sub(/^[[:space:]]+storage[[:space:]]+/,  ""); storage=$0;  next }
+        /^[[:space:]]+prune-backups[[:space:]]/ { sub(/^[[:space:]]+prune-backups[[:space:]]+/, ""); prune=$0; next }
+        /^[[:space:]]+enabled[[:space:]]/  { sub(/^[[:space:]]+enabled[[:space:]]+/,  ""); enabled=$0;  next }
+        END { flush() }
+    ' /etc/pve/jobs.cfg | while IFS=$'\t' read -r id storage type schedule prune enabled; do
+        type=$(hb_pve_storage_type "$storage")
+        [[ -z "$type" ]] && type="-"
+        printf '%s\t%s\t%s\t%s\t%s\t%s\n' "$id" "$storage" "$type" "$schedule" "$prune" "$enabled"
+    done
+}
+
+# Filters hb_pve_list_vzdump_jobs by a backend family.
+# Args: $1 = "pbs" or "local"
+#   pbs   → only storage_type == "pbs"
+#   local → only file/block storage we can write to as a local archive
+hb_pve_list_vzdump_jobs_for_backend() {
+    local backend="$1"
+    hb_pve_list_vzdump_jobs | while IFS=$'\t' read -r id storage type schedule prune enabled; do
+        case "$backend" in
+            pbs)
+                [[ "$type" == "pbs" ]] && printf '%s\t%s\t%s\t%s\t%s\t%s\n' \
+                    "$id" "$storage" "$type" "$schedule" "$prune" "$enabled"
+                ;;
+            local)
+                case "$type" in
+                    dir|nfs|cifs|zfspool|lvmthin|btrfs)
+                        printf '%s\t%s\t%s\t%s\t%s\t%s\n' \
+                            "$id" "$storage" "$type" "$schedule" "$prune" "$enabled"
+                        ;;
+                esac
+                ;;
+        esac
+    done
+}
+
+# Parses a `prune-backups` value (e.g. "keep-last=7,keep-daily=14")
+# and emits KEY=VAL pairs for sourcing into a scheduler job env file.
+# Maps proxmox' keep-last/hourly/daily/weekly/monthly/yearly to our
+# KEEP_LAST/HOURLY/DAILY/WEEKLY/MONTHLY/YEARLY.
+hb_pve_prune_to_keep_env() {
+    local prune="$1"
+    [[ -z "$prune" || "$prune" == "-" ]] && return 0
+    local kv k v upper
+    while IFS=',' read -ra kv; do
+        for k in "${kv[@]}"; do
+            v="${k#*=}"
+            k="${k%=*}"
+            case "$k" in
+                keep-last)    echo "KEEP_LAST=$v" ;;
+                keep-hourly)  echo "KEEP_HOURLY=$v" ;;
+                keep-daily)   echo "KEEP_DAILY=$v" ;;
+                keep-weekly)  echo "KEEP_WEEKLY=$v" ;;
+                keep-monthly) echo "KEEP_MONTHLY=$v" ;;
+                keep-yearly)  echo "KEEP_YEARLY=$v" ;;
+            esac
+        done
+    done <<<"$prune"
+}
+
+hb_install_vzdump_hook() {
+    local src="/usr/local/share/proxmenux/scripts/backup_restore/vzdump-hook.sh"
+    local dst="/etc/proxmenux/vzdump-hook.sh"
+    local chain="/etc/proxmenux/vzdump-hook-chain.sh"
+    local conf="/etc/vzdump.conf"
+
+    [[ -f "$src" ]] || return 1
+    mkdir -p /etc/proxmenux
+    install -m 0755 "$src" "$dst" || return 1
+
+    [[ -f "$conf" ]] || : >"$conf"
+
+    local current
+    current=$(awk -F'[[:space:]]*:[[:space:]]*' \
+        '/^[[:space:]]*script[[:space:]]*:/ { sub(/[#].*/,"",$2); gsub(/[[:space:]]/,"",$2); print $2; exit }' \
+        "$conf")
+
+    if [[ -z "$current" ]]; then
+        printf 'script: %s\n' "$dst" >>"$conf"
+        return 0
+    fi
+
+    [[ "$current" == "$dst" ]] && return 0
+
+    # Existing third-party hook — preserve it as a chain target.
+    if [[ -x "$current" && ! -e "$chain" ]]; then
+        cp -p "$current" "$chain"
+    fi
+    sed -i "s|^[[:space:]]*script[[:space:]]*:.*|script: ${dst}|" "$conf"
+}
+
+hb_write_archive_sidecar() {
+    local archive_path="$1"
+    local kind="${2:-}"
+    local job_id="${3:-}"
+    local profile="${4:-}"
+    [[ -z "$archive_path" || ! -f "$archive_path" ]] && return 1
+    local sidecar="${archive_path}.proxmenux.json"
+    local archive_basename hostname_val created_at archive_size
+    archive_basename=$(basename "$archive_path")
+    hostname_val=$(hostname 2>/dev/null || echo "unknown")
+    created_at=$(date -Iseconds 2>/dev/null || date '+%Y-%m-%dT%H:%M:%S%z')
+    archive_size=$(stat -c %s "$archive_path" 2>/dev/null || echo 0)
+
+    if command -v jq >/dev/null 2>&1; then
+        jq -n \
+            --arg kind "$kind" \
+            --arg job_id "$job_id" \
+            --arg profile "$profile" \
+            --arg hostname "$hostname_val" \
+            --arg archive "$archive_basename" \
+            --arg created_at "$created_at" \
+            --argjson size "$archive_size" \
+            '{
+                schema_version: 1,
+                kind: $kind,
+                job_id: (if $job_id == "" then null else $job_id end),
+                profile: (if $profile == "" then null else $profile end),
+                hostname: $hostname,
+                archive: $archive,
+                created_at: $created_at,
+                archive_size: $size
+            }' > "$sidecar" 2>/dev/null && return 0
+    fi
+
+    # Fallback: jq unavailable — emit JSON by hand. Fields are
+    # controlled by us (no untrusted strings besides hostname/path
+    # which we already constrain via shell context), so a small
+    # printf is safe enough.
+    {
+        printf '{\n'
+        printf '  "schema_version": 1,\n'
+        printf '  "kind": "%s",\n' "$kind"
+        if [[ -n "$job_id" ]]; then
+            printf '  "job_id": "%s",\n' "$job_id"
+        else
+            printf '  "job_id": null,\n'
+        fi
+        if [[ -n "$profile" ]]; then
+            printf '  "profile": "%s",\n' "$profile"
+        else
+            printf '  "profile": null,\n'
+        fi
+        printf '  "hostname": "%s",\n' "$hostname_val"
+        printf '  "archive": "%s",\n' "$archive_basename"
+        printf '  "created_at": "%s",\n' "$created_at"
+        printf '  "archive_size": %s\n' "$archive_size"
+        printf '}\n'
+    } > "$sidecar" 2>/dev/null
+    return 0
+}
diff --git a/scripts/backup_restore/mount_disk_host_bk.sh b/scripts/backup_restore/mount_disk_host_bk.sh
deleted file mode 100644
index d195c4e0..00000000
--- a/scripts/backup_restore/mount_disk_host_bk.sh
+++ /dev/null
@@ -1,433 +0,0 @@
-#!/bin/bash
-
-# ==========================================================
-# ProxMenu - Mount disk on Proxmox host for backups
-# ==========================================================
-# Author      : MacRimi
-# Copyright   : (c) 2024 MacRimi
-# License     : GPL-3.0
-# Version     : 1.3-dialog
-# Last Updated: 13/12/2024
-# ==========================================================
-
-LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
-BASE_DIR="/usr/local/share/proxmenux"
-UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
-
-if [[ -f "$UTILS_FILE" ]]; then
-    source "$UTILS_FILE"
-fi
-load_language
-initialize_cache
-
-
-mount_disk_host_bk() {
-
-
-
-get_disk_info() {
-    local disk=$1
-    MODEL=$(lsblk -dn -o MODEL "$disk" | xargs)
-    SIZE=$(lsblk -dn -o SIZE "$disk" | xargs)
-    echo "$MODEL" "$SIZE"
-}
-
-
-is_usb_disk() {
-    local disk=$1
-    local disk_name=$(basename "$disk")
-    
-
-    if readlink -f "/sys/block/$disk_name/device" 2>/dev/null | grep -q "usb"; then
-        return 0 
-    fi
-    
-
-    if udevadm info --query=property --name="$disk" 2>/dev/null | grep -q "ID_BUS=usb"; then
-        return 0  
-    fi
-    
-    return 1
-}
-
-
-is_system_disk() {
-    local disk=$1
-    local disk_name=$(basename "$disk")
-    
-
-    local system_mounts=$(df -h | grep -E '^\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+(/|/boot|/usr|/var|/home)$' | awk '{print $1}')
-    
-
-    for mount_dev in $system_mounts; do
-   
-        local mount_disk=""
-        if [[ "$mount_dev" =~ ^/dev/mapper/ ]]; then
-     
-            local vg_name=$(lvs --noheadings -o vg_name "$mount_dev" 2>/dev/null | xargs)
-            if [[ -n "$vg_name" ]]; then
-                local pvs_list=$(pvs --noheadings -o pv_name -S vg_name="$vg_name" 2>/dev/null | xargs)
-                for pv in $pvs_list; do
-                    if [[ -n "$pv" && -e "$pv" ]]; then
-                        mount_disk=$(lsblk -no PKNAME "$pv" 2>/dev/null)
-                        if [[ -n "$mount_disk" && "/dev/$mount_disk" == "$disk" ]]; then
-                            return 0  
-                        fi
-                    fi
-                done
-            fi
-        elif [[ "$mount_dev" =~ ^/dev/[hsv]d[a-z][0-9]* || "$mount_dev" =~ ^/dev/nvme[0-9]+n[0-9]+p[0-9]+ ]]; then
-      
-            mount_disk=$(lsblk -no PKNAME "$mount_dev" 2>/dev/null)
-            if [[ -n "$mount_disk" && "/dev/$mount_disk" == "$disk" ]]; then
-                return 0  
-            fi
-        fi
-    done
-    
-
-    local fs_type=$(lsblk -no FSTYPE "$disk" 2>/dev/null | head -1)
-    if [[ "$fs_type" == "btrfs" ]]; then
-
-        local temp_mount=$(mktemp -d)
-        if mount -o ro "$disk" "$temp_mount" 2>/dev/null; then
-   
-            if btrfs subvolume list "$temp_mount" 2>/dev/null | grep -qE '(@|@home|@var|@boot|@root|root)'; then
-                umount "$temp_mount" 2>/dev/null
-                rmdir "$temp_mount" 2>/dev/null
-                return 0  
-            fi
-            umount "$temp_mount" 2>/dev/null
-        fi
-        rmdir "$temp_mount" 2>/dev/null
-        
-
-        while read -r part; do
-            if [[ -n "$part" ]]; then
-                local part_fs=$(lsblk -no FSTYPE "/dev/$part" 2>/dev/null)
-                if [[ "$part_fs" == "btrfs" ]]; then
-                    local mount_point=$(lsblk -no MOUNTPOINT "/dev/$part" 2>/dev/null)
-                    if [[ "$mount_point" == "/" || "$mount_point" == "/boot" || "$mount_point" == "/home" || "$mount_point" == "/var" ]]; then
-                        return 0  
-                    fi
-                fi
-            fi
-        done < <(lsblk -ln -o NAME "$disk" | tail -n +2)
-    fi
-    
-
-    local disk_uuid=$(blkid -s UUID -o value "$disk" 2>/dev/null)
-    local part_uuids=()
-    while read -r part; do
-        if [[ -n "$part" ]]; then
-            local uuid=$(blkid -s UUID -o value "/dev/$part" 2>/dev/null)
-            if [[ -n "$uuid" ]]; then
-                part_uuids+=("$uuid")
-            fi
-        fi
-    done < <(lsblk -ln -o NAME "$disk" | tail -n +2)
-    
- 
-    for uuid in "${part_uuids[@]}" "$disk_uuid"; do
-        if [[ -n "$uuid" ]] && grep -q "UUID=$uuid" /etc/fstab; then
-            local mount_point=$(grep "UUID=$uuid" /etc/fstab | awk '{print $2}')
-            if [[ "$mount_point" == "/" || "$mount_point" == "/boot" || "$mount_point" == "/home" || "$mount_point" == "/var" ]]; then
-                return 0  
-            fi
-        fi
-    done
-    
-
-    if grep -q "$disk" /etc/fstab; then
-        local mount_point=$(grep "$disk" /etc/fstab | awk '{print $2}')
-        if [[ "$mount_point" == "/" || "$mount_point" == "/boot" || "$mount_point" == "/home" || "$mount_point" == "/var" ]]; then
-            return 0 
-        fi
-    fi
-    
-
-    local disk_count=$(lsblk -dn -e 7,11 -o PATH | wc -l)
-    if [[ "$disk_count" -eq 1 ]]; then
-        return 0 
-    fi
-    
-    return 1 
-}
-
-
-USED_DISKS=$(lsblk -n -o PKNAME,TYPE | grep 'lvm' | awk '{print "/dev/" $1}')
-MOUNTED_DISKS=$(lsblk -ln -o NAME,MOUNTPOINT | awk '$2!="" {print "/dev/" $1}')
-
-ZFS_DISKS=""
-ZFS_RAW=$(zpool list -v -H 2>/dev/null | awk '{print $1}' | grep -v '^NAME$' | grep -v '^-' | grep -v '^mirror')
-
-for entry in $ZFS_RAW; do
-    path=""
-    if [[ "$entry" == wwn-* || "$entry" == ata-* ]]; then
-        if [ -e "/dev/disk/by-id/$entry" ]; then
-            path=$(readlink -f "/dev/disk/by-id/$entry")
-        fi
-    elif [[ "$entry" == /dev/* ]]; then
-        path="$entry"
-    fi
-
-    if [ -n "$path" ]; then
-        base_disk=$(lsblk -no PKNAME "$path" 2>/dev/null)
-        if [ -n "$base_disk" ]; then
-            ZFS_DISKS+="/dev/$base_disk"$'\n'
-        fi
-    fi
-done
-
-ZFS_DISKS=$(echo "$ZFS_DISKS" | sort -u)
-
-LVM_DEVICES=$(
-    pvs --noheadings -o pv_name 2> >(grep -v 'File descriptor .* leaked') |
-    while read -r dev; do
-        [[ -n "$dev" && -e "$dev" ]] && readlink -f "$dev"
-    done | sort -u
-)
-
-FREE_DISKS=()
-
-while read -r DISK; do
-    [[ "$DISK" =~ /dev/zd ]] && continue
-
-    INFO=($(get_disk_info "$DISK"))
-    MODEL="${INFO[@]::${#INFO[@]}-1}"
-    SIZE="${INFO[-1]}"
-    LABEL=""
-    SHOW_DISK=true
-
-    IS_MOUNTED=false
-    IS_RAID=false
-    IS_ZFS=false
-    IS_LVM=false
-    IS_SYSTEM=false
-    IS_USB=false
-
- 
-    if is_system_disk "$DISK"; then
-        IS_SYSTEM=true
-    fi
-
-  
-    if is_usb_disk "$DISK"; then
-        IS_USB=true
-    fi
-
-    while read -r part fstype; do
-        [[ "$fstype" == "zfs_member" ]] && IS_ZFS=true
-        [[ "$fstype" == "linux_raid_member" ]] && IS_RAID=true
-        [[ "$fstype" == "LVM2_member" ]] && IS_LVM=true
-        if grep -q "/dev/$part" <<< "$MOUNTED_DISKS"; then
-            IS_MOUNTED=true
-        fi
-    done < <(lsblk -ln -o NAME,FSTYPE "$DISK" | tail -n +2)
-
-    REAL_PATH=""
-    if [[ -n "$DISK" && -e "$DISK" ]]; then
-        REAL_PATH=$(readlink -f "$DISK")
-    fi
-    if [[ -n "$REAL_PATH" ]] && echo "$LVM_DEVICES" | grep -qFx "$REAL_PATH"; then
-        IS_MOUNTED=true
-    fi
-
-    USED_BY=""
-    REAL_PATH=""
-    if [[ -n "$DISK" && -e "$DISK" ]]; then
-        REAL_PATH=$(readlink -f "$DISK")
-    fi
-    CONFIG_DATA=$(grep -vE '^\s*#' /etc/pve/qemu-server/*.conf /etc/pve/lxc/*.conf 2>/dev/null)
-
-    if grep -Fq "$REAL_PATH" <<< "$CONFIG_DATA"; then
-        USED_BY="⚠ $(translate "In use")"
-    else
-        for SYMLINK in /dev/disk/by-id/*; do
-            [[ -e "$SYMLINK" ]] || continue
-            if [[ "$(readlink -f "$SYMLINK")" == "$REAL_PATH" ]]; then
-                if grep -Fq "$SYMLINK" <<< "$CONFIG_DATA"; then
-                    USED_BY="⚠ $(translate "In use")"
-                    break
-                fi
-            fi
-        done
-    fi
-
-    if $IS_RAID && grep -q "$DISK" <<< "$(cat /proc/mdstat)"; then
-        if grep -q "active raid" /proc/mdstat; then
-            SHOW_DISK=false
-        fi
-    fi
-    if $IS_ZFS; then SHOW_DISK=false; fi
-    if $IS_MOUNTED; then SHOW_DISK=false; fi
-    if $IS_SYSTEM; then SHOW_DISK=false; fi  
-
-    if $SHOW_DISK; then
-        [[ -n "$USED_BY" ]] && LABEL+=" [$USED_BY]"
-        [[ "$IS_RAID" == true ]] && LABEL+=" ⚠ RAID"
-        [[ "$IS_LVM" == true ]] && LABEL+=" ⚠ LVM"
-        [[ "$IS_ZFS" == true ]] && LABEL+=" ⚠ ZFS"
-        
-        
-        if $IS_USB; then
-            LABEL+="  USB"
-        else
-            LABEL+="  $(translate "Internal")"
-        fi
-        
-        DESCRIPTION=$(printf "%-30s %10s%s" "$MODEL" "$SIZE" "$LABEL")
-        FREE_DISKS+=("$DISK" "$DESCRIPTION" "off")
-    fi
-done < <(lsblk -dn -e 7,11 -o PATH)
-
-if [ "${#FREE_DISKS[@]}" -eq 0 ]; then
-    dialog --title "$(translate "Error")" --msgbox "$(translate "No available disks found on the host.")" 8 60
-    
-    exit 1
-fi
-
-
-# Building the array for dialog (format: tag item on/off tag item on/off...)
-DLG_LIST=()
-for ((i=0; i<${#FREE_DISKS[@]}; i+=3)); do
-    DLG_LIST+=("${FREE_DISKS[i]}" "${FREE_DISKS[i+1]}" "${FREE_DISKS[i+2]}")
-done
-
-SELECTED=$(dialog --clear --backtitle "ProxMenux" --title "$(translate "Select Disk")" \
-    --radiolist "\n$(translate "Select the disk you want to mount on the host:")" 20 90 10 \
-    "${DLG_LIST[@]}" 2>&1 >/dev/tty)
-
-if [ -z "$SELECTED" ]; then
-    dialog --title "$(translate "Error")" --msgbox "$(translate "No disk was selected.")" 8 50
-    
-    exit 1
-fi
-
-
-# ------------------- Partitions and formatting ------------------------
-
-PARTITION=$(lsblk -rno NAME "$SELECTED" | awk -v disk="$(basename "$SELECTED")" '$1 != disk {print $1; exit}')
-SKIP_FORMAT=false
-DEFAULT_MOUNT="/mnt/backup"
-
-if [ -n "$PARTITION" ]; then
-    PARTITION="/dev/$PARTITION"
-    CURRENT_FS=$(lsblk -no FSTYPE "$PARTITION" | xargs)
-    if [[ "$CURRENT_FS" == "ext4" || "$CURRENT_FS" == "xfs" || "$CURRENT_FS" == "btrfs" ]]; then
-        SKIP_FORMAT=true
-      
-    else
-        dialog --title "$(translate "Unsupported Filesystem")" --yesno \
-        "$(translate "The partition") $PARTITION $(translate "has an unsupported filesystem ($CURRENT_FS).\nDo you want to format it?")" 10 70
-        if [ $? -ne 0 ]; then exit 0; fi
-    fi
-else
-    CURRENT_FS=$(lsblk -no FSTYPE "$SELECTED" | xargs)
-    if [[ "$CURRENT_FS" == "ext4" || "$CURRENT_FS" == "xfs" || "$CURRENT_FS" == "btrfs" ]]; then
-        SKIP_FORMAT=true
-        PARTITION="$SELECTED"
-
-    else
-        dialog --title "$(translate "No Valid Partitions")" --yesno \
-        "$(translate "The disk has no partitions and no valid filesystem. Do you want to create a new partition and format it?")" 10 70
-        if [ $? -ne 0 ]; then exit 0; fi
-
-        echo -e "$(translate "Creating partition table and partition...")"
-        parted -s "$SELECTED" mklabel gpt
-        parted -s "$SELECTED" mkpart primary 0% 100%
-        sleep 2
-        partprobe "$SELECTED"
-        sleep 2
-
-        PARTITION=$(lsblk -rno NAME "$SELECTED" | awk -v disk="$(basename "$SELECTED")" '$1 != disk {print $1; exit}')
-        if [ -n "$PARTITION" ]; then
-            PARTITION="/dev/$PARTITION"
-        else
-            dialog --title "$(translate "Partition Error")" --msgbox \
-            "$(translate "Failed to create partition on disk") $SELECTED." 8 70
-            exit 1
-        fi
-    fi
-fi
-
-if [ "$SKIP_FORMAT" != true ]; then
-    FORMAT_TYPE=$(dialog --title "$(translate "Select Format Type")" --menu \
-        "$(translate "Select the filesystem type for") $PARTITION:" 15 60 5 \
-        "ext4" "$(translate "Extended Filesystem 4 (recommended)")" \
-        "xfs" "XFS" \
-        "btrfs" "Btrfs" 2>&1 >/dev/tty)
-    if [ -z "$FORMAT_TYPE" ]; then
-        dialog --title "$(translate "Format Cancelled")" --msgbox \
-        "$(translate "Format operation cancelled. The disk will not be added.")" 8 60
-        exit 0
-    fi
-
-    dialog --title "$(translate "WARNING")" --yesno \
-    "$(translate "WARNING: This operation will FORMAT the disk") $PARTITION $(translate "with") $FORMAT_TYPE.\n\n$(translate "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!")\n\n$(translate "Are you sure you want to continue")" 15 70
-    if [ $? -ne 0 ]; then exit 0; fi
-
-    echo -e "$(translate "Formatting partition") $PARTITION $(translate "with") $FORMAT_TYPE..."
-    case "$FORMAT_TYPE" in
-        "ext4") mkfs.ext4 -F "$PARTITION" ;;
-        "xfs") mkfs.xfs -f "$PARTITION" ;;
-        "btrfs") mkfs.btrfs -f "$PARTITION" ;;
-    esac
-
-    if [ $? -ne 0 ]; then
-        cleanup
-        dialog --title "$(translate "Format Failed")" --msgbox \
-        "$(translate "Failed to format partition") $PARTITION $(translate "with") $FORMAT_TYPE." 12 70
-        exit 1
-    else
-  
-        partprobe "$SELECTED"
-        sleep 2
-    fi
-fi
-
-
-# ------------------- Mount point and permissions (modular, non-blocking) -------------------
-
-
-
-    MOUNT_POINT=$(dialog --clear --title "$(translate "Mount Point")" \
-        --inputbox "$(translate "Enter the mount point for the disk (e.g., /mnt/backup):")" \
-        10 60 "$DEFAULT_MOUNT" 2>&1 >/dev/tty)
-
-    if [ -z "$MOUNT_POINT" ]; then
-        >&2 echo "$(translate "No mount point was specified.")"
-        return 1
-    fi
-
-    mkdir -p "$MOUNT_POINT"
-
-    UUID=$(blkid -s UUID -o value "$PARTITION")
-    FS_TYPE=$(lsblk -no FSTYPE "$PARTITION" | xargs)
-    FSTAB_ENTRY="UUID=$UUID $MOUNT_POINT $FS_TYPE defaults 0 0"
-
-    if grep -q "UUID=$UUID" /etc/fstab; then
-        sed -i "s|^.*UUID=$UUID.*|$FSTAB_ENTRY|" /etc/fstab
-    else
-        echo "$FSTAB_ENTRY" >> /etc/fstab
-    fi
-
-    mount "$MOUNT_POINT" 2> >(grep -v "systemd still uses")
-    if [ $? -eq 0 ]; then
-        if ! getent group sharedfiles >/dev/null; then
-            groupadd sharedfiles
-        fi
-
-        chown root:sharedfiles "$MOUNT_POINT"
-        chmod 2775 "$MOUNT_POINT"
-        echo "$MOUNT_POINT" > /usr/local/share/proxmenux/last_backup_mount.txt
-
-        MOUNT_POINT=$(echo "$MOUNT_POINT" | head -n1 | tr -d '\r\n\t ')
-        echo "$MOUNT_POINT"
-    else
-        >&2 echo "$(translate "Failed to mount the disk at") $MOUNT_POINT"
-        return 1
-    fi
-
-}
diff --git a/scripts/backup_restore/restore/compute_rollback_plan.sh b/scripts/backup_restore/restore/compute_rollback_plan.sh
new file mode 100755
index 00000000..598bde5e
--- /dev/null
+++ b/scripts/backup_restore/restore/compute_rollback_plan.sh
@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux — compute rollback plan (read-only)
+# ==========================================================
+# Compares a staged restore vs the current host state and emits
+# a JSON document describing what a "rollback to backup state"
+# would do:
+#
+#   {
+#     "backup_time": "...",
+#     "vms_in_backup":    [100, 101],
+#     "vms_in_host":      [100, 101, 105],
+#     "vms_to_remove":    [105],            // exist now, not in backup
+#     "vms_to_restore":   [100, 101],       // present in both → reapplied
+#     "lxcs_in_backup":   [201],
+#     "lxcs_in_host":     [201, 202],
+#     "lxcs_to_remove":   [202],
+#     "lxcs_to_restore":  [201],
+#     "components_to_uninstall": ["coral_driver"],   // installed now, missing in backup
+#     "components_to_reinstall":  ["nvidia_driver"]  // installed in backup
+#   }
+#
+# No side effects whatsoever — pure inspection. The actual
+# rollback is applied later by apply_cluster_postboot.sh after
+# the operator confirms in the UI.
+#
+# Usage:
+#   compute_rollback_plan.sh <staging-directory>
+#
+# The staging directory must already be the post-extract layout
+# (rootfs/ + metadata/) — list_paths.sh's normalization should
+# have run first.
+# ==========================================================
+set -e
+
+STAGING="${1:-}"
+if [[ -z "$STAGING" || ! -d "$STAGING" ]]; then
+  printf 'compute_rollback_plan: usage: %s <staging-directory>\n' "$0" >&2
+  exit 64
+fi
+
+# ── Discover guest configs (VMs + LXCs) on both sides ──
+# /etc/pve/nodes/<node>/qemu-server/<id>.conf for VMs
+# /etc/pve/nodes/<node>/lxc/<id>.conf for LXCs
+# We collect just the numeric IDs; the rollback only needs to
+# know "exists in A, exists in B" — actual config rewrite is
+# done by the standard restore path for /etc/pve.
+
+_collect_ids() {
+  # $1 = root directory, $2 = subdir under /etc/pve/nodes/<n>/
+  local root="$1" sub="$2"
+  if [[ -d "$root/etc/pve/nodes" ]]; then
+    find "$root/etc/pve/nodes" -mindepth 3 -maxdepth 3 -path "*/$sub/*.conf" -print 2>/dev/null \
+      | sed -E "s|.*/([0-9]+)\\.conf$|\\1|" | sort -un
+  fi
+}
+
+mapfile -t vms_backup    < <(_collect_ids "$STAGING/rootfs" qemu-server)
+mapfile -t vms_host      < <(_collect_ids "/" qemu-server)
+mapfile -t lxcs_backup   < <(_collect_ids "$STAGING/rootfs" lxc)
+mapfile -t lxcs_host     < <(_collect_ids "/" lxc)
+
+_diff() {
+  # Echoes lines from A that are NOT in B.
+  local -n a_ref=$1
+  local -n b_ref=$2
+  local x y found
+  for x in "${a_ref[@]}"; do
+    found=0
+    for y in "${b_ref[@]}"; do
+      [[ "$x" == "$y" ]] && { found=1; break; }
+    done
+    (( found == 0 )) && echo "$x"
+  done
+}
+
+mapfile -t vms_to_remove  < <(_diff vms_host vms_backup)
+mapfile -t vms_to_restore < <(_diff vms_backup vms_host || true; for x in "${vms_backup[@]}"; do for y in "${vms_host[@]}"; do [[ "$x" == "$y" ]] && echo "$x"; done; done | sort -un)
+mapfile -t vms_to_restore < <(printf '%s\n' "${vms_backup[@]}")
+mapfile -t lxcs_to_remove  < <(_diff lxcs_host lxcs_backup)
+mapfile -t lxcs_to_restore < <(printf '%s\n' "${lxcs_backup[@]}")
+
+# ── Components: parse JSON on both sides, list deltas ──
+backup_components_file="$STAGING/rootfs/usr/local/share/proxmenux/components_status.json"
+host_components_file="/usr/local/share/proxmenux/components_status.json"
+
+_installed_keys() {
+  # Echoes one component key per line for `status == "installed"`.
+  local f="$1"
+  [[ ! -f "$f" ]] && return 0
+  command -v jq >/dev/null 2>&1 || { return 0; }
+  jq -r 'to_entries[] | select(.value.status == "installed") | .key' "$f" 2>/dev/null | sort -u
+}
+
+mapfile -t comps_backup < <(_installed_keys "$backup_components_file")
+mapfile -t comps_host   < <(_installed_keys "$host_components_file")
+mapfile -t comps_to_uninstall < <(_diff comps_host comps_backup)
+mapfile -t comps_to_reinstall < <(printf '%s\n' "${comps_backup[@]}")
+
+# ── Backup timestamp from metadata for the UI ──
+backup_time=""
+if [[ -f "$STAGING/metadata/run_info.env" ]]; then
+  backup_time=$(grep -m1 '^generated_at=' "$STAGING/metadata/run_info.env" 2>/dev/null \
+    | cut -d= -f2-)
+fi
+
+# ── Emit JSON. Pure printf — no jq required for the writer ──
+_json_arr_int() {
+  printf '['
+  local first=1 v
+  for v in "$@"; do
+    [[ -z "$v" ]] && continue
+    if (( first )); then printf '%s' "$v"; first=0
+    else                 printf ',%s' "$v"
+    fi
+  done
+  printf ']'
+}
+_json_arr_str() {
+  printf '['
+  local first=1 v esc
+  for v in "$@"; do
+    [[ -z "$v" ]] && continue
+    esc="${v//\\/\\\\}"; esc="${esc//\"/\\\"}"
+    if (( first )); then printf '"%s"' "$esc"; first=0
+    else                 printf ',"%s"' "$esc"
+    fi
+  done
+  printf ']'
+}
+
+printf '{'
+printf '"backup_time":"%s"'                    "${backup_time//\"/\\\"}"
+printf ',"vms_in_backup":';      _json_arr_int "${vms_backup[@]}"
+printf ',"vms_in_host":';        _json_arr_int "${vms_host[@]}"
+printf ',"vms_to_remove":';      _json_arr_int "${vms_to_remove[@]}"
+printf ',"vms_to_restore":';     _json_arr_int "${vms_to_restore[@]}"
+printf ',"lxcs_in_backup":';     _json_arr_int "${lxcs_backup[@]}"
+printf ',"lxcs_in_host":';       _json_arr_int "${lxcs_host[@]}"
+printf ',"lxcs_to_remove":';     _json_arr_int "${lxcs_to_remove[@]}"
+printf ',"lxcs_to_restore":';    _json_arr_int "${lxcs_to_restore[@]}"
+printf ',"components_to_uninstall":'; _json_arr_str "${comps_to_uninstall[@]}"
+printf ',"components_to_reinstall":'; _json_arr_str "${comps_to_reinstall[@]}"
+printf '}\n'
diff --git a/scripts/backup_restore/restore/list_paths.sh b/scripts/backup_restore/restore/list_paths.sh
new file mode 100755
index 00000000..18bf893e
--- /dev/null
+++ b/scripts/backup_restore/restore/list_paths.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux — list backup paths actually present in staging
+# ==========================================================
+# Reads <staging>/metadata/selected_paths.txt (the canonical
+# record of WHICH paths went into this backup) and emits a JSON
+# array of those that still exist under <staging>/rootfs/.
+#
+# This replaces the 13-component grouping used previously: the
+# Custom restore checklist now shows one entry per real path
+# (default profile + any operator-added extras), so what you
+# backed up is exactly what you can restore.
+#
+# Usage:
+#   list_paths.sh <staging-directory>
+#
+# Output: JSON array of paths with a leading slash, e.g.:
+#   ["/etc/pve","/etc/network","/opt/mistuff"]
+# ==========================================================
+set -e
+
+STAGING="${1:-}"
+if [[ -z "$STAGING" || ! -d "$STAGING" ]]; then
+  printf 'list_paths: usage: %s <staging-directory>\n' "$0" >&2
+  exit 64
+fi
+
+SELECTED="$STAGING/metadata/selected_paths.txt"
+ROOTFS="$STAGING/rootfs"
+
+paths=()
+if [[ -f "$SELECTED" ]]; then
+  # The file stores paths without the leading slash (etc/pve,
+  # var/lib/pve-cluster, ...). Filter to only those that are
+  # actually present in the staged rootfs/ — anything in
+  # missing_paths.txt at backup time would otherwise show up
+  # here even though there's nothing to restore.
+  while IFS= read -r rel; do
+    [[ -z "$rel" ]] && continue
+    rel="${rel#/}"
+    if [[ -e "$ROOTFS/$rel" ]]; then
+      paths+=("/$rel")
+    fi
+  done < "$SELECTED"
+else
+  # No selected_paths.txt sidecar — backup might be from a
+  # pre-metadata era. Walk rootfs/ at depth 1-2 and use those
+  # as the path list. Best-effort fallback.
+  while IFS= read -r entry; do
+    [[ -z "$entry" ]] && continue
+    paths+=("/${entry#./}")
+  done < <(cd "$ROOTFS" 2>/dev/null && find . -mindepth 1 -maxdepth 2 -print 2>/dev/null | sed 's|^\./||')
+fi
+
+# Emit JSON array — keep it dependency-free (no jq).
+printf '['
+first=1
+for p in "${paths[@]}"; do
+  esc="${p//\\/\\\\}"
+  esc="${esc//\"/\\\"}"
+  if (( first )); then
+    printf '"%s"' "$esc"
+    first=0
+  else
+    printf ',"%s"' "$esc"
+  fi
+done
+printf ']\n'
diff --git a/scripts/backup_restore/restore/monitor_apply.sh b/scripts/backup_restore/restore/monitor_apply.sh
new file mode 100755
index 00000000..4bb71c2d
--- /dev/null
+++ b/scripts/backup_restore/restore/monitor_apply.sh
@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux Monitor restore wrapper
+# ==========================================================
+# Bridges the Monitor's "Restore" button to the TUI restore
+# functions in backup_host.sh. The Monitor takes care of the
+# extraction (snapshot → staging directory + manifest), then
+# launches this script in a ScriptTerminalModal so the operator
+# sees the same dialog flow used by the shell TUI.
+#
+# The Monitor's script_runner only forwards env vars (no argv).
+# Inputs (env):
+#   STAGING — absolute path to the prepared staging dir
+#   MODE    — "full" or "custom"
+#   PATHS   — CSV of absolute backup paths, only when MODE=custom
+#             (e.g. "/etc/pve,/etc/network,/opt/mistuff").
+#             Each must be present in <staging>/metadata/selected_paths.txt
+#             or the wrapper drops it. Omit to let the TUI checklist
+#             pop up so the operator can pick interactively.
+#   ROLLBACK_EXECUTE — "1" to ask _rs_prepare_pending_restore to
+#             run the destructive rollback (qm/pct destroy --purge)
+#             on guests created after the backup. The frontend only
+#             sets this after the operator ticks the "I understand…"
+#             checkbox in the Complete restore confirm dialog. Has
+#             no effect when MODE=custom.
+# ==========================================================
+# Note: NO `set -e` here. backup_host.sh + its sourced utils/lib
+# emit a few non-zero exit codes during load (locale checks,
+# optional commands missing, etc.) — under set -e those abort the
+# wrapper silently and the operator only sees "Connection closed"
+# in the Monitor terminal with no clue why. We rely on explicit
+# error handling inside _rs_run_complete_guided / _rs_run_custom_restore.
+
+STAGING="${STAGING:-}"
+MODE="${MODE:-full}"
+PATHS="${PATHS:-}"
+ROLLBACK_EXECUTE="${ROLLBACK_EXECUTE:-0}"
+
+# Also accept --staging / --mode / --paths / --rollback-execute
+# positional args for direct CLI use outside the Monitor.
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --staging)          shift; STAGING="${1:-}" ;;
+    --mode)             shift; MODE="${1:-full}" ;;
+    --paths)            shift; PATHS="${1:-}" ;;
+    --rollback-execute) ROLLBACK_EXECUTE=1 ;;
+    *) ;;
+  esac
+  shift
+done
+
+if [[ -z "$STAGING" || ! -d "$STAGING" ]]; then
+  printf 'monitor_apply: STAGING missing or not a directory (%s)\n' "$STAGING" >&2
+  exit 64
+fi
+
+HB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+# Source the library + the TUI. backup_host.sh carries a guard so
+# sourcing it does NOT spawn the main menu — only the functions
+# (_rs_check_layout, _rs_run_complete_guided, _rs_run_custom_restore,
+# _rs_apply, ...) get loaded.
+# shellcheck source=/dev/null
+. "$HB_DIR/lib_host_backup_common.sh"
+# shellcheck source=/dev/null
+. "$HB_DIR/backup_host.sh"
+
+# Normalize the staging layout to the canonical rootfs/+metadata/
+# shape. The Monitor's Python extract path already does this, but
+# rerunning here keeps the wrapper safe when invoked directly.
+if ! _rs_check_layout "$STAGING"; then
+  printf 'monitor_apply: archive layout not recognized in %s\n' "$STAGING" >&2
+  exit 65
+fi
+
+# Tell the apply helpers that we're running under the Monitor.
+# Two effects:
+#  • _rs_apply skips its final `systemctl daemon-reload` so the
+#    Monitor service unit isn't marked "needs restart" and the
+#    WebSocket survives the apply (the restored unit file IS
+#    written to disk — it'll take effect at the next reboot).
+#  • _rs_run_complete_guided / _rs_run_custom_restore skip the
+#    second "Reboot now?" dialog and instead emit one final
+#    "Restore prepared — reboot when ready" line. The operator
+#    closes the modal in the web UI and reboots from the host
+#    panel; no need for two consecutive yes/no prompts.
+export HB_MONITOR_FLOW=1
+
+# Propagate the destructive-rollback opt-in to _rs_prepare_pending_restore.
+# Only honored for MODE=full — custom restores never trigger guest destroy.
+if [[ "$MODE" == "full" && "$ROLLBACK_EXECUTE" == "1" ]]; then
+  export HB_ROLLBACK_EXECUTE=1
+fi
+
+case "$MODE" in
+  full)
+    # The TUI path runs `_rs_collect_plan_stats` before calling
+    # `_rs_run_complete_guided`. We were skipping it here and that's
+    # why the confirm dialog showed "0 rutas seguras ahora /
+    # 0 rutas para el próximo arranque" when launched from the Monitor.
+    _rs_collect_plan_stats "$STAGING"
+    _rs_run_complete_guided "$STAGING"
+    ;;
+  custom)
+    if [[ -n "$PATHS" ]]; then
+      HB_PRESELECTED_PATHS="$PATHS" _rs_run_custom_restore "$STAGING"
+    else
+      _rs_run_custom_restore "$STAGING"
+    fi
+    ;;
+  *)
+    printf 'monitor_apply: unknown MODE %s (expected: full | custom)\n' "$MODE" >&2
+    exit 66
+    ;;
+esac
+
+# Clean exit. _rs_finish_flow under HB_MONITOR_FLOW already returns
+# without waiting for Enter, so falling off the end here closes the
+# PTY → the WS closes → the modal sees `isComplete=true` (script_runner
+# sends "[Script exited with code 0]" on normal termination) so the
+# ScriptTerminalModal won't try to auto-reconnect.
diff --git a/scripts/backup_restore/restore/parse_manifest.sh b/scripts/backup_restore/restore/parse_manifest.sh
new file mode 100755
index 00000000..3b75c79b
--- /dev/null
+++ b/scripts/backup_restore/restore/parse_manifest.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup restore — manifest reader
+# ==========================================================
+# Reads the JSON manifest from a ProxMenux host backup. Supports:
+#   - A loose manifest.json file path
+#   - A backup archive (.tar.gz / .tar.zst / .tar)
+#   - A pre-extracted backup directory
+#
+# Emits the manifest's `proxmenux_backup_manifest` sub-object as
+# JSON to stdout (i.e. unwraps the top-level key) so downstream
+# scripts can use `jq '.source_host'` directly. Exit 0 on success,
+# non-zero with a message on stderr if the manifest can't be found.
+#
+# Usage:
+#   parse_manifest.sh <archive-or-dir-or-manifest> [--with-wrapper]
+#
+# --with-wrapper keeps the outer { proxmenux_backup_manifest: { ... } }
+#                wrap (useful when piping to jsonschema validation).
+# ==========================================================
+set -euo pipefail
+
+SOURCE="${1:-}"
+KEEP_WRAPPER=0
+shift || true
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --with-wrapper) KEEP_WRAPPER=1 ;;
+  esac
+  shift
+done
+
+if [[ -z "$SOURCE" ]]; then
+  printf 'parse_manifest: missing source path\n' >&2
+  exit 64
+fi
+
+# Locate the manifest. Three input shapes:
+manifest_json=""
+case "$SOURCE" in
+  *.tar.gz|*.tgz|*.tar.zst|*.tar)
+    # Archive — extract just the manifest entry to stdout. We tolerate
+    # the manifest sitting at the root OR under any meta/ subdirectory.
+    extractor=()
+    case "$SOURCE" in
+      *.tar.zst) extractor=(zstd -d --long=27 -c "$SOURCE") ;;
+      *.tar.gz|*.tgz) extractor=(gzip -dc "$SOURCE") ;;
+      *.tar) extractor=(cat "$SOURCE") ;;
+    esac
+    # Use --wildcards so the manifest is found at any depth. We extract
+    # to stdout and stop at the first match.
+    if ! manifest_json="$("${extractor[@]}" | tar -xO --wildcards '*manifest.json' 2>/dev/null | head -c 4194304)"; then
+      printf 'parse_manifest: no manifest.json found inside %s\n' "$SOURCE" >&2
+      exit 65
+    fi
+    ;;
+  *)
+    if [[ -f "$SOURCE" ]]; then
+      manifest_json="$(cat "$SOURCE")"
+    elif [[ -d "$SOURCE" ]]; then
+      # Pre-extracted directory — try common paths first, then a search.
+      for candidate in "$SOURCE/manifest.json" "$SOURCE/meta/manifest.json"; do
+        if [[ -f "$candidate" ]]; then
+          manifest_json="$(cat "$candidate")"; break
+        fi
+      done
+      if [[ -z "$manifest_json" ]]; then
+        found="$(find "$SOURCE" -maxdepth 3 -name 'manifest.json' -print -quit 2>/dev/null || true)"
+        [[ -n "$found" ]] && manifest_json="$(cat "$found")"
+      fi
+      if [[ -z "$manifest_json" ]]; then
+        printf 'parse_manifest: no manifest.json under %s\n' "$SOURCE" >&2
+        exit 65
+      fi
+    else
+      printf 'parse_manifest: %s is neither archive, dir, nor file\n' "$SOURCE" >&2
+      exit 66
+    fi
+    ;;
+esac
+
+# Verify it's at least valid JSON before unwrapping.
+if ! printf '%s' "$manifest_json" | jq -e 'type == "object"' >/dev/null 2>&1; then
+  printf 'parse_manifest: contents are not a JSON object\n' >&2
+  exit 67
+fi
+
+# Check the wrapper key is present.
+if ! printf '%s' "$manifest_json" | jq -e '.proxmenux_backup_manifest' >/dev/null 2>&1; then
+  printf 'parse_manifest: missing proxmenux_backup_manifest key (not a ProxMenux manifest?)\n' >&2
+  exit 68
+fi
+
+if [[ "$KEEP_WRAPPER" == 1 ]]; then
+  printf '%s' "$manifest_json"
+else
+  printf '%s' "$manifest_json" | jq '.proxmenux_backup_manifest'
+fi
diff --git a/scripts/backup_restore/restore/preflight_checks.sh b/scripts/backup_restore/restore/preflight_checks.sh
new file mode 100755
index 00000000..92568aa3
--- /dev/null
+++ b/scripts/backup_restore/restore/preflight_checks.sh
@@ -0,0 +1,239 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup restore — pre-flight compatibility checks
+# ==========================================================
+# Runs every pre-flight check against the destination host's current
+# state and emits a JSON report. The orchestrator (run_restore.sh)
+# decides go/no-go based on whether any check has severity=fail.
+#
+# Severity levels:
+#   pass — green, restore can proceed for this dimension
+#   warn — proceed but operator should know (e.g. RAM lower than source,
+#          NIC MAC absent, PBS role missing but PVE present)
+#   fail — must address before proceeding (e.g. CPU arch mismatch,
+#          PVE version older than backup)
+#
+# Usage:
+#   preflight_checks.sh <manifest-json-path-or-archive>
+#
+# Stdout: JSON {checks: [...], summary: {pass: N, warn: N, fail: N}}.
+# Exit code: 0 if all checks pass or warn; 1 if any fail.
+# ==========================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SOURCE="${1:-}"
+
+if [[ -z "$SOURCE" ]]; then
+  printf 'preflight_checks: missing manifest source\n' >&2
+  exit 64
+fi
+
+manifest="$(bash "$SCRIPT_DIR/parse_manifest.sh" "$SOURCE")"
+
+# Collect "current host" facts up-front so the checks themselves
+# stay declarative.
+cur_hostname="$(hostname)"
+cur_pve_full="$(pveversion 2>/dev/null | head -1 || true)"
+cur_pve_ver="$(printf '%s\n' "$cur_pve_full" | sed -nE 's@^pve-manager/([0-9.]+)/.*@\1@p')"
+cur_pbs_present=0
+command -v proxmox-backup-manager >/dev/null 2>&1 && cur_pbs_present=1
+cur_kernel="$(uname -r)"
+cur_boot_mode="$([ -d /sys/firmware/efi ] && echo efi || echo bios)"
+cur_root_fs="$(findmnt -no FSTYPE / 2>/dev/null || echo unknown)"
+cur_cpu_arch="$(uname -m)"
+case "$cur_cpu_arch" in x86_64|amd64) cur_cpu_arch=x86_64 ;; aarch64|arm64) cur_cpu_arch=aarch64 ;; esac
+cur_memory_kb="$(awk '/^MemTotal:/{print $2; exit}' /proc/meminfo 2>/dev/null || echo 0)"
+
+# Manifest-side facts
+m_source="$(printf '%s' "$manifest" | jq -c '.source_host')"
+m_pve="$(printf '%s' "$m_source" | jq -r '.pve_version // ""')"
+m_pbs="$(printf '%s' "$m_source" | jq -r '.pbs_version // ""')"
+m_roles="$(printf '%s' "$m_source" | jq -c '.roles')"
+m_boot_mode="$(printf '%s' "$m_source" | jq -r '.boot_mode')"
+m_root_fs="$(printf '%s' "$m_source" | jq -r '.root_fs // ""')"
+m_cpu_arch="$(printf '%s' "$m_source" | jq -r '.cpu_arch')"
+m_memory_kb="$(printf '%s' "$m_source" | jq -r '.memory_kb')"
+m_hostname="$(printf '%s' "$m_source" | jq -r '.hostname')"
+
+checks='[]'
+
+# Helper to compare semver-style strings as tuples. Returns 0 if $1 ≥ $2.
+ver_ge() {
+  # Pad both to (major,minor,patch) and compare numerically.
+  local a b
+  IFS='.' read -ra a <<< "$1"
+  IFS='.' read -ra b <<< "$2"
+  for i in 0 1 2; do
+    local av="${a[$i]:-0}" bv="${b[$i]:-0}"
+    av="${av%%-*}"; bv="${bv%%-*}"   # strip pre-release suffixes
+    av="$(printf '%d' "$av" 2>/dev/null || echo 0)"
+    bv="$(printf '%d' "$bv" 2>/dev/null || echo 0)"
+    if   (( av > bv )); then return 0
+    elif (( av < bv )); then return 1
+    fi
+  done
+  return 0
+}
+
+add_check() {
+  local id="$1" severity="$2" message="$3" details="${4:-null}"
+  checks="$(jq --argjson acc "$checks" \
+    --arg id "$id" --arg sev "$severity" --arg msg "$message" --argjson det "$details" \
+    -n '$acc + [{id: $id, severity: $sev, message: $msg, details: $det}]')"
+}
+
+# ── Check 1: CPU arch must match ──
+if [[ "$cur_cpu_arch" == "$m_cpu_arch" ]]; then
+  add_check cpu_arch_match pass "CPU arch matches ($cur_cpu_arch)"
+else
+  add_check cpu_arch_match fail \
+    "Source $m_cpu_arch ≠ destination $cur_cpu_arch — backup is not portable across architectures" \
+    "$(jq -n --arg s "$m_cpu_arch" --arg d "$cur_cpu_arch" '{source: $s, destination: $d}')"
+fi
+
+# ── Check 2: Boot mode (efi vs bios) ──
+if [[ "$cur_boot_mode" == "$m_boot_mode" ]]; then
+  add_check boot_mode_match pass "Boot mode matches ($cur_boot_mode)"
+else
+  add_check boot_mode_match warn \
+    "Source $m_boot_mode ≠ destination $cur_boot_mode. Bootloader config from the backup will not apply." \
+    "$(jq -n --arg s "$m_boot_mode" --arg d "$cur_boot_mode" '{source: $s, destination: $d}')"
+fi
+
+# ── Check 3: Root filesystem family ──
+if [[ -n "$m_root_fs" ]]; then
+  if [[ "$cur_root_fs" == "$m_root_fs" ]]; then
+    add_check root_fs_match pass "Root filesystem matches ($cur_root_fs)"
+  else
+    add_check root_fs_match warn \
+      "Source root_fs=$m_root_fs vs destination $cur_root_fs. Fine for config-only restore, but ZFS-specific paths from the backup may need manual adjustment." \
+      "$(jq -n --arg s "$m_root_fs" --arg d "$cur_root_fs" '{source: $s, destination: $d}')"
+  fi
+fi
+
+# ── Check 4: PVE version ──
+if [[ -n "$m_pve" ]]; then
+  if [[ -z "$cur_pve_ver" ]]; then
+    add_check pve_version fail \
+      "Source had PVE $m_pve but destination has no PVE installed" \
+      "$(jq -n --arg s "$m_pve" '{source_version: $s, destination_version: null}')"
+  elif ver_ge "$cur_pve_ver" "$m_pve"; then
+    add_check pve_version pass \
+      "Destination PVE $cur_pve_ver ≥ source $m_pve"
+  else
+    add_check pve_version warn \
+      "Destination PVE $cur_pve_ver is OLDER than source $m_pve. New config files may reference fields the older PVE doesn't recognise." \
+      "$(jq -n --arg s "$m_pve" --arg d "$cur_pve_ver" '{source: $s, destination: $d}')"
+  fi
+fi
+
+# ── Check 5: PBS role ──
+roles_have_pbs="$(printf '%s' "$m_roles" | jq 'index("pbs") != null')"
+if [[ "$roles_have_pbs" == "true" ]]; then
+  if [[ "$cur_pbs_present" == 1 ]]; then
+    add_check pbs_role pass "Destination has PBS — manifest's pbs role can be restored"
+  else
+    add_check pbs_role warn \
+      "Source had PBS role but destination has no PBS installed. PBS-related configs will be ignored unless you install proxmox-backup-server first."
+  fi
+fi
+
+# ── Check 6: Memory ──
+if [[ "$m_memory_kb" -gt 0 && "$cur_memory_kb" -gt 0 ]]; then
+  # 80% rule — destination must have at least 80% of source RAM.
+  threshold_kb=$(( m_memory_kb * 80 / 100 ))
+  if [[ "$cur_memory_kb" -ge "$m_memory_kb" ]]; then
+    add_check memory pass "Destination $(( cur_memory_kb / 1024 ))MB ≥ source $(( m_memory_kb / 1024 ))MB"
+  elif [[ "$cur_memory_kb" -ge "$threshold_kb" ]]; then
+    add_check memory warn \
+      "Destination $(( cur_memory_kb / 1024 ))MB is below source $(( m_memory_kb / 1024 ))MB but within 80% threshold. VMs may need memory limits reduced."
+  else
+    add_check memory fail \
+      "Destination $(( cur_memory_kb / 1024 ))MB is below 80% of source $(( m_memory_kb / 1024 ))MB. VMs from the backup will likely refuse to start." \
+      "$(jq -n --argjson s "$m_memory_kb" --argjson d "$cur_memory_kb" '{source_kb: $s, destination_kb: $d}')"
+  fi
+fi
+
+# ── Check 7: Required by-id disks present ──
+required_disks="$(printf '%s' "$manifest" | jq -r '
+  [.storage_inventory.zfs_pools[]?.devices_by_id[]?]
+  + [.storage_inventory.physical_disks[]?.by_id // empty]
+  | unique[]
+' | grep -v '^$' || true)"
+
+missing_disks='[]'
+present_disks='[]'
+while IFS= read -r dev; do
+  [[ -z "$dev" ]] && continue
+  if [[ -e "/dev/disk/by-id/$dev" ]]; then
+    present_disks="$(jq --argjson acc "$present_disks" --arg d "$dev" -n '$acc + [$d]')"
+  else
+    missing_disks="$(jq --argjson acc "$missing_disks" --arg d "$dev" -n '$acc + [$d]')"
+  fi
+done <<< "$required_disks"
+
+missing_count="$(printf '%s' "$missing_disks" | jq 'length')"
+present_count="$(printf '%s' "$present_disks" | jq 'length')"
+total_count=$(( missing_count + present_count ))
+
+if [[ "$total_count" == 0 ]]; then
+  add_check disk_inventory pass "Manifest declares no by-id disks (no ZFS pools to import)"
+elif [[ "$missing_count" == 0 ]]; then
+  add_check disk_inventory pass "All $present_count required by-id disks present" \
+    "$(jq -n --argjson p "$present_disks" '{present: $p}')"
+else
+  add_check disk_inventory warn \
+    "$missing_count of $total_count required by-id disks are missing. Affected ZFS pools / storages cannot auto-import." \
+    "$(jq -n --argjson m "$missing_disks" --argjson p "$present_disks" '{missing: $m, present: $p}')"
+fi
+
+# ── Check 8: NIC MACs present ──
+required_macs="$(printf '%s' "$manifest" | jq -r '.hardware_inventory.nic[]?.mac // empty')"
+current_macs="$(ip -j link 2>/dev/null | jq -r '.[].address' 2>/dev/null | sort -u)"
+
+missing_macs='[]'
+matched_macs='[]'
+while IFS= read -r mac; do
+  [[ -z "$mac" ]] && continue
+  if printf '%s\n' "$current_macs" | grep -qFx "$mac"; then
+    matched_macs="$(jq --argjson acc "$matched_macs" --arg m "$mac" -n '$acc + [$m]')"
+  else
+    missing_macs="$(jq --argjson acc "$missing_macs" --arg m "$mac" -n '$acc + [$m]')"
+  fi
+done <<< "$required_macs"
+
+mac_missing="$(printf '%s' "$missing_macs" | jq 'length')"
+mac_total=$(( mac_missing + $(printf '%s' "$matched_macs" | jq 'length') ))
+if [[ "$mac_total" == 0 ]]; then
+  add_check nic_macs pass "Manifest declares no NICs"
+elif [[ "$mac_missing" == 0 ]]; then
+  add_check nic_macs pass "All $mac_total NIC MACs from source present on destination"
+else
+  add_check nic_macs warn \
+    "$mac_missing of $mac_total source NIC MACs are absent. Bridge memberships referencing those interfaces will need manual remap." \
+    "$(jq -n --argjson m "$missing_macs" --argjson p "$matched_macs" '{missing: $m, matched: $p}')"
+fi
+
+# ── Check 9: Hostname collision ──
+if [[ "$cur_hostname" == "$m_hostname" ]]; then
+  add_check hostname pass "Hostname unchanged ($cur_hostname)"
+else
+  add_check hostname warn \
+    "Source hostname '$m_hostname' ≠ destination '$cur_hostname'. Restoring /etc/hostname will change it; this affects PVE cluster identity and some certs." \
+    "$(jq -n --arg s "$m_hostname" --arg d "$cur_hostname" '{source: $s, destination: $d}')"
+fi
+
+# Compose final report
+summary="$(printf '%s' "$checks" | jq '
+  reduce .[] as $c ({pass: 0, warn: 0, fail: 0};
+    .[$c.severity] += 1)
+')"
+fail_count="$(printf '%s' "$summary" | jq '.fail')"
+
+jq -n \
+  --argjson checks "$checks" \
+  --argjson summary "$summary" \
+  '{ checks: $checks, summary: $summary }'
+
+exit "$([ "$fail_count" -eq 0 ] && echo 0 || echo 1)"
diff --git a/scripts/backup_restore/restore/reinstall_drivers.sh b/scripts/backup_restore/restore/reinstall_drivers.sh
new file mode 100755
index 00000000..4a491840
--- /dev/null
+++ b/scripts/backup_restore/restore/reinstall_drivers.sh
@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup restore — driver reinstaller
+# ==========================================================
+# Walks the manifest's proxmenux_installed_components list and
+# emits a plan (--dry-run, default) or actually invokes the
+# installers (--apply). Each installer is called with:
+#
+#   bash <installer> --auto-from-manifest \
+#       --version <version_at_backup> \
+#       --id <component_id>
+#
+# The installers themselves are responsible for honoring those
+# flags and running non-interactively. This script does NOT touch
+# the host directly — it only delegates to the existing installers.
+#
+# Usage:
+#   reinstall_drivers.sh <manifest> [--apply]
+#
+# Output: JSON {plan: [...], applied: [...] (only with --apply)}.
+# ==========================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROXMENUX_ROOT="/usr/local/share/proxmenux"   # where the installers live at runtime
+
+SOURCE="${1:-}"
+APPLY=0
+shift || true
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --apply) APPLY=1 ;;
+    --root)  shift; PROXMENUX_ROOT="$1" ;;
+  esac
+  shift
+done
+
+[[ -z "$SOURCE" ]] && { printf 'reinstall_drivers: missing manifest source\n' >&2; exit 64; }
+
+manifest="$(bash "$SCRIPT_DIR/parse_manifest.sh" "$SOURCE")"
+
+plan='[]'
+applied='[]'
+
+while IFS= read -r comp; do
+  [[ -z "$comp" ]] && continue
+  id="$(printf '%s' "$comp" | jq -r '.id')"
+  type="$(printf '%s' "$comp" | jq -r '.type // ""')"
+  version="$(printf '%s' "$comp" | jq -r '.version_at_backup // ""')"
+  installer_rel="$(printf '%s' "$comp" | jq -r '.proxmenux_installer // ""')"
+
+  # Components without an installer are reinstalled manually by the
+  # operator after restore (e.g. OCI apps like Tailscale). We still
+  # surface them in the plan so the operator has the full list.
+  if [[ -z "$installer_rel" ]]; then
+    plan="$(jq --argjson acc "$plan" \
+      --arg id "$id" --arg type "$type" --arg version "$version" \
+      -n '$acc + [{
+        component_id:    $id,
+        type:            $type,
+        version:         $version,
+        installer:       null,
+        action:          "manual_reinstall_required",
+        reason:          "component has no installer mapping — operator must reinstall manually"
+      }]')"
+    continue
+  fi
+
+  installer_abs="$PROXMENUX_ROOT/$installer_rel"
+  if [[ ! -f "$installer_abs" ]]; then
+    plan="$(jq --argjson acc "$plan" \
+      --arg id "$id" --arg type "$type" --arg version "$version" --arg ir "$installer_rel" \
+      -n '$acc + [{
+        component_id: $id,
+        type:         $type,
+        version:      $version,
+        installer:    $ir,
+        action:       "installer_missing",
+        reason:       "installer script not present on this host — ProxMenux installation incomplete?"
+      }]')"
+    continue
+  fi
+
+  plan="$(jq --argjson acc "$plan" \
+    --arg id "$id" --arg type "$type" --arg version "$version" --arg ir "$installer_rel" \
+    -n '$acc + [{
+      component_id: $id,
+      type:         $type,
+      version:      $version,
+      installer:    $ir,
+      action:       "will_invoke_installer",
+      reason:       "bash <installer> --auto-from-manifest --version <V> --id <ID>"
+    }]')"
+
+  if [[ "$APPLY" == 1 ]]; then
+    started_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    if bash "$installer_abs" --auto-from-manifest --version "$version" --id "$id" \
+        >/tmp/proxmenux-restore-install-"$id".log 2>&1; then
+      result="ok"; exit_code=0
+    else
+      exit_code=$?
+      result="failed"
+    fi
+    finished_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+    applied="$(jq --argjson acc "$applied" \
+      --arg id "$id" --arg result "$result" --argjson ec "$exit_code" \
+      --arg s "$started_at" --arg f "$finished_at" \
+      -n '$acc + [{
+        component_id: $id,
+        result:       $result,
+        exit_code:    $ec,
+        started_at:   $s,
+        finished_at:  $f,
+        log:          ("/tmp/proxmenux-restore-install-" + $id + ".log")
+      }]')"
+  fi
+done < <(printf '%s' "$manifest" | jq -c '.proxmenux_installed_components[]?')
+
+if [[ "$APPLY" == 1 ]]; then
+  jq -n --argjson plan "$plan" --argjson applied "$applied" '{plan: $plan, applied: $applied}'
+else
+  jq -n --argjson plan "$plan" '{plan: $plan}'
+fi
diff --git a/scripts/backup_restore/restore/remap_network.sh b/scripts/backup_restore/restore/remap_network.sh
new file mode 100755
index 00000000..122282d3
--- /dev/null
+++ b/scripts/backup_restore/restore/remap_network.sh
@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup restore — NIC remap by MAC
+# ==========================================================
+# Compares the manifest's NIC list (ifname + MAC + bridges) against
+# the destination's current state and produces a remap table.
+#
+# Decision rules per NIC:
+#   - MAC found on the SAME ifname        → keep (no action)
+#   - MAC found on a DIFFERENT ifname     → rename or rewrite bridge config
+#   - MAC NOT found at all                → orphan: bridge member needs
+#                                            human decision
+#   - Destination has a NIC not in manifest → new hardware: no action
+#                                              needed for restore, but
+#                                              operator may want to add
+#                                              to a bridge afterwards
+#
+# Usage:
+#   remap_network.sh <manifest-json-path-or-archive>
+#
+# Output: JSON {keep: [...], remap: [...], orphan: [...], new: [...]}.
+# ==========================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SOURCE="${1:-}"
+[[ -z "$SOURCE" ]] && { printf 'remap_network: missing manifest source\n' >&2; exit 64; }
+
+manifest="$(bash "$SCRIPT_DIR/parse_manifest.sh" "$SOURCE")"
+
+# Snapshot destination NICs.
+dest_nics='[]'
+for dev_path in /sys/class/net/*; do
+  ifname="$(basename "$dev_path")"
+  case "$ifname" in
+    lo|veth*|tap*|fwln*|fwbr*|fwpr*|vmbr*|bond*) continue ;;
+  esac
+  [[ -e "$dev_path/device" ]] || continue
+  mac="$(cat "$dev_path/address" 2>/dev/null || true)"
+  [[ -z "$mac" ]] && continue
+  dest_nics="$(jq --argjson acc "$dest_nics" --arg n "$ifname" --arg m "$mac" \
+    -n '$acc + [{ifname: $n, mac: $m}]')"
+done
+
+# Manifest NICs
+manifest_nics="$(printf '%s' "$manifest" | jq -c '.hardware_inventory.nic // []')"
+
+keep='[]'
+remap='[]'
+orphan='[]'
+
+# Iterate manifest NICs
+while IFS= read -r src_nic; do
+  [[ -z "$src_nic" ]] && continue
+  src_if="$(printf '%s' "$src_nic" | jq -r '.ifname')"
+  src_mac="$(printf '%s' "$src_nic" | jq -r '.mac')"
+  src_bridges="$(printf '%s' "$src_nic" | jq -c '.in_bridges // []')"
+
+  # Look up the same MAC on destination
+  match="$(printf '%s' "$dest_nics" | jq -c --arg m "$src_mac" '.[] | select(.mac == $m)' | head -1)"
+  if [[ -z "$match" ]]; then
+    # MAC not found at all → orphan
+    orphan="$(jq --argjson acc "$orphan" \
+      --arg if "$src_if" --arg mac "$src_mac" --argjson b "$src_bridges" \
+      -n '$acc + [{
+        source_ifname: $if,
+        source_mac:    $mac,
+        in_bridges:    $b
+      }]')"
+    continue
+  fi
+  dest_if="$(printf '%s' "$match" | jq -r '.ifname')"
+  if [[ "$dest_if" == "$src_if" ]]; then
+    keep="$(jq --argjson acc "$keep" \
+      --arg if "$src_if" --arg mac "$src_mac" \
+      -n '$acc + [{ifname: $if, mac: $mac}]')"
+  else
+    remap="$(jq --argjson acc "$remap" \
+      --arg si "$src_if" --arg di "$dest_if" --arg mac "$src_mac" --argjson b "$src_bridges" \
+      -n '$acc + [{
+        source_ifname:      $si,
+        destination_ifname: $di,
+        mac:                $mac,
+        in_bridges:         $b
+      }]')"
+  fi
+done < <(printf '%s' "$manifest_nics" | jq -c '.[]')
+
+# Destination NICs that weren't in the manifest at all → new hardware
+manifest_macs="$(printf '%s' "$manifest_nics" | jq -r '.[].mac')"
+new='[]'
+while IFS= read -r dest_nic; do
+  [[ -z "$dest_nic" ]] && continue
+  dest_mac="$(printf '%s' "$dest_nic" | jq -r '.mac')"
+  if ! printf '%s\n' "$manifest_macs" | grep -qFx "$dest_mac"; then
+    new="$(jq --argjson acc "$new" --argjson n "$dest_nic" -n '$acc + [$n]')"
+  fi
+done < <(printf '%s' "$dest_nics" | jq -c '.[]')
+
+jq -n \
+  --argjson keep "$keep" \
+  --argjson remap "$remap" \
+  --argjson orphan "$orphan" \
+  --argjson new "$new" \
+  '{ keep: $keep, remap: $remap, orphan: $orphan, new: $new }'
diff --git a/scripts/backup_restore/restore/restore_modes.sh b/scripts/backup_restore/restore/restore_modes.sh
new file mode 100755
index 00000000..845ef184
--- /dev/null
+++ b/scripts/backup_restore/restore/restore_modes.sh
@@ -0,0 +1,220 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup restore — mode presets
+# ==========================================================
+# Defines the five canonical restore modes. Each mode is a
+# declarative filter over the manifest:
+#
+#   full          — restore everything from the backup
+#   storage_only  — only PVE storages, ZFS pools, mounts
+#   network_only  — only /etc/network, hostname, hosts, firewall
+#   base          — full minus network (operator keeps current LAN)
+#   custom        — pass-through; the caller decides paths/components
+#
+# Each mode takes the manifest on stdin and prints a plan JSON
+# to stdout. The plan tells run_restore.sh which paths to extract,
+# which components to reinstall, and whether to apply storage /
+# network actions.
+#
+# Plan schema:
+#   {
+#     mode:                "full" | ... ,
+#     paths_include:       [string, ...],   // paths to extract
+#     paths_exclude:       [string, ...],   // paths to skip
+#     components_include:  [string, ...],   // component ids to reinstall
+#     storage_apply:       bool,
+#     network_apply:       bool,
+#     hostname_apply:      bool
+#   }
+#
+# Usage as a library:
+#   source restore_modes.sh
+#   plan="$(mode_plan_full < manifest.json)"
+#
+# Usage as a CLI:
+#   restore_modes.sh <mode> <manifest>
+#
+# Modes consume the manifest's paths_archived list — they don't
+# invent paths. Anything you didn't archive can't be restored.
+# ==========================================================
+set -euo pipefail
+
+# Paths that belong to the "network" concern, used by base/network_only
+# modes. We match prefixes (e.g. /etc/network covers everything under it).
+_NETWORK_PATH_PREFIXES=(
+  "/etc/network"
+  "/etc/hosts"
+  "/etc/hostname"
+  "/etc/resolv.conf"
+  "/etc/pve/firewall"
+  "/etc/pve/nodes"
+  "/etc/pve/.members"
+)
+
+# Paths that belong to the "storage" concern.
+_STORAGE_PATH_PREFIXES=(
+  "/etc/pve/storage.cfg"
+  "/etc/pve/priv/storage"
+  "/etc/fstab"
+  "/etc/iscsi"
+  "/etc/multipath"
+  "/etc/multipath.conf"
+  "/etc/zfs"
+  "/etc/lvm"
+)
+
+# Internal: returns 0 if $1 starts with any of the prefixes in the
+# named array.
+_path_matches_any() {
+  local path="$1"; shift
+  local prefix
+  for prefix in "$@"; do
+    case "$path" in
+      "$prefix"|"$prefix"/*) return 0 ;;
+    esac
+  done
+  return 1
+}
+
+# Internal: emit a JSON array of paths from paths_archived that pass the
+# given path predicate function name.
+_filter_paths() {
+  local predicate="$1" manifest="$2"
+  local out='[]'
+  while IFS= read -r p; do
+    [[ -z "$p" ]] && continue
+    if $predicate "$p"; then
+      out="$(jq --argjson acc "$out" --arg p "$p" -n '$acc + [$p]')"
+    fi
+  done < <(printf '%s' "$manifest" | jq -r '.backup_metadata.paths_archived[]?')
+  printf '%s' "$out"
+}
+
+_is_network_path()  { _path_matches_any "$1" "${_NETWORK_PATH_PREFIXES[@]}"; }
+_is_storage_path()  { _path_matches_any "$1" "${_STORAGE_PATH_PREFIXES[@]}"; }
+_is_not_network()   { ! _is_network_path "$1"; }
+
+# Internal: emit the component-ids array, optionally filtered.
+# Args:
+#   $1 = manifest JSON
+#   $2 = "all" | "none"
+_components_for_mode() {
+  local manifest="$1" policy="$2"
+  case "$policy" in
+    all)
+      printf '%s' "$manifest" | jq '[.proxmenux_installed_components[]?.id]'
+      ;;
+    none)
+      echo '[]'
+      ;;
+  esac
+}
+
+# Public: emit a plan JSON for the requested mode given the manifest
+# on stdin or as $1.
+emit_plan() {
+  local mode="$1" manifest="$2"
+
+  local include exclude components storage_apply network_apply hostname_apply
+
+  case "$mode" in
+    full)
+      include="$(printf '%s' "$manifest" | jq '.backup_metadata.paths_archived // []')"
+      exclude='[]'
+      components="$(_components_for_mode "$manifest" all)"
+      storage_apply=true; network_apply=true; hostname_apply=true
+      ;;
+
+    storage_only)
+      include="$(_filter_paths _is_storage_path "$manifest")"
+      exclude='[]'
+      components='[]'
+      storage_apply=true; network_apply=false; hostname_apply=false
+      ;;
+
+    network_only)
+      include="$(_filter_paths _is_network_path "$manifest")"
+      exclude='[]'
+      components='[]'
+      storage_apply=false; network_apply=true; hostname_apply=true
+      ;;
+
+    base)
+      # everything except the network paths
+      include="$(_filter_paths _is_not_network "$manifest")"
+      # Explicitly enumerate excluded prefixes so the operator sees them
+      exclude="$(printf '%s\n' "${_NETWORK_PATH_PREFIXES[@]}" | jq -R . | jq -s .)"
+      components="$(_components_for_mode "$manifest" all)"
+      storage_apply=true; network_apply=false; hostname_apply=false
+      ;;
+
+    custom)
+      # Pass-through: include nothing, exclude nothing — caller fills in.
+      include='[]'
+      exclude='[]'
+      components='[]'
+      storage_apply=false; network_apply=false; hostname_apply=false
+      ;;
+
+    *)
+      printf 'restore_modes: unknown mode "%s" (expected full|storage_only|network_only|base|custom)\n' "$mode" >&2
+      return 64
+      ;;
+  esac
+
+  jq -n \
+    --arg mode "$mode" \
+    --argjson include "$include" \
+    --argjson exclude "$exclude" \
+    --argjson components "$components" \
+    --argjson storage_apply "$storage_apply" \
+    --argjson network_apply "$network_apply" \
+    --argjson hostname_apply "$hostname_apply" \
+    '{
+      mode:               $mode,
+      paths_include:      $include,
+      paths_exclude:      $exclude,
+      components_include: $components,
+      storage_apply:      $storage_apply,
+      network_apply:      $network_apply,
+      hostname_apply:     $hostname_apply
+    }'
+}
+
+# Public: human-friendly label per mode, used by CLI/UI.
+mode_label() {
+  case "$1" in
+    full)         echo "Full restore — apply everything from the backup" ;;
+    storage_only) echo "Storage only — PVE storages, ZFS, fstab, iSCSI, multipath" ;;
+    network_only) echo "Network only — interfaces, hosts, hostname, firewall" ;;
+    base)         echo "Base (no network) — everything except network changes" ;;
+    custom)       echo "Custom — operator picks paths and components manually" ;;
+    *)            echo "Unknown mode" ;;
+  esac
+}
+
+# CLI mode if called directly
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  MODE="${1:-}"
+  SOURCE="${2:-}"
+  if [[ -z "$MODE" || -z "$SOURCE" ]]; then
+    cat <<EOF >&2
+restore_modes.sh — restore mode preset definitions
+
+Usage:
+  restore_modes.sh <mode> <manifest-or-archive>
+
+Modes:
+  full          — $(mode_label full)
+  storage_only  — $(mode_label storage_only)
+  network_only  — $(mode_label network_only)
+  base          — $(mode_label base)
+  custom        — $(mode_label custom)
+EOF
+    exit 64
+  fi
+
+  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  manifest="$(bash "$SCRIPT_DIR/parse_manifest.sh" "$SOURCE")"
+  emit_plan "$MODE" "$manifest"
+fi
diff --git a/scripts/backup_restore/restore/run_restore.sh b/scripts/backup_restore/restore/run_restore.sh
new file mode 100755
index 00000000..2d6c32be
--- /dev/null
+++ b/scripts/backup_restore/restore/run_restore.sh
@@ -0,0 +1,184 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup restore — orchestrator
+# ==========================================================
+# Composes the four manifest-aware tools into a single restore
+# workflow:
+#
+#   1. parse manifest             (parse_manifest.sh)
+#   2. preflight checks           (preflight_checks.sh)        ← can fail
+#   3. validate storage           (validate_storage.sh)        ← reports
+#   4. network remap plan         (remap_network.sh)           ← reports
+#   5. driver reinstall plan      (reinstall_drivers.sh)       ← reports
+#
+# By default it runs the four AS A DRY-RUN and prints the combined
+# report. With --apply it executes the file extraction (delegated to
+# the existing _rs_apply from backup_host.sh — placeholder for now)
+# and then runs the driver reinstaller with --apply.
+#
+# Usage:
+#   run_restore.sh <backup-archive-or-dir> [options]
+#
+# --mode <mode>  Restore mode preset (default: full)
+#                full | storage_only | network_only | base | custom
+# --json         Machine-readable combined report (default)
+# --text         Human-friendly summary on stderr + JSON report on stdout
+# --apply        Actually perform the restore (refuses if preflight fails)
+# ==========================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SOURCE="${1:-}"
+FORMAT="json"
+APPLY=0
+MODE="full"
+shift || true
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --json)  FORMAT="json" ;;
+    --text)  FORMAT="text" ;;
+    --apply) APPLY=1 ;;
+    --mode)  shift; MODE="${1:-full}" ;;
+  esac
+  shift
+done
+
+[[ -z "$SOURCE" ]] && { printf 'run_restore: usage: %s <backup-archive-or-dir> [--apply]\n' "$0" >&2; exit 64; }
+
+# ── Step 1: Parse manifest ──
+manifest="$(bash "$SCRIPT_DIR/parse_manifest.sh" "$SOURCE")"
+
+# ── Step 2: Resolve mode preset (which paths/components/actions apply) ──
+mode_plan="$(bash "$SCRIPT_DIR/restore_modes.sh" "$MODE" "$SOURCE")"
+
+# ── Step 3: Pre-flight checks (gate) ──
+preflight="$(bash "$SCRIPT_DIR/preflight_checks.sh" "$SOURCE" || true)"
+fail_count="$(printf '%s' "$preflight" | jq '.summary.fail')"
+
+# ── Step 4: Storage validation ──
+# Only report storage if the mode actually applies storage changes;
+# otherwise we still surface the info but mark it as "not in mode".
+storage_apply_in_mode="$(printf '%s' "$mode_plan" | jq -r '.storage_apply')"
+storage="$(bash "$SCRIPT_DIR/validate_storage.sh" "$SOURCE")"
+
+# ── Step 5: NIC remap plan ──
+network_apply_in_mode="$(printf '%s' "$mode_plan" | jq -r '.network_apply')"
+network="$(bash "$SCRIPT_DIR/remap_network.sh" "$SOURCE")"
+
+# ── Step 6: Driver reinstaller plan ──
+# In modes that don't include components (storage_only, network_only,
+# custom-without-explicit), we narrow the driver plan to nothing.
+components_in_mode="$(printf '%s' "$mode_plan" | jq -c '.components_include')"
+drivers_full_plan="$(bash "$SCRIPT_DIR/reinstall_drivers.sh" "$SOURCE")"
+drivers_plan="$(printf '%s' "$drivers_full_plan" | jq --argjson ids "$components_in_mode" '
+  if ($ids | length) == 0 then
+    .plan |= []
+  else
+    .plan |= map(select(.component_id as $id | $ids | index($id) != null))
+  end
+')"
+
+drivers_applied='null'
+apply_done=false
+abort_reason=""
+
+if [[ "$APPLY" == 1 ]]; then
+  if [[ "$fail_count" -gt 0 ]]; then
+    abort_reason="preflight has $fail_count failing check(s) — refusing --apply"
+  else
+    # Driver reinstall only runs if the selected mode includes components.
+    # Modes that don't (storage_only, network_only) keep drivers untouched.
+    if [[ "$(printf '%s' "$components_in_mode" | jq 'length')" -gt 0 ]]; then
+      drivers_full="$(bash "$SCRIPT_DIR/reinstall_drivers.sh" "$SOURCE" --apply)"
+      # Narrow to components selected by the mode
+      drivers_applied="$(printf '%s' "$drivers_full" | jq --argjson ids "$components_in_mode" '
+        .applied | map(select(.component_id as $id | $ids | index($id) != null))
+      ')"
+    else
+      drivers_applied='[]'
+    fi
+    # TODO(13D): delegate the actual file extraction (paths_include /
+    # paths_exclude from $mode_plan) + storage_apply / network_apply
+    # decisions to backup_host.sh's _rs_apply(). This is the integration
+    # seam between the manifest-aware tooling and the existing extraction
+    # engine.
+    apply_done=true
+  fi
+fi
+
+# Decorate sections that aren't part of the selected mode so the report
+# is honest about what would actually be touched.
+storage_for_report="$(jq -n --argjson s "$storage" --argjson in_mode "$storage_apply_in_mode" \
+  '$s + {in_selected_mode: $in_mode}')"
+network_for_report="$(jq -n --argjson n "$network" --argjson in_mode "$network_apply_in_mode" \
+  '$n + {in_selected_mode: $in_mode}')"
+
+report="$(jq -n \
+  --argjson manifest_source_host "$(printf '%s' "$manifest" | jq '.source_host')" \
+  --argjson mode_plan "$mode_plan" \
+  --argjson preflight "$preflight" \
+  --argjson storage   "$storage_for_report" \
+  --argjson network   "$network_for_report" \
+  --argjson drivers_plan "$(printf '%s' "$drivers_plan" | jq '.plan')" \
+  --argjson drivers_applied "$drivers_applied" \
+  --argjson apply_done "$apply_done" \
+  --arg     abort_reason "$abort_reason" \
+  '{
+    source_host_at_backup: $manifest_source_host,
+    selected_mode:         $mode_plan,
+    preflight:             $preflight,
+    storage:               $storage,
+    network:               $network,
+    driver_reinstall: {
+      plan:    $drivers_plan,
+      applied: $drivers_applied
+    },
+    applied:      $apply_done,
+    abort_reason: (if $abort_reason == "" then null else $abort_reason end)
+  }')"
+
+if [[ "$FORMAT" == "text" ]]; then
+  # Brief human summary on stderr; the JSON still goes to stdout so the
+  # caller can pipe it elsewhere.
+  {
+    printf '─────────────────────────────────────────────\n'
+    printf 'ProxMenux Restore — dry-run report\n'
+    printf '─────────────────────────────────────────────\n'
+    printf 'Source host : %s (PVE %s)\n' \
+      "$(printf '%s' "$report" | jq -r '.source_host_at_backup.hostname')" \
+      "$(printf '%s' "$report" | jq -r '.source_host_at_backup.pve_version // "-"')"
+    printf 'Mode        : %s — %s paths in, %s components\n' \
+      "$MODE" \
+      "$(printf '%s' "$report" | jq -r '.selected_mode.paths_include | length')" \
+      "$(printf '%s' "$report" | jq -r '.selected_mode.components_include | length')"
+    printf 'Pre-flight  : %s pass · %s warn · %s fail\n' \
+      "$(printf '%s' "$report" | jq -r '.preflight.summary.pass')" \
+      "$(printf '%s' "$report" | jq -r '.preflight.summary.warn')" \
+      "$(printf '%s' "$report" | jq -r '.preflight.summary.fail')"
+    printf 'Storage     : %s pools / %s LVM VGs / %s PVE storages  [in mode: %s]\n' \
+      "$(printf '%s' "$report" | jq -r '.storage.zfs | length')" \
+      "$(printf '%s' "$report" | jq -r '.storage.lvm | length')" \
+      "$(printf '%s' "$report" | jq -r '.storage.pve_storage | length')" \
+      "$(printf '%s' "$report" | jq -r '.storage.in_selected_mode')"
+    printf 'Network     : %s keep / %s remap / %s orphan / %s new  [in mode: %s]\n' \
+      "$(printf '%s' "$report" | jq -r '.network.keep | length')" \
+      "$(printf '%s' "$report" | jq -r '.network.remap | length')" \
+      "$(printf '%s' "$report" | jq -r '.network.orphan | length')" \
+      "$(printf '%s' "$report" | jq -r '.network.new | length')" \
+      "$(printf '%s' "$report" | jq -r '.network.in_selected_mode')"
+    printf 'Drivers     : %s in plan\n' \
+      "$(printf '%s' "$report" | jq -r '.driver_reinstall.plan | length')"
+    if [[ "$APPLY" == 1 ]]; then
+      printf '─── APPLY ───\n'
+      if [[ -n "$abort_reason" ]]; then
+        printf 'ABORTED: %s\n' "$abort_reason"
+      else
+        printf 'Drivers applied: %s\n' \
+          "$(printf '%s' "$report" | jq -r '.driver_reinstall.applied | length')"
+      fi
+    fi
+    printf '─────────────────────────────────────────────\n'
+  } >&2
+fi
+
+printf '%s\n' "$report"
diff --git a/scripts/backup_restore/restore/validate_storage.sh b/scripts/backup_restore/restore/validate_storage.sh
new file mode 100755
index 00000000..afc8ce6c
--- /dev/null
+++ b/scripts/backup_restore/restore/validate_storage.sh
@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux backup restore — storage validation
+# ==========================================================
+# Walks the manifest's storage_inventory and reports per-pool /
+# per-storage whether it can be auto-restored on this host. Builds
+# the "what's safe to import vs needs manual work" picture that
+# the orchestrator turns into actionable steps.
+#
+# Usage:
+#   validate_storage.sh <manifest-json-path-or-archive>
+#
+# Output: JSON {zfs: [...], lvm: [...], pve_storage: [...]} with
+# per-item action (auto_import / partial / manual_required / present)
+# and the disks/parameters that drove the decision.
+# ==========================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SOURCE="${1:-}"
+[[ -z "$SOURCE" ]] && { printf 'validate_storage: missing manifest source\n' >&2; exit 64; }
+
+manifest="$(bash "$SCRIPT_DIR/parse_manifest.sh" "$SOURCE")"
+
+# ── ZFS pools ──
+zfs_report='[]'
+while IFS= read -r pool_json; do
+  [[ -z "$pool_json" ]] && continue
+  name="$(printf '%s' "$pool_json" | jq -r '.name')"
+  needed_devs="$(printf '%s' "$pool_json" | jq -r '.devices_by_id[]?')"
+  present=()
+  missing=()
+  while IFS= read -r dev; do
+    [[ -z "$dev" ]] && continue
+    if [[ -e "/dev/disk/by-id/$dev" ]]; then
+      present+=("$dev")
+    else
+      missing+=("$dev")
+    fi
+  done <<< "$needed_devs"
+
+  # Already imported?
+  if zpool list -H -o name 2>/dev/null | grep -qFx "$name"; then
+    action="present"
+  elif [[ ${#missing[@]} -eq 0 ]]; then
+    action="auto_import"
+  elif [[ ${#present[@]} -gt 0 ]]; then
+    action="partial"
+  else
+    action="manual_required"
+  fi
+
+  present_json="$(printf '%s\n' "${present[@]:-}" | jq -R . | jq -s 'map(select(. != ""))')"
+  missing_json="$(printf '%s\n' "${missing[@]:-}" | jq -R . | jq -s 'map(select(. != ""))')"
+
+  zfs_report="$(jq --argjson acc "$zfs_report" \
+    --arg name "$name" \
+    --arg action "$action" \
+    --argjson present "$present_json" \
+    --argjson missing "$missing_json" \
+    -n '$acc + [{
+      name:    $name,
+      action:  $action,
+      present: $present,
+      missing: $missing
+    }]')"
+done < <(printf '%s' "$manifest" | jq -c '.storage_inventory.zfs_pools[]?')
+
+# ── LVM volume groups ──
+lvm_report='[]'
+while IFS= read -r vg_json; do
+  [[ -z "$vg_json" ]] && continue
+  name="$(printf '%s' "$vg_json" | jq -r '.name')"
+  if command -v vgs >/dev/null 2>&1 && vgs --noheadings -o vg_name 2>/dev/null | grep -qE "^[[:space:]]*${name}[[:space:]]*$"; then
+    action="present"
+  else
+    action="manual_required"
+  fi
+  lvm_report="$(jq --argjson acc "$lvm_report" \
+    --arg name "$name" --arg action "$action" \
+    -n '$acc + [{ name: $name, action: $action }]')"
+done < <(printf '%s' "$manifest" | jq -c '.storage_inventory.lvm.vgs[]?')
+
+# ── PVE storage.cfg entries ──
+# For each storage entry in the manifest we report whether it currently
+# exists in the destination's storage.cfg (no action needed), whether the
+# backing resource is reachable (e.g. NFS server pings), and what kind of
+# follow-up is required if the storage.cfg is being restored.
+pve_report='[]'
+existing_pve_ids='[]'
+if [[ -r /etc/pve/storage.cfg ]]; then
+  existing_pve_ids="$(awk '/^[a-z]+:[[:space:]]+/{print $2}' /etc/pve/storage.cfg | jq -R . | jq -s .)"
+fi
+
+while IFS= read -r st_json; do
+  [[ -z "$st_json" ]] && continue
+  id="$(printf '%s' "$st_json" | jq -r '.id')"
+  type="$(printf '%s' "$st_json" | jq -r '.type')"
+  server="$(printf '%s' "$st_json" | jq -r '.server // ""')"
+  pool="$(printf '%s' "$st_json" | jq -r '.pool // ""')"
+
+  already_present="$(printf '%s' "$existing_pve_ids" | jq -r --arg i "$id" 'any(. == $i)')"
+  reachable_note=""
+
+  case "$type" in
+    nfs|cifs)
+      if [[ -n "$server" ]]; then
+        if ping -c 1 -W 1 "$server" >/dev/null 2>&1; then
+          reachable_note="reachable"
+        else
+          reachable_note="server_unreachable"
+        fi
+      fi
+      ;;
+    zfspool)
+      # The pool name in storage.cfg is e.g. "rpool/data" — only valid
+      # if the parent pool is imported.
+      parent_pool="${pool%%/*}"
+      if [[ -n "$parent_pool" ]] && zpool list -H -o name 2>/dev/null | grep -qFx "$parent_pool"; then
+        reachable_note="pool_imported"
+      else
+        reachable_note="pool_not_imported"
+      fi
+      ;;
+  esac
+
+  if [[ "$already_present" == "true" ]]; then
+    action="present"
+  else
+    action="will_be_restored"
+  fi
+
+  pve_report="$(jq --argjson acc "$pve_report" \
+    --arg id "$id" --arg type "$type" --arg action "$action" --arg note "$reachable_note" \
+    -n '$acc + [{
+      id:     $id,
+      type:   $type,
+      action: $action,
+      note:   (if $note == "" then null else $note end)
+    }]')"
+done < <(printf '%s' "$manifest" | jq -c '.storage_inventory.pve_storage_cfg[]?')
+
+# Compose
+jq -n \
+  --argjson zfs "$zfs_report" \
+  --argjson lvm "$lvm_report" \
+  --argjson pve "$pve_report" \
+  '{ zfs: $zfs, lvm: $lvm, pve_storage: $pve }'
diff --git a/scripts/backup_restore/run_scheduled_backup.sh b/scripts/backup_restore/run_scheduled_backup.sh
old mode 100644
new mode 100755
index 73d86e7c..f7f1c1c8
--- a/scripts/backup_restore/run_scheduled_backup.sh
+++ b/scripts/backup_restore/run_scheduled_backup.sh
@@ -27,6 +27,9 @@ else
   exit 1
 fi
 
+load_language
+initialize_cache
+
 LIB_FILE="$SCRIPT_DIR/lib_host_backup_common.sh"
 [[ ! -f "$LIB_FILE" ]] && LIB_FILE="$LOCAL_SCRIPTS_DEFAULT/backup_restore/lib_host_backup_common.sh"
 if [[ -f "$LIB_FILE" ]]; then
@@ -57,7 +60,16 @@ _sb_prune_local() {
     for f in "${files[@]}"; do
       idx=$((idx+1))
       (( idx <= keep_last )) && continue
-      rm -f "$f" || true
+      # Remove the archive AND its sidecar in one shot — if we
+      # leave .proxmenux.json files behind, the Monitor would
+      # show them as broken entries pointing at deleted archives.
+      # Also drop the matching runner log so retention is symmetric:
+      # one archive ↔ one log, never an orphan log left behind.
+      local stem suffix
+      stem=$(basename "$f")
+      suffix=".${ext}"
+      stem="${stem%"$suffix"}"
+      rm -f "$f" "${f}.proxmenux.json" "${LOG_DIR}/${stem}.log" || true
     done
   fi
 }
@@ -80,29 +92,117 @@ _sb_run_local() {
     archive_ext="tar.gz"
   fi
 
+  # Drop a sidecar JSON next to the archive — explicit marker the
+  # Monitor can use to identify this as a scheduled host backup,
+  # independent of any future rename of the archive.
+  hb_write_archive_sidecar "$archive" "scheduled" "$job_id" "${PROFILE:-}" || true
+
   _sb_prune_local "$job_id" "$dest_dir" "$archive_ext"
   echo "LOCAL_ARCHIVE=$archive"
   return 0
 }
 
+# Look up a borg destination's passphrase from the proxmenux state
+# directory. The shell convention is `borg-pass-<name>.txt` next to
+# `borg-targets.txt`; we resolve the `<name>` by scanning targets for
+# the one whose repository matches the runtime BORG_REPO.
+_sb_borg_resolve_password() {
+  local repo="$1"
+  local cfg="${HB_STATE_DIR:-/usr/local/share/proxmenux}/borg-targets.txt"
+  [[ -f "$cfg" && -n "$repo" ]] || return 1
+  local found_name="" line name target_repo
+  while IFS='|' read -r name target_repo _; do
+    [[ -z "$name" || -z "$target_repo" ]] && continue
+    if [[ "$target_repo" == "$repo" ]]; then
+      found_name="$name"
+      break
+    fi
+  done < "$cfg"
+  [[ -z "$found_name" ]] && return 1
+  local pf="${HB_STATE_DIR:-/usr/local/share/proxmenux}/borg-pass-${found_name}.txt"
+  [[ -r "$pf" ]] || return 1
+  cat "$pf"
+}
+
 _sb_run_borg() {
   local stage_root="$1"
   local archive_name="$2"
-  local borg_bin repo passphrase
+  local borg_bin repo passphrase encrypt_mode
 
-  borg_bin=$(hb_ensure_borg) || return 1
+  borg_bin=$(hb_ensure_borg) || { echo "borg binary not available"; return 1; }
   repo="${BORG_REPO:-}"
   passphrase="${BORG_PASSPHRASE:-}"
-  [[ -z "$repo" || -z "$passphrase" ]] && return 1
-
-  export BORG_PASSPHRASE="$passphrase"
-
-  if ! hb_borg_init_if_needed "$borg_bin" "$repo" "${BORG_ENCRYPT_MODE:-none}" >/dev/null 2>&1; then
+  encrypt_mode="${BORG_ENCRYPT_MODE:-none}"
+  if [[ -z "$repo" ]]; then
+    echo "BORG_REPO not configured"
+    return 1
+  fi
+  # Empty passphrase + encrypted mode → look it up from the saved
+  # destination sidecar (the canonical place for borg credentials,
+  # same pattern as PBS). Jobs created against a destination that
+  # has its passphrase stored no longer need to duplicate it in the
+  # job .env.
+  if [[ -z "$passphrase" && "$encrypt_mode" != "none" ]]; then
+    passphrase=$(_sb_borg_resolve_password "$repo" 2>/dev/null || true)
+  fi
+  if [[ "$encrypt_mode" != "none" && -z "$passphrase" ]]; then
+    echo "BORG_PASSPHRASE is required when encryption is enabled (mode=$encrypt_mode)"
+    echo "  → save the passphrase on the destination or set it in the job .env"
     return 1
   fi
 
+  # Re-export the credentials so child processes (borg, ssh) inherit
+  # them. `source <job.env>` only assigns to the current shell — without
+  # an explicit re-export, child `borg` calls drop back to ssh defaults
+  # and a remote repo silently auth-fails with no log trail.
+  export BORG_PASSPHRASE="$passphrase"
+  [[ -n "${BORG_RSH:-}" ]] && export BORG_RSH
+  export BORG_RELOCATED_REPO_ACCESS_IS_OK=yes
+  export BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=yes
+
+  # Probe the repo first when working with a local path. Three cases
+  # the operator hits regularly:
+  #   - path is a valid borg repo + creds match  → `borg list` works
+  #   - path is a valid borg repo + creds DON'T match  → explicit
+  #     "credentials don't match" error (a wrong passphrase saved on
+  #     the destination, typically)
+  #   - path exists, has files, but is NOT a borg repo → explicit
+  #     "path is not empty" error so the operator points at a fresh
+  #     subdirectory instead of hitting borg's confusing "There is
+  #     already something at <path>" message
+  if [[ "$repo" != ssh://* && -d "$repo" ]]; then
+    if ! "$borg_bin" list "$repo" </dev/null >/dev/null 2>&1; then
+      local repo_config="$repo/config"
+      if [[ -f "$repo_config" ]] && grep -qE '^\[repository\]' "$repo_config" 2>/dev/null; then
+        echo "Borg repository at ${repo} exists but the configured credentials don't match it."
+        echo "  → the saved passphrase or encryption mode for this destination is wrong."
+        return 1
+      fi
+      # Not a repo. If the directory isn't empty, init will fail with
+      # "There is already something at <path>". Detect and explain.
+      if find "$repo" -mindepth 1 -maxdepth 1 -print -quit 2>/dev/null | grep -q .; then
+        echo "Path ${repo} is not a borg repository AND is not empty."
+        echo "  → Borg refuses to initialize a repo where there are other files."
+        echo "  → Point the destination at a fresh empty subdirectory (e.g. ${repo}/borgbackup)."
+        return 1
+      fi
+    fi
+  fi
+
+  # Send stderr to stdout so the caller's `>>$log_file 2>&1` captures
+  # borg's diagnostics. The previous `>/dev/null 2>&1` silenced every
+  # error and made "Job finished with errors" impossible to debug.
+  if ! hb_borg_init_if_needed "$borg_bin" "$repo" "$encrypt_mode" 2>&1; then
+    return 1
+  fi
+
+  # Include manifest.json (top-level) when present. Borg needs the
+  # paths spelled out explicitly — without this, parse_manifest can't
+  # find the schema'd manifest on a restored Borg archive.
+  local -a _borg_paths=(rootfs metadata)
+  [[ -f "$stage_root/manifest.json" ]] && _borg_paths+=(manifest.json)
   (cd "$stage_root" && "$borg_bin" create --stats \
-    "${repo}::${archive_name}" rootfs metadata) >/dev/null 2>&1 || return 1
+    "${repo}::${archive_name}" "${_borg_paths[@]}") 2>&1 || return 1
 
   "$borg_bin" prune -v --list "$repo" \
     ${KEEP_LAST:+--keep-last "$KEEP_LAST"} \
@@ -111,47 +211,294 @@ _sb_run_borg() {
     ${KEEP_WEEKLY:+--keep-weekly "$KEEP_WEEKLY"} \
     ${KEEP_MONTHLY:+--keep-monthly "$KEEP_MONTHLY"} \
     ${KEEP_YEARLY:+--keep-yearly "$KEEP_YEARLY"} \
-    >/dev/null 2>&1 || true
+    2>&1 || true
 
   echo "BORG_ARCHIVE=${archive_name}"
   return 0
 }
 
+# Resolve a PBS password for an auto-discovered Datacenter storage by
+# matching the repository string against /etc/pve/storage.cfg and
+# returning the contents of /etc/pve/priv/storage/<name>.pw. Used as a
+# fallback when the job .env carries an empty PBS_PASSWORD — happens
+# when the operator picks a PVE-managed PBS in the wizard (the .pw
+# file is the canonical credential location for those).
+#
+# Implemented in pure bash because the previous awk version relied on
+# `match($0, regex, arr)` which is a gawk extension and silently no-ops
+# on mawk / busybox awk — leaving the password unresolved and breaking
+# every manual / scheduled PBS run against a PVE-managed storage.
+_sb_pbs_resolve_password() {
+  local repo="$1"
+  local cfg=/etc/pve/storage.cfg
+  [[ -f "$cfg" && -n "$repo" ]] || return 1
+
+  local current_type="" current_name="" server="" datastore="" username=""
+  local found_name=""
+
+  _try_match() {
+    [[ "$current_type" == "pbs" && -n "$current_name" && -n "$server" && -n "$datastore" ]] || return
+    local u="${username:-root@pam}"
+    local built="${u}@${server}:${datastore}"
+    if [[ "$built" == "$repo" ]]; then
+      found_name="$current_name"
+    fi
+  }
+
+  local line key val
+  while IFS= read -r line; do
+    if [[ "$line" =~ ^([a-z]+):[[:space:]]+(.+)$ ]]; then
+      _try_match
+      [[ -n "$found_name" ]] && break
+      current_type="${BASH_REMATCH[1]}"
+      current_name="${BASH_REMATCH[2]}"
+      server=""; datastore=""; username=""
+      continue
+    fi
+    if [[ "$line" =~ ^[[:space:]]+([a-zA-Z_]+)[[:space:]]+(.+)$ ]]; then
+      key="${BASH_REMATCH[1]}"
+      val="${BASH_REMATCH[2]}"
+      case "$key" in
+        server)    server="$val" ;;
+        datastore) datastore="$val" ;;
+        username)  username="$val" ;;
+      esac
+    fi
+  done < "$cfg"
+  # Final block may not have triggered the start-of-next-block check.
+  [[ -z "$found_name" ]] && _try_match
+  unset -f _try_match 2>/dev/null
+
+  [[ -z "$found_name" ]] && return 1
+  local pw_file="/etc/pve/priv/storage/${found_name}.pw"
+  [[ -r "$pw_file" ]] || return 1
+  cat "$pw_file"
+}
+
+# Return the certificate fingerprint of the PBS storage entry whose
+# `<user>@<server>:<datastore>` matches $1. Mirrors the walker in
+# `_sb_pbs_resolve_password` but reads the `fingerprint <sha>` line
+# instead. Needed because attached scheduled jobs are created without
+# PBS_FINGERPRINT in their .env (the wizard inherits it from
+# `/etc/pve/storage.cfg`), and without a fingerprint the client falls
+# back to an interactive `(y/n)` prompt at connect time — which never
+# gets an answer under systemd, hanging the whole job. Empty result
+# is a valid outcome (PBS behind a CA-signed cert doesn't need one);
+# a missing storage entry returns non-zero so the caller can log it.
+_sb_pbs_resolve_fingerprint() {
+  local repo="$1"
+  local cfg=/etc/pve/storage.cfg
+  [[ -f "$cfg" && -n "$repo" ]] || return 1
+
+  local current_type="" current_name="" server="" datastore="" username=""
+  local current_fp=""
+  local found_fp="" found_any=0
+
+  local line key val
+  while IFS= read -r line; do
+    if [[ "$line" =~ ^([a-z]+):[[:space:]]+(.+)$ ]]; then
+      if [[ "$current_type" == "pbs" && -n "$current_name" && -n "$server" && -n "$datastore" ]]; then
+        local u="${username:-root@pam}"
+        local built="${u}@${server}:${datastore}"
+        if [[ "$built" == "$repo" ]]; then
+          found_fp="$current_fp"
+          found_any=1
+          break
+        fi
+      fi
+      current_type="${BASH_REMATCH[1]}"
+      current_name="${BASH_REMATCH[2]}"
+      server=""; datastore=""; username=""; current_fp=""
+      continue
+    fi
+    if [[ "$line" =~ ^[[:space:]]+([a-zA-Z_]+)[[:space:]]+(.+)$ ]]; then
+      key="${BASH_REMATCH[1]}"
+      val="${BASH_REMATCH[2]}"
+      case "$key" in
+        server)      server="$val" ;;
+        datastore)   datastore="$val" ;;
+        username)    username="$val" ;;
+        fingerprint) current_fp="$val" ;;
+      esac
+    fi
+  done < "$cfg"
+  # Final block may not have triggered the start-of-next-block check.
+  if (( ! found_any )); then
+    if [[ "$current_type" == "pbs" && -n "$current_name" && -n "$server" && -n "$datastore" ]]; then
+      local u="${username:-root@pam}"
+      local built="${u}@${server}:${datastore}"
+      if [[ "$built" == "$repo" ]]; then
+        found_fp="$current_fp"
+        found_any=1
+      fi
+    fi
+  fi
+
+  (( found_any )) || return 1
+  # Empty fingerprint is a legit outcome for CA-signed PBS setups.
+  printf '%s' "$found_fp"
+}
+
 _sb_run_pbs() {
   local stage_root="$1"
   local backup_id="$2"
   local epoch="$3"
+  # Stage the WHOLE root (rootfs/ + metadata/ + manifest.json), not
+  # just rootfs/. Mirrors backup_host.sh::_bk_pbs (the TUI flow) — and
+  # parse_manifest.sh / run_restore.sh need metadata/ + manifest.json
+  # to compose a meaningful restore plan. With only rootfs/ in the
+  # pxar, View Contents reports "no manifest.json" forever.
   local -a cmd=(
     proxmox-backup-client backup
-    "hostcfg.pxar:${stage_root}/rootfs"
+    "hostcfg.pxar:${stage_root}"
     --repository "$PBS_REPOSITORY"
     --backup-type host
     --backup-id "$backup_id"
     --backup-time "$epoch"
   )
 
+  # If the .env was created against a Datacenter-managed PBS storage,
+  # PBS_PASSWORD is intentionally empty there (the credential lives in
+  # /etc/pve/priv/storage/<name>.pw). Resolve it now so the rest of
+  # this function can run unchanged.
+  if [[ -z "${PBS_PASSWORD:-}" && -n "${PBS_REPOSITORY:-}" ]]; then
+    PBS_PASSWORD=$(_sb_pbs_resolve_password "$PBS_REPOSITORY" 2>/dev/null || true)
+  fi
+
+  # Same treatment for PBS_FINGERPRINT. Attached scheduled jobs are
+  # created without one (the wizard delegates trust to PVE's storage
+  # config), and running proxmox-backup-client with an empty fingerprint
+  # against a self-signed PBS drops into an interactive `(y/n)` prompt —
+  # which under systemd never gets an answer and hangs the timer.
+  # Resolving on-demand from storage.cfg matches the runtime behavior
+  # PVE itself has for its own vzdump jobs.
+  if [[ -z "${PBS_FINGERPRINT:-}" && -n "${PBS_REPOSITORY:-}" ]]; then
+    PBS_FINGERPRINT=$(_sb_pbs_resolve_fingerprint "$PBS_REPOSITORY" 2>/dev/null || true)
+  fi
+
+  # PBS_ENCRYPTION_PASSWORD: the passphrase that unlocks the keyfile
+  # itself when it was created with `--kdf scrypt`. The Import flow
+  # persists it at pbs-key.pass (chmod 600, root-only, same trust
+  # boundary as the keyfile). If the file is absent the keyfile is
+  # kdf=none and no passphrase is needed. `PBS_ENCRYPTION_PASSWORD`
+  # from the .env still wins if the operator set it there for a
+  # per-job override.
+  if [[ -z "${PBS_ENCRYPTION_PASSWORD:-}" ]]; then
+    local _pbs_pass_file="/usr/local/share/proxmenux/pbs-key.pass"
+    if [[ -r "$_pbs_pass_file" ]]; then
+      PBS_ENCRYPTION_PASSWORD=$(cat "$_pbs_pass_file" 2>/dev/null || true)
+    fi
+  fi
+
   [[ -z "${PBS_REPOSITORY:-}" || -z "${PBS_PASSWORD:-}" ]] && return 1
   if [[ -n "${PBS_KEYFILE:-}" ]]; then
     cmd+=(--keyfile "$PBS_KEYFILE")
   fi
 
-  env PBS_PASSWORD="$PBS_PASSWORD" PBS_ENCRYPTION_PASSWORD="${PBS_ENCRYPTION_PASSWORD:-}" \
-    "${cmd[@]}" >/dev/null 2>&1 || return 1
+  # `</dev/null` on every proxmox-backup-client invocation defends
+  # against any interactive prompt (fingerprint mismatch, keyfile
+  # passphrase, ...) that would otherwise block on stdin under systemd
+  # and freeze the timer for its entire timeout window. With the
+  # fingerprint resolved above the prompt should never fire, but if
+  # storage.cfg is out of sync (PBS cert rotated, entry renamed) we
+  # want a fast, clear failure — not a silent hang.
+  env PBS_PASSWORD="$PBS_PASSWORD" \
+      PBS_ENCRYPTION_PASSWORD="${PBS_ENCRYPTION_PASSWORD:-}" \
+      PBS_FINGERPRINT="${PBS_FINGERPRINT:-}" \
+    "${cmd[@]}" </dev/null 2>&1 || return 1
 
   # Best effort prune for PBS group.
-  proxmox-backup-client prune "host/${backup_id}" --repository "$PBS_REPOSITORY" \
-    ${KEEP_LAST:+--keep-last "$KEEP_LAST"} \
-    ${KEEP_HOURLY:+--keep-hourly "$KEEP_HOURLY"} \
-    ${KEEP_DAILY:+--keep-daily "$KEEP_DAILY"} \
-    ${KEEP_WEEKLY:+--keep-weekly "$KEEP_WEEKLY"} \
-    ${KEEP_MONTHLY:+--keep-monthly "$KEEP_MONTHLY"} \
-    ${KEEP_YEARLY:+--keep-yearly "$KEEP_YEARLY"} \
-    >/dev/null 2>&1 || true
+  env PBS_PASSWORD="$PBS_PASSWORD" \
+      PBS_FINGERPRINT="${PBS_FINGERPRINT:-}" \
+    proxmox-backup-client prune "host/${backup_id}" --repository "$PBS_REPOSITORY" \
+      ${KEEP_LAST:+--keep-last "$KEEP_LAST"} \
+      ${KEEP_HOURLY:+--keep-hourly "$KEEP_HOURLY"} \
+      ${KEEP_DAILY:+--keep-daily "$KEEP_DAILY"} \
+      ${KEEP_WEEKLY:+--keep-weekly "$KEEP_WEEKLY"} \
+      ${KEEP_MONTHLY:+--keep-monthly "$KEEP_MONTHLY"} \
+      ${KEEP_YEARLY:+--keep-yearly "$KEEP_YEARLY"} \
+      </dev/null 2>&1 || true
+
+  # Upload the keyfile recovery blob alongside the main backup so the
+  # operator can rebuild the keyfile on a fresh host. Only fires when:
+  #   - this backup was encrypted (PBS_KEYFILE set), AND
+  #   - the operator configured a recovery passphrase
+  #     (pbs-key.recovery.enc exists, created by the UI's
+  #     /pbs-recovery/setup endpoint or shell hb_pbs_setup_recovery).
+  # The blob is already passphrase-encrypted by openssl, so we do NOT
+  # pass --keyfile here: PBS stores it as a plain blob retrievable
+  # without the keyfile, which is the whole point of the escrow.
+  local recovery_enc="/usr/local/share/proxmenux/pbs-key.recovery.enc"
+  if [[ -n "${PBS_KEYFILE:-}" && -f "$recovery_enc" ]]; then
+    local keyrec_id
+    keyrec_id="hostcfg-$(hostname)-keyrecovery"
+    env PBS_PASSWORD="$PBS_PASSWORD" \
+        PBS_FINGERPRINT="${PBS_FINGERPRINT:-}" \
+      proxmox-backup-client backup \
+        "keyrecovery.conf:${recovery_enc}" \
+        --repository "$PBS_REPOSITORY" \
+        --backup-type host \
+        --backup-id "$keyrec_id" \
+        --backup-time "$epoch" \
+        </dev/null 2>&1 || true
+
+    # Prune the paired keyrecovery group with the SAME retention
+    # values as the main backup. Without this the keyrecovery snapshots
+    # accumulate one per run while the main group is pruned to keep-*,
+    # cluttering the datastore over time. Any single keyrecovery snapshot
+    # is sufficient to reconstruct the keyfile — but matching retention
+    # keeps the two groups aligned in count and makes cleanup obvious.
+    env PBS_PASSWORD="$PBS_PASSWORD" \
+        PBS_FINGERPRINT="${PBS_FINGERPRINT:-}" \
+      proxmox-backup-client prune "host/${keyrec_id}" --repository "$PBS_REPOSITORY" \
+        ${KEEP_LAST:+--keep-last "$KEEP_LAST"} \
+        ${KEEP_HOURLY:+--keep-hourly "$KEEP_HOURLY"} \
+        ${KEEP_DAILY:+--keep-daily "$KEEP_DAILY"} \
+        ${KEEP_WEEKLY:+--keep-weekly "$KEEP_WEEKLY"} \
+        ${KEEP_MONTHLY:+--keep-monthly "$KEEP_MONTHLY"} \
+        ${KEEP_YEARLY:+--keep-yearly "$KEEP_YEARLY"} \
+        </dev/null 2>&1 || true
+  fi
 
   echo "PBS_SNAPSHOT=host/${backup_id}/${epoch}"
   return 0
 }
 
+# For attached jobs, re-read the parent vzdump job's prune-backups
+# live from /etc/pve/jobs.cfg every run and rewrite KEEP_*. The .env
+# only carries a snapshot of the parent's retention at creation time,
+# so if the parent later gained (or changed) prune-backups the child
+# would silently accumulate. Attached mode is authoritative from the
+# parent by design — that's the whole point of "attached".
+_sb_hydrate_attached_retention() {
+  local parent="${PVE_PARENT_JOB:-}"
+  [[ -z "$parent" ]] && return 0
+  local cfg=/etc/pve/jobs.cfg
+  [[ -f "$cfg" ]] || return 0
+
+  local prune
+  prune=$(awk -v pid="$parent" '
+    /^vzdump:[[:space:]]/ { in_block=($2==pid); next }
+    /^[a-z]+:/ { in_block=0; next }
+    in_block && /^[[:space:]]+prune-backups[[:space:]]/ {
+      sub(/^[[:space:]]+prune-backups[[:space:]]+/, "");
+      print; exit
+    }
+  ' "$cfg")
+
+  # Clear any KEEP_* the .env may have — those are the create-time
+  # snapshot and are now stale. If the parent later removed prune-
+  # backups altogether, this correctly stops pruning the child too.
+  unset KEEP_LAST KEEP_HOURLY KEEP_DAILY KEEP_WEEKLY KEEP_MONTHLY KEEP_YEARLY
+
+  [[ -z "$prune" ]] && return 0
+
+  local kv
+  while IFS= read -r kv; do
+    [[ -n "$kv" ]] && export "${kv?}"
+  done < <(hb_pve_prune_to_keep_env "$prune")
+}
+
 main() {
   local job_id="${1:-}"
   [[ -z "$job_id" ]] && { echo "Usage: $0 <job_id>" >&2; exit 1; }
@@ -162,6 +509,11 @@ main() {
   # shellcheck source=/dev/null
   source "$job_file"
 
+  # Attached jobs: re-read retention from the PVE parent live (see
+  # _sb_hydrate_attached_retention above for the why). Standalone
+  # jobs keep whatever KEEP_* the .env has.
+  _sb_hydrate_attached_retention
+
   local lock_file="${LOCK_DIR}/proxmenux-backup-${job_id}.lock"
   if command -v flock >/dev/null 2>&1; then
     exec 9>"$lock_file" || exit 1
@@ -187,13 +539,34 @@ main() {
   {
     echo "=== Scheduled backup job ${job_id} started at $(date -Iseconds) ==="
     echo "Backend: ${BACKEND:-}"
+    echo "Profile: ${PROFILE_MODE:-default}"
   } >"$log_file"
 
+  # Fire the lifecycle "start" event. Per-channel/per-event toggles in
+  # Settings decide whether the user actually receives it
+  # (host_backup_start ships with default_enabled=False).
+  local _hb_dest=""
+  case "${BACKEND:-}" in
+    local) _hb_dest="${LOCAL_DEST_DIR:-/var/lib/vz/dump}" ;;
+    borg)  _hb_dest="${BORG_REPO:-}" ;;
+    pbs)   _hb_dest="${PBS_REPOSITORY:-}" ;;
+  esac
+  export HB_NOTIFY_BACKEND="${BACKEND:-}"
+  export HB_NOTIFY_DESTINATION="$_hb_dest"
+  export HB_NOTIFY_PROFILE_MODE="${PROFILE_MODE:-default}"
+  export HB_NOTIFY_LOG_FILE="$log_file"
+  hb_notify_lifecycle "start"
+
   local -a paths=()
   if [[ "${PROFILE_MODE:-default}" == "custom" && -f "${JOBS_DIR}/${job_id}.paths" ]]; then
     mapfile -t paths < "${JOBS_DIR}/${job_id}.paths"
   else
-    mapfile -t paths < <(hb_default_profile_paths)
+    # Default profile = base paths + operator-saved extras (the
+    # TUI flow does the same — see hb_resolve_paths_mode in
+    # lib_host_backup_common.sh). Without the extras line, the
+    # `backup-extra-paths.txt` set in Settings was silently
+    # ignored for scheduled / manual runs from the Monitor.
+    mapfile -t paths < <(hb_default_profile_paths; hb_load_extra_paths)
   fi
 
   if [[ ${#paths[@]} -eq 0 ]]; then
@@ -203,21 +576,57 @@ main() {
     exit 1
   fi
 
+  # Interactive output mirrors the colored layout of _bk_local in
+  # backup_host.sh when stdout is a TTY (operator launched "Run job
+  # now"). Otherwise — timer / vzdump hook — only the plain log
+  # file is written.
+  local TTY=0
+  [[ -t 1 ]] && TTY=1
+
+  if (( TTY )); then
+    echo -e "${TAB}${BGN}$(translate "Backend:")${CL}        ${BL}${BACKEND}${CL}"
+    echo -e "${TAB}${BGN}$(translate "Profile:")${CL}        ${BL}${PROFILE_MODE:-default}${CL}"
+    echo -e "${TAB}${BGN}$(translate "Paths to back up:")${CL}  ${BL}${#paths[@]}${CL}"
+    echo
+    msg_info "$(translate "Preparing staging area...")"
+  fi
+  {
+    echo "Paths to back up: ${#paths[@]}"
+    echo "Preparing staging area at $stage_root ..."
+  } >>"$log_file"
   hb_prepare_staging "$stage_root" "${paths[@]}" >>"$log_file" 2>&1
+  local staged_files staged_size
+  staged_files=$(find "$stage_root/rootfs" -type f 2>/dev/null | wc -l)
+  staged_size=$(hb_file_size "$stage_root/rootfs" 2>/dev/null || echo "?")
+  echo "Staging ready: $staged_files files copied (size $staged_size)." >>"$log_file"
+  (( TTY )) && msg_ok "$(translate "Staging ready.") $(translate "Data size:") $staged_size — $staged_files $(translate "files")"
+
+  local rc=1 t_start elapsed archive_path=""
+  t_start=$SECONDS
 
-  local rc=1
   case "${BACKEND:-}" in
     local)
-      _sb_run_local "$stage_root" "$job_id" "$ts" "${LOCAL_DEST_DIR:-/var/lib/vz/dump}" >>"$log_file" 2>&1
+      (( TTY )) && { echo; msg_info "$(translate "Creating local archive...")"; stop_spinner; }
+      echo "Writing local archive to ${LOCAL_DEST_DIR:-/var/lib/vz/dump} ..." >>"$log_file"
+      local _output
+      _output=$(_sb_run_local "$stage_root" "$job_id" "$ts" "${LOCAL_DEST_DIR:-/var/lib/vz/dump}" 2>>"$log_file")
       rc=$?
+      echo "$_output" >>"$log_file"
+      archive_path=$(grep "^LOCAL_ARCHIVE=" <<<"$_output" | cut -d'=' -f2-)
       ;;
     borg)
+      (( TTY )) && { echo; msg_info "$(translate "Sending backup to Borg repository...")"; stop_spinner; }
+      echo "Sending backup to Borg repository ${BORG_REPO:-} ..." >>"$log_file"
       _sb_run_borg "$stage_root" "${job_id}-${ts}" >>"$log_file" 2>&1
       rc=$?
+      archive_path="${BORG_REPO:-}::${job_id}-${ts}"
       ;;
     pbs)
+      (( TTY )) && { echo; msg_info "$(translate "Sending backup to PBS...")"; stop_spinner; }
+      echo "Sending backup to PBS ${PBS_REPOSITORY:-} (id=${PBS_BACKUP_ID:-hostcfg-$(hostname)}) ..." >>"$log_file"
       _sb_run_pbs "$stage_root" "${PBS_BACKUP_ID:-hostcfg-$(hostname)}" "$(date +%s)" >>"$log_file" 2>&1
       rc=$?
+      archive_path="${PBS_REPOSITORY:-}::host/${PBS_BACKUP_ID:-hostcfg-$(hostname)}"
       ;;
     *)
       echo "Unknown backend: ${BACKEND:-}" >>"$log_file"
@@ -225,17 +634,68 @@ main() {
       ;;
   esac
 
+  elapsed=$((SECONDS - t_start))
+
+  echo "Cleaning up staging area ..." >>"$log_file"
   rm -rf "$stage_root"
 
+  # Single source of truth for archive_size (was previously computed
+  # only inside the TTY block, which left the notification body with
+  # '-' for headless scheduled runs). Local backends know the actual
+  # output file; PBS / Borg backends manage their own dedupe storage
+  # so we leave '-' meaning "see repository for usage".
+  local archive_size="-"
+  if [[ "${BACKEND:-}" == "local" && -n "$archive_path" && -f "$archive_path" ]]; then
+    archive_size=$(hb_file_size "$archive_path" 2>/dev/null || echo '-')
+  fi
+  local pretty_duration
+  pretty_duration=$(hb_human_elapsed "$elapsed" 2>/dev/null || echo "${elapsed}s")
+
   if [[ $rc -eq 0 ]]; then
     echo "RESULT=ok" >>"$summary_file"
     echo "LOG_FILE=${log_file}" >>"$summary_file"
     echo "=== Job finished OK at $(date -Iseconds) ===" >>"$log_file"
+    export HB_NOTIFY_DATA_SIZE="$staged_size"
+    export HB_NOTIFY_ARCHIVE_SIZE="$archive_size"
+    export HB_NOTIFY_DURATION="$pretty_duration"
+    hb_notify_lifecycle "complete"
+    if (( TTY )); then
+      local method_label
+      case "${BACKEND:-}" in
+        local) method_label="Local archive (tar)" ;;
+        borg)  method_label="Borg repository" ;;
+        pbs)   method_label="Proxmox Backup Server" ;;
+      esac
+      echo
+      echo -e "${TAB}${BOLD}$(translate "Backup completed:")${CL}"
+      echo -e "${TAB}${BGN}$(translate "Method:")${CL}        ${BL}${method_label}${CL}"
+      [[ -n "$archive_path" ]] && \
+        echo -e "${TAB}${BGN}$(translate "Archive:")${CL}       ${BL}${archive_path}${CL}"
+      echo -e "${TAB}${BGN}$(translate "Data size:")${CL}     ${BL}${staged_size}${CL}"
+      [[ "$archive_size" != "-" ]] && \
+        echo -e "${TAB}${BGN}$(translate "Archive size:")${CL}  ${BL}${archive_size}${CL}"
+      echo -e "${TAB}${BGN}$(translate "Duration:")${CL}      ${BL}$(hb_human_elapsed "$elapsed")${CL}"
+      echo -e "${TAB}${BGN}$(translate "Log:")${CL}           ${BL}${log_file}${CL}"
+      echo
+      msg_ok "$(translate "Backup completed successfully.")"
+    fi
     exit 0
   else
     echo "RESULT=failed" >>"$summary_file"
     echo "LOG_FILE=${log_file}" >>"$summary_file"
     echo "=== Job finished with errors at $(date -Iseconds) ===" >>"$log_file"
+    # Build a one-line reason from the last error-ish line in the log
+    # so the notification body has something actionable rather than a
+    # generic "Reason: unknown". Falls back to the literal exit code.
+    local _hb_reason=""
+    _hb_reason=$(grep -iE 'error|fail|fatal|abort' "$log_file" 2>/dev/null | tail -1 | sed 's/^[[:space:]]*//')
+    [[ -z "$_hb_reason" ]] && _hb_reason="Runner exited with status ${rc}"
+    export HB_NOTIFY_DATA_SIZE="${staged_size:-}"
+    export HB_NOTIFY_ARCHIVE_SIZE="$archive_size"
+    export HB_NOTIFY_DURATION="$pretty_duration"
+    export HB_NOTIFY_REASON="$_hb_reason"
+    hb_notify_lifecycle "fail"
+    (( TTY )) && msg_error "$(translate "Backup failed. See log:") $log_file"
     exit 1
   fi
 }
diff --git a/scripts/backup_restore/schema/manifest.schema.json b/scripts/backup_restore/schema/manifest.schema.json
new file mode 100644
index 00000000..3d401890
--- /dev/null
+++ b/scripts/backup_restore/schema/manifest.schema.json
@@ -0,0 +1,304 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://proxmenux.dev/schemas/host-backup-manifest/v1.json",
+  "title": "ProxMenux Host Backup Manifest",
+  "description": "Recipe-style manifest embedded inside every ProxMenux host backup. Generated at backup time and consumed by the restore wizard for compatibility checks, driver reinstallation via ProxMenux installers, and hardware/storage validation before applying any file. Schema designed against the .55 fixture (AMD homelab, LVM, vfio passthrough, NFS+CIFS) and the .89 production target (NVIDIA Quadro + ZFS).",
+  "type": "object",
+  "required": ["proxmenux_backup_manifest"],
+  "additionalProperties": false,
+  "properties": {
+    "proxmenux_backup_manifest": {
+      "type": "object",
+      "required": ["schema_version", "created_at", "source_host"],
+      "additionalProperties": false,
+      "properties": {
+        "schema_version": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Manifest schema version. Bumped on breaking field changes."
+        },
+        "created_at": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO8601 timestamp of backup creation."
+        },
+        "created_by": {
+          "type": "string",
+          "description": "Tool + version, e.g. 'proxmenux-host-backup/1.3.0'."
+        },
+        "source_host":                   { "$ref": "#/$defs/source_host" },
+        "hardware_inventory":            { "$ref": "#/$defs/hardware_inventory" },
+        "storage_inventory":             { "$ref": "#/$defs/storage_inventory" },
+        "proxmenux_installed_components": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/installed_component" }
+        },
+        "kernel_params":                 { "$ref": "#/$defs/kernel_params" },
+        "vms_lxcs_at_backup":            { "$ref": "#/$defs/guests_inventory" },
+        "backup_metadata":               { "$ref": "#/$defs/backup_metadata" }
+      }
+    }
+  },
+
+  "$defs": {
+    "source_host": {
+      "type": "object",
+      "required": ["hostname", "kernel", "roles", "boot_mode", "cpu_arch", "memory_kb"],
+      "additionalProperties": false,
+      "properties": {
+        "hostname":            { "type": "string", "minLength": 1 },
+        "pve_version":         { "type": ["string", "null"], "description": "Short version like 9.2.2." },
+        "pve_version_full":    { "type": ["string", "null"], "description": "Full pveversion line." },
+        "pbs_version":         { "type": ["string", "null"], "description": "Present only if proxmox-backup-server is installed." },
+        "roles": {
+          "type": "array",
+          "items": { "enum": ["pve", "pbs"] },
+          "minItems": 1,
+          "uniqueItems": true,
+          "description": "Domain roles present on the host. Drives recipe selection at restore."
+        },
+        "kernel":              { "type": "string" },
+        "boot_mode":           { "enum": ["efi", "bios"] },
+        "root_fs":             { "enum": ["ext4", "xfs", "btrfs", "zfs"] },
+        "cpu_model":           { "type": "string" },
+        "cpu_arch":            { "enum": ["x86_64", "aarch64"] },
+        "memory_kb":           { "type": "integer", "minimum": 0 }
+      }
+    },
+
+    "hardware_inventory": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "gpu":      { "type": "array", "items": { "$ref": "#/$defs/gpu" } },
+        "tpu":      { "type": "array", "items": { "$ref": "#/$defs/tpu" } },
+        "nic":      { "type": "array", "items": { "$ref": "#/$defs/nic" } },
+        "wireless": { "type": "array", "items": { "$ref": "#/$defs/wireless" } }
+      }
+    },
+
+    "gpu": {
+      "type": "object",
+      "required": ["vendor", "pci_address", "pci_id"],
+      "additionalProperties": false,
+      "properties": {
+        "vendor":                   { "enum": ["AMD", "NVIDIA", "Intel", "Other"] },
+        "model":                    { "type": "string" },
+        "pci_address":              { "type": "string", "pattern": "^[0-9a-f]{4}:[0-9a-f]{2}:[0-9a-f]{2}\\.[0-9a-f]$" },
+        "pci_id":                   { "type": "string", "pattern": "^[0-9a-f]{4}:[0-9a-f]{4}$" },
+        "kernel_driver":            { "type": ["string", "null"] },
+        "passthrough_eligible":     { "type": "boolean" },
+        "proxmenux_installer":      { "type": ["string", "null"], "description": "Relative path to the installer script, e.g. 'scripts/gpu_tpu/nvidia_installer.sh'. Null if no installer is applicable (AMD iGPU, etc.)." },
+        "installed_driver_version": { "type": ["string", "null"] }
+      }
+    },
+
+    "tpu": {
+      "type": "object",
+      "required": ["vendor"],
+      "additionalProperties": false,
+      "properties": {
+        "vendor":              { "enum": ["Google", "Other"] },
+        "model":               { "type": "string" },
+        "bus":                 { "enum": ["PCIe", "USB"] },
+        "pci_address":         { "type": ["string", "null"] },
+        "proxmenux_installer": { "type": ["string", "null"] },
+        "installed_version":   { "type": ["string", "null"] }
+      }
+    },
+
+    "nic": {
+      "type": "object",
+      "required": ["ifname", "mac"],
+      "additionalProperties": false,
+      "properties": {
+        "ifname":        { "type": "string" },
+        "mac":           { "type": "string", "pattern": "^[0-9a-f:]{17}$" },
+        "kernel_driver": { "type": ["string", "null"] },
+        "in_bridges":    { "type": "array", "items": { "type": "string" } },
+        "operstate":     { "enum": ["UP", "DOWN", "UNKNOWN"] }
+      }
+    },
+
+    "wireless": {
+      "type": "object",
+      "required": ["ifname", "mac"],
+      "additionalProperties": false,
+      "properties": {
+        "ifname": { "type": "string" },
+        "mac":    { "type": "string" }
+      }
+    },
+
+    "storage_inventory": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "zfs_pools":       { "type": "array", "items": { "$ref": "#/$defs/zfs_pool" } },
+        "lvm":             { "$ref": "#/$defs/lvm_state" },
+        "physical_disks":  { "type": "array", "items": { "$ref": "#/$defs/physical_disk" } },
+        "pve_storage_cfg": { "type": "array", "items": { "$ref": "#/$defs/storage_entry" } },
+        "mounts":          { "type": "array", "items": { "$ref": "#/$defs/mount" } }
+      }
+    },
+
+    "zfs_pool": {
+      "type": "object",
+      "required": ["name"],
+      "additionalProperties": false,
+      "properties": {
+        "name":           { "type": "string" },
+        "type":           { "enum": ["mirror", "raidz1", "raidz2", "raidz3", "stripe", "single"] },
+        "devices_by_id":  { "type": "array", "items": { "type": "string" }, "description": "Disks referenced by stable /dev/disk/by-id paths. Restore validates these exist before importing." },
+        "mountpoint":     { "type": "string" },
+        "compression":    { "type": "string" },
+        "size_bytes":     { "type": "integer" },
+        "health":         { "enum": ["ONLINE", "DEGRADED", "FAULTED", "OFFLINE", "UNAVAIL", "REMOVED"] }
+      }
+    },
+
+    "lvm_state": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "vgs": { "type": "array", "items": { "$ref": "#/$defs/lvm_vg" } }
+      }
+    },
+
+    "lvm_vg": {
+      "type": "object",
+      "required": ["name"],
+      "additionalProperties": false,
+      "properties": {
+        "name":       { "type": "string" },
+        "size_bytes": { "type": "integer" },
+        "thin_pools": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "lv_name":    { "type": "string" },
+              "size_bytes": { "type": "integer" }
+            }
+          }
+        }
+      }
+    },
+
+    "physical_disk": {
+      "type": "object",
+      "required": ["name"],
+      "additionalProperties": false,
+      "properties": {
+        "name":       { "type": "string" },
+        "model":      { "type": ["string", "null"] },
+        "size_bytes": { "type": "integer" },
+        "by_id":      { "type": ["string", "null"], "description": "Stable /dev/disk/by-id symlink target if available. Used to detect the same disk on different controller layouts." }
+      }
+    },
+
+    "storage_entry": {
+      "type": "object",
+      "required": ["id", "type"],
+      "description": "additionalProperties is intentionally TRUE here. PVE's storage.cfg accepts driver-specific options (sparse, krbd, fingerprint, datacenter, fs-name, nodes, prune-backups, …) that vary across releases and we don't want to play whack-a-mole on the schema every time someone uses a flag we haven't seen.",
+      "properties": {
+        "id":       { "type": "string" },
+        "type":    { "enum": ["dir", "lvm", "lvmthin", "zfs", "zfspool", "btrfs", "nfs", "cifs", "iscsi", "rbd", "cephfs", "pbs", "esxi"] },
+        "path":     { "type": ["string", "null"] },
+        "server":   { "type": ["string", "null"] },
+        "export":   { "type": ["string", "null"] },
+        "share":    { "type": ["string", "null"] },
+        "thinpool": { "type": ["string", "null"] },
+        "vgname":   { "type": ["string", "null"] },
+        "pool":     { "type": ["string", "null"] },
+        "content":  { "type": "array", "items": { "type": "string" } }
+      }
+    },
+
+    "mount": {
+      "type": "object",
+      "required": ["target", "source", "fstype"],
+      "additionalProperties": false,
+      "properties": {
+        "target":  { "type": "string" },
+        "source":  { "type": "string" },
+        "fstype":  { "type": "string" },
+        "options": { "type": ["string", "null"] }
+      }
+    },
+
+    "installed_component": {
+      "type": "object",
+      "required": ["id"],
+      "additionalProperties": false,
+      "properties": {
+        "id":                  { "type": "string", "description": "Stable identifier matching ProxMenux managed_installs registry." },
+        "type":                { "type": "string", "description": "Type from registry, e.g. nvidia_xfree86, coral, oci_app, tailscale." },
+        "version_at_backup":   { "type": ["string", "null"] },
+        "proxmenux_installer": { "type": ["string", "null"], "description": "Installer script relative to scripts/, called with --auto-from-manifest at restore." },
+        "applied_settings":    { "type": "array", "items": { "type": "string" }, "description": "Named tweaks applied (log2ram, memory_settings, etc.). Reapplied via post-install scripts at restore." }
+      }
+    },
+
+    "kernel_params": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "cmdline_extra":          { "type": "array", "items": { "type": "string" }, "description": "Extra entries in /proc/cmdline beyond the default PVE set (BOOT_IMAGE, root, ro). Used to detect iommu, hugepages, custom GRUB tunings." },
+        "modules_loaded_at_boot": { "type": "array", "items": { "type": "string" }, "description": "Contents of /etc/modules." },
+        "modprobe_d_files":       { "type": "array", "items": { "type": "string" }, "description": "Paths under /etc/modprobe.d/ that contain user-defined options/blacklists." }
+      }
+    },
+
+    "guests_inventory": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "vms": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["vmid", "name"],
+            "additionalProperties": false,
+            "properties": {
+              "vmid":         { "type": "integer", "minimum": 100, "maximum": 999999999 },
+              "name":         { "type": "string" },
+              "memory_mb":    { "type": "integer" },
+              "bootdisk_gb":  { "type": "number" },
+              "status":       { "enum": ["running", "stopped", "paused"] },
+              "config_file":  { "type": ["string", "null"], "description": "Relative path inside the backup archive where the .conf was captured." }
+            }
+          }
+        },
+        "lxcs": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["vmid", "name"],
+            "additionalProperties": false,
+            "properties": {
+              "vmid":        { "type": "integer", "minimum": 100, "maximum": 999999999 },
+              "name":        { "type": "string" },
+              "status":      { "enum": ["running", "stopped"] },
+              "config_file": { "type": ["string", "null"] }
+            }
+          }
+        }
+      }
+    },
+
+    "backup_metadata": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "encrypted":          { "type": "boolean" },
+        "encryption_format":  { "type": ["string", "null"], "enum": [null, "age", "gpg"] },
+        "compression":        { "enum": ["none", "gzip", "zstd"] },
+        "paths_archived":     { "type": ["array", "null"], "items": { "type": "string" }, "description": "Snapshot of every host path that ended up inside the archive. Used by restore to drive selective category extraction." },
+        "sha256_archive":     { "type": ["string", "null"], "pattern": "^[0-9a-f]{64}$" },
+        "size_bytes":         { "type": ["integer", "null"] }
+      }
+    }
+  }
+}
diff --git a/scripts/backup_restore/test_backup_restore.sh b/scripts/backup_restore/test_backup_restore.sh
deleted file mode 100644
index 64fc7a29..00000000
--- a/scripts/backup_restore/test_backup_restore.sh
+++ /dev/null
@@ -1,284 +0,0 @@
-#!/bin/bash
-# ==========================================================
-# ProxMenux - Backup/Restore Test Matrix (non-destructive)
-# ==========================================================
-
-set -u
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-RUNNER="${SCRIPT_DIR}/run_scheduled_backup.sh"
-APPLY_ONBOOT="${SCRIPT_DIR}/apply_pending_restore.sh"
-HOST_SCRIPT="${SCRIPT_DIR}/backup_host.sh"
-LIB_SCRIPT="${SCRIPT_DIR}/lib_host_backup_common.sh"
-SCHED_SCRIPT="${SCRIPT_DIR}/backup_scheduler.sh"
-
-KEEP_TMP=0
-if [[ "${1:-}" == "--keep-tmp" ]]; then
-  KEEP_TMP=1
-fi
-
-TMP_ROOT="$(mktemp -d /tmp/proxmenux-brtest.XXXXXX)"
-REPORT_FILE="/tmp/proxmenux-backup-restore-test-$(date +%Y%m%d_%H%M%S).log"
-
-PASS=0
-FAIL=0
-SKIP=0
-
-log() {
-  echo "$*" | tee -a "$REPORT_FILE"
-}
-
-pass() {
-  PASS=$((PASS + 1))
-  log "[PASS] $*"
-}
-
-fail() {
-  FAIL=$((FAIL + 1))
-  log "[FAIL] $*"
-}
-
-skip() {
-  SKIP=$((SKIP + 1))
-  log "[SKIP] $*"
-}
-
-cleanup() {
-  if [[ "$KEEP_TMP" -eq 0 ]]; then
-    rm -rf "$TMP_ROOT"
-  else
-    log "[INFO] Temp root preserved: $TMP_ROOT"
-  fi
-}
-trap cleanup EXIT
-
-assert_file_contains() {
-  local file="$1"
-  local needle="$2"
-  if [[ -f "$file" ]] && grep -q "$needle" "$file"; then
-    return 0
-  fi
-  return 1
-}
-
-run_cmd_expect_ok() {
-  local desc="$1"
-  shift
-  if "$@" >>"$REPORT_FILE" 2>&1; then
-    pass "$desc"
-    return 0
-  fi
-  fail "$desc"
-  return 1
-}
-
-run_cmd_expect_fail() {
-  local desc="$1"
-  shift
-  if "$@" >>"$REPORT_FILE" 2>&1; then
-    fail "$desc"
-    return 1
-  fi
-  pass "$desc"
-  return 0
-}
-
-syntax_tests() {
-  log "\n=== Syntax checks ==="
-  run_cmd_expect_ok "bash -n backup_host.sh" bash -n "$HOST_SCRIPT"
-  run_cmd_expect_ok "bash -n lib_host_backup_common.sh" bash -n "$LIB_SCRIPT"
-  run_cmd_expect_ok "bash -n backup_scheduler.sh" bash -n "$SCHED_SCRIPT"
-  run_cmd_expect_ok "bash -n run_scheduled_backup.sh" bash -n "$RUNNER"
-  run_cmd_expect_ok "bash -n apply_pending_restore.sh" bash -n "$APPLY_ONBOOT"
-}
-
-scheduler_e2e_tests() {
-  log "\n=== Scheduler E2E (sandbox) ==="
-  if ! help mapfile >/dev/null 2>&1; then
-    skip "Scheduler E2E skipped: current bash does not provide mapfile (requires bash >= 4)."
-    return
-  fi
-
-  local jobs_dir="$TMP_ROOT/backup-jobs"
-  local logs_dir="$TMP_ROOT/backup-jobs-logs"
-  local lock_dir="$TMP_ROOT/locks"
-  local archives_dir="$TMP_ROOT/archives"
-
-  mkdir -p "$jobs_dir" "$logs_dir" "$lock_dir" "$archives_dir"
-
-  cat > "$jobs_dir/t1.env" <<EOJ
-JOB_ID=t1
-BACKEND=local
-PROFILE_MODE=custom
-LOCAL_DEST_DIR=${archives_dir}
-LOCAL_ARCHIVE_EXT=tar.gz
-KEEP_LAST=2
-KEEP_HOURLY=0
-KEEP_DAILY=0
-KEEP_WEEKLY=0
-KEEP_MONTHLY=0
-KEEP_YEARLY=0
-EOJ
-
-  cat > "$jobs_dir/t1.paths" <<EOP
-/etc/hosts
-/etc/resolv.conf
-EOP
-
-  local i
-  for i in 1 2 3; do
-    if PMX_BACKUP_JOBS_DIR="$jobs_dir" PMX_BACKUP_LOG_DIR="$logs_dir" PMX_BACKUP_LOCK_DIR="$lock_dir" \
-      bash "$RUNNER" t1 >>"$REPORT_FILE" 2>&1; then
-      :
-    else
-      fail "Runner execution #$i for t1"
-      return
-    fi
-    sleep 1
-  done
-
-  local archive_count
-  archive_count="$(find "$archives_dir" -maxdepth 1 -type f -name 't1-*.tar.gz' | wc -l | tr -d ' ')"
-  if [[ "$archive_count" == "2" ]]; then
-    pass "Retention KEEP_LAST=2 keeps exactly 2 archives"
-  else
-    fail "Retention expected 2 archives, got $archive_count"
-  fi
-
-  if assert_file_contains "$logs_dir/t1-last.status" "RESULT=ok"; then
-    pass "t1-last.status reports RESULT=ok"
-  else
-    fail "t1-last.status does not report RESULT=ok"
-  fi
-
-  cat > "$jobs_dir/tbad.env" <<EOJ
-JOB_ID=tbad
-BACKEND=invalid
-PROFILE_MODE=custom
-KEEP_LAST=1
-EOJ
-  echo "/etc/hosts" > "$jobs_dir/tbad.paths"
-
-  run_cmd_expect_fail "Invalid backend fails" \
-    env PMX_BACKUP_JOBS_DIR="$jobs_dir" PMX_BACKUP_LOG_DIR="$logs_dir" PMX_BACKUP_LOCK_DIR="$lock_dir" \
-    bash "$RUNNER" tbad
-
-  if assert_file_contains "$logs_dir/tbad-last.status" "RESULT=failed"; then
-    pass "tbad-last.status reports RESULT=failed"
-  else
-    fail "tbad-last.status does not report RESULT=failed"
-  fi
-
-  cat > "$jobs_dir/tempty.env" <<EOJ
-JOB_ID=tempty
-BACKEND=local
-PROFILE_MODE=custom
-LOCAL_DEST_DIR=${archives_dir}
-LOCAL_ARCHIVE_EXT=tar.gz
-KEEP_LAST=1
-EOJ
-  : > "$jobs_dir/tempty.paths"
-
-  run_cmd_expect_fail "Empty paths fails" \
-    env PMX_BACKUP_JOBS_DIR="$jobs_dir" PMX_BACKUP_LOG_DIR="$logs_dir" PMX_BACKUP_LOCK_DIR="$lock_dir" \
-    bash "$RUNNER" tempty
-
-  if assert_file_contains "$logs_dir/tempty-last.status" "RESULT=failed"; then
-    pass "tempty-last.status reports RESULT=failed"
-  else
-    fail "tempty-last.status does not report RESULT=failed"
-  fi
-}
-
-pending_restore_tests() {
-  log "\n=== Pending restore E2E (sandbox) ==="
-  local pending_base="$TMP_ROOT/restore-pending"
-  local logs_dir="$TMP_ROOT/restore-logs"
-  local target_root="$TMP_ROOT/target"
-  local pre_backup_base="$TMP_ROOT/pre-restore"
-  local recovery_base="$TMP_ROOT/recovery"
-
-  mkdir -p "$pending_base/r1/rootfs/etc/pve" "$pending_base/r1/rootfs/etc/zfs" "$pending_base/r1/rootfs/etc" "$target_root/etc"
-
-  echo "new-value" > "$pending_base/r1/rootfs/etc/test.conf"
-  echo "cluster-data" > "$pending_base/r1/rootfs/etc/pve/cluster.cfg"
-  echo "zfs-data" > "$pending_base/r1/rootfs/etc/zfs/zpool.cache"
-  echo "old-value" > "$target_root/etc/test.conf"
-
-  cat > "$pending_base/r1/apply-on-boot.list" <<EOL
-etc/test.conf
-etc/pve/cluster.cfg
-etc/zfs/zpool.cache
-EOL
-
-  cat > "$pending_base/r1/plan.env" <<EOP
-HB_RESTORE_INCLUDE_ZFS=0
-EOP
-
-  ln -sfn "$pending_base/r1" "$pending_base/current"
-
-  if PMX_RESTORE_PENDING_BASE="$pending_base" PMX_RESTORE_LOG_DIR="$logs_dir" \
-     PMX_RESTORE_DEST_PREFIX="$target_root" PMX_RESTORE_PRE_BACKUP_BASE="$pre_backup_base" \
-     PMX_RESTORE_RECOVERY_BASE="$recovery_base" \
-     bash "$APPLY_ONBOOT" >>"$REPORT_FILE" 2>&1; then
-    pass "apply_pending_restore completes"
-  else
-    fail "apply_pending_restore completes"
-    return
-  fi
-
-  if assert_file_contains "$target_root/etc/test.conf" "new-value"; then
-    pass "Regular file restored into target prefix"
-  else
-    fail "Regular file was not restored"
-  fi
-
-  if [[ -e "$target_root/etc/pve/cluster.cfg" ]]; then
-    fail "Cluster file should not be restored live"
-  else
-    pass "Cluster file skipped from live restore"
-  fi
-
-  if find "$recovery_base" -type f -name cluster.cfg 2>/dev/null | grep -q .; then
-    pass "Cluster file extracted to recovery directory"
-  else
-    fail "Cluster file not found in recovery directory"
-  fi
-
-  if assert_file_contains "$pending_base/completed/r1/state" "completed"; then
-    pass "Pending restore state marked completed"
-  else
-    fail "Pending restore state not marked completed"
-  fi
-
-  if [[ -e "$pending_base/current" ]]; then
-    fail "current symlink should be removed"
-  else
-    pass "current symlink removed"
-  fi
-}
-
-main() {
-  log "ProxMenux backup/restore test matrix"
-  log "Report: $REPORT_FILE"
-  log "Temp root: $TMP_ROOT"
-
-  syntax_tests
-  scheduler_e2e_tests
-  pending_restore_tests
-
-  log "\n=== Summary ==="
-  log "PASS=$PASS"
-  log "FAIL=$FAIL"
-  log "SKIP=$SKIP"
-
-  if [[ "$FAIL" -eq 0 ]]; then
-    log "RESULT=OK"
-    exit 0
-  else
-    log "RESULT=FAILED"
-    exit 1
-  fi
-}
-
-main "$@"
diff --git a/scripts/backup_restore/vzdump-hook.sh b/scripts/backup_restore/vzdump-hook.sh
new file mode 100755
index 00000000..1b95b326
--- /dev/null
+++ b/scripts/backup_restore/vzdump-hook.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux - vzdump hook
+# ==========================================================
+# ProxMenux vzdump hook: bridges PVE vzdump jobs to attached host-config
+# backups. Installed system-wide via /etc/vzdump.conf ("script:" line).
+# PVE 9 invokes the hook for every phase and only exports a fixed set of env
+# vars (STOREID, DUMPDIR, VMTYPE, HOSTNAME, TARGET, LOGFILE) — JOB_ID is NOT
+# exported. We therefore match each proxmenux .env by its PVE_STORAGE field
+# against STOREID and only act once per PVE job, in the job-end phase.
+
+set -u
+
+PHASE="${1:-}"
+PROXMENUX_JOBS_DIR="${PROXMENUX_JOBS_DIR:-/var/lib/proxmenux/backup-jobs}"
+PROXMENUX_LOG_DIR="/var/log/proxmenux"
+PROXMENUX_RUNNER="/usr/local/share/proxmenux/scripts/backup_restore/run_scheduled_backup.sh"
+CHAIN_HOOK="/etc/proxmenux/vzdump-hook-chain.sh"
+
+# Chain to any pre-existing hook that we displaced when we registered ours.
+if [[ -x "$CHAIN_HOOK" ]]; then
+  "$CHAIN_HOOK" "$@" || true
+fi
+
+[[ "$PHASE" != "job-end" ]] && exit 0
+[[ -z "${STOREID:-}" ]] && exit 0
+
+mkdir -p "$PROXMENUX_LOG_DIR"
+HOOK_LOG="$PROXMENUX_LOG_DIR/vzdump-hook.log"
+echo "[$(date '+%F %T')] phase=$PHASE STOREID=$STOREID" >>"$HOOK_LOG"
+
+if [[ ! -x "$PROXMENUX_RUNNER" ]]; then
+  echo "  runner missing: $PROXMENUX_RUNNER" >>"$HOOK_LOG"
+  exit 0
+fi
+
+shopt -s nullglob
+for env_file in "$PROXMENUX_JOBS_DIR"/*.env; do
+  storage="" enabled="" pmx_id=""
+  while IFS='=' read -r k v; do
+    case "$k" in
+      PVE_STORAGE) storage="$v" ;;
+      ENABLED)     enabled="$v" ;;
+      JOB_ID)      pmx_id="$v" ;;
+    esac
+  done <"$env_file"
+
+  [[ "$storage" != "$STOREID" ]] && continue
+  [[ "${enabled:-1}" != "1" ]] && { echo "  skip $pmx_id (disabled)" >>"$HOOK_LOG"; continue; }
+  [[ -z "$pmx_id" ]] && continue
+
+  echo "  -> run $pmx_id" >>"$HOOK_LOG"
+  bash "$PROXMENUX_RUNNER" "$pmx_id" >>"$HOOK_LOG" 2>&1 || \
+    echo "  ! $pmx_id exited non-zero" >>"$HOOK_LOG"
+done
+
+exit 0
diff --git a/scripts/emergency_repair.sh b/scripts/emergency_repair.sh
index ed1dec3e..798b6e17 100644
--- a/scripts/emergency_repair.sh
+++ b/scripts/emergency_repair.sh
@@ -17,7 +17,6 @@
 # Configuration ============================================
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
 BACKUP_DIR="/var/backups/proxmenux"
 
 if [[ -f "$UTILS_FILE" ]]; then
diff --git a/scripts/global/common-functions.sh b/scripts/global/common-functions.sh
index b56baf44..d74bf0e3 100644
--- a/scripts/global/common-functions.sh
+++ b/scripts/global/common-functions.sh
@@ -7,7 +7,6 @@
 LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
 TOOLS_JSON="/usr/local/share/proxmenux/installed_tools.json"
 
 if [[ -f "$UTILS_FILE" ]]; then
diff --git a/scripts/global/iso_storage_helpers.sh b/scripts/global/iso_storage_helpers.sh
index a4d2b6b0..dccfa98b 100644
--- a/scripts/global/iso_storage_helpers.sh
+++ b/scripts/global/iso_storage_helpers.sh
@@ -133,14 +133,41 @@ iso_human_size() {
   [[ -n "$bytes" ]] && echo "${bytes}B" || echo "-"
 }
 
+iso_fast_path_from_volid() {
+  local volid="$1"
+  local storage rel file
+
+  storage=$(iso_storage_from_volid "$volid")
+  rel="${volid#*:}"
+  file="$(basename "${rel#iso/}")"
+
+  if [[ "$storage" == "local" ]]; then
+    echo "/var/lib/vz/template/iso/$file"
+  else
+    echo "/mnt/pve/$storage/template/iso/$file"
+  fi
+}
+
+iso_display_name() {
+  local name="$1"
+  local max_length="${2:-54}"
+
+  if [ ${#name} -gt "$max_length" ]; then
+    printf '%s...' "${name:0:$((max_length - 3))}"
+  else
+    printf '%-*s' "$max_length" "$name"
+  fi
+}
+
 iso_dialog_description() {
   local volid="$1"
-  local name storage path size
+  local storage path size
 
-  name=$(iso_name_from_volid "$volid")
   storage=$(iso_storage_from_volid "$volid")
-  path=$(iso_volid_to_path "$volid")
+  path=$(iso_fast_path_from_volid "$volid")
   size=$(iso_human_size "$path")
+  printf '%-10s | %s' "$storage" "$size"
+  return 0
 
   printf '%-42s │ %-14s │ %s' "$name" "$storage" "$size"
 }
diff --git a/scripts/global/pci_passthrough_helpers.sh b/scripts/global/pci_passthrough_helpers.sh
index e11daaf7..9a3fec77 100644
--- a/scripts/global/pci_passthrough_helpers.sh
+++ b/scripts/global/pci_passthrough_helpers.sh
@@ -380,6 +380,9 @@ function _pci_sriov_role() {
 
 PROXMENUX_VFIO_BIND_STATE="/etc/proxmenux/vfio-bind.bdfs"
 PROXMENUX_VFIO_BIND_UDEV_RULE="/etc/udev/rules.d/10-proxmenux-vfio-bind.rules"
+# Auto-managed blacklist applied only when *every* NVIDIA GPU on the host
+# is in passthrough. Removed when any NVIDIA GPU goes back to the host.
+PROXMENUX_NVIDIA_VFIO_BLACKLIST="/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf"
 # Legacy artifact paths from a previous attempt — kept here so we can
 # remove them when migrating a host that ran the older init-top hook.
 PROXMENUX_VFIO_BIND_LEGACY_HOOK="/etc/initramfs-tools/scripts/init-top/proxmenux-vfio-bind"
@@ -447,6 +450,7 @@ _proxmenux_vfio_bind_add_bdfs() {
     done
     if $changed; then
         _proxmenux_vfio_bind_write_udev_rule
+        _proxmenux_nvidia_vfio_blacklist_sync || true
         [[ -n "${HOST_CONFIG_CHANGED+x}" ]] && HOST_CONFIG_CHANGED=true
     fi
 }
@@ -471,6 +475,7 @@ _proxmenux_vfio_bind_remove_bdfs() {
     if ! cmp -s "$tmp" "$PROXMENUX_VFIO_BIND_STATE"; then
         mv "$tmp" "$PROXMENUX_VFIO_BIND_STATE"
         _proxmenux_vfio_bind_write_udev_rule
+        _proxmenux_nvidia_vfio_blacklist_sync || true
         [[ -n "${HOST_CONFIG_CHANGED+x}" ]] && HOST_CONFIG_CHANGED=true
         # If empty, remove state file too (keeps host clean)
         [[ ! -s "$PROXMENUX_VFIO_BIND_STATE" ]] && rm -f "$PROXMENUX_VFIO_BIND_STATE"
@@ -479,6 +484,117 @@ _proxmenux_vfio_bind_remove_bdfs() {
     fi
 }
 
+# Returns 0 if every NVIDIA GPU on this host is registered for VFIO
+# passthrough, 1 otherwise. Used to decide whether a global nvidia
+# module blacklist is safe (mono-GPU host or all-passthrough case)
+# or whether the host still needs the nvidia driver loaded for at
+# least one GPU (multi-GPU mixed case).
+_proxmenux_all_nvidia_in_vfio() {
+    local -a host_nvidia=() vfio_nvidia=()
+    local d cls vendor
+    for d in /sys/bus/pci/devices/*; do
+        vendor=$(cat "$d/vendor" 2>/dev/null)
+        [[ "$vendor" != "0x10de" ]] && continue
+        cls=$(cat "$d/class" 2>/dev/null)
+        case "$cls" in
+            0x0300*|0x0302*) host_nvidia+=("$(basename "$d")") ;;
+        esac
+    done
+    (( ${#host_nvidia[@]} == 0 )) && return 1
+
+    if [[ -f "$PROXMENUX_VFIO_BIND_STATE" ]]; then
+        local bdf full
+        while IFS= read -r bdf; do
+            [[ -z "$bdf" ]] && continue
+            case "$bdf" in \#*) continue ;; esac
+            full="$bdf"
+            [[ "$full" != 0000:* ]] && full="0000:${full}"
+            vendor=$(cat "/sys/bus/pci/devices/${full}/vendor" 2>/dev/null)
+            [[ "$vendor" != "0x10de" ]] && continue
+            cls=$(cat "/sys/bus/pci/devices/${full}/class" 2>/dev/null)
+            case "$cls" in
+                0x0300*|0x0302*) vfio_nvidia+=("$full") ;;
+            esac
+        done < "$PROXMENUX_VFIO_BIND_STATE"
+    fi
+
+    (( ${#vfio_nvidia[@]} >= ${#host_nvidia[@]} ))
+}
+
+# Apply or remove the auto-managed nvidia blacklist + the nvidia-smi
+# udev rule based on whether every host NVIDIA GPU is in VFIO
+# passthrough. Returns 0 if anything changed (caller may want to
+# rebuild initramfs).
+_proxmenux_nvidia_vfio_blacklist_sync() {
+    local nvidia_udev_rule="/etc/udev/rules.d/70-nvidia.rules"
+    local changed=1
+
+    if _proxmenux_all_nvidia_in_vfio; then
+        if [[ ! -f "$PROXMENUX_NVIDIA_VFIO_BLACKLIST" ]]; then
+            cat > "$PROXMENUX_NVIDIA_VFIO_BLACKLIST" <<'EOF'
+# ProxMenux: every NVIDIA GPU on this host is in VFIO passthrough.
+# Block the nvidia module so it doesn't loop trying to claim devices
+# already owned by vfio-pci. Removed automatically when any GPU
+# returns to the host.
+blacklist nvidia
+blacklist nvidia_drm
+blacklist nvidia_modeset
+blacklist nvidia_uvm
+EOF
+            changed=0
+        fi
+        # nvidia-smi-on-PCI-event udev rule loops infinitely when nvidia
+        # is blacklisted (the RUN+= call fails and re-triggers). Rename
+        # it out of the way; the original is preserved with a .proxmenux-
+        # disabled suffix so it can be restored cleanly.
+        if [[ -f "$nvidia_udev_rule" ]]; then
+            mv "$nvidia_udev_rule" "${nvidia_udev_rule}.proxmenux-disabled" 2>/dev/null
+            udevadm control --reload-rules >/dev/null 2>&1 || true
+            changed=0
+        fi
+    else
+        if [[ -f "$PROXMENUX_NVIDIA_VFIO_BLACKLIST" ]]; then
+            rm -f "$PROXMENUX_NVIDIA_VFIO_BLACKLIST"
+            changed=0
+        fi
+        # Some NVIDIA GPU is back on the host — restore the udev rule.
+        if [[ -f "${nvidia_udev_rule}.proxmenux-disabled" ]]; then
+            mv "${nvidia_udev_rule}.proxmenux-disabled" "$nvidia_udev_rule" 2>/dev/null
+            udevadm control --reload-rules >/dev/null 2>&1 || true
+            changed=0
+        fi
+    fi
+    return $changed
+}
+
+# Returns the BDF of a PCI bridge sharing the IOMMU group of $1, if any.
+# The kernel refuses to bind vfio-pci to root ports, so when a GPU shares
+# its IOMMU group with the upstream root port the VFIO setup silently
+# does nothing — the GPU keeps its native driver and the host can also
+# end up with a stuck boot if other devices behind the bridge were
+# expected to come up under the original driver. Detecting this lets
+# callers warn the operator and bail out before writing host config.
+_proxmenux_vfio_bind_group_bridge() {
+    local target="$1"
+    [[ "$target" != 0000:* ]] && target="0000:${target}"
+    local group_link
+    group_link=$(readlink "/sys/bus/pci/devices/${target}/iommu_group" 2>/dev/null) || return 1
+    local group_num
+    group_num=$(basename "$group_link")
+    local member bdf cls
+    for member in "/sys/kernel/iommu_groups/${group_num}/devices/"*; do
+        bdf=$(basename "$member")
+        [[ "$bdf" == "$target" ]] && continue
+        cls=$(cat "$member/class" 2>/dev/null)
+        # PCI bridge class is 0x0604xx (Normal bridge 0x060400, Subtractive 0x060401).
+        if [[ "$cls" == 0x0604* ]]; then
+            echo "$bdf"
+            return 0
+        fi
+    done
+    return 1
+}
+
 _proxmenux_vfio_bind_purge_vendor() {
     # Removes every BDF from the binder state whose PCI vendor matches $1
     # (hex, e.g. "10de" for NVIDIA, "1002" for AMD, "8086" for Intel).
diff --git a/scripts/global/remove-banner-pve8.sh b/scripts/global/remove-banner-pve8.sh
index 9eb71182..8b55a7fb 100644
--- a/scripts/global/remove-banner-pve8.sh
+++ b/scripts/global/remove-banner-pve8.sh
@@ -5,7 +5,6 @@
 LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
 TOOLS_JSON="/usr/local/share/proxmenux/installed_tools.json"
 
 if [[ -f "$UTILS_FILE" ]]; then
diff --git a/scripts/global/share-common.func b/scripts/global/share-common.func
index c135785e..02a9297e 100644
--- a/scripts/global/share-common.func
+++ b/scripts/global/share-common.func
@@ -26,7 +26,11 @@ ensure_repositories() {
 
   if (( pve_version >= 9 )); then
     # ===== PVE 9 (Debian 13 - trixie) =====
-    # proxmox.sources (no-subscription) - create if missing
+    # proxmox.sources (no-subscription) - create if missing.
+    # chmod 0644 explicit on every new .sources file: under the default
+    # root umask 0027 the redirect would land at 0640, which the PVE 9
+    # webgui's repository manager treats as unparseable and silently
+    # hides the source — issue #230.
     if [[ ! -f /etc/apt/sources.list.d/proxmox.sources ]]; then
       cat > /etc/apt/sources.list.d/proxmox.sources <<'EOF'
 Enabled: true
@@ -36,6 +40,7 @@ Suites: trixie
 Components: pve-no-subscription
 Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
 EOF
+      chmod 0644 /etc/apt/sources.list.d/proxmox.sources
       need_update=true
     fi
 
@@ -54,6 +59,7 @@ Suites: trixie-security
 Components: main contrib non-free-firmware
 Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 EOF
+      chmod 0644 /etc/apt/sources.list.d/debian.sources
       need_update=true
     fi
 
diff --git a/scripts/global/update-pve8.sh b/scripts/global/update-pve8.sh
index d745f2b9..b825be57 100644
--- a/scripts/global/update-pve8.sh
+++ b/scripts/global/update-pve8.sh
@@ -7,7 +7,6 @@
 LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
 TOOLS_JSON="/usr/local/share/proxmenux/installed_tools.json"
 
 if [[ -f "$UTILS_FILE" ]]; then
diff --git a/scripts/global/update-pve9_2.sh b/scripts/global/update-pve9_2.sh
index aed66823..58d9e85f 100644
--- a/scripts/global/update-pve9_2.sh
+++ b/scripts/global/update-pve9_2.sh
@@ -7,7 +7,6 @@
 LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
 TOOLS_JSON="/usr/local/share/proxmenux/installed_tools.json"
 APT_ENV="env DEBIAN_FRONTEND=noninteractive LC_ALL=C LANG=C"
 
@@ -130,6 +129,7 @@ Suites: ${TARGET_CODENAME}
 Components: pve-no-subscription
 Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
 EOF
+    chmod 0644 /etc/apt/sources.list.d/proxmox.sources
     msg_ok "$(translate "Proxmox VE 9.x no-subscription repository created")" | tee -a "$screen_capture"
     changes_made=true
 
@@ -147,6 +147,7 @@ Suites: ${TARGET_CODENAME}-security
 Components: main contrib non-free non-free-firmware
 Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 EOF
+    chmod 0644 /etc/apt/sources.list.d/debian.sources
 
     msg_ok "$(translate "Debian repositories configured for $TARGET_CODENAME")"
 
diff --git a/scripts/global/utils-install-functions.sh b/scripts/global/utils-install-functions.sh
index 0b02682c..7dcfefc3 100644
--- a/scripts/global/utils-install-functions.sh
+++ b/scripts/global/utils-install-functions.sh
@@ -52,6 +52,10 @@ ensure_repositories() {
 
     if (( pve_version >= 9 )); then
         # ===== PVE 9 (Debian 13 - trixie) =====
+        # Force 0644 (world-readable) on every .sources file we drop.
+        # Under the default root umask 0027 the redirect would land at
+        # 0640, which the PVE 9 webgui's repository manager treats as
+        # unparseable and silently hides the source — issue #230.
         if [[ ! -f /etc/apt/sources.list.d/proxmox.sources ]]; then
             cat > /etc/apt/sources.list.d/proxmox.sources <<'EOF'
 Enabled: true
@@ -61,6 +65,7 @@ Suites: trixie
 Components: pve-no-subscription
 Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
 EOF
+            chmod 0644 /etc/apt/sources.list.d/proxmox.sources
             need_update=true
         fi
 
@@ -78,6 +83,7 @@ Suites: trixie-security
 Components: main contrib non-free-firmware
 Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 EOF
+            chmod 0644 /etc/apt/sources.list.d/debian.sources
             need_update=true
         fi
 
@@ -104,6 +110,11 @@ EOF
     if [[ "$need_update" == true ]] || [[ ! -d /var/lib/apt/lists || -z "$(ls -A /var/lib/apt/lists 2>/dev/null)" ]]; then
         msg_info "$(translate "Updating APT package lists...")"
         apt-get update >/dev/null 2>&1 || apt-get update
+        # Spinner pair: msg_info must be closed before returning.
+        # Without this the next `msg_info` caller spawns a second
+        # spinner on top of ours and the original line never gets
+        # ✓'d — leaving a dangling progress char on screen.
+        msg_ok "$(translate "APT package lists updated")"
     fi
 
     return 0
diff --git a/scripts/gpu_tpu/add_gpu_vm.sh b/scripts/gpu_tpu/add_gpu_vm.sh
index 952f63f3..2a27ede4 100644
--- a/scripts/gpu_tpu/add_gpu_vm.sh
+++ b/scripts/gpu_tpu/add_gpu_vm.sh
@@ -1811,6 +1811,30 @@ sanitize_nvidia_host_stack_for_vfio() {
     else
         msg_ok "$(translate 'NVIDIA host services already aligned for VFIO mode')" | tee -a "$screen_capture"
     fi
+
+    # Sync components_status.json — the host driver stays on disk but is
+    # not in use for this GPU because it now belongs to a VM. Per-BDF
+    # model: on multi-GPU hosts where another NVIDIA card still uses the
+    # nvidia driver, keep the status as "installed" — the driver is
+    # genuinely in use elsewhere. Only flip to "vfio_passthrough" when no
+    # NVIDIA GPU is bound to the host driver anymore.
+    if declare -F update_component_status >/dev/null 2>&1; then
+        local _nvd_ver _nvd_new_status
+        _nvd_ver=$(jq -r '.nvidia_driver.version // ""' \
+            /usr/local/share/proxmenux/components_status.json 2>/dev/null)
+        _nvd_new_status="vfio_passthrough"
+        # Any NVIDIA PCI device still using the nvidia driver on the host?
+        if lspci -nnk 2>/dev/null | awk '
+            /NVIDIA/{gpu=1; next}
+            gpu && /Kernel driver in use: nvidia$/ {found=1; exit}
+            /^[^\t]/{gpu=0}
+            END{exit !found}
+        '; then
+            _nvd_new_status="installed"
+        fi
+        update_component_status "nvidia_driver" "$_nvd_new_status" \
+            "${_nvd_ver:-}" "gpu" '{"patched":false}' >>"$LOG_FILE" 2>&1 || true
+    fi
 }
 
 # Per-BDF VFIO binder + legacy NVIDIA blacklist migration are defined in
@@ -2197,6 +2221,9 @@ _configure_nvidia_kvm_hide() {
 update_initramfs_host() {
     msg_info "$(translate 'Updating initramfs (this may take a minute)...')"
     update-initramfs -u -k all >>"$LOG_FILE" 2>&1
+    # Copy the freshly-built initramfs to the EFI System Partition.
+    # Without this the bootloader keeps using the previous initramfs.
+    proxmox-boot-tool refresh >>"$LOG_FILE" 2>&1 || true
     msg_ok "$(translate 'initramfs updated')" | tee -a "$screen_capture"
 }
 
diff --git a/scripts/gpu_tpu/amd_gpu_tools.sh b/scripts/gpu_tpu/amd_gpu_tools.sh
index 144caf7e..6e0a2632 100644
--- a/scripts/gpu_tpu/amd_gpu_tools.sh
+++ b/scripts/gpu_tpu/amd_gpu_tools.sh
@@ -257,7 +257,39 @@ main() {
   fi
 }
 
+# ==========================================================
+# Non-interactive auto-reinstall (post-restore hook)
+# ==========================================================
+# Called from apply_cluster_postboot.sh when components_status
+# says amdgpu_top was installed on the source but its binary is
+# missing on the target (typical for a fresh PVE install + host
+# restore — the .deb downloaded from GitHub is not in
+# packages.manual.list, so we re-fetch and install it). No
+# dialogs.
+auto_reinstall_from_state() {
+  : >"$LOG_FILE"
+  echo "=== amd_gpu_tools auto_reinstall $(date -Iseconds) ===" >>"$LOG_FILE"
+  command -v jq >/dev/null 2>&1 || return 1
+  [[ -f "$COMPONENTS_STATUS_FILE" ]] || return 1
+  local s
+  s=$(jq -r '.amdgpu_top.status // ""' "$COMPONENTS_STATUS_FILE" 2>/dev/null)
+  [[ "$s" == "installed" ]] || { echo "not installed in state ($s)" >>"$LOG_FILE"; return 0; }
+  if command -v amdgpu_top >/dev/null 2>&1 || dpkg -s amdgpu-top >/dev/null 2>&1; then
+    echo "already present — no-op" >>"$LOG_FILE"; return 0
+  fi
+  export DEBIAN_FRONTEND=noninteractive
+  install_dependencies >>"$LOG_FILE" 2>&1
+  if ! get_latest_release >>"$LOG_FILE" 2>&1; then
+    echo "Failed to fetch latest release info" >>"$LOG_FILE"; return 2
+  fi
+  install_amdgpu_top
+}
+
 # Run main function
 if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  if [[ "${1:-}" == "--auto-reinstall" ]]; then
+    auto_reinstall_from_state
+    exit $?
+  fi
   main
 fi
\ No newline at end of file
diff --git a/scripts/gpu_tpu/install_coral.sh b/scripts/gpu_tpu/install_coral.sh
index ac29b154..8c44364c 100644
--- a/scripts/gpu_tpu/install_coral.sh
+++ b/scripts/gpu_tpu/install_coral.sh
@@ -749,4 +749,57 @@ main() {
   esac
 }
 
+# ==========================================================
+# Non-interactive auto-reinstall (post-restore hook)
+# ==========================================================
+# Called from apply_cluster_postboot.sh when components_status
+# says coral_driver was installed on the source. Coral has two
+# install branches that are independent: the PCIe/M.2 gasket+apex
+# DKMS modules (kernel-level) and the USB libedgetpu user-space
+# runtime. We replay both if either was previously installed and
+# the corresponding hardware is now present — the hardware
+# detection in detect_coral_hardware naturally short-circuits if
+# the user moved the card to a different host or it's not in
+# this slot any more.
+auto_reinstall_from_state() {
+  : >"$LOG_FILE"
+  echo "=== install_coral auto_reinstall $(date -Iseconds) ===" >>"$LOG_FILE"
+  command -v jq >/dev/null 2>&1 || return 1
+  [[ -f "$COMPONENTS_STATUS_FILE" ]] || return 1
+  local s
+  s=$(jq -r '.coral_driver.status // ""' "$COMPONENTS_STATUS_FILE" 2>/dev/null)
+  [[ "$s" == "installed" ]] || { echo "not installed in state ($s)" >>"$LOG_FILE"; return 0; }
+
+  detect_coral_hardware
+  detect_coral_install_state
+
+  # No Coral hardware on this host? Skip — nothing to install.
+  if (( CORAL_PCIE_COUNT == 0 && CORAL_USB_COUNT == 0 )); then
+    echo "no Coral hardware on this host — skipping" >>"$LOG_FILE"
+    return 0
+  fi
+  # Already healthy on every branch that has matching hardware → bail out.
+  if { (( CORAL_PCIE_COUNT == 0 )) || $CORAL_PCIE_INSTALLED; } \
+      && { (( CORAL_USB_COUNT == 0 )) || $CORAL_USB_INSTALLED; }; then
+    echo "already healthy — no-op" >>"$LOG_FILE"
+    return 0
+  fi
+
+  export DEBIAN_FRONTEND=noninteractive
+
+  if (( CORAL_PCIE_COUNT > 0 )) && ! $CORAL_PCIE_INSTALLED; then
+    echo "Installing gasket+apex DKMS modules..." >>"$LOG_FILE"
+    install_gasket_apex_dkms >>"$LOG_FILE" 2>&1 || echo "PCIe branch failed" >>"$LOG_FILE"
+  fi
+  if (( CORAL_USB_COUNT > 0 )) && ! $CORAL_USB_INSTALLED; then
+    echo "Installing libedgetpu USB runtime..." >>"$LOG_FILE"
+    install_libedgetpu_runtime >>"$LOG_FILE" 2>&1 || echo "USB branch failed" >>"$LOG_FILE"
+  fi
+}
+
+if [[ "${1:-}" == "--auto-reinstall" ]]; then
+  auto_reinstall_from_state
+  exit $?
+fi
+
 main
diff --git a/scripts/gpu_tpu/install_coral_lxc.sh b/scripts/gpu_tpu/install_coral_lxc.sh
index 9920b751..cc004acf 100644
--- a/scripts/gpu_tpu/install_coral_lxc.sh
+++ b/scripts/gpu_tpu/install_coral_lxc.sh
@@ -46,7 +46,6 @@
 LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
 
 if [[ -f "$UTILS_FILE" ]]; then
     source "$UTILS_FILE"
@@ -402,6 +401,30 @@ configure_lxc_hardware() {
 # INSTALL CORAL TPU DRIVER INSIDE CONTAINER
 # ==========================================================
 
+# Detect the package family inside the container. The PVE passthrough
+# config (above) works on any distro, but Google only ships an official
+# libedgetpu APT repo for Debian/Ubuntu. For other distros we configure
+# the device and skip the runtime install with a clear message.
+detect_container_distro() {
+    local id_like id
+    id=$(pct exec "$CONTAINER_ID" -- sh -c 'awk -F= "/^ID=/{gsub(/\"/, \"\", \$2); print \$2}" /etc/os-release 2>/dev/null' 2>/dev/null | tr -d '\r' | tr '[:upper:]' '[:lower:]')
+    id_like=$(pct exec "$CONTAINER_ID" -- sh -c 'awk -F= "/^ID_LIKE=/{gsub(/\"/, \"\", \$2); print \$2}" /etc/os-release 2>/dev/null' 2>/dev/null | tr -d '\r' | tr '[:upper:]' '[:lower:]')
+    case "$id" in
+        debian|ubuntu|raspbian|linuxmint|pop|kali|devuan) echo "debian"; return ;;
+        alpine) echo "alpine"; return ;;
+        arch|manjaro|endeavouros|garuda|cachyos) echo "arch"; return ;;
+        rhel|centos|rocky|almalinux|fedora|amzn|ol) echo "rhel"; return ;;
+        opensuse*|sles|suse) echo "suse"; return ;;
+    esac
+    case "$id_like" in
+        *debian*|*ubuntu*) echo "debian"; return ;;
+        *arch*) echo "arch"; return ;;
+        *rhel*|*fedora*|*centos*) echo "rhel"; return ;;
+        *suse*) echo "suse"; return ;;
+    esac
+    echo "unknown"
+}
+
 install_coral_in_container() {
     msg_info "$(translate 'Installing Coral TPU driver inside the container...')"
     tput sc
@@ -420,12 +443,48 @@ install_coral_in_container() {
 
     stop_spinner
 
-    # Pre-flight: refuse to run on non-Debian-family containers. The
-    # apt-get block below would crash with cryptic errors and leave the
-    # container half-configured.
-    if ! pct exec "$CONTAINER_ID" -- bash -c 'command -v apt-get' &>/dev/null; then
-        msg_error "$(translate 'Container does not have apt-get available. Coral driver installation only supports Debian/Ubuntu containers.')"
-        return 1
+    # Detect the container distro. Passthrough config (already written to
+    # /etc/pve/lxc/<id>.conf above) works on any distro — only the libedgetpu
+    # runtime install path is distro-specific, and Google's official APT repo
+    # only covers Debian/Ubuntu. For other distros offer an opt-in
+    # passthrough-only mode (skip the apt-get install, leave the device
+    # visible inside the CT so app-level runtimes can use it, e.g. the
+    # Frigate Docker image bundles libedgetpu). If the user declines,
+    # behave exactly like the pre-detection version: error out and abort.
+    local CT_FAMILY
+    CT_FAMILY=$(detect_container_distro)
+
+    if [[ "$CT_FAMILY" != "debian" ]]; then
+        rm -f "$LOG_FILE"
+        local distro_label
+        case "$CT_FAMILY" in
+            alpine) distro_label="Alpine" ;;
+            arch)   distro_label="Arch / Manjaro" ;;
+            rhel)   distro_label="RHEL / Rocky / AlmaLinux / Fedora" ;;
+            suse)   distro_label="openSUSE / SLES" ;;
+            *)      distro_label="$(translate 'this distribution')" ;;
+        esac
+
+        # whiptail (not dialog) — prompt sits in the middle of the install
+        # flow. Default is "No" so a user who just presses Enter / Esc lands
+        # on the same abort path as the legacy behaviour.
+        if ! whiptail --title "$(translate 'Non-Debian container detected')" --defaultno \
+            --yesno "$(translate 'Detected:') $distro_label
+
+$(translate 'Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to')  /etc/pve/lxc/${CONTAINER_ID}.conf  $(translate '— that part works on any distro and is harmless.')
+
+$(translate 'Would you like to continue in passthrough-only mode? The libedgetpu APT install will be skipped, the Coral device will still be visible inside the container (e.g. /dev/apex_0), and you can install the runtime yourself or use an app container that bundles it (e.g. the Frigate Docker image).')
+
+$(translate 'Choose No to abort and roll back to the legacy refuse behaviour.')" 22 78 \
+            3>&1 1>&2 2>&3; then
+            msg_error "$(translate 'Container does not have apt-get available. Coral driver installation only supports Debian/Ubuntu containers.')"
+            return 1
+        fi
+
+        msg_warn "$(translate 'Container distro') ($distro_label) $(translate 'is not supported by the official Google libedgetpu APT repository.')"
+        msg_ok "$(translate 'Hardware passthrough is already configured — the Coral device is visible inside the container as /dev/apex_0 (M.2) and/or /dev/bus/usb (USB).')"
+        msg_info2 "$(translate 'To use Coral from a regular app, install the libedgetpu runtime via the usual method for your distro (community package or build from source). The simplest path is to run an app container that bundles the runtime — e.g. the Frigate Docker image — passing the device through with')  --device /dev/apex_0:/dev/apex_0"
+        return 0
     fi
 
     # Determine driver package for Coral M.2 (USB always uses -std).
diff --git a/scripts/gpu_tpu/intel_gpu_tools.sh b/scripts/gpu_tpu/intel_gpu_tools.sh
index a0d56106..38e716cf 100644
--- a/scripts/gpu_tpu/intel_gpu_tools.sh
+++ b/scripts/gpu_tpu/intel_gpu_tools.sh
@@ -194,7 +194,29 @@ main() {
   fi
 }
 
-# Run main function
+# ==========================================================
+# Non-interactive auto-reinstall (post-restore hook)
+# ==========================================================
+auto_reinstall_from_state() {
+  : >"$LOG_FILE"
+  echo "=== intel_gpu_tools auto_reinstall $(date -Iseconds) ===" >>"$LOG_FILE"
+  command -v jq >/dev/null 2>&1 || return 1
+  [[ -f "$COMPONENTS_STATUS_FILE" ]] || return 1
+  local s
+  s=$(jq -r '.intel_gpu_tools.status // ""' "$COMPONENTS_STATUS_FILE" 2>/dev/null)
+  [[ "$s" == "installed" ]] || { echo "not installed in state ($s)" >>"$LOG_FILE"; return 0; }
+  if dpkg -s intel-gpu-tools >/dev/null 2>&1; then
+    echo "already present — no-op" >>"$LOG_FILE"; return 0
+  fi
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update -qq >>"$LOG_FILE" 2>&1
+  install_intel_gpu_tools
+}
+
 if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  if [[ "${1:-}" == "--auto-reinstall" ]]; then
+    auto_reinstall_from_state
+    exit $?
+  fi
   main
 fi
\ No newline at end of file
diff --git a/scripts/gpu_tpu/nvidia_installer.sh b/scripts/gpu_tpu/nvidia_installer.sh
index 7241383f..e6cc015f 100644
--- a/scripts/gpu_tpu/nvidia_installer.sh
+++ b/scripts/gpu_tpu/nvidia_installer.sh
@@ -436,6 +436,24 @@ offer_lxc_updates_if_any() {
 # System preparation (repos, headers, etc.)
 # ==========================================================
 ensure_repos_and_headers() {
+  # Bootstrap APT repos FIRST. On a fresh Proxmox install the
+  # pve-no-subscription / debian repos aren't configured by default
+  # → `pve-headers-$(uname -r)` and `build-essential` come back as
+  # "Unable to locate package" and the NVIDIA install bails out with
+  # "no cc found". We delegate to the shared helper (same one the
+  # post-install flow uses), which owns its own spinner pair — that's
+  # why this block has to run BEFORE we open our own msg_info.
+  if ! declare -F ensure_repositories >/dev/null 2>&1; then
+    local _utils_install="$LOCAL_SCRIPTS/global/utils-install-functions.sh"
+    [[ ! -f "$_utils_install" ]] && _utils_install="/usr/local/share/proxmenux/scripts/global/utils-install-functions.sh"
+    # shellcheck source=/dev/null
+    [[ -f "$_utils_install" ]] && source "$_utils_install"
+  fi
+  if declare -F ensure_repositories >/dev/null 2>&1; then
+    ensure_repositories >>"$LOG_FILE" 2>&1 || true
+  fi
+
+  # Now own the spinner for the headers + build-tools check.
   msg_info "$(translate 'Checking kernel headers and build tools...')"
 
   local kver
@@ -467,8 +485,13 @@ blacklist nouveau
 options nouveau modeset=0
 EOF
 
-  # Attempt to unload nouveau if currently loaded
+  # Attempt to unload nouveau if currently loaded.
+  # Close the spinner from the opening msg_info before going further —
+  # otherwise the second msg_info below leaves the first one spinning
+  # forever (visible on fresh installs where nouveau is loaded; invisible
+  # on reinstalls where this branch is skipped).
   if grep -q "^nouveau " /proc/modules 2>/dev/null; then
+    msg_ok "$(translate 'nouveau driver has been blacklisted.')" | tee -a "$screen_capture"
 
     msg_info "$(translate 'Nouveau module is loaded, attempting to unload...')"
     modprobe -r nouveau 2>/dev/null || true
@@ -799,10 +822,19 @@ filter_option_c_branch() {
     return 0
   fi
 
+  # Accept the target branch AND any newer branch (major ≥ target).
+  # Historical behaviour was an exact-major match, which locked kernel
+  # 7.x users to 580.x only. When a 580.x build happens to fail to
+  # compile on a very recent kernel + toolchain combo (reproduced on
+  # kernel 7.0.14-4-pve — see issue #248), the operator had no
+  # in-menu escape. `MIN_DRIVER_VERSION` from get_kernel_compatibility_info
+  # still gates the floor, so this only opens the ceiling: newer stable
+  # branches like 590 / 595 / 600 that satisfy the min version become
+  # selectable, while ancient branches remain filtered out.
   while IFS= read -r ver; do
     [[ -z "$ver" ]] && continue
     local ver_major="${ver%%.*}"
-    if [[ "$ver_major" == "$target_branch" ]]; then
+    if (( 10#$ver_major >= 10#$target_branch )); then
       printf '%s\n' "$ver"
     fi
   done <<< "$versions_in"
@@ -1070,6 +1102,7 @@ run_nvidia_installer() {
   if [[ "${NOUVEAU_STILL_LOADED:-false}" == "true" ]]; then
     msg_info "$(translate 'Rebuilding initramfs to apply nouveau blacklist before installation...')"
     update-initramfs -u -k all >>"$LOG_FILE" 2>&1 || true
+    proxmox-boot-tool refresh >>"$LOG_FILE" 2>&1 || true
     # Try one more time to unload nouveau after initramfs rebuild
     modprobe -r nouveau 2>/dev/null || true
     sleep 1
@@ -1150,12 +1183,24 @@ EOF
 }
 
 apply_nvidia_patch_if_needed() {
-  if ! hybrid_whiptail_yesno "$(translate 'NVIDIA Patch')" \
-    "\n$(translate 'Do you want to apply the optional NVIDIA patch to remove some GPU limitations?')"; then
-    msg_info2 "$(translate 'NVIDIA patch not applied.')"
-    update_component_status "nvidia_driver" "installed" "$CURRENT_DRIVER_VERSION" "gpu" '{"patched":false}'
-    return 0
-  fi
+  # NVIDIA_PATCH_AUTO=yes|no skips the yes/no prompt for non-interactive
+  # callers; unset preserves the interactive menu behavior.
+  case "${NVIDIA_PATCH_AUTO:-}" in
+    yes) : ;;
+    no)
+      msg_info2 "$(translate 'NVIDIA patch not applied.')"
+      update_component_status "nvidia_driver" "installed" "$CURRENT_DRIVER_VERSION" "gpu" '{"patched":false}'
+      return 0
+      ;;
+    *)
+      if ! hybrid_whiptail_yesno "$(translate 'NVIDIA Patch')" \
+        "\n$(translate 'Do you want to apply the optional NVIDIA patch to remove some GPU limitations?')"; then
+        msg_info2 "$(translate 'NVIDIA patch not applied.')"
+        update_component_status "nvidia_driver" "installed" "$CURRENT_DRIVER_VERSION" "gpu" '{"patched":false}'
+        return 0
+      fi
+      ;;
+  esac
 
   msg_info "$(translate 'Cloning and applying NVIDIA patch (keylase/nvidia-patch)...')"
   ensure_workdir
@@ -1476,10 +1521,6 @@ main() {
       stop_and_disable_nvidia_services
       unload_nvidia_modules
 
-      # No msg_info spinner here — it would clash with wget --show-progress,
-      # which writes its progress bar directly to /dev/tty from inside the
-      # download function. Stderr from the function is allowed through so
-      # warnings/errors reach the user.
       local installer
       installer=$(download_nvidia_installer "$DRIVER_VERSION")
       local download_result=$?
@@ -1512,6 +1553,7 @@ main() {
 
       msg_info "$(translate 'Updating initramfs for all kernels...')"
       update-initramfs -u -k all >>"$LOG_FILE" 2>&1 || true
+      proxmox-boot-tool refresh >>"$LOG_FILE" 2>&1 || true
       msg_ok "$(translate 'initramfs updated.')"
 
       msg_info2 "$(translate 'Checking NVIDIA driver status with nvidia-smi')"
@@ -1554,6 +1596,7 @@ main() {
 
         msg_info "$(translate 'Updating initramfs for all kernels...')"
         update-initramfs -u -k all >>"$LOG_FILE" 2>&1 || true
+        proxmox-boot-tool refresh >>"$LOG_FILE" 2>&1 || true
         msg_ok "$(translate 'initramfs updated.')"
 
         restart_prompt
@@ -1565,6 +1608,139 @@ main() {
   esac
 }
 
+# ==========================================================
+# Non-interactive auto-reinstall entry point
+# ==========================================================
+# Invoked after a host-config restore by apply_cluster_postboot.sh
+# when components_status.json reports nvidia_driver as installed
+# but the kernel module isn't loaded on the live system (i.e. the
+# restore brought back the configs but not the binary driver from
+# /lib/modules/<kernel>/). Replays the install path the user
+# originally ran via `menu → 2`, using the recorded version, with
+# no dialogs.
+#
+# Exit codes:
+#   0  installed (or no-op — GPU absent / driver already present)
+#   1  state file unreadable or no nvidia_driver entry
+#   2  install failed
+auto_reinstall_from_state() {
+  : >"$LOG_FILE"
+  echo "=== auto_reinstall_from_state started $(date -Iseconds) ===" >>"$LOG_FILE"
+
+  if ! command -v jq >/dev/null 2>&1; then
+    echo "jq not available — cannot read components_status.json" | tee -a "$LOG_FILE"
+    return 1
+  fi
+  if [[ ! -f "$COMPONENTS_STATUS_FILE" ]]; then
+    echo "No components_status.json at $COMPONENTS_STATUS_FILE" | tee -a "$LOG_FILE"
+    return 1
+  fi
+
+  local recorded_status recorded_version recorded_patched
+  recorded_status=$(jq -r '.nvidia_driver.status // ""'    "$COMPONENTS_STATUS_FILE" 2>/dev/null)
+  recorded_version=$(jq -r '.nvidia_driver.version // ""'  "$COMPONENTS_STATUS_FILE" 2>/dev/null)
+  recorded_patched=$(jq -r '.nvidia_driver.patched // false' "$COMPONENTS_STATUS_FILE" 2>/dev/null)
+
+  if [[ "$recorded_status" != "installed" ]]; then
+    echo "nvidia_driver not marked installed in state ($recorded_status) — nothing to do" | tee -a "$LOG_FILE"
+    return 0
+  fi
+  if [[ -z "$recorded_version" || "$recorded_version" == "null" ]]; then
+    echo "nvidia_driver marked installed but no version recorded — aborting" | tee -a "$LOG_FILE"
+    return 1
+  fi
+  echo "Recorded driver: $recorded_version (patched=$recorded_patched)" >>"$LOG_FILE"
+
+  detect_nvidia_gpus
+  if ! $NVIDIA_GPU_PRESENT; then
+    echo "No NVIDIA GPU detected on this host — skipping reinstall" | tee -a "$LOG_FILE"
+    return 0
+  fi
+  # Skip when the host is configured for VFIO passthrough. Two
+  # signals — config wins over runtime:
+  #
+  #   1. modprobe.d declares the nvidia* modules blacklisted (the
+  #      file ProxMenux drops when switching the GPU to VM mode is
+  #      `proxmenux-nvidia-vfio-blacklist.conf`, but any blacklist
+  #      file counts).
+  #   2. The PCI device is bound to vfio-pci.
+  #
+  # The config check has to come FIRST because right after a host
+  # restore + reboot, the binding may not yet be effective (the
+  # GPU temporarily shows "no driver" while udev/initramfs settle).
+  # Reinstalling NVIDIA in that window forces the module onto a
+  # PCI device vfio-pci has already reserved → "NVRM: Try unloading
+  # the conflicting kernel module" and exit 1.
+  if [[ -f /etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf ]] \
+     || grep -qrhE '^[[:space:]]*blacklist[[:space:]]+nvidia([[:space:]_]|$)' \
+          /etc/modprobe.d/ 2>/dev/null; then
+    echo "NVIDIA blacklisted (host is VFIO-configured) — skipping host driver reinstall" \
+      | tee -a "$LOG_FILE"
+    return 0
+  fi
+  local _vfio_dev
+  for _vfio_dev in /sys/bus/pci/devices/*; do
+    [[ "$(cat "$_vfio_dev/vendor" 2>/dev/null)" == "0x10de" ]] || continue
+    if [[ -L "$_vfio_dev/driver" ]] \
+       && [[ "$(basename "$(readlink "$_vfio_dev/driver")")" == "vfio-pci" ]]; then
+      echo "NVIDIA GPU bound to vfio-pci — skipping host driver reinstall" | tee -a "$LOG_FILE"
+      return 0
+    fi
+  done
+  detect_driver_status
+  if $CURRENT_DRIVER_INSTALLED && [[ "$CURRENT_DRIVER_VERSION" == "$recorded_version" ]]; then
+    echo "Driver $recorded_version already installed and matches state — no-op" | tee -a "$LOG_FILE"
+    return 0
+  fi
+
+  DRIVER_VERSION="$recorded_version"
+
+  # Same install path as the interactive main() flow, minus all
+  # dialogs and confirmations.
+  echo "Reinstalling NVIDIA driver $DRIVER_VERSION non-interactively..." | tee -a "$LOG_FILE"
+  ensure_workdir
+  ensure_repos_and_headers          >>"$LOG_FILE" 2>&1
+  blacklist_nouveau                 >>"$LOG_FILE" 2>&1
+  ensure_modules_config             >>"$LOG_FILE" 2>&1
+
+  if $CURRENT_DRIVER_INSTALLED; then
+    echo "Different version currently installed; cleaning up first..." | tee -a "$LOG_FILE"
+    complete_nvidia_uninstall       >>"$LOG_FILE" 2>&1
+  fi
+
+  local installer
+  installer=$(download_nvidia_installer "$DRIVER_VERSION" 2>>"$LOG_FILE")
+  if [[ -z "$installer" || ! -f "$installer" ]]; then
+    echo "Download failed — see $LOG_FILE" | tee -a "$LOG_FILE"
+    return 2
+  fi
+  echo "Installer ready: $installer" >>"$LOG_FILE"
+  if ! run_nvidia_installer "$installer" >>"$LOG_FILE" 2>&1; then
+    echo "Install failed — see $LOG_FILE" | tee -a "$LOG_FILE"
+    return 2
+  fi
+  install_udev_rules_and_persistenced >>"$LOG_FILE" 2>&1
+
+  # Preserve the recorded patched state across the reinstall. The patch
+  # helper writes its own update_component_status on success.
+  CURRENT_DRIVER_VERSION="$DRIVER_VERSION"
+  if [[ "$recorded_patched" == "true" ]]; then
+    echo "Recorded state had patched=true — re-applying NVIDIA patch..." | tee -a "$LOG_FILE"
+    NVIDIA_PATCH_AUTO=yes apply_nvidia_patch_if_needed >>"$LOG_FILE" 2>&1 || true
+  else
+    if declare -F update_component_status >/dev/null 2>&1; then
+      update_component_status "nvidia_driver" "installed" "$DRIVER_VERSION" "gpu" '{"patched":false}' >>"$LOG_FILE" 2>&1
+    fi
+  fi
+
+  echo "✓ NVIDIA driver $DRIVER_VERSION reinstalled" | tee -a "$LOG_FILE"
+  return 0
+}
+
 if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  if [[ "${1:-}" == "--auto-reinstall" ]]; then
+    auto_reinstall_from_state
+    exit $?
+  fi
   main
-fi
+fi
\ No newline at end of file
diff --git a/scripts/gpu_tpu/switch_gpu_mode.sh b/scripts/gpu_tpu/switch_gpu_mode.sh
index 15b42fe1..02acb793 100644
--- a/scripts/gpu_tpu/switch_gpu_mode.sh
+++ b/scripts/gpu_tpu/switch_gpu_mode.sh
@@ -338,6 +338,18 @@ EOF
   else
     msg_ok "$(translate 'NVIDIA host services/autoload already aligned for VFIO mode')" | tee -a "$screen_capture"
   fi
+
+  # Sync components_status.json — the host driver stays on disk but is
+  # not in use because the GPU now belongs to a VM. Prevents the update
+  # notification path (and any future logic gated on nvidia_driver.status)
+  # from acting on a state that no longer matches reality.
+  if declare -F update_component_status >/dev/null 2>&1; then
+    local _nvd_ver
+    _nvd_ver=$(jq -r '.nvidia_driver.version // ""' \
+      /usr/local/share/proxmenux/components_status.json 2>/dev/null)
+    update_component_status "nvidia_driver" "vfio_passthrough" \
+      "${_nvd_ver:-}" "gpu" '{"patched":false}' >>"$LOG_FILE" 2>&1 || true
+  fi
 }
 
 _restore_nvidia_host_stack_for_lxc() {
@@ -402,6 +414,21 @@ _restore_nvidia_host_stack_for_lxc() {
   else
     msg_ok "$(translate 'NVIDIA host services/autoload already aligned for native mode')" | tee -a "$screen_capture"
   fi
+
+  # Sync components_status.json back to installed — the host has reclaimed
+  # the GPU and the nvidia stack is being reloaded. Restores the state to
+  # what it was before the VFIO switch so the update notification path and
+  # the auto-reinstall gate see the driver as active on the host again.
+  if declare -F update_component_status >/dev/null 2>&1; then
+    local _nvd_ver
+    _nvd_ver=$(nvidia-smi --query-gpu=driver_version --format=csv,noheader 2>/dev/null | head -1)
+    if [[ -z "$_nvd_ver" ]]; then
+      _nvd_ver=$(jq -r '.nvidia_driver.version // ""' \
+        /usr/local/share/proxmenux/components_status.json 2>/dev/null)
+    fi
+    update_component_status "nvidia_driver" "installed" \
+      "${_nvd_ver:-}" "gpu" '{"patched":false}' >>"$LOG_FILE" 2>&1 || true
+  fi
 }
 
 _add_amd_softdep() {
@@ -1214,6 +1241,7 @@ switch_to_vm_mode() {
   if [[ "$HOST_CONFIG_CHANGED" == "true" ]]; then
     msg_info "$(translate 'Updating initramfs (this may take a minute)...')"
     update-initramfs -u -k all >>"$LOG_FILE" 2>&1
+    proxmox-boot-tool refresh >>"$LOG_FILE" 2>&1 || true
     msg_ok "$(translate 'initramfs updated')" | tee -a "$screen_capture"
   fi
 }
@@ -1285,6 +1313,7 @@ switch_to_lxc_mode() {
   if [[ "$HOST_CONFIG_CHANGED" == "true" ]]; then
     msg_info "$(translate 'Updating initramfs (this may take a minute)...')"
     update-initramfs -u -k all >>"$LOG_FILE" 2>&1
+    proxmox-boot-tool refresh >>"$LOG_FILE" 2>&1 || true
     msg_ok "$(translate 'initramfs updated')" | tee -a "$screen_capture"
   fi
 }
diff --git a/scripts/gpu_tpu/switch_gpu_mode_direct.sh b/scripts/gpu_tpu/switch_gpu_mode_direct.sh
index b5652d07..cd14b9b7 100644
--- a/scripts/gpu_tpu/switch_gpu_mode_direct.sh
+++ b/scripts/gpu_tpu/switch_gpu_mode_direct.sh
@@ -316,6 +316,18 @@ EOF
   else
     msg_ok "$(translate 'NVIDIA host services/autoload already aligned for VFIO mode')" | tee -a "$screen_capture"
   fi
+
+  # Sync components_status.json — the host driver stays on disk but is
+  # not in use because the GPU now belongs to a VM. Prevents the update
+  # notification path (and any future logic gated on nvidia_driver.status)
+  # from acting on a state that no longer matches reality.
+  if declare -F update_component_status >/dev/null 2>&1; then
+    local _nvd_ver
+    _nvd_ver=$(jq -r '.nvidia_driver.version // ""' \
+      /usr/local/share/proxmenux/components_status.json 2>/dev/null)
+    update_component_status "nvidia_driver" "vfio_passthrough" \
+      "${_nvd_ver:-}" "gpu" '{"patched":false}' >>"$LOG_FILE" 2>&1 || true
+  fi
 }
 
 _restore_nvidia_host_stack_for_lxc() {
@@ -376,6 +388,21 @@ _restore_nvidia_host_stack_for_lxc() {
   else
     msg_ok "$(translate 'NVIDIA host services/autoload already aligned for native mode')" | tee -a "$screen_capture"
   fi
+
+  # Sync components_status.json back to installed — the host has reclaimed
+  # the GPU and the nvidia stack is being reloaded. Restores the state to
+  # what it was before the VFIO switch so the update notification path and
+  # the auto-reinstall gate see the driver as active on the host again.
+  if declare -F update_component_status >/dev/null 2>&1; then
+    local _nvd_ver
+    _nvd_ver=$(nvidia-smi --query-gpu=driver_version --format=csv,noheader 2>/dev/null | head -1)
+    if [[ -z "$_nvd_ver" ]]; then
+      _nvd_ver=$(jq -r '.nvidia_driver.version // ""' \
+        /usr/local/share/proxmenux/components_status.json 2>/dev/null)
+    fi
+    update_component_status "nvidia_driver" "installed" \
+      "${_nvd_ver:-}" "gpu" '{"patched":false}' >>"$LOG_FILE" 2>&1 || true
+  fi
 }
 
 _add_amd_softdep() {
@@ -1040,6 +1067,7 @@ switch_to_vm_mode() {
   if [[ "$HOST_CONFIG_CHANGED" == "true" ]]; then
     msg_info "$(translate 'Updating initramfs (this may take a minute)...')"
     update-initramfs -u -k all >>"$LOG_FILE" 2>&1
+    proxmox-boot-tool refresh >>"$LOG_FILE" 2>&1 || true
     msg_ok "$(translate 'initramfs updated')" | tee -a "$screen_capture"
   fi
 }
@@ -1111,6 +1139,7 @@ switch_to_lxc_mode() {
   if [[ "$HOST_CONFIG_CHANGED" == "true" ]]; then
     msg_info "$(translate 'Updating initramfs (this may take a minute)...')"
     update-initramfs -u -k all >>"$LOG_FILE" 2>&1
+    proxmox-boot-tool refresh >>"$LOG_FILE" 2>&1 || true
     msg_ok "$(translate 'initramfs updated')" | tee -a "$screen_capture"
   fi
 }
diff --git a/scripts/help_info_menu.sh b/scripts/help_info_menu.sh
index 1912eb1e..f960e262 100644
--- a/scripts/help_info_menu.sh
+++ b/scripts/help_info_menu.sh
@@ -32,7 +32,6 @@
 LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
 
 if [[ -f "$UTILS_FILE" ]]; then
     source "$UTILS_FILE"
diff --git a/scripts/lxc/lxc-manual-guide.sh b/scripts/lxc/lxc-manual-guide.sh
index 40c87101..dc4dd5e0 100644
--- a/scripts/lxc/lxc-manual-guide.sh
+++ b/scripts/lxc/lxc-manual-guide.sh
@@ -14,7 +14,6 @@
 LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
 
 if [[ -f "$UTILS_FILE" ]]; then
     source "$UTILS_FILE"
diff --git a/scripts/lxc/lxc-privileged-to-unprivileged.sh b/scripts/lxc/lxc-privileged-to-unprivileged.sh
index 56648dfc..b9e94f15 100644
--- a/scripts/lxc/lxc-privileged-to-unprivileged.sh
+++ b/scripts/lxc/lxc-privileged-to-unprivileged.sh
@@ -18,7 +18,6 @@
 LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
 
 if [[ -f "$UTILS_FILE" ]]; then
     source "$UTILS_FILE"
diff --git a/scripts/menus/config_menu.sh b/scripts/menus/config_menu.sh
index 943d0ba4..66fcc299 100644
--- a/scripts/menus/config_menu.sh
+++ b/scripts/menus/config_menu.sh
@@ -40,13 +40,11 @@
 LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 BASE_DIR="/usr/local/share/proxmenux"
 CONFIG_FILE="$BASE_DIR/config.json"
-CACHE_FILE="$BASE_DIR/cache.json"
 UTILS_FILE="$BASE_DIR/utils.sh"
 LOCAL_VERSION_FILE="$BASE_DIR/version.txt"
 BETA_VERSION_FILE="$BASE_DIR/beta_version.txt"
 INSTALL_DIR="/usr/local/bin"
 MENU_SCRIPT="menu"
-VENV_PATH="/opt/googletrans-env"
 BACKTITLE="ProxMenux Configuration"
 
 REPO_MAIN="https://raw.githubusercontent.com/MacRimi/ProxMenux/main"
@@ -113,30 +111,6 @@ uninstall_proxmenux_monitor() {
     
 }
 
-detect_installation_type() {
-    local has_venv=false
-    local has_language=false
-    
-    # Check if virtual environment exists
-    if [ -d "$VENV_PATH" ] && [ -f "$VENV_PATH/bin/activate" ]; then
-        has_venv=true
-    fi
-    
-    # Check if language is configured
-    if [ -f "$CONFIG_FILE" ]; then
-        local current_language=$(jq -r '.language // empty' "$CONFIG_FILE" 2>/dev/null)
-        if [[ -n "$current_language" && "$current_language" != "null" && "$current_language" != "empty" ]]; then
-            has_language=true
-        fi
-    fi
-    
-    if [ "$has_venv" = true ] && [ "$has_language" = true ]; then
-        echo "translation"
-    else
-        echo "normal"
-    fi
-}
-
 check_monitor_status() {
     if systemctl list-unit-files | grep -q "$MONITOR_SERVICE"; then
         if systemctl is-active --quiet "$MONITOR_SERVICE"; then
@@ -547,9 +521,6 @@ show_monitor_status() {
 
 # ==========================================================
 show_config_menu() {
-    local install_type
-    install_type=$(detect_installation_type)
-    
     while true; do
         local menu_options=()
         local option_actions=()
@@ -580,35 +551,22 @@ show_config_menu() {
         option_actions[$option_num]="change_release_channel"
         ((option_num++))
 
-        # Build menu based on installation type
-        if [ "$install_type" = "translation" ]; then
-            menu_options+=("$option_num" "$(translate "Change Language")")
-            option_actions[$option_num]="change_language"
-            ((option_num++))
-            
-            menu_options+=("$option_num" "$(translate "Show Version Information")")
-            option_actions[$option_num]="show_version_info"
-            ((option_num++))
-            
-            menu_options+=("$option_num" "$(translate "Uninstall ProxMenux")")
-            option_actions[$option_num]="uninstall_proxmenu"
-            ((option_num++))
-            
-            menu_options+=("$option_num" "$(translate "Return to Main Menu")")
-            option_actions[$option_num]="return_main"
-        else
-            # Normal version (English only)
-            menu_options+=("$option_num" "Show Version Information")
-            option_actions[$option_num]="show_version_info"
-            ((option_num++))
-            
-            menu_options+=("$option_num" "Uninstall ProxMenux")
-            option_actions[$option_num]="uninstall_proxmenu"
-            ((option_num++))
-            
-            menu_options+=("$option_num" "Return to Main Menu")
-            option_actions[$option_num]="return_main"
-        fi
+        # Translation/Normal split is gone — single menu now. Change Language
+        # is always available since every install ships the lang/*.json cache.
+        menu_options+=("$option_num" "$(translate "Change Language")")
+        option_actions[$option_num]="change_language"
+        ((option_num++))
+
+        menu_options+=("$option_num" "$(translate "Show Version Information")")
+        option_actions[$option_num]="show_version_info"
+        ((option_num++))
+
+        menu_options+=("$option_num" "$(translate "Uninstall ProxMenux")")
+        option_actions[$option_num]="uninstall_proxmenu"
+        ((option_num++))
+
+        menu_options+=("$option_num" "$(translate "Return to Main Menu")")
+        option_actions[$option_num]="return_main"
         
         # Show menu
         OPTION=$(dialog --clear --backtitle "ProxMenux Configuration" \
@@ -684,8 +642,7 @@ change_language() {
 
 # ==========================================================
 show_version_info() {
-    local version info_message install_type release_channel beta_version
-    install_type=$(detect_installation_type)
+    local version info_message release_channel beta_version
     release_channel=$(get_release_channel)
     
     if [ -f "$LOCAL_VERSION_FILE" ]; then
@@ -702,15 +659,8 @@ show_version_info() {
     fi
     info_message+="\n"
     
-    # Show installation type
-    info_message+="$(translate "Installation type:")\n"
-    if [ "$install_type" = "translation" ]; then
-        info_message+="✓ $(translate "Translation Version (Multi-language support)")\n"
-    else
-        info_message+="✓ $(translate "Normal Version (English only - Lightweight)")\n"
-    fi
-    info_message+="\n"
-    
+    # Translation/Normal split is gone — single install path now.
+    # Translation support is always present via the lang/*.json cache.
     info_message+="$(translate "Installed components:")\n"
     if [ -f "$CONFIG_FILE" ]; then
         while IFS=': ' read -r component value; do
@@ -745,23 +695,16 @@ show_version_info() {
     [ -f "$CONFIG_FILE" ] && info_message+="✓ config.json → $CONFIG_FILE\n" || info_message+="✗ config.json\n"
     [ -f "$LOCAL_VERSION_FILE" ] && info_message+="✓ version.txt → $LOCAL_VERSION_FILE\n" || info_message+="✗ version.txt\n"
     
-    # Show translation-specific files
-    if [ "$install_type" = "translation" ]; then
-        [ -f "$CACHE_FILE" ] && info_message+="✓ cache.json → $CACHE_FILE\n" || info_message+="✗ cache.json\n"
-        
-        info_message+="\n$(translate "Virtual Environment:")\n"
-        if [ -d "$VENV_PATH" ] && [ -f "$VENV_PATH/bin/activate" ]; then
-            info_message+="✓ $(translate "Installed") → $VENV_PATH\n"
-            [ -f "$VENV_PATH/bin/pip" ] && info_message+="✓ pip: $(translate "Installed") → $VENV_PATH/bin/pip\n" || info_message+="✗ pip: $(translate "Not installed")\n"
-        else
-            info_message+="✗ $(translate "Virtual Environment"): $(translate "Not installed")\n"
-            info_message+="✗ pip: $(translate "Not installed")\n"
-        fi
-        
-        current_language=$(jq -r '.language // "en"' "$CONFIG_FILE")
-        info_message+="\n$(translate "Current language:")\n$current_language\n"
+    # Language section: always present now that translations are static
+    # JSON lookups. Show the configured language and the lang/ directory
+    # so the operator can verify the cache is in place.
+    current_language=$(jq -r '.language // "en"' "$CONFIG_FILE" 2>/dev/null)
+    [[ -z "$current_language" || "$current_language" == "null" ]] && current_language="en"
+    info_message+="\n$(translate "Current language:")\n${current_language}\n"
+    if [ -d "$BASE_DIR/lang" ]; then
+        info_message+="✓ $(translate "Translation files:") $BASE_DIR/lang/\n"
     else
-        info_message+="\n$(translate "Language:")\nEnglish (Fixed)\n"
+        info_message+="✗ $(translate "Translation files:") $(translate "missing")\n"
     fi
     
     # Display information in a scrollable text box
@@ -775,9 +718,6 @@ show_version_info() {
 
 # ==========================================================
 uninstall_proxmenu() {
-    local install_type
-    install_type=$(detect_installation_type)
-    
     if ! dialog --clear --backtitle "ProxMenux Configuration" \
                 --title "Uninstall ProxMenux" \
                 --yesno "\n$(translate "Are you sure you want to uninstall ProxMenux?")" 8 60; then
@@ -785,40 +725,26 @@ uninstall_proxmenu() {
     fi
     
     local deps_to_remove=""
-    
-    # Show different dependency options based on installation type
-    if [ "$install_type" = "translation" ]; then
-        deps_to_remove=$(dialog --clear --backtitle "ProxMenux Configuration" \
-                               --title "Remove Dependencies" \
-                               --checklist "Select dependencies to remove:" 15 60 4 \
-                               "python3-venv" "Python virtual environment" OFF \
-                               "python3-pip" "Python package installer" OFF \
-                               "python3" "Python interpreter" OFF \
-                               "jq" "JSON processor" OFF \
-                               3>&1 1>&2 2>&3)
-    else
-        deps_to_remove=$(dialog --clear --backtitle "ProxMenux Configuration" \
-                               --title "Remove Dependencies" \
-                               --checklist "Select dependencies to remove:" 12 60 2 \
-                               "dialog" "Interactive dialog boxes" OFF \
-                               "jq" "JSON processor" OFF \
-                               3>&1 1>&2 2>&3)
-    fi
-    
+
+    deps_to_remove=$(dialog --clear --backtitle "ProxMenux Configuration" \
+                           --title "Remove Dependencies" \
+                           --checklist "Select dependencies to remove:" 12 60 2 \
+                           "dialog" "Interactive dialog boxes" OFF \
+                           "jq" "JSON processor" OFF \
+                           3>&1 1>&2 2>&3)
+
     # Perform uninstallation with progress bar
     (
         echo "10" ; echo "Removing ProxMenu files..."
         sleep 1
-        
-        # Remove googletrans and virtual environment if exists
-        if [ -f "$VENV_PATH/bin/activate" ]; then
-            echo "30" ; echo "Removing googletrans and virtual environment..."
-            source "$VENV_PATH/bin/activate"
-            pip uninstall -y googletrans >/dev/null 2>&1
-            deactivate
-            rm -rf "$VENV_PATH"
+
+        # Purge the legacy googletrans virtualenv if it was left over from
+        # a pre-static-translations install. Cheap idempotent check.
+        if [ -d "/opt/googletrans-env" ]; then
+            echo "30" ; echo "Removing legacy googletrans virtualenv..."
+            rm -rf "/opt/googletrans-env"
         fi
-        
+
         echo "50" ; echo "Removing ProxMenu files..."
         rm -f "$INSTALL_DIR/$MENU_SCRIPT"
         rm -rf "$BASE_DIR"
diff --git a/scripts/menus/create_vm_menu.sh b/scripts/menus/create_vm_menu.sh
index 7e49a9a1..4d6d5798 100644
--- a/scripts/menus/create_vm_menu.sh
+++ b/scripts/menus/create_vm_menu.sh
@@ -39,7 +39,6 @@ MENU_REPO="$LOCAL_SCRIPTS/menus"
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$LOCAL_SCRIPTS/utils.sh"
 [[ ! -f "$UTILS_FILE" ]] && UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
 
 # Source utilities and required scripts
 if [[ -f "$UTILS_FILE" ]]; then
diff --git a/scripts/menus/hw_grafics_menu.sh b/scripts/menus/hw_grafics_menu.sh
index 234ca7db..2eda832f 100644
--- a/scripts/menus/hw_grafics_menu.sh
+++ b/scripts/menus/hw_grafics_menu.sh
@@ -27,22 +27,21 @@ initialize_cache
 while true; do
     OPTION=$(dialog --colors --backtitle "ProxMenux" \
         --title "$(translate "GPUs and Coral-TPU Menu")" \
-        --menu "\n$(translate "Select an option:")" 26 78 16 \
-            ""  "\Z4──────────────────────── HOST ─────────────────────────\Zn" \
+        --menu "\n$(translate "Select an option:")" 26 80 16 \
+            ""  "\Zb\Z4                         HOST\Zn" \
             "1"         "$(translate "Install/Update NVIDIA Drivers (Host + LXC)")" \
             "2"         "$(translate "Install/Update Coral TPU on Host")" \
-            ""          "" \
-            ""  "\Z4──────────────────────── LXC ──────────────────────────\Zn" \
+            ""  "\Zb\Z4                          LXC\Zn" \
             "3"         "$(translate "Add GPU to LXC   (Intel | AMD | NVIDIA)")  \Zb\Z4Switch Mode\Zn" \
             "4"         "$(translate "Add Coral TPU to LXC")" \
-            ""          "" \
-            ""  "\Z4──────────────────────── VM ───────────────────────────\Zn" \
+            ""  "\Zb\Z4                          VM\Zn" \
             "5"         "$(translate "Add GPU to VM    (Intel | AMD | NVIDIA)")  \Zb\Z4Switch Mode\Zn" \
             ""          "" \
             ""  "\Z4──────────────────── SWICHT MODE ───────────────────────\Zn" \
+            ""          "" \
             "6"         "$(translate "Switch GPU Mode  (VM <-> LXC)")" \
             ""  "" \
-            ""  "\Z4────────────────────── Utilities ───────────────────────\Zn" \
+            ""  "\Z4───────────────────── Utilities ────────────────────────\Zn" \
             "7"         "$(translate "Manual CLI Guide (GPU/TPU)")" \
             "0"         "$(translate "Return to Main Menu")" \
             2>&1 >/dev/tty
diff --git a/scripts/menus/main_menu.sh b/scripts/menus/main_menu.sh
index f26fdb2f..7c42ef9f 100644
--- a/scripts/menus/main_menu.sh
+++ b/scripts/menus/main_menu.sh
@@ -14,7 +14,6 @@
 LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
-VENV_PATH="/opt/googletrans-env"
 
 
 if ! command -v dialog &>/dev/null; then
@@ -23,47 +22,11 @@ if ! command -v dialog &>/dev/null; then
 fi
 
 
-check_pve9_translation_compatibility() {
-    local pve_version
-    
-    if command -v pveversion &>/dev/null; then
-        pve_version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+' | head -1)
-    else
-        return 0
-    fi
-    
-    if [[ -n "$pve_version" ]] && [[ "$pve_version" -ge 9 ]] && [[ -d "$VENV_PATH" ]]; then
-        
-        local has_googletrans=false
-        local has_cache=false
-        
-        if [[ -f "$VENV_PATH/bin/pip" ]]; then
-            if "$VENV_PATH/bin/pip" list 2>/dev/null | grep -q "googletrans"; then
-                has_googletrans=true
-            fi
-        fi
-        
-        if [[ -f "$BASE_DIR/cache.json" ]]; then
-            has_cache=true
-        fi
-        
-        if [[ "$has_googletrans" = true ]] || [[ "$has_cache" = true ]]; then
-            
-            dialog --clear \
-                --backtitle "ProxMenux - Compatibility Required" \
-                --title "Translation Environment Incompatible with PVE $pve_version" \
-                --msgbox "NOTICE: You are running Proxmox VE $pve_version with translation components installed.\n\nTranslations are NOT supported in PVE 9+. This causes:\n• Menu loading errors\n• Translation failures\n• System instability\n\nREQUIRED ACTION:\nProxMenux will now automatically reinstall the Normal Version.\n\nThis process will:\n• Remove incompatible translation components\n• Install PVE 9+ compatible version\n• Preserve all your settings and preferences\n\nPress OK to continue with automatic reinstallation..." 20 75
-            
-            bash "$BASE_DIR/install_proxmenux.sh"
-
-        fi
-        exit 0 
-    fi
-}
-
-check_pve9_translation_compatibility
-
 # ==========================================================
+# The legacy "PVE9 + googletrans incompatible" gate that used to live
+# here has been removed along with the googletrans runtime. Translations
+# are now a static lookup against $BASE_DIR/lang/<lang>.json — there is
+# no runtime venv to be incompatible with any PVE version.
 
 if [[ -f "$UTILS_FILE" ]]; then
     source "$UTILS_FILE"
@@ -94,7 +57,7 @@ show_menu() {
         dialog --clear \
             --backtitle "ProxMenux" \
             --title "$(translate "$menu_title")" \
-            --menu "\n$(translate "Select an option:")" 20 70 11 \
+            --menu "\n$(translate "Select an option:")" 21 70 12 \
             1 "$(translate "Settings post-install Proxmox")" \
             2 "$(translate "Hardware: GPUs and Coral-TPU")" \
             3 "$(translate "Create VM from template or script")" \
@@ -104,6 +67,7 @@ show_menu() {
             7 "$(translate "Network Management")" \
             8 "$(translate "Security")" \
             9 "$(translate "Utilities and Tools")" \
+            b "$(translate "Host Backup & Restore")" \
             h "$(translate "Help and Info Commands")" \
             s "$(translate "Settings")" \
             0 "$(translate "Exit")" 2>"$TEMP_FILE"
@@ -129,6 +93,7 @@ show_menu() {
             7) exec bash "$LOCAL_SCRIPTS/menus/network_menu.sh" ;;
             8) exec bash "$LOCAL_SCRIPTS/menus/security_menu.sh" ;;
             9) exec bash "$LOCAL_SCRIPTS/menus/utilities_menu.sh" ;;
+            b) bash "$LOCAL_SCRIPTS/backup_restore/backup_host.sh" ;;
             h) bash "$LOCAL_SCRIPTS/help_info_menu.sh" ;;
             s) exec bash "$LOCAL_SCRIPTS/menus/config_menu.sh" ;;
             0) clear; msg_ok "$(translate "Thank you for using ProxMenux. Goodbye!")"; rm -f "$TEMP_FILE"; exit 0 ;;
diff --git a/scripts/menus/menu_post_install.sh b/scripts/menus/menu_post_install.sh
index 62b30b15..4d396322 100644
--- a/scripts/menus/menu_post_install.sh
+++ b/scripts/menus/menu_post_install.sh
@@ -254,6 +254,32 @@ format_menu_item() {
     echo "${description}${spacing}${source}"
 }
 
+post_install_label() {
+    case "$1" in
+        "Automated post-installation script")
+            translate "Automated post-installation script"
+            ;;
+        "Customizable post-installation script")
+            translate "Customizable post-installation script"
+            ;;
+        "Uninstall optimizations")
+            translate "Uninstall optimizations"
+            ;;
+        "Proxmox VE Post Install")
+            echo "Proxmox VE Post Install"
+            ;;
+        "Proxmox VE Microcode")
+            echo "Proxmox VE Microcode"
+            ;;
+        "Community Scripts")
+            translate "Community Scripts"
+            ;;
+        *)
+            translate "$1"
+            ;;
+    esac
+}
+
 # ==========================================================
 show_menu() {
     while true; do
@@ -276,10 +302,8 @@ show_menu() {
             # above "Uninstall optimizations" so it sits next to the
             # related rollback action and not buried in the middle.
             if [[ "$name" == "Uninstall optimizations" && "$update_count" -gt 0 ]]; then
-                local update_label
-                update_label="Apply available updates ($update_count)"
                 local translated_update
-                translated_update="$(translate "$update_label")"
+                translated_update="$(translate "Apply available updates") ($update_count)"
                 local formatted_update
                 formatted_update=$(format_menu_item "$translated_update" "ProxMenux")
                 menu_items+=("$counter" "$formatted_update")
@@ -287,7 +311,8 @@ show_menu() {
                 ((counter++))
             fi
 
-            local translated_name="$(translate "$name")"
+            local translated_name
+            translated_name="$(post_install_label "$name")"
             local formatted_item
             formatted_item=$(format_menu_item "$translated_name" "$source")
             menu_items+=("$counter" "$formatted_item")
@@ -297,13 +322,12 @@ show_menu() {
         
 
         menu_items+=("" "")
-        menu_items+=("-" "───────────────────── Community Scripts ──────────────────────")
-        menu_items+=("" "")
-        
+        menu_items+=("" "\Z4───────────────────── Community Scripts ──────────────────────\Zn")
 
         for script in "${COMMUNITY_SCRIPTS[@]}"; do
             IFS='|' read -r name source command <<< "$script"
-            local translated_name="$(translate "$name")"
+            local translated_name
+            translated_name="$(post_install_label "$name")"
             local formatted_item
             formatted_item=$(format_menu_item "$translated_name" "$source")
             menu_items+=("$counter" "$formatted_item")
@@ -317,11 +341,11 @@ show_menu() {
         
 
         exec 3>&1
-        script_selection=$(dialog --clear \
+        script_selection=$(dialog --clear --colors \
                                  --backtitle "ProxMenux" \
                                  --title "$(translate "Post-Installation Scripts")" \
                                  --menu "\n$(translate "Select a post-installation script:"):\n" \
-                                 22 78 15 \
+                                 24 84 16 \
                                  "${menu_items[@]}" 2>&1 1>&3)
         exit_status=$?
         exec 3>&-
diff --git a/scripts/menus/network_menu.sh b/scripts/menus/network_menu.sh
index 033530ce..8b204ef7 100644
--- a/scripts/menus/network_menu.sh
+++ b/scripts/menus/network_menu.sh
@@ -1184,6 +1184,56 @@ format_menu_item() {
     echo "${description}${spacing}${source}"
 }
 
+network_menu_label() {
+    case "$1" in
+        "Real-time network usage (iftop)")
+            translate "Real-time network usage (iftop)"
+            ;;
+        "Network monitoring tool (iptraf-ng)")
+            translate "Network monitoring tool (iptraf-ng)"
+            ;;
+        "Bandwidth test (iperf3)")
+            translate "Bandwidth test (iperf3)"
+            ;;
+        "Show Routing Table")
+            translate "Show Routing Table"
+            ;;
+        "Test Connectivity")
+            translate "Test Connectivity"
+            ;;
+        "Advanced Diagnostics")
+            translate "Advanced Diagnostics"
+            ;;
+        "Analyze Bridge Configuration")
+            translate "Analyze Bridge Configuration"
+            ;;
+        "Analyze Network Configuration")
+            translate "Analyze Network Configuration"
+            ;;
+        "Setup Persistent Network Names")
+            translate "Setup Persistent Network Names"
+            ;;
+        "Restart Network Service")
+            translate "Restart Network Service"
+            ;;
+        "Show Network Config File")
+            translate "Show Network Config File"
+            ;;
+        "Create Network Backup")
+            translate "Create Network Backup"
+            ;;
+        "Restore Network Backup")
+            translate "Restore Network Backup"
+            ;;
+        "Disable NIC Offloading (Intel e1000e)")
+            translate "Disable NIC Offloading (Intel e1000e)"
+            ;;
+        *)
+            translate "$1"
+            ;;
+    esac
+}
+
 # ==========================================================
 show_menu() {
     while true; do
@@ -1195,7 +1245,8 @@ show_menu() {
 
         for script in "${PROXMENUX_SCRIPTS[@]}"; do
             IFS='|' read -r name source command <<< "$script"
-            local translated_name="$(translate "$name")"
+            local translated_name
+            translated_name="$(network_menu_label "$name")"
             local formatted_item
             formatted_item=$(format_menu_item "$translated_name" "$source")
             menu_items+=("$counter" "$formatted_item")
@@ -1205,13 +1256,12 @@ show_menu() {
         
 
         menu_items+=("" "")
-        menu_items+=("-" "───────────────────── $(translate "Community Scripts") ──────────────────────")
-        menu_items+=("" "")
-        
+        menu_items+=("" "\Z4───────────────────── Community Scripts ──────────────────────\Zn")
 
         for script in "${COMMUNITY_SCRIPTS[@]}"; do
             IFS='|' read -r name source command <<< "$script"
-            local translated_name="$(translate "$name")"
+            local translated_name
+            translated_name="$(network_menu_label "$name")"
             local formatted_item
             formatted_item=$(format_menu_item "$translated_name" "$source")
             menu_items+=("$counter" "$formatted_item")
@@ -1225,11 +1275,11 @@ show_menu() {
         
 
         exec 3>&1
-        script_selection=$(dialog --clear \
+        script_selection=$(dialog --clear --colors \
                                  --backtitle "ProxMenux" \
                                  --title "$(translate "Network Management")" \
                                  --menu "\n$(translate "Select a network management option:"):\n" \
-                                 28 78 19 \
+                                 28 82 19 \
                                  "${menu_items[@]}" 2>&1 1>&3)
         exit_status=$?
         exec 3>&-
diff --git a/scripts/menus/security_menu.sh b/scripts/menus/security_menu.sh
index 6a27560c..f2f5c3fb 100644
--- a/scripts/menus/security_menu.sh
+++ b/scripts/menus/security_menu.sh
@@ -39,7 +39,13 @@ initialize_cache
 # ==========================================================
 security_menu() {
   while true; do
-    local menu_text
+    # `local menu_text` alone does NOT reset the variable on the
+    # second iteration of the while loop — bash keeps the value from
+    # the previous round, so `menu_text+=` accumulated a duplicate
+    # "Select an option:" every time the user cancelled a sub-menu
+    # and came back. Assigning "" on declaration guarantees a clean
+    # slate each round.
+    local menu_text=""
     menu_text+="\n$(translate 'Select an option:')"
 
     local OPTION
diff --git a/scripts/menus/share_menu.sh b/scripts/menus/share_menu.sh
index 4f5d341b..8c22d02c 100644
--- a/scripts/menus/share_menu.sh
+++ b/scripts/menus/share_menu.sh
@@ -34,14 +34,14 @@ while true; do
     OPTION=$(dialog --colors --backtitle "ProxMenux" \
         --title "$(translate "Storage & Share Manager")" \
         --menu "\n$(translate "Select an option:")" 28 78 17 \
-            "" "\Z4──────────────────────── HOST ─────────────────────────\Zn" \
+            "" "\Zb\Z4                          HOST\Zn" \
             "1"         "$(translate "Add NFS share    as Proxmox Storage")" \
             "2"         "$(translate "Add Samba share  as Proxmox Storage")" \
             "3"         "$(translate "Add iSCSI Target as Proxmox Storage")" \
             "4"         "$(translate "Add Local Disk   as Proxmox Storage")" \
             "5"         "$(translate "Create Shared Directory on Host")" \
             ""          "" \
-            ""  "\Z4──────────────────────── LXC ─────────────────────────\Zn" \
+            ""  "\Zb\Z4                          LXC\Zn" \
             "6"         "$(translate "Configure LXC Mount Points    (Host ↔ Container)")" \
             ""          "" \
             "7"         "$(translate "Configure NFS   Client in LXC (only privileged)")" \
diff --git a/scripts/menus/storage_menu.sh b/scripts/menus/storage_menu.sh
index d9250395..54cf4694 100644
--- a/scripts/menus/storage_menu.sh
+++ b/scripts/menus/storage_menu.sh
@@ -32,12 +32,12 @@ while true; do
     OPTION=$(dialog --colors --backtitle "ProxMenux" \
         --title "$(translate "Disk Manager")" \
         --menu "\n$(translate "Select an option:")" 24 78 16 \
-            ""  "\Z4──────────────────────── VM ───────────────────────────\Zn" \
+            ""  "\Zb\Z4                           VM\Zn" \
             "1" "$(translate "Import Disk to VM")" \
             "2" "$(translate "Import Disk Image to VM")" \
             "3" "$(translate "Add Controller or NVMe PCIe to VM")" \
             ""  "" \
-            ""  "\Z4──────────────────────── LXC ──────────────────────────\Zn" \
+            ""  "\Zb\Z4                          LXC\Zn" \
             "4" "$(translate "Import Disk to LXC")" \
             ""  "" \
             ""  "\Z4────────────────────── Utilities ───────────────────────\Zn" \
diff --git a/scripts/post_install/auto_post_install.sh b/scripts/post_install/auto_post_install.sh
index cc53beae..67fbf4b3 100644
--- a/scripts/post_install/auto_post_install.sh
+++ b/scripts/post_install/auto_post_install.sh
@@ -40,6 +40,14 @@ if [[ -f "$UTILS_FILE" ]]; then
     source "$UTILS_FILE"
 fi
 
+# Pull in ensure_repositories + PROXMENUX_UTILS — customizable already
+# sources this helper; auto did not, so a function that calls
+# `ensure_repositories` (setup_proxmox_repositories below) needs the
+# import here too.
+if [[ -f "$LOCAL_SCRIPTS/global/utils-install-functions.sh" ]]; then
+    source "$LOCAL_SCRIPTS/global/utils-install-functions.sh"
+fi
+
 load_language
 initialize_cache
 
@@ -191,6 +199,35 @@ remove_subscription_banner() {
 
 
 
+setup_proxmox_repositories() {
+    local FUNC_VERSION="1.1"
+# Description: Configure Proxmox + Debian APT repositories (no-subscription)
+# and set the correct file permissions.
+
+    msg_info2 "$(translate "Configuring Proxmox APT repositories...")"
+
+    if ! ensure_repositories; then
+        msg_error "$(translate "Failed to configure Proxmox repositories")"
+        register_tool "proxmox_repos" false "$FUNC_VERSION"
+        return 1
+    fi
+
+    # Defensive re-chmod: if the files already existed with the old 0640
+    # permissions there is nothing for `ensure_repositories` to recreate,
+    # so we still flip the bits explicitly here.
+    local f
+    for f in /etc/apt/sources.list.d/proxmox.sources \
+             /etc/apt/sources.list.d/debian.sources \
+             /etc/apt/sources.list.d/pve-no-subscription.list \
+             /etc/apt/sources.list.d/pve-enterprise.list; do
+        [[ -f "$f" ]] && chmod 0644 "$f" 2>/dev/null
+    done
+
+    register_tool "proxmox_repos" true "$FUNC_VERSION"
+    msg_success "$(translate "Proxmox APT repositories configured")"
+}
+
+
 configure_time_sync() {
     local FUNC_VERSION="1.0"
     # description: Detect timezone from public IP and enable systemd time sync (NTP).
diff --git a/scripts/post_install/customizable_post_install.sh b/scripts/post_install/customizable_post_install.sh
index 0e89c4b3..5eebcca3 100644
--- a/scripts/post_install/customizable_post_install.sh
+++ b/scripts/post_install/customizable_post_install.sh
@@ -101,6 +101,32 @@ register_tool() {
 
 
 
+setup_proxmox_repositories() {
+    local FUNC_VERSION="1.1"
+    # Description: Configure Proxmox + Debian APT repositories (no-subscription)
+    # and set the correct file permissions.
+
+    msg_info2 "$(translate "Configuring Proxmox APT repositories...")"
+
+    if ! ensure_repositories; then
+        msg_error "$(translate "Failed to configure Proxmox repositories")"
+        register_tool "proxmox_repos" false "$FUNC_VERSION"
+        return 1
+    fi
+
+    local f
+    for f in /etc/apt/sources.list.d/proxmox.sources \
+             /etc/apt/sources.list.d/debian.sources \
+             /etc/apt/sources.list.d/pve-no-subscription.list \
+             /etc/apt/sources.list.d/pve-enterprise.list; do
+        [[ -f "$f" ]] && chmod 0644 "$f" 2>/dev/null
+    done
+
+    register_tool "proxmox_repos" true "$FUNC_VERSION"
+    msg_success "$(translate "Proxmox APT repositories configured")"
+}
+
+
 check_extremeshok_warning() {
     local marker_file="/etc/extremeshok"
 
@@ -988,6 +1014,7 @@ Suites: ${target_codename}
 Components: no-subscription
 Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
 EOF
+        chmod 0644 /etc/apt/sources.list.d/ceph.sources
         msg_ok "$(translate "Ceph repository configured for PVE 9")"
         
     else
@@ -2910,8 +2937,128 @@ install_system_utils() {
 
 
 
+custom_post_category_label() {
+  case "$1" in
+    "Basic Settings") translate "Basic Settings" ;;
+    "System") translate "System" ;;
+    "Hardware") translate "Hardware" ;;
+    "Virtualization") translate "Virtualization" ;;
+    "Network") translate "Network" ;;
+    "Storage") translate "Storage" ;;
+    "Security") translate "Security" ;;
+    "Customization") translate "Customization" ;;
+    "Monitoring") translate "Monitoring" ;;
+    "Performance") translate "Performance" ;;
+    "Optional") translate "Optional" ;;
+    *) echo "$1" ;;
+  esac
+}
+
+custom_post_description_label() {
+  case "$1" in
+    "Configure Proxmox APT repositories") translate "Configure Proxmox APT repositories" ;;
+    "Update and upgrade system") translate "Update and upgrade system" ;;
+    "Synchronize time automatically") translate "Synchronize time automatically" ;;
+    "Skip downloading additional languages") translate "Skip downloading additional languages" ;;
+    "Install common system utilities") translate "Install common system utilities" ;;
+    "Optimize journald") translate "Optimize journald" ;;
+    "Optimize logrotate") translate "Optimize logrotate" ;;
+    "Increase various system limits") translate "Increase various system limits" ;;
+    "Optimize Memory") translate "Optimize Memory" ;;
+    "Enable fast reboots") translate "Enable fast reboots" ;;
+    "Enable restart on kernel panic") translate "Enable restart on kernel panic" ;;
+    "Apply AMD CPU fixes") translate "Apply AMD CPU fixes" ;;
+    "Install relevant guest agent") translate "Install relevant guest agent" ;;
+    "Enable VFIO IOMMU support") translate "Enable VFIO IOMMU support" ;;
+    "Force APT to use IPv4") translate "Force APT to use IPv4" ;;
+    "Apply network optimizations") translate "Apply network optimizations" ;;
+    "Install Open vSwitch") translate "Install Open vSwitch" ;;
+    "Enable TCP BBR/Fast Open control") translate "Enable TCP BBR/Fast Open control" ;;
+    "Interface Names (persistent)") translate "Interface Names (persistent)" ;;
+    "Optimize ZFS ARC size") translate "Optimize ZFS ARC size" ;;
+    "Install ZFS auto-snapshot") translate "Install ZFS auto-snapshot" ;;
+    "Enable ZFS autotrim (SSD/NVMe pools)") translate "Enable ZFS autotrim (SSD/NVMe pools)" ;;
+    "Increase vzdump backup speed") translate "Increase vzdump backup speed" ;;
+    "Disable portmapper/rpcbind") translate "Disable portmapper/rpcbind" ;;
+    "Customize bashrc") translate "Customize bashrc" ;;
+    "Set up custom MOTD banner") translate "Set up custom MOTD banner" ;;
+    "Remove subscription banner") translate "Remove subscription banner" ;;
+    "Install OVH Real Time Monitoring") translate "Install OVH Real Time Monitoring" ;;
+    "Use pigz for faster gzip compression") translate "Use pigz for faster gzip compression" ;;
+    "Install and configure Fastfetch") translate "Install and configure Fastfetch" ;;
+    "Update Proxmox VE Appliance Manager") translate "Update Proxmox VE Appliance Manager" ;;
+    "Add latest Ceph support") translate "Add latest Ceph support" ;;
+    "Enable High Availability services") translate "Enable High Availability services" ;;
+    "Install Figurine") translate "Install Figurine" ;;
+    "Install and configure Log2RAM") translate "Install and configure Log2RAM" ;;
+    *) echo "$1" ;;
+  esac
+}
+
+format_custom_post_line() {
+  local description="$1"
+  local category="$2"
+  local max_description_length=52
+
+  if command -v python3 >/dev/null 2>&1; then
+    python3 - "$description" "$category" "$max_description_length" <<'PY'
+import sys
+import unicodedata
+
+description = sys.argv[1]
+category = sys.argv[2]
+max_width = int(sys.argv[3])
+
+def display_width(text):
+    width = 0
+    for char in text:
+        if unicodedata.combining(char):
+            continue
+        width += 2 if unicodedata.east_asian_width(char) in ("F", "W") else 1
+    return width
+
+def fit_text(text, width):
+    result = ""
+    used = 0
+    for char in text:
+        char_width = 0 if unicodedata.combining(char) else (2 if unicodedata.east_asian_width(char) in ("F", "W") else 1)
+        if used + char_width > width:
+            break
+        result += char
+        used += char_width
+    return result, used
+
+if display_width(description) > max_width:
+    description, used_width = fit_text(description, max_width - 3)
+    description += "..."
+    used_width += 3
+else:
+    used_width = display_width(description)
+
+print(f"{description}{' ' * (max_width - used_width)} | {category}")
+PY
+    return
+  fi
+
+  if [ ${#description} -gt $max_description_length ]; then
+    description="${description:0:$((max_description_length - 3))}..."
+  fi
+  printf '%-*s | %s' "$max_description_length" "$description" "$category"
+}
+
+format_custom_post_header() {
+  local description_label
+  local category_label
+  local checklist_prefix="           "
+
+  description_label="$(translate "Description")"
+  category_label="$(translate "Category")"
+  printf '%s%s' "$checklist_prefix" "$(format_custom_post_line "$description_label" "$category_label")"
+}
+
 # Main menu function
 main_menu() {
+  local header_line
   local HEADER
   if [[ "$LANGUAGE" == "es" ]]; then
     HEADER="Seleccione las opciones a configurar:\n\n           Descripción                                  | Categoría"
@@ -2919,6 +3066,9 @@ main_menu() {
     HEADER="$(translate "Choose options to configure:")\n\n           Description                                | Category"
   fi
 
+  header_line="$(format_custom_post_header)"
+  HEADER="$(translate "Choose options to configure:")\n\n${header_line}"
+
   declare -A category_order=(
     ["Basic Settings"]=1 ["System"]=2 ["Hardware"]=3 ["Virtualization"]=4
     ["Network"]=5 ["Storage"]=6 ["Security"]=7 ["Customization"]=8
@@ -2926,6 +3076,7 @@ main_menu() {
   )
 
   local options=(
+    "Basic Settings|Configure Proxmox APT repositories|REPOS"
     "Basic Settings|Update and upgrade system|APTUPGRADE"
     "Basic Settings|Synchronize time automatically|TIMESYNC"
     "Basic Settings|Skip downloading additional languages|NOAPTLANG"
@@ -2969,23 +3120,18 @@ main_menu() {
   done | sort -n | cut -d'|' -f2-))
   unset IFS
 
-  local max_desc_length=0
   local temp_descriptions=()
+  local temp_categories=()
   
   for option in "${sorted_options[@]}"; do
     IFS='|' read -r category description function_name <<< "$option"
-    local desc_translated="$(translate "$description")"
+    local desc_translated
+    local category_translated
+    desc_translated="$(custom_post_description_label "$description")"
+    category_translated="$(custom_post_category_label "$category")"
     temp_descriptions+=("$desc_translated")
-    
-    local desc_length=${#desc_translated}
-    if [ $desc_length -gt $max_desc_length ]; then
-      max_desc_length=$desc_length
-    fi
+    temp_categories+=("$category_translated")
   done
-  
-  if [ $max_desc_length -gt 50 ]; then
-    max_desc_length=50
-  fi
 
   local checklist_items=()
   local i=1
@@ -3001,21 +3147,11 @@ main_menu() {
     fi
     
     local desc_translated="${temp_descriptions[$desc_index]}"
+    local category_translated="${temp_categories[$desc_index]}"
     desc_index=$((desc_index + 1))
     
-
-    if [ ${#desc_translated} -gt $max_desc_length ]; then
-      desc_translated="${desc_translated:0:$((max_desc_length-3))}..."
-    fi
-    
-
-    local spaces_needed=$((max_desc_length - ${#desc_translated}))
-    local padding=""
-    for ((j=0; j<spaces_needed; j++)); do
-      padding+=" "
-    done
-    
-    local line="${desc_translated}${padding}      | ${category}"
+    local line
+    line="$(format_custom_post_line "$desc_translated" "$category_translated")"
 
     checklist_items+=("$i" "$line" "off")
     i=$((i + 1))
@@ -3026,7 +3162,7 @@ main_menu() {
   selected_indices=$(dialog --clear \
     --backtitle "ProxMenux" \
     --title "$(translate "Post-Installation Options")" \
-    --checklist "$HEADER" 22 80 15 \
+    --checklist "$HEADER" 22 88 15 \
     "${checklist_items[@]}" \
     2>&1 1>&3)
 
@@ -3076,6 +3212,7 @@ done
     IFS='|' read -r _ description function_name <<< "$option"
     if [[ ${selected_functions[$function_name]} -eq 1 ]]; then
       case $function_name in
+        REPOS) setup_proxmox_repositories ;;
         APTUPGRADE) apt_upgrade ;;
         TIMESYNC) configure_time_sync ;;
         NOAPTLANG) skip_apt_languages ;;
diff --git a/scripts/post_install/uninstall-tools.sh b/scripts/post_install/uninstall-tools.sh
index 840f5f4a..b59972ac 100644
--- a/scripts/post_install/uninstall-tools.sh
+++ b/scripts/post_install/uninstall-tools.sh
@@ -30,7 +30,6 @@ RETURN_SCRIPT="$LOCAL_SCRIPTS/menus/menu_post_install.sh"
 BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
 TOOLS_JSON="$BASE_DIR/installed_tools.json"
-VENV_PATH="/opt/googletrans-env"
 
 if [[ -f "$UTILS_FILE" ]]; then
     source "$UTILS_FILE"
@@ -642,6 +641,7 @@ uninstall_vfio_iommu() {
     msg_info "$(translate 'Updating initramfs (this may take a minute)...')"
 
     update-initramfs -u -k all >/dev/null 2>&1 || true
+    proxmox-boot-tool refresh >/dev/null 2>&1 || true
 
     msg_ok "$(translate "IOMMU/VFIO configuration reverted")"
     register_tool "vfio_iommu" false
@@ -718,6 +718,7 @@ uninstall_amd_fixes() {
             fi
 
             update-initramfs -u -k all >/dev/null 2>&1 || true
+    proxmox-boot-tool refresh >/dev/null 2>&1 || true
         else
             msg_ok "$(translate "KVM MSR options not present, nothing to revert")"
         fi
diff --git a/scripts/post_install/update_post_install_function.sh b/scripts/post_install/update_post_install_function.sh
index a34e0bbc..207e3c9e 100644
--- a/scripts/post_install/update_post_install_function.sh
+++ b/scripts/post_install/update_post_install_function.sh
@@ -75,7 +75,16 @@ SOURCED_CUSTOM=0
 ensure_flow_loaded() {
     local source_type="$1"
     case "$source_type" in
-        auto)
+        # `detected` is the synthetic source the registry assigns to a
+        # tool when a legacy detector finds it on the host but the
+        # entry was never written to installed_tools.json (e.g.
+        # proxmox_repos on a pre-1.2.2 install). Treat it as `auto`
+        # for the source-loading step — the legacy-tool's wrapper
+        # function lives in auto_post_install.sh, and once the update
+        # runs successfully `register_tool` overwrites the synthetic
+        # entry with source="auto" so subsequent runs don't hit this
+        # branch again.
+        auto|detected)
             if [[ $SOURCED_AUTO -eq 0 ]]; then
                 # shellcheck disable=SC1091
                 source "$LOCAL_SCRIPTS/post_install/auto_post_install.sh"
@@ -90,7 +99,7 @@ ensure_flow_loaded() {
             fi
             ;;
         *)
-            echo "ERROR: invalid source '$source_type' (must be 'auto' or 'custom')"
+            echo "ERROR: invalid source '$source_type' (must be 'auto', 'custom', or 'detected')"
             return 2
             ;;
     esac
diff --git a/scripts/share/commands_share.sh b/scripts/share/commands_share.sh
index 0b1553ba..309c5444 100644
--- a/scripts/share/commands_share.sh
+++ b/scripts/share/commands_share.sh
@@ -225,7 +225,7 @@ show_disk_host_help() {
 show_iscsi_host_help() {
     clear
     show_proxmenux_logo
-    msg_title "$(translate "Add iSCSI Target as Proxmox Storage")"
+    msg_title "$(translate "Add iSCSI storage in Proxmox Storage")"
 
     msg_info2 "$(translate "Equivalent manual flow of iscsi_host.sh.")"
     echo -e
@@ -501,7 +501,7 @@ show_help_menu() {
             "1" "$(translate "Host NFS/Samba as Proxmox Storage (pvesm)")" \
             "2" "$(translate "Local Shared Directory on Host")" \
             "3" "$(translate "Add Local Disk as Proxmox Storage")" \
-            "4" "$(translate "Add iSCSI Target as Proxmox Storage")" \
+            "4" "$(translate "Add iSCSI storage in Proxmox Storage")" \
             "5" "$(translate "Mount Host Directory to LXC Container")" \
             "6" "$(translate "NFS Client in LXC (privileged)")" \
             "7" "$(translate "Samba Client in LXC (privileged)")" \
diff --git a/scripts/utilities/proxmenux_debug.sh b/scripts/utilities/proxmenux_debug.sh
new file mode 100755
index 00000000..eba02497
--- /dev/null
+++ b/scripts/utilities/proxmenux_debug.sh
@@ -0,0 +1,455 @@
+#!/usr/bin/env bash
+# ==========================================================
+# ProxMenux RESTORE Debug Snapshot
+# ==========================================================
+# Author      : MacRimi
+# License     : GPL-3.0
+# ==========================================================
+# Description:
+# Single GitHub-pasteable block focused on RESTORE bug
+# triage only. Each section corresponds to a class of
+# restore failure we need to diagnose. Nothing else is
+# included — no notifications data, no global guest counts,
+# no system telemetry that doesn't directly explain a
+# failed restore.
+#
+# Sections (and why each one is here):
+#   1. Versions               — reproducibility anchor.
+#   2. GPU bind state         — passthrough / VFIO bugs.
+#   3. Components status      — what ProxMenux thinks is installed.
+#   4. Latest restore plan    — rollback.json + plan.env + apply-list.
+#   5. Pre-restore snapshot   — what the restore overwrote.
+#   6. VFIO config files      — current state of every file the
+#                                switch_gpu / restore flows touch
+#                                (presence + content).
+#   7. Boot args              — /etc/kernel/cmdline vs /proc/cmdline,
+#                                proxmox-boot-tool sync state.
+#   8. dmesg boot binding     — order vfio-pci ↔ nvidia loaded.
+#   9. Restore service        — systemd unit state + on-boot log.
+#  10. Cluster post-boot log  — initramfs regen + component reinstall.
+#  11. Guests holding the GPU — VMs whose hostpci could keep the GPU
+#                                reserved for vfio-pci.
+#  12. Recent monitor errors  — fail-fast clues from the service log.
+#
+# Usage:
+#   bash /usr/local/share/proxmenux/scripts/utilities/proxmenux_debug.sh > /tmp/debug.txt
+#   cat /tmp/debug.txt   # copy-paste the whole block in the GitHub thread
+#
+# Output is redacted: hostnames, IPv4 addresses, MAC addresses
+# and the obvious password=, passphrase=, token= patterns are
+# replaced before printing.
+# ==========================================================
+set -u
+
+# ── Redaction helpers ──────────────────────────────────────
+_HOSTNAME_REAL="$(hostname 2>/dev/null || echo host)"
+_redact() {
+  sed -E \
+    -e "s/${_HOSTNAME_REAL}/<host>/g" \
+    -e 's/([0-9]{1,3}\.){3}[0-9]{1,3}/<ip>/g' \
+    -e 's/([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}/<mac>/g' \
+    -e 's/(password|passphrase|secret|token|api[_-]?key)[[:space:]]*[:=][[:space:]]*"?[^"[:space:]]+"?/\1=<redacted>/gi'
+}
+_header() { echo; echo "── $1 ──"; }
+_kv()     { printf '%-22s %s\n' "$1:" "$2"; }
+# Dump a config file inline only when it's small (≤2KB) and non-empty.
+# Larger or absent files get a single status line so the section
+# doesn't balloon with content we won't read anyway.
+_dump_if_small() {
+  local f="$1"
+  if [ ! -e "$f" ]; then
+    echo "  absent           : $f"
+    return
+  fi
+  local sz
+  sz=$(stat -c%s "$f" 2>/dev/null || echo 0)
+  echo "  present (${sz} bytes): $f"
+  if [ -s "$f" ] && [ "$sz" -lt 2048 ] 2>/dev/null; then
+    sed 's/^/      | /' "$f" | _redact
+  fi
+}
+
+echo "============================================================"
+echo " ProxMenux RESTORE Debug Snapshot"
+echo " Generated: $(date -Iseconds 2>/dev/null || date)"
+echo "============================================================"
+
+# ── 0. Quick status (auto-detected) ───────────────────────
+# Runs a handful of well-known restore health checks and emits a
+# colour-coded overall verdict. The point is that whoever pastes the
+# snapshot in the GitHub thread, AND whoever reads it later, can both
+# tell in five seconds whether the restore was clean or whether there
+# is something to investigate — without scrolling through the rest of
+# the report. Every signal here has a corresponding section below
+# where the raw evidence lives.
+declare -a _STATUS_LINES=()
+_ERRORS=0
+_WARNINGS=0
+# Colour codes only when stdout is a real terminal — the operator
+# almost always redirects this script to /tmp/proxmenux-debug.txt
+# and pastes the file in GitHub, where raw `\033[…m` sequences
+# would render as literal `[32m✓[0m` garbage.
+if [ -t 1 ]; then
+  _C_OK=$'\033[32m'; _C_WARN=$'\033[33m'; _C_ERR=$'\033[31m'
+  _C_BOLD_OK=$'\033[1;32m'; _C_BOLD_WARN=$'\033[1;33m'; _C_BOLD_ERR=$'\033[1;31m'
+  _C_RESET=$'\033[0m'
+else
+  _C_OK=''; _C_WARN=''; _C_ERR=''
+  _C_BOLD_OK=''; _C_BOLD_WARN=''; _C_BOLD_ERR=''
+  _C_RESET=''
+fi
+_ok()   { _STATUS_LINES+=("  ${_C_OK}✓${_C_RESET} $1"); }
+_warn() { _STATUS_LINES+=("  ${_C_WARN}⚠${_C_RESET} $1"); _WARNINGS=$((_WARNINGS + 1)); }
+_err()  { _STATUS_LINES+=("  ${_C_ERR}✗${_C_RESET} $1"); _ERRORS=$((_ERRORS + 1)); }
+
+# Check A — NVIDIA GPUs binding state.
+# We've hit several restore bugs where the GPU stayed bound to
+# vfio-pci after a rollback-to-LXC. Flag any NVIDIA BDF stuck on
+# vfio-pci so the operator notices before scrolling to section 2.
+if lspci -d 10de: 2>/dev/null | grep -qiE 'VGA|3D'; then
+  stuck_vfio=0
+  for bdf in $(lspci -D -d 10de: 2>/dev/null | grep -iE 'VGA|3D' | awk '{print $1}'); do
+    drv=$(basename "$(readlink "/sys/bus/pci/devices/$bdf/driver" 2>/dev/null)" 2>/dev/null)
+    [ "$drv" = "vfio-pci" ] && stuck_vfio=$((stuck_vfio + 1))
+  done
+  if (( stuck_vfio > 0 )); then
+    _warn "$stuck_vfio NVIDIA GPU(s) bound to vfio-pci (intended only if you actively use passthrough)"
+  else
+    _ok "NVIDIA GPU(s) bound to the native driver"
+  fi
+fi
+
+# Check B — VFIO-related ProxMenux files lingering on the host.
+# If present after a "rollback to host mode" restore, the next boot
+# will re-bind the GPU to vfio-pci via the udev rule.
+_vfio_present=0
+for f in /etc/udev/rules.d/10-proxmenux-vfio-bind.rules \
+         /etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf \
+         /etc/modprobe.d/nvidia-blacklist.conf \
+         /etc/proxmenux/vfio-bind.bdfs; do
+  [ -e "$f" ] && _vfio_present=$((_vfio_present + 1))
+done
+if (( _vfio_present > 0 )); then
+  _warn "$_vfio_present ProxMenux VFIO file(s) present on host (would re-bind GPU at next boot)"
+else
+  _ok "No ProxMenux VFIO files present on host"
+fi
+
+# Note: cmdline / IOMMU drift was tried here as a check, but it
+# is a system-config finding that's INDEPENDENT of whether the
+# last restore succeeded. Including it in Quick status painted a
+# perfectly clean restore in yellow and made operators think
+# their restore had failed. The raw evidence still lives in
+# section 7 for anyone investigating that specific issue.
+
+# Check C — apply_cluster_postboot.sh actually finished.
+_last_pb=$(ls -t /var/log/proxmenux/proxmenux-cluster-postboot-*.log 2>/dev/null | head -1)
+if [ -n "$_last_pb" ]; then
+  if grep -q '=== Apply finished' "$_last_pb" 2>/dev/null; then
+    _ok "Last apply_cluster_postboot finished successfully"
+  else
+    _err "Last apply_cluster_postboot did NOT finish (crashed mid-apply or still running)"
+  fi
+fi
+
+# Check E — proxmenux-restore-onboot.service status.
+if systemctl list-unit-files proxmenux-restore-onboot.service >/dev/null 2>&1; then
+  if systemctl is-failed --quiet proxmenux-restore-onboot.service 2>/dev/null; then
+    _err "proxmenux-restore-onboot.service is in failed state"
+  fi
+fi
+
+# Check F — rollback consistency: if the operator opted into
+# destructive rollback AND the plan listed VMs to remove, those VMs
+# should be gone now. If any survived, the rollback executor silently
+# skipped them.
+_latest=$(ls -t /var/lib/proxmenux/restore-pending/completed/ 2>/dev/null | head -1)
+if [ -n "$_latest" ] && command -v jq >/dev/null 2>&1; then
+  _base="/var/lib/proxmenux/restore-pending/completed/$_latest"
+  _rb_ack=$(grep -E '^HB_ROLLBACK_EXECUTE=' "$_base/plan.env" 2>/dev/null | cut -d= -f2)
+  if [ "$_rb_ack" = "1" ] && [ -f "$_base/rollback.json" ]; then
+    _to_rm=$(jq -r '.vms_to_remove[]?' "$_base/rollback.json" 2>/dev/null)
+    _still=0
+    for _id in $_to_rm; do
+      [ -z "$_id" ] && continue
+      qm status "$_id" >/dev/null 2>&1 && _still=$((_still + 1))
+    done
+    if (( _still > 0 )); then
+      _err "Rollback was ACK'd but $_still VM(s) marked for removal are still present"
+    elif [ -n "$_to_rm" ]; then
+      _ok "Rollback executed: all VMs listed for removal are gone"
+    fi
+  fi
+fi
+
+# Render the section.
+_header "0. Quick status (auto-detected)"
+for _line in "${_STATUS_LINES[@]}"; do
+  printf '%s\n' "$_line"
+done
+echo
+if (( _ERRORS > 0 )); then
+  printf '  %sOVERALL: 🔴 %d error(s), %d warning(s)%s — see sections below\n' \
+    "$_C_BOLD_ERR" "$_ERRORS" "$_WARNINGS" "$_C_RESET"
+elif (( _WARNINGS > 0 )); then
+  printf '  %sOVERALL: 🟡 %d warning(s)%s — see sections below\n' \
+    "$_C_BOLD_WARN" "$_WARNINGS" "$_C_RESET"
+else
+  printf '  %sOVERALL: 🟢 Restore state looks clean%s\n' \
+    "$_C_BOLD_OK" "$_C_RESET"
+fi
+
+# ── 1. Versions ────────────────────────────────────────────
+_header "1. Versions"
+PMX_VERSION="(unknown)"
+if [ -f /usr/local/share/proxmenux/monitor-app/web/package.json ]; then
+  PMX_VERSION=$(grep -oE '"version":[[:space:]]*"[^"]*"' \
+                  /usr/local/share/proxmenux/monitor-app/web/package.json \
+                | head -1 | sed -E 's/.*"version":[[:space:]]*"([^"]+)".*/\1/')
+fi
+_kv "ProxMenux"  "$PMX_VERSION"
+_kv "Proxmox VE" "$(command -v pveversion >/dev/null 2>&1 && pveversion 2>/dev/null | head -1)"
+_kv "Kernel"     "$(uname -r 2>/dev/null)"
+_kv "Boot mode"  "$([ -d /sys/firmware/efi ] && echo UEFI || echo BIOS)"
+
+# ── 2. GPU bind state ─────────────────────────────────────
+# Most restore bugs we've hit so far revolved around the GPU
+# staying bound to vfio-pci when it should have returned to the
+# nvidia driver (or vice-versa). Showing the driver, override and
+# IOMMU group for every PCI display device tells us at a glance
+# which side of that fence the host landed on.
+_header "2. GPU PCI bind state"
+if command -v lspci >/dev/null 2>&1; then
+  for bdf in $(lspci -D 2>/dev/null | grep -iE 'VGA compatible controller|3D controller|Display controller' | awk '{print $1}'); do
+    name=$(lspci -nn -s "$bdf" 2>/dev/null \
+           | sed -E 's/^[0-9a-f]{4}:[0-9a-f]{2}:[0-9a-f]{2}\.[0-9]+ //' \
+           | sed -E 's/(VGA compatible controller|3D controller|Display controller) \[[0-9a-f]+\]:[[:space:]]*//I' \
+           | cut -c1-80)
+    drv=$(basename "$(readlink "/sys/bus/pci/devices/$bdf/driver" 2>/dev/null)" 2>/dev/null || echo "(none)")
+    override=$(cat "/sys/bus/pci/devices/$bdf/driver_override" 2>/dev/null || true)
+    iommu=$(basename "$(readlink "/sys/bus/pci/devices/$bdf/iommu_group" 2>/dev/null)" 2>/dev/null || echo "-")
+    echo "  $bdf  driver=$drv  override=${override:-(unset)}  iommu_group=$iommu"
+    echo "         $name"
+  done
+fi
+# nvidia-smi gets its own short summary — confirms the driver
+# can actually talk to the device, not just that it's bound.
+if command -v nvidia-smi >/dev/null 2>&1; then
+  echo "  nvidia-smi:"
+  nvidia-smi --query-gpu=name,driver_version --format=csv,noheader 2>&1 | sed 's/^/    /' | head -4
+fi
+
+# ── 3. ProxMenux components ───────────────────────────────
+_header "3. ProxMenux components_status.json"
+CSF=/usr/local/share/proxmenux/components_status.json
+if [ -f "$CSF" ] && command -v jq >/dev/null 2>&1; then
+  jq -r 'to_entries[] | "  \(.key): status=\(.value.status) version=\(.value.version // "-") patched=\(.value.patched // "-")"' "$CSF"
+elif [ -f "$CSF" ]; then
+  sed 's/^/  /' "$CSF" | head -40
+else
+  echo "  (no components registered)"
+fi
+
+# ── 4. Latest restore plan ────────────────────────────────
+# The rollback.json + plan.env + apply-on-boot.list of the
+# most-recent restore tell us exactly what the operator asked
+# for and what the system tried to do. Without these we can't
+# tell "rollback flag never propagated" from "rollback flag
+# propagated but executor skipped guests".
+_header "4. Latest restore plan"
+PEND=/var/lib/proxmenux/restore-pending
+if [ -d "$PEND" ]; then
+  latest=$(ls -t "$PEND/completed" 2>/dev/null | head -1)
+  if [ -n "$latest" ]; then
+    base="$PEND/completed/$latest"
+    echo "  pending dir: $base"
+    if [ -f "$base/plan.env" ]; then
+      echo "  plan.env:"
+      sed 's/^/    /' "$base/plan.env"
+    fi
+    if [ -f "$base/rollback.json" ]; then
+      echo "  rollback.json:"
+      sed 's/^/    /' "$base/rollback.json"
+    fi
+    if [ -f "$base/apply-on-boot.list" ]; then
+      count=$(wc -l < "$base/apply-on-boot.list" 2>/dev/null || echo 0)
+      # Drop the misleading "first 30" tag when the file already fits.
+      if [ "$count" -le 30 ]; then
+        echo "  apply-on-boot.list (${count} paths):"
+      else
+        echo "  apply-on-boot.list (${count} paths; first 30):"
+      fi
+      head -30 "$base/apply-on-boot.list" | sed 's/^/    /'
+    fi
+  else
+    echo "  (no completed restores yet)"
+  fi
+else
+  echo "  (no pending-restore dir)"
+fi
+
+# ── 5. Pre-restore preservation ───────────────────────────
+# `apply_pending_restore.sh` snapshots every file it's about to
+# overwrite into /var/lib/proxmenux/pre-restore/<id>-onboot/. The
+# list (paths only — we don't dump contents) tells us what the
+# restore touched and lets us spot files that were ON the host
+# before but NOT in the backup (additive-restore orphans).
+_header "5. Pre-restore preservation (paths overwritten by the restore)"
+PRE=/var/lib/proxmenux/pre-restore
+if [ -d "$PRE" ]; then
+  latest_pre=$(ls -t "$PRE" 2>/dev/null | grep -E -- '-onboot$' | head -1)
+  if [ -n "$latest_pre" ]; then
+    echo "  pre-restore dir: $PRE/$latest_pre"
+    find "$PRE/$latest_pre" -type f 2>/dev/null \
+      | sed "s|^$PRE/$latest_pre||" \
+      | sort | sed 's/^/    /'
+  else
+    echo "  (no -onboot snapshot present — apply_pending_restore never ran)"
+  fi
+else
+  echo "  (no pre-restore dir)"
+fi
+
+# ── 6. VFIO / passthrough config files ────────────────────
+# Every file the host-mode ↔ vfio-mode switch flow touches. We
+# need both PRESENCE and CONTENT here, because "the file exists
+# but is empty" and "the file has the wrong vendor IDs" are two
+# different bug classes (we've hit both).
+_header "6. VFIO / passthrough config files (current state)"
+for f in \
+  /etc/proxmenux/vfio-bind.bdfs \
+  /etc/modules-load.d/nvidia-vfio.conf \
+  /etc/modules-load.d/nvidia-vfio.conf.proxmenux-disabled-vfio \
+  /etc/udev/rules.d/10-proxmenux-vfio-bind.rules \
+  /etc/udev/rules.d/70-nvidia.rules \
+  /etc/udev/rules.d/70-nvidia.rules.proxmenux-disabled \
+  /etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf \
+  /etc/modprobe.d/nvidia-blacklist.conf \
+  /etc/modprobe.d/vfio.conf
+do
+  _dump_if_small "$f"
+done
+
+# ── 7. Kernel boot args ───────────────────────────────────
+# /etc/kernel/cmdline is what the operator (or our scripts)
+# *configured*. /proc/cmdline is what the running kernel actually
+# booted with. They diverge whenever someone edits cmdline and
+# forgets proxmox-boot-tool refresh — and that drift breaks every
+# downstream passthrough/intel_iommu assumption.
+_header "7. Kernel boot args"
+echo "  /etc/kernel/cmdline (configured):"
+[ -f /etc/kernel/cmdline ] && sed 's/^/    /' /etc/kernel/cmdline | _redact || echo "    (not present — non-systemd-boot host)"
+echo "  /proc/cmdline (running):"
+sed 's/^/    /' /proc/cmdline 2>/dev/null | _redact
+# /etc/default/grub is the OTHER place kernel args can live. On
+# systemd-boot hosts `proxmox-boot-tool refresh` reads cmdline +
+# GRUB_CMDLINE_LINUX_DEFAULT and concatenates them — so a drift
+# here is what causes "intel_iommu=on disappears at the next
+# proxmox-boot-tool refresh after restore" bugs.
+if [ -f /etc/default/grub ]; then
+  echo "  /etc/default/grub  GRUB_CMDLINE_LINUX*:"
+  grep -E '^GRUB_CMDLINE_LINUX(_DEFAULT)?=' /etc/default/grub 2>/dev/null \
+    | sed 's/^/    /' | _redact || echo "    (no GRUB_CMDLINE_LINUX entries)"
+fi
+if command -v proxmox-boot-tool >/dev/null 2>&1; then
+  echo "  proxmox-boot-tool status:"
+  proxmox-boot-tool status 2>&1 | grep -vE '^(System|Re-executing)' | sed 's/^/    /' | head -10
+fi
+
+# ── 8. dmesg — vfio + nvidia + GPU PCI bus ────────────────
+# The early-boot trace. Tells us whether vfio-pci or nvidia
+# claimed the PCI BDF FIRST. If we see `vfio-pci 0000:01:00.0`
+# before `nvidia 0000:01:00.0`, that's the smoking gun for a
+# restore that didn't clear the vfio bindings before reboot.
+_header "8. dmesg — vfio / nvidia / GPU bus binding sequence"
+dmesg 2>/dev/null | grep -iE 'vfio|nvidia|VFIO' | head -25 | _redact \
+  || echo "  (no matches in dmesg)"
+
+# ── 9. Restore service status + on-boot log ───────────────
+# systemd's own view of the on-boot apply (success/timeout/exit)
+# plus the script's log file. The two together cover both
+# "the script failed silently" and "the script ran but its log
+# was truncated by a hung apply".
+_header "9. proxmenux-restore-onboot.service — current boot"
+journalctl -u proxmenux-restore-onboot.service -b 0 -n 20 --no-pager 2>/dev/null \
+  | _redact || echo "  (no journal entries)"
+echo
+last_ob=$(ls -t /var/log/proxmenux/proxmenux-restore-onboot-*.log 2>/dev/null | head -1)
+if [ -n "$last_ob" ]; then
+  echo "  log file: $last_ob"
+  tail -30 "$last_ob" | sed 's/^/    /' | _redact
+else
+  echo "  (no restore-onboot log files)"
+fi
+
+# ── 10. Cluster post-boot log ─────────────────────────────
+# Where update-initramfs / update-grub / component auto-reinstall
+# actually run. Surface the whole tail so we see whether the
+# postboot finished or stopped partway through.
+_header "10. apply_cluster_postboot — last run (full log, redacted)"
+last_pb=$(ls -t /var/log/proxmenux/proxmenux-cluster-postboot-*.log 2>/dev/null | head -1)
+if [ -n "$last_pb" ]; then
+  echo "  log file: $last_pb"
+  # Dump the WHOLE post-boot log when small enough — the operator
+  # almost always wants to see the header (`=== ProxMenux cluster
+  # post-boot apply at … ===`) AND the tail together. 50-line tail
+  # was eating the start of the log on every restore we've inspected.
+  sz=$(stat -c%s "$last_pb" 2>/dev/null || echo 0)
+  if [ "$sz" -lt 8192 ]; then
+    sed 's/^/    /' "$last_pb" | _redact
+  else
+    echo "    (log > 8 KB — showing last 80 lines)"
+    tail -80 "$last_pb" | sed 's/^/    /' | _redact
+  fi
+else
+  echo "  (no cluster-postboot log files)"
+fi
+
+# ── 11. Guests holding the GPU ────────────────────────────
+# If a VM with `hostpci` still exists after the restore, Proxmox
+# will auto-rebind the matching PCI device to vfio-pci at the
+# next boot — which makes the GPU look "stuck" in passthrough
+# even though every config file looks clean. We only list IDs +
+# BDFs, NOT full configs, to keep secrets out of the report.
+_header "11. Guests with hostpci entries (would re-reserve the GPU)"
+hits=0
+if command -v qm >/dev/null 2>&1; then
+  for vmid in $(qm list 2>/dev/null | awk 'NR>1 {print $1}'); do
+    out=$(qm config "$vmid" 2>/dev/null | grep -iE '^hostpci[0-9]+:' || true)
+    if [ -n "$out" ]; then
+      echo "  VM $vmid:"
+      echo "$out" | sed 's/^/    /'
+      hits=$((hits + 1))
+    fi
+  done
+fi
+if command -v pct >/dev/null 2>&1; then
+  for ctid in $(pct list 2>/dev/null | awk 'NR>1 {print $1}'); do
+    out=$(pct config "$ctid" 2>/dev/null | grep -iE 'mp[0-9]+:.*nvidia|dev[0-9]+:|lxc.cgroup2.devices' || true)
+    if [ -n "$out" ]; then
+      echo "  CT $ctid:"
+      echo "$out" | sed 's/^/    /'
+      hits=$((hits + 1))
+    fi
+  done
+fi
+[ "$hits" = "0" ] && echo "  (no guests hold passthrough entries)"
+
+# ── 12. proxmenux-monitor errors (current boot) ───────────
+# Any Python traceback or "Error/Exception" line that ended up
+# in the service log this boot. Filtered so we don't drown the
+# report in the normal startup noise.
+_header "12. proxmenux-monitor.service — errors this boot"
+err=$(journalctl -u proxmenux-monitor.service -b 0 --no-pager 2>/dev/null \
+  | grep -iE 'error|exception|traceback|failed' | tail -15)
+if [ -n "$err" ]; then
+  echo "$err" | sed 's/^/  /' | _redact
+else
+  echo "  (no errors logged this boot)"
+fi
+
+echo
+echo "============================================================"
+echo " End of restore debug snapshot."
+echo " Paste the whole block in the GitHub discussion thread."
+echo "============================================================"
diff --git a/scripts/utils.sh b/scripts/utils.sh
index 0de07ec0..08d1d0b6 100644
--- a/scripts/utils.sh
+++ b/scripts/utils.sh
@@ -38,16 +38,11 @@ LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
 INSTALL_DIR="/usr/local/bin"
 BASE_DIR="/usr/local/share/proxmenux"
 CONFIG_FILE="$BASE_DIR/config.json"
-CACHE_FILE="$BASE_DIR/cache.json"
+LANG_DIR="$BASE_DIR/lang"
 LOCAL_VERSION_FILE="$BASE_DIR/version.txt"
 MENU_SCRIPT="menu"
-VENV_PATH="/opt/googletrans-env"
 COMPONENTS_STATUS_FILE="$BASE_DIR/components_status.json"
 
-
-# Translation context
-TRANSLATION_CONTEXT="Context: Technical message for Proxmox and IT. Translate:"
-
 # Color and style definitions
 NEON_PURPLE_BLUE="\033[38;5;99m"
 WHITE="\033[38;5;15m" 
@@ -216,9 +211,10 @@ msg_error() {
 # Initialize cache
 initialize_cache() {
     if [[ "$LANGUAGE" != "en" ]]; then
-        if [ ! -f "$CACHE_FILE" ]; then
-            mkdir -p "$(dirname "$CACHE_FILE")"
-            echo "{}" > "$CACHE_FILE"
+        mkdir -p "$LANG_DIR"
+        local lang_file="$LANG_DIR/${LANGUAGE}.json"
+        if [ ! -f "$lang_file" ]; then
+            echo "{}" > "$lang_file"
         fi
     fi
 }
@@ -241,78 +237,37 @@ load_language() {
 
 
 translate() {
+    # Pre-generated lookup ONLY. Translations live in
+    #   $LANG_DIR/<dest>.json
+    # built by .github/scripts/build_translation_cache.py during CI on
+    # every push that touches scripts/. There is intentionally no live
+    # fallback: removing the runtime googletrans dependency lets us
+    # ship a smaller AppImage, skip /opt/googletrans-env, and stop
+    # leaking translation traffic from the host at runtime.
+    #
+    # Behavior:
+    #   - dest == "en"  → echo the original text
+    #   - lookup hit    → echo the translation
+    #   - lookup miss   → echo the original text (English fallback)
     local text="$1"
     local dest_lang="$LANGUAGE"
 
-
     if [ "$dest_lang" = "en" ]; then
         echo "$text"
         return
     fi
 
-    if [ ! -s "$CACHE_FILE" ] || ! jq -e . "$CACHE_FILE" > /dev/null 2>&1; then
-        echo "{}" > "$CACHE_FILE"
-    fi
-
-    local cached_translation=$(jq -r --arg text "$text" --arg lang "$dest_lang" '.[$text][$lang] // .[$text]["notranslate"] // empty' "$CACHE_FILE")
-    if [ -n "$cached_translation" ]; then
-        echo "$cached_translation"
-        return
-    fi
-
-    if [ ! -d "$VENV_PATH" ]; then
-        echo "$text"
-        return
-    fi
-
-    source "$VENV_PATH/bin/activate"
-    local translated
-    translated=$(python3 -c "
-from googletrans import Translator
-import sys, json, re
-
-def translate_text(text, dest_lang, context):
-    translator = Translator()
-    try:
-        full_text = context + ' ' + text
-        result = translator.translate(full_text, dest=dest_lang).text
-        translated = re.sub(r'^.*?(Translate:|Traducir:|Traduire:|Übersetzen:|Tradurre:|Traduzir:|翻译:|翻訳:)', '', result, flags=re.IGNORECASE | re.DOTALL).strip()
-        translated = re.sub(r'^.*?(Context:|Contexto:|Contexte:|Kontext:|Contesto:|上下文：|コンテキスト：).*?:', '', translated, flags=re.IGNORECASE | re.DOTALL).strip()
-        print(json.dumps({'success': True, 'text': translated}))
-    except Exception as e:
-        print(json.dumps({'success': False, 'error': str(e)}))
-
-translate_text(
-    json.loads(sys.argv[1]),
-    sys.argv[2],
-    json.loads(sys.argv[3])
-)
-" "$(jq -Rn --arg t "$text" '$t')" "$dest_lang" "$(jq -Rn --arg ctx "$TRANSLATION_CONTEXT" '$ctx')")
-    deactivate
-
-    local translation_result=$(echo "$translated" | jq -r '.')
-    local success=$(echo "$translation_result" | jq -r '.success')
-    
-    if [ "$success" = "true" ]; then
-        translated=$(echo "$translation_result" | jq -r '.text')
-        
-        # Additional cleaning step
-        translated=$(echo "$translated" | sed -E 's/^(Context:|Contexto:|Contexte:|Kontext:|Contesto:|上下文：|コンテキスト：).*?(Translate:|Traducir:|Traduire:|Übersetzen:|Tradurre:|Traduzir:|翻译:|翻訳:)//gI' | sed 's/^ *//; s/ *$//')
-        
-        # Only cache if the language is not English
-        if [ "$dest_lang" != "en" ]; then
-            local temp_cache=$(mktemp)
-            jq --arg text "$text" --arg lang "$dest_lang" --arg translated "$translated" '
-                if .[$text] == null then .[$text] = {} else . end |
-                .[$text][$lang] = $translated
-            ' "$CACHE_FILE" > "$temp_cache" && mv "$temp_cache" "$CACHE_FILE"
+    local lang_file="$LANG_DIR/${dest_lang}.json"
+    if [ -s "$lang_file" ] && command -v jq >/dev/null 2>&1; then
+        local cached
+        cached=$(jq -r --arg text "$text" '.[$text] // empty' "$lang_file" 2>/dev/null)
+        if [ -n "$cached" ]; then
+            echo "$cached"
+            return
         fi
-        
-        echo "$translated"
-    else
-        local error=$(echo "$translation_result" | jq -r '.error')
-        echo "$text"
     fi
+
+    echo "$text"
 }
 
 
@@ -627,4 +582,4 @@ hybrid_whiptail_msgbox() {
     else
         whiptail --title "$title" --msgbox "$text" "$height" "$width"
     fi
-}
\ No newline at end of file
+}
diff --git a/scripts/vm/select_linux_iso.sh b/scripts/vm/select_linux_iso.sh
index cb7158ca..97bee392 100644
--- a/scripts/vm/select_linux_iso.sh
+++ b/scripts/vm/select_linux_iso.sh
@@ -64,7 +64,7 @@ function select_linux_iso() {
                   --menu "\nSeleccione el tipo de instalación de Linux:\n\n$header" \
                   20 70 10 \
                   1 "$(printf '%-35s│ %s' 'Instalar con metodo tradicional' 'Desde ISO oficial')" \
-                  2 "$(printf '%-35s│ %s' 'Instalar con script Cloud-Init' 'Helper Scripts')" \
+                  2 "$(printf '%-35s│ %s' 'Instalar con script Cloud-Init' 'Helper-Scripts')" \
                   3 "$(printf '%-35s│ %s' 'Instalar con ISO personal' 'Almacenamiento ISO')" \
                   4 "Volver al menú principal" \
                   3>&1 1>&2 2>&3)
@@ -171,13 +171,13 @@ function select_linux_iso_official() {
 
 function select_linux_cloudinit() {
   local CLOUDINIT_OPTIONS=(
-    "1" "Arch Linux   (Cloud-Init automated)   │ Helper Scripts"
-    "2" "Debian 13    (Cloud-Init automated)   │ Helper Scripts"
-    "3" "Debian 12    (Cloud-Init automated)   │ Helper Scripts"
-    "4" "Ubuntu 22.04 (Cloud-Init automated)   │ Helper Scripts"
-    "5" "Ubuntu 24.04 (Cloud-Init automated)   │ Helper Scripts"
-    "6" "Ubuntu 24.10 (Cloud-Init automated)   │ Helper Scripts"
-    "7" "Ubuntu 25.04 (Cloud-Init automated)   │ Helper Scripts"
+    "1" "Arch Linux   (Cloud-Init automated)   │ Helper-Scripts"
+    "2" "Debian 13    (Cloud-Init automated)   │ Helper-Scripts"
+    "3" "Debian 12    (Cloud-Init automated)   │ Helper-Scripts"
+    "4" "Ubuntu 22.04 (Cloud-Init automated)   │ Helper-Scripts"
+    "5" "Ubuntu 24.04 (Cloud-Init automated)   │ Helper-Scripts"
+    "6" "Ubuntu 24.10 (Cloud-Init automated)   │ Helper-Scripts"
+    "7" "Ubuntu 25.04 (Cloud-Init automated)   │ Helper-Scripts"
     "8" "$(translate "Return to Main Menu")"
   )
 
@@ -230,10 +230,21 @@ function select_linux_cloudinit() {
 
 function select_linux_custom_iso() {
   local volid
+  local name display_name tag storage
+  local selected_tag
+  declare -A ISO_VOLID_BY_TAG=()
   ISO_LIST=()
   while read -r volid; do
     [[ -z "$volid" ]] && continue
-    ISO_LIST+=("$volid" "$(iso_dialog_description "$volid")")
+    name=$(iso_name_from_volid "$volid")
+    display_name=$(iso_display_name "$name" 58)
+    storage=$(iso_storage_from_volid "$volid")
+    tag="$display_name"
+    if [[ -n "${ISO_VOLID_BY_TAG[$tag]:-}" ]]; then
+      tag="$(iso_display_name "$name ($storage)" 58)"
+    fi
+    ISO_VOLID_BY_TAG["$tag"]="$volid"
+    ISO_LIST+=("$tag" "$(iso_dialog_description "$volid")")
   done < <(iso_list_volids "all")
 
   if [[ ${#ISO_LIST[@]} -eq 0 ]]; then
@@ -243,15 +254,16 @@ function select_linux_custom_iso() {
     return 1
   fi
 
-  ISO_VOLID=$(dialog --backtitle "ProxMenux" --title "$(translate "Available ISO Images")" \
-    --menu "$(translate "Select a custom ISO to use:")\n\n$(printf '%-42s │ %-14s │ %s' "$(translate "ISO")" "$(translate "Storage")" "$(translate "Size")")" 22 86 12 \
+  selected_tag=$(dialog --backtitle "ProxMenux" --title "$(translate "Available ISO Images")" \
+    --menu "$(translate "Select a custom ISO to use:")\n\n$(printf '%-58s %-10s %s' "$(translate "ISO")" "$(translate "Storage")" "$(translate "Size")")" 22 86 12 \
     "${ISO_LIST[@]}" 3>&1 1>&2 2>&3)
 
-  if [[ -z "$ISO_VOLID" ]]; then
+  if [[ -z "$selected_tag" ]]; then
     header_info
     msg_warn "$(translate "No ISO selected.")"
     return 1
   fi
+  ISO_VOLID="${ISO_VOLID_BY_TAG[$selected_tag]}"
 
   ISO_FILE=$(iso_name_from_volid "$ISO_VOLID")
   ISO_PATH=$(iso_volid_to_path "$ISO_VOLID")
@@ -266,9 +278,9 @@ function select_linux_custom_iso() {
 
 function select_linux_other_scripts() {
 local OTHER_OPTIONS=(
-  "1" "Home Assistant OS VM (HAOS)       │ Helper Scripts"
-  "2" "Docker VM (Debian + SSH + Docker) │ Helper Scripts"
-  "3" "Nextcloud                         │ Helper Scripts"
+  "1" "Home Assistant OS VM (HAOS)       │ Helper-Scripts"
+  "2" "Docker VM (Debian + SSH + Docker) │ Helper-Scripts"
+  "3" "Nextcloud                         │ Helper-Scripts"
   "4" "$(translate "Return to Main Menu")"
 )
 
@@ -313,5 +325,3 @@ whiptail --title "Proxmox VE Helper-Scripts" \
 return 1
 
 }
-
-
diff --git a/scripts/vm/select_nas_iso.sh b/scripts/vm/select_nas_iso.sh
index 452c2343..22a53b14 100644
--- a/scripts/vm/select_nas_iso.sh
+++ b/scripts/vm/select_nas_iso.sh
@@ -190,12 +190,13 @@ function select_nas_iso() {
     "7" "ZimaOS         VM          (Proxmox-zimaos)"
     ""  ""
     ""  "\Z4───────────────── Community Scripts ─────────────────\Zn"
-    "8" "Umbrel OS      VM          (Helper Scripts)"
+    ""  ""
+    "8" "Umbrel OS      VM          (Helper-Scripts)"
     "9" "$(translate "Return to Main Menu")"
   )
 
   local NAS_TYPE
-  NAS_TYPE=$(dialog --backtitle "ProxMenux" \
+  NAS_TYPE=$(dialog --colors --backtitle "ProxMenux" \
     --title "$(translate "NAS Systems")" \
     --menu "\n$(translate "Select the NAS system to install:")" 20 70 10 \
     "${NAS_OPTIONS[@]}" 3>&1 1>&2 2>&3)
diff --git a/scripts/vm/select_windows_iso.sh b/scripts/vm/select_windows_iso.sh
index e54a16da..253ca891 100644
--- a/scripts/vm/select_windows_iso.sh
+++ b/scripts/vm/select_windows_iso.sh
@@ -100,10 +100,21 @@ function select_windows_iso() {
 
 function select_existing_iso() {
   local volid
+  local name display_name tag storage
+  local selected_tag
+  declare -A ISO_VOLID_BY_TAG=()
   ISO_LIST=()
   while read -r volid; do
     [[ -z "$volid" ]] && continue
-    ISO_LIST+=("$volid" "$(iso_dialog_description "$volid")")
+    name=$(iso_name_from_volid "$volid")
+    display_name=$(iso_display_name "$name" 58)
+    storage=$(iso_storage_from_volid "$volid")
+    tag="$display_name"
+    if [[ -n "${ISO_VOLID_BY_TAG[$tag]:-}" ]]; then
+      tag="$(iso_display_name "$name ($storage)" 58)"
+    fi
+    ISO_VOLID_BY_TAG["$tag"]="$volid"
+    ISO_LIST+=("$tag" "$(iso_dialog_description "$volid")")
   done < <(iso_list_volids "windows")
 
   if [[ ${#ISO_LIST[@]} -eq 0 ]]; then
@@ -113,11 +124,12 @@ function select_existing_iso() {
     return 1
   fi
 
-  ISO_VOLID=$(dialog --backtitle "ProxMenux" --title "$(translate "Available ISO Images")" \
-    --menu "$(translate "Choose a Windows ISO to use:")\n\n$(printf '%-42s │ %-14s │ %s' "$(translate "ISO")" "$(translate "Storage")" "$(translate "Size")")" 22 86 12 \
+  selected_tag=$(dialog --backtitle "ProxMenux" --title "$(translate "Available ISO Images")" \
+    --menu "$(translate "Choose a Windows ISO to use:")\n\n$(printf '%-58s %-10s %s' "$(translate "ISO")" "$(translate "Storage")" "$(translate "Size")")" 22 86 12 \
     "${ISO_LIST[@]}" 3>&1 1>&2 2>&3)
 
-  [[ -z "$ISO_VOLID" ]] && msg_warn "$(translate "No ISO selected.")" && return 1
+  [[ -z "$selected_tag" ]] && msg_warn "$(translate "No ISO selected.")" && return 1
+  ISO_VOLID="${ISO_VOLID_BY_TAG[$selected_tag]}"
 
   ISO_FILE=$(iso_name_from_volid "$ISO_VOLID")
   ISO_PATH=$(iso_volid_to_path "$ISO_VOLID")
diff --git a/version.txt b/version.txt
index 23aa8390..e2cac26c 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.2.2
+1.2.3
\ No newline at end of file
diff --git a/web/app/[locale]/docs/backup-restore/destinations/pbs/page.tsx b/web/app/[locale]/docs/backup-restore/destinations/pbs/page.tsx
index 4bf935fb..ba11ac43 100644
--- a/web/app/[locale]/docs/backup-restore/destinations/pbs/page.tsx
+++ b/web/app/[locale]/docs/backup-restore/destinations/pbs/page.tsx
@@ -225,7 +225,7 @@ export default async function PbsDestinationPage({
       </h3>
 
       <p className="mb-4 text-gray-800 leading-relaxed">
-        {t.rich("encryption.blobUploadBody1", { code, strong })}
+        {t.rich("encryption.blobUploadBody1", { code, strong, em })}
       </p>
 
       <figure className="my-6">
diff --git a/web/app/[locale]/docs/hardware/coral-tpu-lxc/page.tsx b/web/app/[locale]/docs/hardware/coral-tpu-lxc/page.tsx
index e3c88677..adc1ee4a 100644
--- a/web/app/[locale]/docs/hardware/coral-tpu-lxc/page.tsx
+++ b/web/app/[locale]/docs/hardware/coral-tpu-lxc/page.tsx
@@ -350,7 +350,7 @@ python3 -c "from pycoral.utils.edgetpu import list_edge_tpus; print(list_edge_tp
       </Callout>
 
       <Callout variant="troubleshoot" title={t("troubleshoot.alpineTitle")}>
-        {t.rich("troubleshoot.alpineBody", { code })}
+        {t.rich("troubleshoot.alpineBody", { code, em })}
       </Callout>
 
       <Callout variant="troubleshoot" title={t("troubleshoot.frigateTitle")}>
diff --git a/web/messages/en/docs/settings/change-language.json b/web/messages/en/docs/settings/change-language.json
index 9a402f03..d11e6c8b 100644
--- a/web/messages/en/docs/settings/change-language.json
+++ b/web/messages/en/docs/settings/change-language.json
@@ -66,7 +66,7 @@
       "Dialog menu lists the 6 codes; you pick one.",
       "If <code>config.json</code> exists: <code>jq --arg lang \"$new_language\" '.language = $lang'</code> updates the field in place.",
       "If <code>config.json</code> doesn't exist: a fresh one is created with the language code in a single-field object.",
-      "Confirmation dialog: <em>\"Language changed to &lt;code&gt;\"</em>.",
+      "Confirmation dialog: <em>\"Language changed to [code]\"</em>.",
       "<code>exec bash config_menu.sh</code> reloads the Settings menu with the new language active."
     ]
   },
diff --git a/web/messages/es/docs/settings/change-language.json b/web/messages/es/docs/settings/change-language.json
index 0a959510..7ebc28dc 100644
--- a/web/messages/es/docs/settings/change-language.json
+++ b/web/messages/es/docs/settings/change-language.json
@@ -66,7 +66,7 @@
       "El menú de diálogo lista los 6 códigos; eliges uno.",
       "Si <code>config.json</code> existe: <code>jq --arg lang \"$new_language\" '.language = $lang'</code> actualiza el campo en sitio.",
       "Si <code>config.json</code> no existe: se crea uno nuevo con el código de idioma en un objeto de un solo campo.",
-      "Diálogo de confirmación: <em>\"Idioma cambiado a &lt;code&gt;\"</em>.",
+      "Diálogo de confirmación: <em>\"Idioma cambiado a [code]\"</em>.",
       "<code>exec bash config_menu.sh</code> recarga el menú Settings con el nuevo idioma activo."
     ]
   },