diff --git a/web/messages/en/docs/utils/export-vm.json b/web/messages/en/docs/utils/export-vm.json
index a5eaafad..81a2704c 100644
--- a/web/messages/en/docs/utils/export-vm.json
+++ b/web/messages/en/docs/utils/export-vm.json
@@ -59,8 +59,8 @@
   },
   "package": {
     "heading": "What ends up in the package",
-    "intro": "For an OVA / OVF named <code>myvm-100-2026-04-26_18-30-15</code>:",
-    "code": "# OVA mode (single .ova file is a TAR of):\nmyvm-100-2026-04-26_18-30-15.ovf      # XML descriptor (DMTF OVF 1.0 + RASD + VSSD)\nmyvm-100-2026-04-26_18-30-15.mf       # SHA1 manifest\nmyvm-100-2026-04-26_18-30-15-disk0.vmdk\nmyvm-100-2026-04-26_18-30-15-disk1.vmdk\n...\n\n# OVF mode (a directory):\nmyvm-100-2026-04-26_18-30-15-ovf/\n├── myvm-100-2026-04-26_18-30-15.ovf\n├── myvm-100-2026-04-26_18-30-15.mf\n├── myvm-100-2026-04-26_18-30-15-disk0.vmdk\n└── myvm-100-2026-04-26_18-30-15-disk1.vmdk"
+    "intro": "For an OVA / OVF named <code>myvm-100-20260426_183015</code>:",
+    "code": "# OVA mode (single .ova file is a TAR of):\nmyvm-100-20260426_183015.ovf      # XML descriptor (DMTF OVF 1.0 + RASD + VSSD)\nmyvm-100-20260426_183015.mf       # SHA1 manifest\nmyvm-100-20260426_183015-disk1.vmdk\nmyvm-100-20260426_183015-disk2.vmdk\n...\n\n# OVF mode (a directory):\nmyvm-100-20260426_183015-ovf/\n├── myvm-100-20260426_183015.ovf\n├── myvm-100-20260426_183015.mf\n├── myvm-100-20260426_183015-disk1.vmdk\n└── myvm-100-20260426_183015-disk2.vmdk"
   },
   "exported": {
     "heading": "What gets exported",
@@ -90,7 +90,7 @@
   "manifest": {
     "heading": "SHA1 manifest",
     "intro": "Every package includes a <code>.mf</code> file with SHA1 hashes of the OVF descriptor and each VMDK:",
-    "code": "SHA1(myvm-100-2026-04-26_18-30-15.ovf)= 3a7bd3e2360a3d29eea436fcfb7e44c735d117c9\nSHA1(myvm-100-2026-04-26_18-30-15-disk0.vmdk)= b7e23ec29af22b0b4e41da31e868d57226121c84\nSHA1(myvm-100-2026-04-26_18-30-15-disk1.vmdk)= a87ff679a2f3e71d9181a67b7542122c",
+    "code": "SHA1(myvm-100-20260426_183015.ovf)= 3a7bd3e2360a3d29eea436fcfb7e44c735d117c9\nSHA1(myvm-100-20260426_183015-disk1.vmdk)= b7e23ec29af22b0b4e41da31e868d57226121c84\nSHA1(myvm-100-20260426_183015-disk2.vmdk)= a87ff679a2f3e71d9181a67b7542122c",
     "outro": "Optional in the OVF spec — many readers ignore it — but useful for verifying the package made it across intact. Verify manually with <code>sha1sum -c file.mf</code>."
   },
   "import": {
diff --git a/web/messages/en/docs/utils/index.json b/web/messages/en/docs/utils/index.json
index 5d9388df..c41da87e 100644
--- a/web/messages/en/docs/utils/index.json
+++ b/web/messages/en/docs/utils/index.json
@@ -38,7 +38,7 @@
       "body": "Keep the host healthy: CLI tooling, regular updates, and the major-version upgrade when it's time.",
       "bullets": [
         "System Utilities Installer (25 CLI tools)",
-        "Proxmox System Update (apt + dist-upgrade)",
+        "Proxmox System Update (apt + full-upgrade)",
         "PVE 8 → PVE 9 major upgrade"
       ]
     },
@@ -58,11 +58,11 @@
   },
   "isoSection": {
     "heading": "ISO creation",
-    "body": "Build a fresh, up-to-date Windows installation ISO directly on the Proxmox host. The script automates the whole UUP Dump flow: dependency install (aria2c, cabextract, wimlib-imagex, …), parallelised download of the update files via aria2, and conversion into a single bootable ISO that lands in <code>/var/lib/vz/template/iso</code> ready to attach to a VM.",
+    "body": "Build a fresh, up-to-date Windows installation ISO directly on the Proxmox host. The script automates the whole UUP Dump flow: dependency install (aria2c, cabextract, wimlib-imagex, …), parallelised download of the update files via aria2, and conversion into a single bootable ISO saved to the detected Proxmox ISO storage (fallback <code>/var/lib/vz/template/iso</code>), ready to attach to a VM.",
     "options": [
       {
         "title": "UUP Dump ISO Creator",
-        "description": "Build an up-to-date Windows installation ISO from a UUP Dump shared link. Dependencies, download and conversion fully automated; the resulting ISO lands in /var/lib/vz/template/iso ready for VM creation.",
+        "description": "Build an up-to-date Windows installation ISO from a UUP Dump shared link. Dependencies, download and conversion fully automated; the resulting ISO is saved to the detected Proxmox ISO storage, ready for VM creation.",
         "href": "/docs/utils/UUp-Dump-ISO-Creator"
       }
     ]
@@ -78,7 +78,7 @@
       },
       {
         "title": "Proxmox System Update",
-        "description": "Repository check + apt update + apt dist-upgrade with reboot prompt. Detects the PVE major version (8 or 9), keeps the configured repositories and asks before switching a host without subscription to no-subscription, then runs autoremove.",
+        "description": "Repository check + apt update + apt full-upgrade with reboot prompt. Detects the PVE major version (8 or 9), keeps the configured repositories and asks before switching a host without subscription to no-subscription, then runs autoremove.",
         "href": "/docs/utils/system-update"
       },
       {
diff --git a/web/messages/en/docs/utils/system-update.json b/web/messages/en/docs/utils/system-update.json
index dffc2bca..d64b4e1b 100644
--- a/web/messages/en/docs/utils/system-update.json
+++ b/web/messages/en/docs/utils/system-update.json
@@ -128,7 +128,7 @@
         "body": "The Enterprise repository is enabled and the host has no active subscription. The worker offers the switch to no-subscription before <code>apt-get update</code>; when it was declined, run the update again and accept it, or disable the Enterprise source in <em>Node → Updates → Repositories</em> and enable the no-subscription one."
       },
       {
-        "title": "dist-upgrade hangs at \"Configuring grub-pc\"",
+        "title": "full-upgrade hangs at \"Configuring grub-pc\"",
         "body": "If an interactive GRUB prompt is visible, it asks which devices should receive the boot loader. The <code>--force-confold</code> option applies to configuration-file decisions, not to this device selection. Use <kbd>Tab</kbd> + <kbd>Space</kbd> to select the appropriate boot disks, then OK. You can configure this selection beforehand with <code>dpkg-reconfigure grub-pc</code>."
       },
       {
diff --git a/web/messages/en/docs/utils/system-utils.json b/web/messages/en/docs/utils/system-utils.json
index a47a9e04..e15db3ce 100644
--- a/web/messages/en/docs/utils/system-utils.json
+++ b/web/messages/en/docs/utils/system-utils.json
@@ -235,7 +235,7 @@
       {
         "href": "/docs/utils/system-update",
         "label": "Proxmox System Update",
-        "tailRich": " — for the actual <code>apt dist-upgrade</code> on the host."
+        "tailRich": " — for the actual <code>apt full-upgrade</code> on the host."
       },
       {
         "href": "/docs/network/monitoring",
diff --git a/web/messages/en/docs/utils/upgrade-pve8-pve9.json b/web/messages/en/docs/utils/upgrade-pve8-pve9.json
index dff9360c..4b8b0ba3 100644
--- a/web/messages/en/docs/utils/upgrade-pve8-pve9.json
+++ b/web/messages/en/docs/utils/upgrade-pve8-pve9.json
@@ -16,9 +16,9 @@
     "items": [
       "<strong>Verified backups</strong> of every VM and CT (PBS, vzdump, ZFS snapshots — and verify they restore).",
       "<strong>Console / IPMI / iKVM access</strong> to the host for when SSH drops mid-upgrade.",
-      "The host already up-to-date on PVE 8.4.x (the script enforces this).",
+      "The host on the latest PVE 8 patch level. The script updates PVE 8 first; it does not check for a specific 8.4.x version.",
       "Ceph (if present) on version 19.x Squid.",
-      "At least <strong>5 GB free</strong> on the root filesystem."
+      "At least <strong>5 GB free</strong> on the root filesystem, as the Proxmox guide recommends. The script itself only checks for 1 GB in /var/cache/apt/archives."
     ]
   },
   "modeMenu": {
@@ -63,13 +63,13 @@
   },
   "webTerminal": {
     "heading": "Why the web terminal is blocked",
-    "body": "All three upgrade modes detect <code>termproxy</code> / <code>vncshell</code> in the parent process chain and refuse to run. Reason: the Proxmox web terminal is served by <code>pveproxy</code>, which is one of the services that gets upgraded mid-flow. As soon as <code>pveproxy</code> restarts, your terminal session dies — and so does the upgrade script that was running inside it. The host is left half-upgraded, no good way to resume.",
+    "body": "The Automatic and Interactive modes detect <code>termproxy</code> / <code>vncshell</code> in the parent process chain and refuse to run, unless the session comes over SSH or <code>PVE_ALLOW_WEBTERM=1</code> is set. The pre-check and the manual guide change nothing and run anywhere. Reason: the Proxmox web terminal is served by <code>pveproxy</code>, which is one of the services that gets upgraded mid-flow. As soon as <code>pveproxy</code> restarts, your terminal session dies — and so does the upgrade script that was running inside it. The host is left half-upgraded, no good way to resume.",
     "warningTitle": "Use SSH or physical / IPMI / iKVM console",
-    "warningBody": "SSH is the most common choice. Open it inside <code>tmux</code> or <code>screen</code> so the upgrade survives a brief network blip. The very first thing the script does is print the tmux/screen reminder if it detects you're in a plain SSH shell."
+    "warningBody": "SSH is the most common choice. Open it inside <code>tmux</code> or <code>screen</code> so the upgrade survives a brief network blip. The upgrade confirmation dialog reminds you to run it from the console or from SSH inside tmux/screen."
   },
   "auto": {
     "heading": "Automatic / Unattended mode",
-    "intro": "Package and configuration-file prompts use the defaults in the table below, and a 401 from the enterprise repository switches to no-subscription without asking. The upgrade confirmation, the PVE 8 update summary, any pre-check repairs and the reboot prompt are still shown.",
+    "intro": "Package and configuration-file prompts use the defaults in the table below. The upgrade confirmation, the PVE 8 update summary, any pre-check repairs and the reboot prompt are still shown.",
     "behaviourHeading": "Auto-mode-specific behaviour",
     "behaviourTable": {
       "settingHeader": "Setting",
@@ -94,8 +94,8 @@
       ]
     },
     "flowHeading": "Auto-mode flow",
-    "flowIntro": "Six sequential phases. Phase 2 updates the PVE 8 packages and phase 3 writes the PVE 9 repository configuration. A failure stops the flow without rolling those changes back; if the PVE 8 update fails or is cancelled, the repositories are left unchanged. Phase 5 runs the PVE 9 <code>dist-upgrade</code>.",
-    "flowDiagram": "1. CHECKS\nBlock termproxy / vncshell; confirm the upgrade; reject PVE 9.\n\n2. PREPARE PVE 8\nscripts/global/update-pve8.sh\nUpdate PVE 8 packages; stop if the update fails or is cancelled.\npve8to9 --full (may offer repairs).\nCheck space and connectivity; Ceph 19.x Squid on hyper-converged nodes.\n\n3. MIGRATE REPOSITORIES\nBookworm → Trixie; write deb822 .sources files.\nComment legacy .list files; apt-get update.\n\n4. VALIDATE THE PVE 9 CANDIDATE\napt-cache policy proxmox-ve\napt-get -s dist-upgrade\nStop if the candidate is not 9.x or proxmox-ve would be removed.\n\n5. UPGRADE\napt-get -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' dist-upgrade\nNo subscription: disable pve-enterprise.sources.\nLog: /var/log/pve8-a-pve9-<timestamp>.log\n\n6. VERIFY AND REBOOT\nEFI: apt install grub-efi-amd64\npve8to9 --full; review results and the reboot prompt.",
+    "flowIntro": "Six sequential phases. Phase 2 switches the PVE 8 repositories to no-subscription (enterprise and Ceph lists disabled, <code>/etc/apt/sources.list</code> rewritten) before it shows the update summary, then updates the packages; phase 3 writes the PVE 9 repository configuration. A failure stops the flow without rolling those changes back; if the PVE 8 update fails or is cancelled, the PVE 9 migration does not start, but the PVE 8 repository changes stay. Phase 5 runs the PVE 9 <code>dist-upgrade</code>.",
+    "flowDiagram": "1. CHECKS\nBlock termproxy / vncshell; confirm the upgrade; reject PVE 9.\n\n2. PREPARE PVE 8\nscripts/global/update-pve8.sh\nSwitch PVE 8 repositories to no-subscription and rewrite sources.list;\nupdate PVE 8 packages; stop if the update fails or is cancelled.\npve8to9 --full (may offer repairs).\nCheck space and connectivity; Ceph 19.x Squid on hyper-converged nodes.\n\n3. MIGRATE REPOSITORIES\nBookworm → Trixie; write deb822 .sources files.\nComment legacy .list files; apt-get update.\n\n4. VALIDATE THE PVE 9 CANDIDATE\napt-cache policy proxmox-ve\napt-get -s dist-upgrade\nStop if the candidate is not 9.x or proxmox-ve would be removed.\n\n5. UPGRADE\napt-get -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' dist-upgrade\nNo subscription: disable pve-enterprise.sources.\nLog: /var/log/pve8-a-pve9-<timestamp>.log\n\n6. VERIFY AND REBOOT\nEFI: apt install grub-efi-amd64\npve8to9 --full; review results and the reboot prompt.",
     "preflightHeading": "Pre-flight: what gets checked",
     "preflightTable": {
       "checkHeader": "Check",
@@ -158,7 +158,7 @@
   },
   "manual": {
     "heading": "Manual upgrade procedure",
-    "intro": "This is what the <strong>Manual upgrade guide</strong> menu option displays — a faithful mirror of <wikilink>the official Proxmox 8-to-9 upgrade wiki</wikilink> organised in 4 phases. The script <em>shows</em> these commands; you type them yourself in a separate root shell. No automation — full visibility.",
+    "intro": "This follows what the <strong>Manual upgrade guide</strong> menu option displays, based on <wikilink>the official Proxmox 8-to-9 upgrade wiki</wikilink> and organised in 4 phases. The dpkg answer table adds the wiki's caveats for sshd_config and chrony.conf, which the menu shows as a plain Y. The script <em>shows</em> these commands; you type them yourself in a separate root shell. No automation — full visibility.",
     "rootCalloutTitle": "All commands need root",
     "rootCalloutBody": "Use a root shell for these commands, including redirections and here-documents. If you use <code>sudo</code>, ensure the entire command runs with root privileges.",
     "phase1Heading": "Phase 1 — Preparation",
@@ -230,7 +230,7 @@
   "clusterCeph": {
     "heading": "Cluster & Ceph",
     "clusterCalloutTitle": "Cluster: upgrade nodes one at a time",
-    "clusterCalloutBody": "Detected via <code>pvecm status</code>. <strong>Do not</strong> upgrade more than one node at a time. Move guests off the node, upgrade, reboot and verify cluster membership before proceeding. During the upgrade, live migration from an older PVE version to a newer one works; the reverse direction is generally unsupported. HA groups migrate automatically to HA rules once all nodes run PVE 9.",
+    "clusterCalloutBody": "<strong>Do not</strong> upgrade more than one node at a time. Move guests off the node, upgrade, reboot and verify cluster membership before proceeding. During the upgrade, live migration from an older PVE version to a newer one works; the reverse direction is generally unsupported. HA groups migrate automatically to HA rules once all nodes run PVE 9.",
     "cephCalloutTitle": "Ceph: upgrade Ceph FIRST, then Proxmox",
     "cephCalloutBody": "Ceph must already run 19.x Squid before upgrading Proxmox. Follow the official sequence: Quincy 17 → Reef 18 → Squid 19, updating packages and restarting Ceph daemons in the documented rolling order. Verify <code>ceph --version</code> before upgrading each Proxmox node. Follow the full procedure: <cephlink>Ceph Reef to Squid upgrade wiki</cephlink>."
   },
@@ -273,7 +273,7 @@
   },
   "files": {
     "heading": "Files involved",
-    "code": "scripts/utilities/upgrade_pve8_to_pve9.sh                         # main upgrade orchestrator\nscripts/utilities/pve8to9_check.sh                                # pre-check (separate menu option)\nscripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh    # 17-step runbook\nscripts/global/update-pve8.sh                                     # PVE 8 worker (final patches)\n/etc/apt/sources.list                                             # bookworm → trixie sed\n/etc/apt/sources.list.d/proxmox.sources                           # created (deb822 PVE 9)\n/etc/apt/sources.list.d/debian.sources                            # created (deb822 trixie)\n/etc/apt/sources.list.d/ceph.sources                              # created if Ceph\n/etc/apt/sources.list.d/*.list                                    # legacy files commented out / removed\n/var/log/pve8-a-pve9-<timestamp>.log                              # full upgrade log"
+    "code": "scripts/utilities/upgrade_pve8_to_pve9.sh                         # main upgrade orchestrator\nscripts/utilities/pve8to9_check.sh                                # pre-check (separate menu option)\nscripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh    # 17-step runbook\nscripts/global/update-pve8.sh                                     # PVE 8 worker (final patches)\n/etc/apt/sources.list                                             # bookworm → trixie sed\n/etc/apt/sources.list.d/proxmox.sources                           # created (deb822 PVE 9)\n/etc/apt/sources.list.d/ceph.sources                              # created if Ceph\n/etc/apt/sources.list.d/*.list                                    # legacy files commented out / removed\n/var/log/pve8-a-pve9-<timestamp>.log                              # full upgrade log"
   },
   "references": {
     "heading": "Official references",