diff --git a/.github/scripts/tests/test_vm_backup_jobs_wiring.py b/.github/scripts/tests/test_vm_backup_jobs_wiring.py
index a8ecf4f5..930c82e3 100644
--- a/.github/scripts/tests/test_vm_backup_jobs_wiring.py
+++ b/.github/scripts/tests/test_vm_backup_jobs_wiring.py
@@ -15,7 +15,7 @@ class VmBackupJobsWiring(TestCase):
         source = ROUTES.read_text()
         routes = re.findall(r'@vm_backup_bp\.route\("([^"]+)", methods=\["(\w+)"\]\)\n@(\w+)\ndef (\w+)', source)
         self.assertEqual(len(routes), source.count('@vm_backup_bp.route('))
-        self.assertEqual(len(routes), 8)
+        self.assertEqual(len(routes), 10)
         for path, method, guard, name in routes:
             expected = 'require_auth' if method == 'GET' else 'require_admin_scope'
             self.assertEqual(guard, expected, f'{method} {path} ({name})')
diff --git a/.github/workflows/test-apprise-services.yml b/.github/workflows/test-apprise-services.yml
new file mode 100644
index 00000000..59df1fd0
--- /dev/null
+++ b/.github/workflows/test-apprise-services.yml
@@ -0,0 +1,50 @@
+name: Apprise Slack and Matrix
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-apprise-services.yml'
+      - 'AppImage/scripts/notification_channels.py'
+      - 'AppImage/components/apprise-service-help.tsx'
+      - 'AppImage/components/notification-settings.tsx'
+      - 'tests/test_apprise_services.py'
+      - 'tests/test_apprise_service_help.cjs'
+  push:
+    branches: [main, develop]
+    paths:
+      - 'AppImage/scripts/notification_channels.py'
+      - 'AppImage/components/apprise-service-help.tsx'
+      - 'tests/test_apprise_services.py'
+      - 'tests/test_apprise_service_help.cjs'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  apprise-services:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        apprise: ['1.7.0', '2.0.1']
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22.14.0'
+      - name: Install fixture dependencies
+        run: |
+          python -m pip install 'apprise==${{ matrix.apprise }}'
+          npm ci --prefix .github/ci/offline-node --ignore-scripts --no-audit --no-fund
+      - name: Test real provider plugins with mocked HTTP
+        run: python -B -m unittest discover -s tests -p test_apprise_services.py -v
+      - name: Render provider help and locale fallback
+        env:
+          NODE_PATH: ${{ github.workspace }}/.github/ci/offline-node/node_modules
+        run: node tests/test_apprise_service_help.cjs
diff --git a/.github/workflows/test-backup-storage-retention.yml b/.github/workflows/test-backup-storage-retention.yml
new file mode 100644
index 00000000..321a227e
--- /dev/null
+++ b/.github/workflows/test-backup-storage-retention.yml
@@ -0,0 +1,50 @@
+name: Backup storage retention
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-backup-storage-retention.yml'
+      - 'AppImage/scripts/flask_vm_backup_routes.py'
+      - 'AppImage/components/backup-storage-retention.tsx'
+      - 'AppImage/components/backup-tab.tsx'
+      - 'AppImage/components/vm-backup-jobs.tsx'
+      - 'AppImage/lib/backup-retention.ts'
+      - 'tests/test_vm_backup_jobs_api.py'
+      - 'tests/test_backup_storage_retention.cjs'
+  push:
+    branches: [main, develop]
+    paths:
+      - 'AppImage/scripts/flask_vm_backup_routes.py'
+      - 'AppImage/components/backup-storage-retention.tsx'
+      - 'AppImage/lib/backup-retention.ts'
+      - 'tests/test_vm_backup_jobs_api.py'
+      - 'tests/test_backup_storage_retention.cjs'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  storage-retention:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22.14.0'
+      - name: Install fixture dependencies
+        run: |
+          python -m pip install 'Flask==3.1.2'
+          npm ci --prefix .github/ci/offline-node --ignore-scripts --no-audit --no-fund
+      - name: Test native job and storage configuration APIs
+        run: python -B -m unittest discover -s tests -p test_vm_backup_jobs_api.py -v
+      - name: Test shared retention properties
+        env:
+          NODE_PATH: ${{ github.workspace }}/.github/ci/offline-node/node_modules
+        run: node tests/test_backup_storage_retention.cjs
diff --git a/.github/workflows/test-figurine.yml b/.github/workflows/test-figurine.yml
new file mode 100644
index 00000000..b379ce4b
--- /dev/null
+++ b/.github/workflows/test-figurine.yml
@@ -0,0 +1,73 @@
+name: Figurine installation
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-figurine.yml'
+      - 'tests/test_figurine_installation.py'
+      - 'scripts/post_install/customizable_post_install.sh'
+      - 'AppImage/scripts/post_install_versions.py'
+      - 'AppImage/scripts/flask_proxmenux_routes.py'
+  push:
+    branches: [main, develop]
+    paths:
+      - '.github/workflows/test-figurine.yml'
+      - 'tests/test_figurine_installation.py'
+      - 'scripts/post_install/customizable_post_install.sh'
+      - 'AppImage/scripts/post_install_versions.py'
+      - 'AppImage/scripts/flask_proxmenux_routes.py'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  installer-and-release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Check shell syntax and isolated installer regressions
+        run: |
+          bash -n scripts/post_install/customizable_post_install.sh
+          python3 -B -m unittest discover -s tests -p test_figurine_installation.py -v
+      - name: Install ARM user-mode emulation for release smoke tests
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends qemu-user
+      - name: Verify and run the pinned AMD64, ARM64 and ARMv7 release binaries
+        env:
+          FIGURINE_VERSION: '2.1.1'
+        shell: bash
+        run: |
+          set -euo pipefail
+          scratch="$(mktemp -d)"
+          trap 'rm -rf "$scratch"' EXIT
+          while read -r arch sha; do
+            archive="figurine_linux_${arch}_v${FIGURINE_VERSION}.tar.gz"
+            target="$scratch/$arch"
+            mkdir -p "$target"
+            curl --fail --location --retry 3 --output "$target/$archive" \
+              "https://github.com/arsham/figurine/releases/download/v${FIGURINE_VERSION}/$archive"
+            printf '%s  %s\n' "$sha" "$target/$archive" | sha256sum --check
+            tar -xf "$target/$archive" -C "$target"
+            runner=()
+            case "$arch" in
+              arm64) runner=(qemu-aarch64) ;;
+              arm) runner=(qemu-arm) ;;
+            esac
+            "${runner[@]}" "$target/deploy/figurine" --version | tee "$target/version"
+            grep -F "figurine version v$FIGURINE_VERSION" "$target/version"
+            "${runner[@]}" "$target/deploy/figurine" -f "3d.flf" "ProxMenux-test" > "$target/banner"
+            test -s "$target/banner"
+            printf 'PASS: %s version and login banner\n' "$arch"
+          done <<'ASSETS'
+          amd64 f2b1c076942c94009d133df0f304a234a0994bf590b40f2927668324d578306a
+          arm64 611550ddb31a75437be3f8587bcdd029d0d890f4d820b7f494a2c6615fecba10
+          arm 429e66bded486d49f730c4a6559e728cd1e9a163a0f56a85867e2cbec010171d
+          ASSETS
diff --git a/.github/workflows/test-guest-backups.yml b/.github/workflows/test-guest-backups.yml
new file mode 100644
index 00000000..60da0353
--- /dev/null
+++ b/.github/workflows/test-guest-backups.yml
@@ -0,0 +1,54 @@
+name: Guest backup archives
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-guest-backups.yml'
+      - 'AppImage/scripts/guest_backup_archives.py'
+      - 'AppImage/scripts/flask_server.py'
+      - 'AppImage/scripts/jwt_middleware.py'
+      - 'AppImage/scripts/build_appimage.sh'
+      - 'AppImage/components/guest-backup-list.tsx'
+      - 'AppImage/components/virtual-machines.tsx'
+      - 'AppImage/lib/guest-backup-archives.ts'
+      - 'AppImage/messages/**'
+      - 'tests/test_guest_backup_archives.*'
+  push:
+    branches: [main, develop]
+    paths:
+      - 'AppImage/scripts/guest_backup_archives.py'
+      - 'AppImage/scripts/flask_server.py'
+      - 'AppImage/scripts/jwt_middleware.py'
+      - 'AppImage/components/guest-backup-list.tsx'
+      - 'AppImage/components/virtual-machines.tsx'
+      - 'AppImage/lib/guest-backup-archives.ts'
+      - 'tests/test_guest_backup_archives.*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  guest-backups:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22.14.0'
+      - name: Install fixture dependencies
+        run: |
+          python -m pip install 'Flask==3.1.2'
+          npm ci --prefix .github/ci/offline-node --ignore-scripts --no-audit --no-fund
+      - name: Test native deletion, protection, authorization and cache invalidation
+        run: python -B -m unittest discover -s tests -p test_guest_backup_archives.py -v
+      - name: Test frontend deletion and completion handling
+        env:
+          NODE_PATH: ${{ github.workspace }}/.github/ci/offline-node/node_modules
+        run: node tests/test_guest_backup_archives.cjs
diff --git a/AppImage/components/apprise-service-help.tsx b/AppImage/components/apprise-service-help.tsx
new file mode 100644
index 00000000..de9d132b
--- /dev/null
+++ b/AppImage/components/apprise-service-help.tsx
@@ -0,0 +1,32 @@
+"use client"
+
+import { ExternalLink } from "lucide-react"
+import { useT } from "../lib/i18n/provider"
+
+// These are examples, never defaults: opening help must not replace a saved
+// destination or put placeholder credentials into the notification settings.
+export function AppriseServiceHelp() {
+  const t = useT()
+  return <details className="rounded-md border border-border bg-muted/20 p-2 text-xs">
+    <summary className="cursor-pointer font-medium">{t("settings.notifications.ui.appriseServiceHelp")}</summary>
+    <div className="grid gap-3 pt-3 sm:grid-cols-2">
+      <div className="space-y-1.5 min-w-0">
+        <h4 className="font-medium">Slack</h4>
+        <p className="text-muted-foreground">{t("settings.notifications.ui.appriseSlackSteps")}</p>
+        <code className="block break-all rounded bg-background p-2 text-[10px]">https://hooks.slack.com/services/TOKEN_A/TOKEN_B/TOKEN_C</code>
+        <a href="https://appriseit.com/services/slack/" target="_blank" rel="noopener noreferrer" className="inline-flex items-center gap-1 text-cyan-500 hover:underline">
+          {t("settings.notifications.ui.appriseSlackDocs")} <ExternalLink className="h-3 w-3" />
+        </a>
+      </div>
+      <div className="space-y-1.5 min-w-0">
+        <h4 className="font-medium">Matrix</h4>
+        <p className="text-muted-foreground">{t("settings.notifications.ui.appriseMatrixSteps")}</p>
+        <code className="block break-all rounded bg-background p-2 text-[10px]">matrixs://USER:PASSWORD@matrix.example.com/!ROOM_ID:matrix.example.com</code>
+        <a href="https://appriseit.com/services/matrix/" target="_blank" rel="noopener noreferrer" className="inline-flex items-center gap-1 text-cyan-500 hover:underline">
+          {t("settings.notifications.ui.appriseMatrixDocs")} <ExternalLink className="h-3 w-3" />
+        </a>
+      </div>
+    </div>
+    <p className="mt-3 text-muted-foreground">{t("settings.notifications.ui.appriseServiceFinish")}</p>
+  </details>
+}
diff --git a/AppImage/components/backup-storage-retention.tsx b/AppImage/components/backup-storage-retention.tsx
new file mode 100644
index 00000000..4d15c6a5
--- /dev/null
+++ b/AppImage/components/backup-storage-retention.tsx
@@ -0,0 +1,105 @@
+"use client"
+
+import { useState } from "react"
+import useSWR from "swr"
+import { HardDrive, Loader2, Pencil, RefreshCw } from "lucide-react"
+import { Card, CardContent, CardHeader, CardTitle } from "./ui/card"
+import { Badge } from "./ui/badge"
+import { Button } from "./ui/button"
+import { Checkbox } from "./ui/checkbox"
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "./ui/dialog"
+import { Input } from "./ui/input"
+import { Label } from "./ui/label"
+import { fetchApi } from "../lib/api-config"
+import { buildRetention, parseRetention, RETENTION } from "../lib/backup-retention"
+import { useT } from "../lib/i18n/provider"
+
+interface StorageRetention { id: string; type: string; prune_backups: string; digest: string }
+const fetcher = (url: string) => fetchApi<{ storages: StorageRetention[] }>(url)
+
+export function BackupStorageRetention() {
+  const t = useT()
+  const { data, error, mutate, isValidating } = useSWR("/api/vm-backup-storages", fetcher)
+  const [editing, setEditing] = useState<StorageRetention | null>(null)
+  const [fields, setFields] = useState<Record<string, string>>({})
+  const [keepAll, setKeepAll] = useState(false)
+  const [useDefault, setUseDefault] = useState(false)
+  const [busy, setBusy] = useState(false)
+  const [message, setMessage] = useState("")
+  const [saveError, setSaveError] = useState("")
+
+  function edit(storage: StorageRetention) {
+    const policy = parseRetention(storage.prune_backups)
+    setFields(policy.fields)
+    setKeepAll(policy.keepAll)
+    setUseDefault(!storage.prune_backups)
+    setSaveError("")
+    setMessage("")
+    setEditing(storage)
+  }
+
+  async function save() {
+    if (!editing || busy) return
+    const prune = useDefault ? "" : buildRetention(fields, keepAll)
+    if (!useDefault && !prune) return setSaveError(t("backup.storageRetention.choosePolicy"))
+    setBusy(true)
+    setSaveError("")
+    try {
+      await fetchApi(`/api/vm-backup-storages/${encodeURIComponent(editing.id)}`, {
+        method: "PUT", body: JSON.stringify({ digest: editing.digest, prune_backups: prune }),
+      })
+      setMessage(t("backup.storageRetention.saved"))
+      setEditing(null)
+      await mutate()
+    } catch (error) {
+      setSaveError(`${t("backup.storageRetention.saveFailed")} ${error instanceof Error ? error.message : ""}`)
+    } finally { setBusy(false) }
+  }
+
+  return <Card className="border-border bg-card/50">
+    <CardHeader className="pb-3 flex-row items-center justify-between gap-2">
+      <CardTitle className="text-base flex items-center gap-2"><HardDrive className="h-4 w-4" />{t("backup.storageRetention.title")}</CardTitle>
+      <Button variant="ghost" size="sm" disabled={isValidating} onClick={() => { void mutate().catch(() => {}) }}>
+        <RefreshCw className={`h-4 w-4 mr-2 ${isValidating ? "animate-spin" : ""}`} />{t("backup.storageRetention.refresh")}
+      </Button>
+    </CardHeader>
+    <CardContent className="space-y-3">
+      <p className="text-xs text-muted-foreground">{t("backup.storageRetention.description")}</p>
+      {message && <p role="status" className="text-xs text-emerald-500">{message}</p>}
+      {error ? <p role="alert" className="text-xs text-destructive">{t("backup.storageRetention.loadFailed")}</p> : !data ?
+        <Loader2 className="h-4 w-4 animate-spin" /> : !data.storages.length ?
+        <p className="text-xs text-muted-foreground">{t("backup.storageRetention.empty")}</p> :
+        data.storages.map(storage => <div key={storage.id} className="flex flex-wrap gap-2 items-center border rounded-lg p-3">
+          <span className="font-medium text-sm">{storage.id}</span><Badge variant="outline">{storage.type}</Badge>
+          <span className="text-xs font-mono text-muted-foreground break-all">{storage.prune_backups || t("backup.storageRetention.default")}</span>
+          <Button variant="outline" size="sm" className="ml-auto gap-1" onClick={() => edit(storage)} disabled={!storage.digest || busy}>
+            <Pencil className="h-3 w-3" />{t("backup.storageRetention.edit")}
+          </Button>
+        </div>)}
+    </CardContent>
+    <Dialog open={!!editing} onOpenChange={open => { if (!open && !busy) setEditing(null) }}>
+      <DialogContent className="bg-accent [&_input]:bg-background">
+        <DialogHeader><DialogTitle>{t("backup.storageRetention.editTitle", { storage: editing?.id ?? "" })}</DialogTitle>
+          <DialogDescription>{t("backup.storageRetention.effect")}</DialogDescription></DialogHeader>
+        <Label className="flex items-center gap-2"><Checkbox checked={useDefault} disabled={busy} onCheckedChange={checked => {
+          setUseDefault(checked === true)
+          if (checked) { setKeepAll(false); setFields({}) }
+        }} />{t("backup.storageRetention.useDefault")}</Label>
+        <Label className="flex items-center gap-2"><Checkbox checked={keepAll} disabled={useDefault || busy} onCheckedChange={checked => {
+          setKeepAll(checked === true)
+          if (checked) setFields({})
+        }} />{t("backup.storageRetention.keepAll")}</Label>
+        <div className="grid grid-cols-2 gap-3">
+          {RETENTION.map(key => <div key={key} className="space-y-1">
+            <Label htmlFor={`storage-retention-${key}`}>{t(`backup.retention.keep${key[0].toUpperCase()}${key.slice(1)}`)}</Label>
+            <Input id={`storage-retention-${key}`} type="number" min={1} max={99999} step={1} disabled={useDefault || keepAll || busy}
+              value={fields[key] ?? ""} onChange={event => setFields(previous => ({ ...previous, [key]: event.target.value }))} />
+          </div>)}
+        </div>
+        {saveError && <p role="alert" className="text-xs text-destructive break-words">{saveError}</p>}
+        <DialogFooter><Button variant="outline" disabled={busy} onClick={() => setEditing(null)}>{t("backup.storageRetention.cancel")}</Button>
+          <Button disabled={busy} onClick={save}>{busy && <Loader2 className="h-4 w-4 mr-2 animate-spin" />}{t("backup.storageRetention.save")}</Button></DialogFooter>
+      </DialogContent>
+    </Dialog>
+  </Card>
+}
diff --git a/AppImage/components/backup-tab.tsx b/AppImage/components/backup-tab.tsx
index e411f6f6..b97c6232 100644
--- a/AppImage/components/backup-tab.tsx
+++ b/AppImage/components/backup-tab.tsx
@@ -8,6 +8,7 @@ import { DatabaseBackup } from "lucide-react"
 import { HostBackup } from "./host-backup"
 import { VmBackupJobs } from "./vm-backup-jobs"
 import { PBSPanel } from "./pbs-panel"
+import { BackupStorageRetention } from "./backup-storage-retention"
 import { useT } from "../lib/i18n/provider"
 
 type BackupView = "host" | "guests" | "pbs"
@@ -52,7 +53,7 @@ export function BackupTab() {
       <div className={view === "host" ? "" : "hidden"}>
         <HostBackup />
       </div>
-      {view === "guests" && <VmBackupJobs />}
+      {view === "guests" && <><VmBackupJobs /><BackupStorageRetention /></>}
       {view === "pbs" && <PBSPanel />}
     </div>
   )
diff --git a/AppImage/components/guest-backup-list.tsx b/AppImage/components/guest-backup-list.tsx
new file mode 100644
index 00000000..3f6878f7
--- /dev/null
+++ b/AppImage/components/guest-backup-list.tsx
@@ -0,0 +1,135 @@
+"use client"
+
+import { useEffect, useRef, useState } from "react"
+import { Archive, Clock, Loader2, LockKeyhole, RefreshCw, Trash2 } from "lucide-react"
+import { Badge } from "./ui/badge"
+import { Button } from "./ui/button"
+import { Checkbox } from "./ui/checkbox"
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "./ui/dialog"
+import { useT } from "@/lib/i18n/provider"
+import { deleteGuestBackups, type GuestBackup } from "../lib/guest-backup-archives"
+
+export function GuestBackupList({ vmid, backups, loading, onRefresh, storageColor }: {
+  vmid: number
+  backups: GuestBackup[]
+  loading: boolean
+  onRefresh: () => Promise<void>
+  storageColor?: (storage: string) => { bg: string; text: string; border: string }
+}) {
+  const t = useT()
+  const [selected, setSelected] = useState<string[]>([])
+  const [confirm, setConfirm] = useState(false)
+  const [busy, setBusy] = useState(false)
+  const [refreshing, setRefreshing] = useState(false)
+  const [message, setMessage] = useState("")
+  const [error, setError] = useState("")
+  const mounted = useRef(true)
+  useEffect(() => {
+    mounted.current = true
+    return () => { mounted.current = false }
+  }, [])
+  // A fresh list can remove a selection or reveal a newly protected archive.
+  useEffect(() => {
+    setSelected(previous => previous.filter(volid => backups.some(backup => backup.volid === volid && !backup.protected)))
+  }, [backups])
+
+  const chosen = backups.filter(backup => selected.includes(backup.volid) && !backup.protected)
+  const selectable = backups.filter(backup => !backup.protected)
+  const disabled = loading || busy || refreshing
+  const storageClass = (storage: string) => {
+    const color = storageColor?.(storage)
+    return color ? `${color.bg} ${color.text} ${color.border}` : ""
+  }
+
+  async function refresh() {
+    setRefreshing(true)
+    setError("")
+    try { await onRefresh() } catch { if (mounted.current) setError(t("vmLxc.backups.refreshFailed")) }
+    finally { if (mounted.current) setRefreshing(false) }
+  }
+
+  async function remove() {
+    if (!chosen.length || busy) return
+    setBusy(true)
+    setError("")
+    setMessage("")
+    try {
+      const results = await deleteGuestBackups(vmid, chosen)
+      if (!mounted.current) return
+      const deleted = results.filter(result => result.status === "deleted").length
+      const unconfirmed = results.length - deleted
+      setMessage(t("vmLxc.backups.deletedCount", { count: deleted }))
+      if (unconfirmed) setError(t("vmLxc.backups.unconfirmedCount", { count: unconfirmed }))
+      setSelected([])
+    } catch (error) {
+      if (mounted.current) setError(`${t("vmLxc.backups.deleteFailed")} ${error instanceof Error ? error.message : ""}`)
+    } finally {
+      // A timeout can hide a successful native task. Always bypass both caches.
+      try { await onRefresh() } catch { if (mounted.current) setError(t("vmLxc.backups.refreshFailed")) }
+      if (mounted.current) { setBusy(false); setConfirm(false) }
+    }
+  }
+
+  return <>
+    <div className="flex items-center justify-between gap-2 mb-3 shrink-0 flex-wrap">
+      <div className="flex items-center gap-2">
+        <span className="text-xs text-muted-foreground">{t("vmLxc.backups.available")}</span>
+        <Badge variant="secondary" className="text-xs h-5">{backups.length}</Badge>
+      </div>
+      <div className="flex items-center gap-2">
+        <Button size="sm" variant="ghost" className="h-7 text-xs gap-1" disabled={disabled} onClick={refresh}>
+          <RefreshCw className={`h-3 w-3 ${refreshing ? "animate-spin" : ""}`} />{t("vmLxc.backups.refresh")}
+        </Button>
+        <Button size="sm" variant="destructive" className="h-7 text-xs gap-1" disabled={disabled || !chosen.length} onClick={() => setConfirm(true)}>
+          {busy ? <Loader2 className="h-3 w-3 animate-spin" /> : <Trash2 className="h-3 w-3" />}
+          {t("vmLxc.backups.deleteSelected", { count: chosen.length })}
+        </Button>
+      </div>
+    </div>
+    {message && <p role="status" className="text-xs text-muted-foreground mb-2">{message}</p>}
+    {error && <p role="alert" className="text-xs text-destructive mb-2 break-words">{error}</p>}
+    {loading ? <div className="flex-1 flex items-center justify-center text-muted-foreground min-h-0">
+      <Loader2 className="h-4 w-4 animate-spin mr-2" /><span className="text-sm">{t("vmLxc.backups.loading")}</span>
+    </div> : backups.length === 0 ? <div className="flex-1 flex flex-col items-center justify-center text-muted-foreground min-h-0">
+      <Archive className="h-12 w-12 mb-3 opacity-30" /><span className="text-sm">{t("vmLxc.backups.empty")}</span>
+      <span className="text-xs mt-1">{t("vmLxc.backups.emptyHint")}</span>
+    </div> : <>
+      <label className="flex items-center gap-2 mb-3 text-xs text-muted-foreground">
+        <Checkbox checked={selectable.length > 0 && chosen.length === Math.min(20, selectable.length)} disabled={disabled || !selectable.length}
+          onCheckedChange={checked => setSelected(checked ? selectable.slice(0, 20).map(backup => backup.volid) : [])} />
+        {t("vmLxc.backups.selectHint")}
+      </label>
+      <div className="space-y-2 flex-1 overflow-y-auto min-h-0 pr-1 -mr-1">
+        {backups.map(backup => <label key={backup.volid} className="flex items-center gap-2 p-3 rounded-lg bg-muted/30 hover:bg-muted/50 transition-colors">
+          <Checkbox aria-label={`${t("vmLxc.backups.selectBackup")} ${backup.date} ${backup.storage}`} checked={selected.includes(backup.volid)}
+            disabled={disabled || !!backup.protected || (chosen.length >= 20 && !selected.includes(backup.volid))}
+            onCheckedChange={checked => setSelected(previous => checked ? [...previous, backup.volid] : previous.filter(id => id !== backup.volid))} />
+          <div className="w-2 h-2 rounded-full bg-green-500 shrink-0" />
+          <Clock className="h-4 w-4 text-muted-foreground shrink-0" />
+          <span className="text-sm min-w-0 truncate" title={backup.volid}>{backup.date}</span>
+          {backup.protected && <Badge variant="secondary" className="gap-1 text-xs"><LockKeyhole className="h-3 w-3" />{t("vmLxc.backups.protected")}</Badge>}
+          <Badge variant="outline" className={`text-xs ml-auto shrink-0 ${storageClass(backup.storage)}`}>{backup.storage}</Badge>
+          <Badge variant="outline" className="font-mono shrink-0">{backup.size_human}</Badge>
+        </label>)}
+      </div>
+    </>}
+    <Dialog open={confirm} onOpenChange={value => { if (!busy) setConfirm(value) }}>
+      <DialogContent onEscapeKeyDown={event => { if (busy) event.preventDefault() }} onPointerDownOutside={event => { if (busy) event.preventDefault() }}>
+        <DialogHeader>
+          <DialogTitle>{t("vmLxc.backups.confirmTitle", { count: chosen.length })}</DialogTitle>
+          <DialogDescription>{t("vmLxc.backups.confirmDescription", { vmid })}</DialogDescription>
+        </DialogHeader>
+        <ul className="max-h-48 overflow-auto text-xs space-y-2 break-all">
+          {chosen.map(backup => <li key={backup.volid}>{backup.volid}</li>)}
+        </ul>
+        {busy && <p role="status" className="text-sm text-muted-foreground">{t("vmLxc.backups.deleting")}</p>}
+        <DialogFooter>
+          <Button variant="outline" disabled={busy} onClick={() => setConfirm(false)}>{t("vmLxc.backups.cancel")}</Button>
+          <Button variant="destructive" disabled={busy || !chosen.length} onClick={remove}>
+            {busy && <Loader2 className="h-4 w-4 animate-spin mr-2" />}{t("vmLxc.backups.confirmDelete")}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  </>
+}
diff --git a/AppImage/components/notification-settings.tsx b/AppImage/components/notification-settings.tsx
index ac9733f1..e84590ee 100644
--- a/AppImage/components/notification-settings.tsx
+++ b/AppImage/components/notification-settings.tsx
@@ -1,5 +1,6 @@
 "use client"
 
+import { AppriseServiceHelp } from "./apprise-service-help"
 import { useState, useEffect, useCallback } from "react"
 import { useTheme } from "next-themes"
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "./ui/card"
@@ -2061,6 +2062,7 @@ export function NotificationSettings() {
                     Enable toggle + Test button pattern as the other
                     channels. */}
                 <TabsContent value="apprise" className="space-y-3 pt-2">
+                  <AppriseServiceHelp />
                   <div className="flex items-center justify-between">
                     <div className="flex items-center gap-2">
                       <Label className="text-xs font-medium">{t("settings.notifications.ui.enableApprise")}</Label>
diff --git a/AppImage/components/virtual-machines.tsx b/AppImage/components/virtual-machines.tsx
index 901655d4..a538627a 100644
--- a/AppImage/components/virtual-machines.tsx
+++ b/AppImage/components/virtual-machines.tsx
@@ -23,6 +23,8 @@ import { MetricsView } from "./metrics-dialog"
 import { LxcTerminalModal } from "./lxc-terminal-modal"
 import { ScriptTerminalModal } from "./script-terminal-modal"
 import { LxcAppPanel, ThemeAwareLogo, ociImageLabel } from "./lxc-app-panel"
+import { GuestBackupList } from "./guest-backup-list"
+import type { GuestBackup } from "../lib/guest-backup-archives"
 import { OciConsoleLogPanel } from "./oci-console-log-panel"
 import { AppUpdaterEditor, type AppUpdateMethod } from "./app-updater-editor"
 import { formatStorage } from "../lib/utils"
@@ -399,16 +401,7 @@ interface BackupStorage {
   avail_human?: string
 }
 
-interface VMBackup {
-  volid: string
-  storage: string
-  type: string
-  size: number
-  size_human: string
-  timestamp: number
-  date: string
-  notes?: string
-}
+type VMBackup = GuestBackup
 
 // Sprint 13.29: shape returned by /api/lxc/<vmid>/mount-points. Lives
 // next to VMBackup since both are LXC-modal data structures.
@@ -1615,7 +1608,7 @@ export function VirtualMachines() {
     }
   }
 
-  const fetchVmBackups = async (vmid: number) => {
+  const fetchVmBackups = async (vmid: number, force = false) => {
     // Stale-while-revalidate with a 6-hour freshness gate.
     //
     // 1. If we already have backups (bulk hydration or a previous
@@ -1632,15 +1625,16 @@ export function VirtualMachines() {
     // 3. Loading spinner only on the true first load.
     const GATE_MS = 6 * 60 * 60 * 1000
     const seed = vmModalCacheRef.current.backups.get(vmid)
-    const isStale = !seed || (Date.now() - seed.fetchedAt) > GATE_MS
+    const isStale = force || !seed || (Date.now() - seed.fetchedAt) > GATE_MS
     if (!seed) setLoadingBackups(true)
     try {
       const url = isStale
         ? `/api/vms/${vmid}/backups?fresh=1`
         : `/api/vms/${vmid}/backups`
-      const response = await fetchApi<{ backups?: VMBackup[] }>(url)
+      const response = await fetchApi<{ backups?: VMBackup[]; error?: string }>(url)
+      if (response.error || !Array.isArray(response.backups)) throw new Error(response.error || "Backup inventory unavailable")
       if (response.backups) {
-        setVmBackups(response.backups)
+        if (selectedVMRef.current?.vmid === vmid) setVmBackups(response.backups)
         vmModalCacheRef.current.backups.set(vmid, { backups: response.backups, fetchedAt: Date.now() })
       }
     } catch (error) {
@@ -1648,9 +1642,10 @@ export function VirtualMachines() {
       // Only clear the visible list if we had nothing to show
       // in the first place — a transient network hiccup must not
       // wipe the stale-but-useful view the user is looking at.
-      if (!seed) setVmBackups([])
+      if (!seed && selectedVMRef.current?.vmid === vmid) setVmBackups([])
+      if (force) throw error
     } finally {
-      if (!seed) setLoadingBackups(false)
+      if (!seed && selectedVMRef.current?.vmid === vmid) setLoadingBackups(false)
     }
   }
 
@@ -7460,7 +7455,7 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                 )}
 
                 {/* Backups Tab */}
-                {activeModalTab === "backups" && (
+                {activeModalTab === "backups" && selectedVM && (
                   /* Backups tab layout: the Card fills the whole tab
                      body so the backup list can scroll inside its
                      bordered card instead of leaving empty space
@@ -7495,48 +7490,17 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                         {/* Divider */}
                         <div className="border-t border-border/50 mb-4 shrink-0" />
 
-                        {/* Backup List */}
-                        <div className="flex items-center justify-between mb-3 shrink-0">
-                          <span className="text-xs text-muted-foreground">{t("vmLxc.backups.available")}</span>
-                          <Badge variant="secondary" className="text-xs h-5">{vmBackups.length}</Badge>
-                        </div>
-
-                        {loadingBackups ? (
-                          <div className="flex-1 flex items-center justify-center text-muted-foreground min-h-0">
-                            <Loader2 className="h-4 w-4 animate-spin mr-2" />
-                            <span className="text-sm">{t("vmLxc.backups.loading")}</span>
-                          </div>
-                        ) : vmBackups.length === 0 ? (
-                          <div className="flex-1 flex flex-col items-center justify-center text-muted-foreground min-h-0">
-                            <Archive className="h-12 w-12 mb-3 opacity-30" />
-                            <span className="text-sm">{t("vmLxc.backups.empty")}</span>
-                            <span className="text-xs mt-1">{t("vmLxc.backups.emptyHint")}</span>
-                          </div>
-                        ) : (
-                          <div className="space-y-2 flex-1 overflow-y-auto min-h-0 pr-1 -mr-1">
-                            {vmBackups.map((backup, index) => (
-                              <div 
-                                key={`backup-${backup.volid}-${index}`}
-                                className="flex items-center justify-between p-3 rounded-lg bg-muted/30 hover:bg-muted/50 transition-colors"
-                              >
-                                <div className="flex items-center gap-2 flex-1 min-w-0">
-                                  <div className="w-2 h-2 rounded-full bg-green-500 flex-shrink-0" />
-                                  <Clock className="h-4 w-4 text-muted-foreground flex-shrink-0" />
-                                  <span className="text-sm text-foreground">{backup.date}</span>
-                                  <Badge 
-                                    variant="outline" 
-                                    className={`text-xs ml-auto flex-shrink-0 ${getStorageColor(backup.storage).bg} ${getStorageColor(backup.storage).text} ${getStorageColor(backup.storage).border}`}
-                                  >
-                                    {backup.storage}
-                                  </Badge>
-                                </div>
-                                <Badge variant="outline" className="font-mono ml-2 flex-shrink-0">
-                                  {backup.size_human}
-                                </Badge>
-                              </div>
-                            ))}
-                          </div>
-                        )}
+                        <GuestBackupList
+                          key={selectedVM.vmid}
+                          vmid={selectedVM.vmid}
+                          backups={vmBackups}
+                          loading={loadingBackups}
+                          onRefresh={async () => {
+                            vmModalCacheRef.current.backups.delete(selectedVM.vmid)
+                            await fetchVmBackups(selectedVM.vmid, true)
+                          }}
+                          storageColor={getStorageColor}
+                        />
                       </CardContent>
                     </Card>
                   </div>
diff --git a/AppImage/components/vm-backup-jobs.tsx b/AppImage/components/vm-backup-jobs.tsx
index b4054300..972c187d 100644
--- a/AppImage/components/vm-backup-jobs.tsx
+++ b/AppImage/components/vm-backup-jobs.tsx
@@ -21,6 +21,7 @@ import {
 import { fetchApi } from "../lib/api-config"
 import { cancelButtonClass } from "../lib/utils"
 import { useT } from "../lib/i18n/provider"
+import { RETENTION, parseRetention, buildRetention } from "../lib/backup-retention"
 
 interface VmBackupJob {
   id: string
@@ -70,24 +71,6 @@ const EMPTY_FORM: FormState = {
   mode: "snapshot", compress: "zstd", retention: {}, keepAll: false, notes: "{{guestname}}", attached: [],
 }
 
-// The limits a job can keep, in the order Proxmox lists them.
-const RETENTION = ["last", "hourly", "daily", "weekly", "monthly", "yearly"] as const
-
-const parseRetention = (prune: string) => {
-  const fields: Record<string, string> = {}
-  let keepAll = false
-  for (const part of prune.split(",")) {
-    const [key, value] = part.trim().split("=")
-    if (key === "keep-all") keepAll = value === "1"
-    else if (key?.startsWith("keep-") && Number(value) > 0) fields[key.slice(5)] = String(Number(value))
-  }
-  return { fields, keepAll }
-}
-
-const buildRetention = (fields: Record<string, string>, keepAll: boolean) => {
-  const parts = RETENTION.filter((key) => Number(fields[key]) > 0).map((key) => `keep-${key}=${Number(fields[key])}`)
-  return parts.length ? parts.join(",") : keepAll ? "keep-all=1" : ""
-}
 
 const isOn = (value: unknown) => value === 1 || value === true || value === "1"
 const jobEnabled = (job: VmBackupJob) => job.enabled === undefined || isOn(job.enabled)
diff --git a/AppImage/lib/backup-retention.ts b/AppImage/lib/backup-retention.ts
new file mode 100644
index 00000000..7caa7686
--- /dev/null
+++ b/AppImage/lib/backup-retention.ts
@@ -0,0 +1,18 @@
+// Native Proxmox retention properties, shared by storage and job editors.
+export const RETENTION = ["last", "hourly", "daily", "weekly", "monthly", "yearly"] as const
+
+export function parseRetention(prune: string) {
+  const fields: Record<string, string> = {}
+  let keepAll = false
+  for (const part of prune.split(",")) {
+    const [key, value] = part.trim().split("=")
+    if (key === "keep-all") keepAll = value === "1"
+    else if (key?.startsWith("keep-") && Number(value) > 0) fields[key.slice(5)] = String(Number(value))
+  }
+  return { fields, keepAll }
+}
+
+export function buildRetention(fields: Record<string, string>, keepAll: boolean) {
+  const parts = RETENTION.filter(key => Number(fields[key]) > 0).map(key => `keep-${key}=${Number(fields[key])}`)
+  return parts.length ? parts.join(",") : keepAll ? "keep-all=1" : ""
+}
diff --git a/AppImage/lib/guest-backup-archives.ts b/AppImage/lib/guest-backup-archives.ts
new file mode 100644
index 00000000..68dceb18
--- /dev/null
+++ b/AppImage/lib/guest-backup-archives.ts
@@ -0,0 +1,55 @@
+import { fetchApi } from './api-config'
+
+export interface GuestBackup {
+  volid: string
+  storage: string
+  type: string
+  size: number
+  size_human: string
+  timestamp: number
+  date: string
+  notes?: string
+  protected?: boolean
+}
+
+export interface BackupDeletionResult {
+  volid: string
+  status: 'deleted' | 'pending' | 'unconfirmed'
+  task?: string
+  error?: string
+}
+
+// Exposed separately so callers can invalidate their inventory even after a
+// lost POST response. Never retry the destructive request automatically.
+export async function deleteGuestBackups(vmid: number, backups: GuestBackup[]): Promise<BackupDeletionResult[]> {
+  const response = await fetchApi<{ results: BackupDeletionResult[] }>(`/api/vms/${vmid}/backups/delete`, {
+    method: 'POST',
+    body: JSON.stringify({ confirm: true, backups: backups.map(({ volid, storage }) => ({ volid, storage })) }),
+    // Up to 20 archives, checked first and then deleted four at a time.
+    signal: AbortSignal.timeout(300_000),
+  })
+  if (!Array.isArray(response.results) || response.results.length !== backups.length ||
+      response.results.some((result, index) => result.volid !== backups[index].volid ||
+        !['deleted', 'pending', 'unconfirmed'].includes(result.status))) throw new Error('deletionUnconfirmed')
+
+  return Promise.all(response.results.map(async result => {
+    if (result.status !== 'pending' || !result.task) return result
+    const deadline = Date.now() + 120_000
+    let failures = 0
+    while (Date.now() < deadline) {
+      await new Promise(resolve => setTimeout(resolve, 1500))
+      try {
+        const status = await fetchApi<BackupDeletionResult>(
+          `/api/vms/${vmid}/backups/delete-status?task=${encodeURIComponent(result.task!)}`,
+          { signal: AbortSignal.timeout(10_000) },
+        )
+        if (status.volid !== result.volid || !['deleted', 'pending', 'unconfirmed'].includes(status.status)) break
+        if (status.status !== 'pending') return status
+        failures = 0
+      } catch {
+        if (++failures >= 3) break
+      }
+    }
+    return { ...result, status: 'unconfirmed', error: 'deletionUnconfirmed' }
+  }))
+}
diff --git a/AppImage/messages/de/common.json b/AppImage/messages/de/common.json
index 840833c7..9fa0c7cf 100644
--- a/AppImage/messages/de/common.json
+++ b/AppImage/messages/de/common.json
@@ -1110,7 +1110,21 @@
       "available": "Verfügbare Backups",
       "loading": "Backups werden geladen...",
       "empty": "Keine Backups gefunden",
-      "emptyHint": "Erstellen Sie Ihr erstes Backup über die Schaltfläche oben"
+      "emptyHint": "Erstellen Sie Ihr erstes Backup über die Schaltfläche oben",
+      "refresh": "Aktualisieren",
+      "refreshFailed": "Sicherungen konnten nicht aktualisiert werden. Aktualisieren Sie erneut, um ihren aktuellen Zustand zu bestätigen.",
+      "deleteSelected": "Ausgewählte löschen ({count})",
+      "deletedCount": "{count} Sicherung(en) gelöscht.",
+      "unconfirmedCount": "Die Löschung von {count} Sicherung(en) wurde nicht bestätigt. Aktualisieren Sie die Liste und prüfen Sie die Proxmox-Aufgaben, bevor Sie es erneut versuchen.",
+      "deleteFailed": "Die Löschung konnte nicht bestätigt werden. Aktualisieren Sie die Liste und prüfen Sie die Proxmox-Aufgaben, bevor Sie es erneut versuchen.",
+      "selectHint": "Ungeschützte Sicherungen auswählen (bis zu 20 pro Durchgang)",
+      "selectBackup": "Sicherung auswählen",
+      "protected": "Geschützt",
+      "confirmTitle": "{count} Sicherung(en) löschen?",
+      "confirmDescription": "Diese Sicherungsarchive für VM/CT {vmid} werden dauerhaft gelöscht. Geschützte Sicherungen sind ausgeschlossen. Der Gast wird dadurch nicht gelöscht.",
+      "deleting": "Warten, bis Proxmox die ausgewählten Archive gelöscht hat…",
+      "cancel": "Abbrechen",
+      "confirmDelete": "Sicherungen löschen"
     },
     "updatesPanel": {
       "pendingTitle": "Ausstehende Paketaktualisierungen",
@@ -1304,7 +1318,7 @@
         "Samstag"
       ],
       "runSkippedStatus": "Lauf übersprungen",
-      "reasonStoppedContainer": "Container ist gestoppt;Das geplante Update wurde übersprungen.",
+      "reasonStoppedContainer": "Container ist gestoppt; das geplante Update wurde übersprungen.",
       "reasonStoppedContainerHistorical": "Der Container wurde zum geplanten Aktualisierungszeitpunkt gestoppt."
     },
     "cronChip": {
@@ -2111,7 +2125,13 @@
         "inactiveFooter": "Aktivieren Sie Benachrichtigungen, um System-, Gesundheits- und Sicherheitswarnungen über die konfigurierten Kanäle zu erhalten.",
         "notificationLanguage": "Benachrichtigungssprache",
         "selectNotificationLanguage": "Benachrichtigungssprache auswählen",
-        "notificationLanguageHint": "Wird für deterministische Laufzeitbenachrichtigungen verwendet, auch wenn KI deaktiviert ist."
+        "notificationLanguageHint": "Wird für deterministische Laufzeitbenachrichtigungen verwendet, auch wenn KI deaktiviert ist.",
+        "appriseServiceHelp": "Slack und Matrix einrichten",
+        "appriseSlackSteps": "Erstellen Sie in Ihrer Slack-App einen eingehenden Webhook für den Zielkanal und fügen Sie dessen vollständige HTTPS-URL in das Feld Apprise-URL ein. Eine Umwandlung ist nicht erforderlich.",
+        "appriseSlackDocs": "Slack-URL-Formate und Einrichtung",
+        "appriseMatrixSteps": "Verwenden Sie ein Benachrichtigungskonto, das in den Raum schreiben darf. Ersetzen Sie den Beispielbenutzer, das Passwort, den Homeserver und die vollständige Raum-ID; kodieren Sie Sonderzeichen in Zugangsdaten für URLs. Das Schema matrixs verwendet HTTPS. Informationen zur Unterstützung von Tokens, SSO und verschlüsselten Räumen in Ihrer installierten Apprise-Version finden Sie in der Dokumentation.",
+        "appriseMatrixDocs": "Matrix-URL-Formate und Einrichtung",
+        "appriseServiceFinish": "Aktivieren Sie Apprise, geben Sie Ihre URL ein, wählen Sie Benachrichtigungskategorien oder einzelne Ereignisse aus, speichern Sie und verwenden Sie anschließend Test senden. Diese Beispiele ändern Ihre gespeicherte URL nicht. Dieser Apprise-Kanal hat ein Ziel; verwenden Sie die Apprise-API für mehrere Dienste gleichzeitig."
       },
       "ai": {
         "title": "KI-Verbesserung",
@@ -4756,6 +4776,24 @@
       "thursday": "Donnerstag",
       "tuesday": "Dienstag",
       "wednesday": "Mittwoch"
+    },
+    "storageRetention": {
+      "title": "Aufbewahrung im Speicher",
+      "keepAll": "Alle Sicherungen behalten",
+      "description": "In Proxmox gespeicherte Standardaufbewahrung für Sicherungen. Sicherungsaufträge mit einer eigenen Richtlinie überschreiben diesen Standard.",
+      "refresh": "Aktualisieren",
+      "saved": "Aufbewahrungsrichtlinie des Speichers gespeichert. Es wurde keine Bereinigung ausgeführt.",
+      "choosePolicy": "Wählen Sie Alle behalten oder mindestens eine Aufbewahrungsanzahl größer als null.",
+      "saveFailed": "Aufbewahrungsrichtlinie des Speichers konnte nicht gespeichert werden. Aktualisieren Sie die Liste, falls die Konfiguration geändert wurde.",
+      "loadFailed": "Aufbewahrungsrichtlinie des Speichers konnte nicht geladen werden.",
+      "empty": "Keine Sicherungsspeicher gefunden.",
+      "default": "Proxmox-Standard",
+      "edit": "Bearbeiten",
+      "editTitle": "Aufbewahrung für {storage}",
+      "effect": "Gilt für zukünftige Sicherungsläufe, die diese Speicherrichtlinie übernehmen. Das Speichern löscht keine vorhandenen Sicherungen. Geschützte Sicherungen bleiben geschützt.",
+      "cancel": "Abbrechen",
+      "save": "Aufbewahrung speichern",
+      "useDefault": "Proxmox-Standard verwenden (keine Richtlinie für diesen Speicher)"
     }
   },
   "healthStatus": {
diff --git a/AppImage/messages/en/common.json b/AppImage/messages/en/common.json
index 5c6aab7a..fa596302 100644
--- a/AppImage/messages/en/common.json
+++ b/AppImage/messages/en/common.json
@@ -1184,7 +1184,21 @@
       "available": "Available backups",
       "loading": "Loading backups...",
       "empty": "No backups found",
-      "emptyHint": "Create your first backup using the button above"
+      "emptyHint": "Create your first backup using the button above",
+      "refresh": "Refresh",
+      "refreshFailed": "Could not refresh backups. Refresh again to confirm their current state.",
+      "deleteSelected": "Delete selected ({count})",
+      "deletedCount": "{count} backup(s) deleted.",
+      "unconfirmedCount": "Deletion of {count} backup(s) was not confirmed. Refresh the list and check Proxmox Tasks before trying again.",
+      "deleteFailed": "Deletion could not be confirmed. Refresh the list and check Proxmox Tasks before trying again.",
+      "selectHint": "Select unprotected backups (up to 20 per batch)",
+      "selectBackup": "Select backup",
+      "protected": "Protected",
+      "confirmTitle": "Delete {count} backup(s)?",
+      "confirmDescription": "These backup archives for VM/CT {vmid} will be permanently deleted. Protected backups are excluded. This does not delete the guest.",
+      "deleting": "Waiting for Proxmox to finish deleting the selected archives…",
+      "cancel": "Cancel",
+      "confirmDelete": "Delete backups"
     },
     "updatesPanel": {
       "pendingTitle": "Pending package updates",
@@ -2150,6 +2164,12 @@
         "pushoverCredentialsHint": "Create an application in Pushover and copy its API token and your user or group key.",
         "enableApprise": "Enable Apprise",
         "urlFormats": "+URL formats",
+        "appriseServiceHelp": "Slack and Matrix setup",
+        "appriseSlackSteps": "Create an Incoming Webhook in your Slack app for the target channel, then paste its complete HTTPS URL into Apprise URL. No conversion is needed.",
+        "appriseSlackDocs": "Slack URL formats and setup",
+        "appriseMatrixSteps": "Use a notification account that can post to the room. Replace the example user, password, homeserver and full room ID; URL-encode special characters in credentials. The matrixs scheme uses HTTPS. See the documentation for token, SSO and encrypted-room support in your installed Apprise version.",
+        "appriseMatrixDocs": "Matrix URL formats and setup",
+        "appriseServiceFinish": "Enable Apprise, enter your URL, choose the notification categories or individual events, save, then use Send Test. These examples do not change your saved URL. This Apprise channel has one destination; use Apprise API for several services at once.",
         "appriseUrl": "Apprise URL",
         "showUrl": "Show URL",
         "hideUrl": "Hide URL",
@@ -3994,6 +4014,24 @@
     }
   },
   "backup": {
+    "storageRetention": {
+      "useDefault": "Use the Proxmox default (no policy on this storage)",
+      "title": "Storage retention",
+      "keepAll": "Keep all backups",
+      "description": "Default backup retention stored in Proxmox. Backup jobs with an explicit policy override this default.",
+      "refresh": "Refresh",
+      "saved": "Storage retention saved. No pruning was run.",
+      "choosePolicy": "Choose Keep all or at least one positive retention count.",
+      "saveFailed": "Could not save storage retention. Refresh the list if the configuration changed.",
+      "loadFailed": "Could not load storage retention.",
+      "empty": "No backup storages found.",
+      "default": "Proxmox default",
+      "edit": "Edit",
+      "editTitle": "Retention for {storage}",
+      "effect": "Applies to future backup runs that inherit this storage policy. Saving does not delete existing backups. Protected backups remain protected.",
+      "cancel": "Cancel",
+      "save": "Save retention"
+    },
     "actions": {
       "addAnother": "Add another",
       "addPath": "Add path",
diff --git a/AppImage/messages/es/common.json b/AppImage/messages/es/common.json
index 9e62febc..322ea52a 100644
--- a/AppImage/messages/es/common.json
+++ b/AppImage/messages/es/common.json
@@ -660,7 +660,7 @@
         "controllerBusyTime": "Minutos totales que el controlador pasó procesando comandos de E/S. Los valores altos indican una carga de trabajo pesada y sostenida.",
         "errorLogEntries": "Número de entradas en el registro de información de errores. A menudo incluye artefactos benignos de autoevaluación; verifique con Errores de Medios.",
         "warningTempTime": "Total de minutos transcurridos por encima del umbral de temperatura de advertencia. Provoca una limitación del rendimiento. El cero es ideal.",
-        "criticalTempTime": "Minutos totales pasados ​​por encima del umbral de temperatura crítica. La unidad puede apagarse para evitar daños. Siempre debe ser cero.",
+        "criticalTempTime": "Minutos totales pasados por encima del umbral de temperatura crítica. La unidad puede apagarse para evitar daños. Siempre debe ser cero.",
         "warningCompositeTemperatureTime": "Minutos totales que la temperatura compuesta superó el umbral de advertencia.",
         "criticalCompositeTemperatureTime": "Minutos totales la temperatura compuesta superó el umbral crítico. Debe ser cero.",
         "thermalManagementT1TransCount": "Número de veces que la unidad entró en aceleración térmica ligera (T1). Indica problemas de enfriamiento.",
@@ -1163,7 +1163,21 @@
       "available": "Backups disponibles",
       "loading": "Cargando backups...",
       "empty": "No se encontraron backups",
-      "emptyHint": "Crea tu primer backup con el botón de arriba"
+      "emptyHint": "Crea tu primer backup con el botón de arriba",
+      "refresh": "Actualizar",
+      "refreshFailed": "No se pudieron actualizar los backups. Vuelve a actualizar para confirmar su estado actual.",
+      "deleteSelected": "Eliminar los seleccionados ({count})",
+      "deletedCount": "{count} backup(s) eliminado(s).",
+      "unconfirmedCount": "No se ha confirmado la eliminación de {count} backup(s). Actualiza la lista y comprueba las tareas de Proxmox antes de volver a intentarlo.",
+      "deleteFailed": "No se pudo confirmar la eliminación. Actualiza la lista y comprueba las tareas de Proxmox antes de volver a intentarlo.",
+      "selectHint": "Selecciona backups sin protección (hasta 20 por lote)",
+      "selectBackup": "Seleccionar backup",
+      "protected": "Protegido",
+      "confirmTitle": "¿Eliminar {count} backup(s)?",
+      "confirmDescription": "Los archivos de backup de la VM/CT {vmid} se eliminarán de forma permanente. Los backups protegidos quedan fuera. La VM o el contenedor no se eliminan.",
+      "deleting": "Esperando a que Proxmox termine de eliminar los archivos seleccionados…",
+      "cancel": "Cancelar",
+      "confirmDelete": "Eliminar backups"
     },
     "updatesPanel": {
       "pendingTitle": "Actualizaciones de paquetes pendientes",
@@ -1357,8 +1371,8 @@
         "sábado"
       ],
       "runSkippedStatus": "ejecución omitida",
-      "reasonStoppedContainer": "el contenedor está detenido;Se omitió la actualización programada.",
-      "reasonStoppedContainerHistorical": "el contenedor se detuvo a la hora de actualización programada."
+      "reasonStoppedContainer": "El contenedor está parado; se ha omitido la actualización programada.",
+      "reasonStoppedContainerHistorical": "El contenedor estaba parado a la hora de la actualización programada."
     },
     "cronChip": {
       "detected": "cron del host detectado",
@@ -2164,7 +2178,13 @@
         "inactiveFooter": "Habilite notificaciones para recibir alertas del sistema, de salud y de seguridad a través de los canales configurados.",
         "notificationLanguage": "Idioma de notificación",
         "selectNotificationLanguage": "Seleccione el idioma de notificación",
-        "notificationLanguageHint": "Se utiliza para notificaciones deterministas en tiempo de ejecución incluso cuando la IA está deshabilitada."
+        "notificationLanguageHint": "Se utiliza para notificaciones deterministas en tiempo de ejecución incluso cuando la IA está deshabilitada.",
+        "appriseServiceHelp": "Configuración de Slack y Matrix",
+        "appriseSlackSteps": "Crea un webhook entrante en tu aplicación de Slack para el canal de destino y pega su URL HTTPS completa en URL de Apprise. No hace falta convertirla.",
+        "appriseSlackDocs": "Formatos de URL y configuración de Slack",
+        "appriseMatrixSteps": "Utiliza una cuenta de notificaciones que pueda publicar en la sala. Sustituye el usuario, la contraseña, el servidor de origen y el ID completo de la sala del ejemplo; codifica para URL los caracteres especiales de las credenciales. El esquema matrixs utiliza HTTPS. Consulta en la documentación la compatibilidad con tokens, SSO y salas cifradas de tu versión de Apprise.",
+        "appriseMatrixDocs": "Formatos de URL y configuración de Matrix",
+        "appriseServiceFinish": "Activa Apprise, introduce tu URL, elige las categorías de notificación o los eventos individuales, guarda y utiliza Enviar prueba. Estos ejemplos no cambian tu URL guardada. Este canal de Apprise tiene un único destino; utiliza la API de Apprise para varios servicios a la vez."
       },
       "ai": {
         "title": "mejora de la IA",
@@ -3619,8 +3639,8 @@
       "short": {
         "hour": "Pasada 1 hora",
         "day": "Pasadas 24h",
-        "week": "Pasados ​​los 7 días",
-        "month": "Pasados ​​los 30 días",
+        "week": "Pasados los 7 días",
+        "month": "Pasados los 30 días",
         "year": "Último 1 año"
       },
       "last": {
@@ -4809,6 +4829,24 @@
       "thursday": "Jueves",
       "tuesday": "Martes",
       "wednesday": "Miércoles"
+    },
+    "storageRetention": {
+      "useDefault": "Usar el valor por defecto de Proxmox (sin política en este almacenamiento)",
+      "title": "Retención del almacenamiento",
+      "keepAll": "Conservar todos los backups",
+      "description": "Retención por defecto de los backups, guardada en Proxmox. Las tareas de backup con su propia política tienen prioridad sobre ella.",
+      "refresh": "Actualizar",
+      "saved": "Retención guardada. No se ha purgado ningún backup.",
+      "choosePolicy": "Elige Conservar todos o al menos un número de retención mayor que cero.",
+      "saveFailed": "No se pudo guardar la retención del almacenamiento. Actualiza la lista si ha cambiado la configuración.",
+      "loadFailed": "No se pudo cargar la retención del almacenamiento.",
+      "empty": "No hay almacenamientos de backups.",
+      "default": "Valor por defecto de Proxmox",
+      "edit": "Editar",
+      "editTitle": "Retención de {storage}",
+      "effect": "Se aplica a los próximos backups que hereden la política de este almacenamiento. Guardar no elimina los backups existentes, y los protegidos siguen protegidos.",
+      "cancel": "Cancelar",
+      "save": "Guardar retención"
     }
   },
   "healthStatus": {
diff --git a/AppImage/messages/fr/common.json b/AppImage/messages/fr/common.json
index 3304918a..7dea3a29 100644
--- a/AppImage/messages/fr/common.json
+++ b/AppImage/messages/fr/common.json
@@ -1110,7 +1110,21 @@
       "available": "Sauvegardes disponibles",
       "loading": "Chargement des sauvegardes...",
       "empty": "Aucune sauvegarde trouvée",
-      "emptyHint": "Créez votre première sauvegarde en utilisant le bouton ci-dessus"
+      "emptyHint": "Créez votre première sauvegarde en utilisant le bouton ci-dessus",
+      "refresh": "Actualiser",
+      "refreshFailed": "Impossible d'actualiser les sauvegardes. Actualisez à nouveau pour confirmer leur état actuel.",
+      "deleteSelected": "Supprimer la sélection ({count})",
+      "deletedCount": "{count} sauvegarde(s) supprimée(s).",
+      "unconfirmedCount": "La suppression de {count} sauvegarde(s) n'a pas été confirmée. Actualisez la liste et vérifiez les tâches Proxmox avant de réessayer.",
+      "deleteFailed": "La suppression n'a pas pu être confirmée. Actualisez la liste et vérifiez les tâches Proxmox avant de réessayer.",
+      "selectHint": "Sélectionnez les sauvegardes non protégées (jusqu'à 20 par lot)",
+      "selectBackup": "Sélectionner la sauvegarde",
+      "protected": "Protégée",
+      "confirmTitle": "Supprimer {count} sauvegarde(s) ?",
+      "confirmDescription": "Ces archives de sauvegarde de la VM/CT {vmid} seront définitivement supprimées. Les sauvegardes protégées sont exclues. Cela ne supprime pas l'invité.",
+      "deleting": "En attente de la fin de la suppression des archives sélectionnées par Proxmox…",
+      "cancel": "Annuler",
+      "confirmDelete": "Supprimer les sauvegardes"
     },
     "updatesPanel": {
       "pendingTitle": "Mises à jour des packages en attente",
@@ -1304,8 +1318,8 @@
         "Samedi"
       ],
       "runSkippedStatus": "exécution ignorée",
-      "reasonStoppedContainer": "le conteneur est arrêté ;la mise à jour programmée a été ignorée.",
-      "reasonStoppedContainerHistorical": "le conteneur a été arrêté à l'heure de mise à jour prévue."
+      "reasonStoppedContainer": "Le conteneur est arrêté ; la mise à jour programmée a été ignorée.",
+      "reasonStoppedContainerHistorical": "Le conteneur était arrêté à l'heure de la mise à jour programmée."
     },
     "cronChip": {
       "detected": "cron hôte détecté",
@@ -2111,7 +2125,13 @@
         "inactiveFooter": "Activez les notifications pour recevoir des alertes système, de santé et de sécurité via les canaux configurés.",
         "notificationLanguage": "Langue de notification",
         "selectNotificationLanguage": "Sélectionnez la langue de notification",
-        "notificationLanguageHint": "Utilisé pour les notifications d'exécution déterministes, même lorsque l'IA est désactivée."
+        "notificationLanguageHint": "Utilisé pour les notifications d'exécution déterministes, même lorsque l'IA est désactivée.",
+        "appriseServiceHelp": "Configuration de Slack et Matrix",
+        "appriseSlackSteps": "Créez un webhook entrant dans votre application Slack pour le canal cible, puis collez son URL HTTPS complète dans le champ URL Apprise. Aucune conversion n'est nécessaire.",
+        "appriseSlackDocs": "Formats d'URL et configuration de Slack",
+        "appriseMatrixSteps": "Utilisez un compte de notification autorisé à publier dans le salon. Remplacez l'utilisateur, le mot de passe, le serveur d'origine et l'identifiant complet du salon de l'exemple ; encodez les caractères spéciaux des identifiants pour les URL. Le schéma matrixs utilise HTTPS. Consultez la documentation pour la prise en charge des jetons, du SSO et des salons chiffrés dans votre version d'Apprise.",
+        "appriseMatrixDocs": "Formats d'URL et configuration de Matrix",
+        "appriseServiceFinish": "Activez Apprise, saisissez votre URL, choisissez les catégories de notification ou les événements individuels, enregistrez, puis utilisez Envoyer un test. Ces exemples ne modifient pas votre URL enregistrée. Ce canal Apprise possède une destination ; utilisez l'API Apprise pour plusieurs services à la fois."
       },
       "ai": {
         "title": "Amélioration de l'IA",
@@ -4756,6 +4776,24 @@
       "thursday": "Jeudi",
       "tuesday": "Mardi",
       "wednesday": "Mercredi"
+    },
+    "storageRetention": {
+      "title": "Rétention du stockage",
+      "keepAll": "Conserver toutes les sauvegardes",
+      "description": "Rétention par défaut des sauvegardes enregistrée dans Proxmox. Les tâches de sauvegarde avec une politique explicite remplacent cette valeur par défaut.",
+      "refresh": "Actualiser",
+      "saved": "Rétention du stockage enregistrée. Aucune purge n'a été exécutée.",
+      "choosePolicy": "Choisissez Tout conserver ou au moins un nombre de rétention supérieur à zéro.",
+      "saveFailed": "Impossible d'enregistrer la rétention du stockage. Actualisez la liste si la configuration a changé.",
+      "loadFailed": "Impossible de charger la rétention du stockage.",
+      "empty": "Aucun stockage de sauvegarde trouvé.",
+      "default": "Valeur par défaut de Proxmox",
+      "edit": "Modifier",
+      "editTitle": "Rétention de {storage}",
+      "effect": "S'applique aux futures sauvegardes qui héritent de cette politique de stockage. L'enregistrement ne supprime pas les sauvegardes existantes. Les sauvegardes protégées restent protégées.",
+      "cancel": "Annuler",
+      "save": "Enregistrer la rétention",
+      "useDefault": "Utiliser la valeur par défaut de Proxmox (aucune politique sur ce stockage)"
     }
   },
   "healthStatus": {
diff --git a/AppImage/messages/it/common.json b/AppImage/messages/it/common.json
index 19c8cecc..9fb2d83e 100644
--- a/AppImage/messages/it/common.json
+++ b/AppImage/messages/it/common.json
@@ -1110,7 +1110,21 @@
       "available": "Backup disponibili",
       "loading": "Caricamento backup...",
       "empty": "Nessun backup trovato",
-      "emptyHint": "Crea il primo backup con il pulsante in alto"
+      "emptyHint": "Crea il primo backup con il pulsante in alto",
+      "refresh": "Aggiorna",
+      "refreshFailed": "Impossibile aggiornare i backup. Aggiorna di nuovo per confermarne lo stato attuale.",
+      "deleteSelected": "Elimina selezionati ({count})",
+      "deletedCount": "{count} backup eliminati.",
+      "unconfirmedCount": "L'eliminazione di {count} backup non è stata confermata. Aggiorna l'elenco e controlla le attività di Proxmox prima di riprovare.",
+      "deleteFailed": "Impossibile confermare l'eliminazione. Aggiorna l'elenco e controlla le attività di Proxmox prima di riprovare.",
+      "selectHint": "Seleziona i backup non protetti (fino a 20 per gruppo)",
+      "selectBackup": "Seleziona backup",
+      "protected": "Protetto",
+      "confirmTitle": "Eliminare {count} backup?",
+      "confirmDescription": "Questi archivi di backup della VM/CT {vmid} verranno eliminati definitivamente. I backup protetti sono esclusi. Questo non elimina l'ospite.",
+      "deleting": "In attesa che Proxmox termini l'eliminazione degli archivi selezionati…",
+      "cancel": "Annulla",
+      "confirmDelete": "Elimina backup"
     },
     "updatesPanel": {
       "pendingTitle": "Aggiornamenti pacchetti in sospeso",
@@ -1303,9 +1317,9 @@
         "Venerdì",
         "Sabato"
       ],
-      "runSkippedStatus": "corsa saltata",
-      "reasonStoppedContainer": "il contenitore è fermo;l'aggiornamento pianificato è stato saltato.",
-      "reasonStoppedContainerHistorical": "il contenitore è stato arrestato all'ora di aggiornamento pianificata."
+      "runSkippedStatus": "esecuzione saltata",
+      "reasonStoppedContainer": "Il contenitore è fermo; l'aggiornamento pianificato è stato saltato.",
+      "reasonStoppedContainerHistorical": "Il contenitore era fermo all'ora dell'aggiornamento pianificato."
     },
     "cronChip": {
       "detected": "cron host rilevato",
@@ -2111,7 +2125,13 @@
         "inactiveFooter": "Abilita le notifiche per ricevere avvisi di sistema, integrità e sicurezza attraverso i canali configurati.",
         "notificationLanguage": "Lingua notifiche",
         "selectNotificationLanguage": "Seleziona lingua notifiche",
-        "notificationLanguageHint": "Usata per le notifiche runtime deterministiche anche quando l’IA è disabilitata."
+        "notificationLanguageHint": "Usata per le notifiche runtime deterministiche anche quando l’IA è disabilitata.",
+        "appriseServiceHelp": "Configurazione di Slack e Matrix",
+        "appriseSlackSteps": "Crea un webhook in ingresso nell'app Slack per il canale di destinazione, quindi incolla il suo URL HTTPS completo nel campo URL di Apprise. Non è necessaria alcuna conversione.",
+        "appriseSlackDocs": "Formati URL e configurazione di Slack",
+        "appriseMatrixSteps": "Usa un account di notifica autorizzato a pubblicare nella stanza. Sostituisci utente, password, homeserver e ID completo della stanza dell'esempio; codifica per URL i caratteri speciali nelle credenziali. Lo schema matrixs usa HTTPS. Consulta la documentazione per il supporto di token, SSO e stanze cifrate nella versione di Apprise installata.",
+        "appriseMatrixDocs": "Formati URL e configurazione di Matrix",
+        "appriseServiceFinish": "Abilita Apprise, inserisci il tuo URL, scegli le categorie di notifica o i singoli eventi, salva e poi usa Invia test. Questi esempi non modificano l'URL salvato. Questo canale Apprise ha una sola destinazione; usa l'API Apprise per più servizi contemporaneamente."
       },
       "ai": {
         "title": "Miglioramento con IA",
@@ -4756,6 +4776,24 @@
       "thursday": "Giovedì",
       "tuesday": "Martedì",
       "wednesday": "Mercoledì"
+    },
+    "storageRetention": {
+      "title": "Conservazione dell'archiviazione",
+      "keepAll": "Mantieni tutti i backup",
+      "description": "Conservazione predefinita dei backup salvata in Proxmox. Le attività di backup con una politica esplicita hanno la precedenza su questo valore.",
+      "refresh": "Aggiorna",
+      "saved": "Politica di conservazione dell'archiviazione salvata. Non è stata eseguita alcuna pulizia.",
+      "choosePolicy": "Scegli Mantieni tutti oppure almeno un numero di conservazione maggiore di zero.",
+      "saveFailed": "Impossibile salvare la politica di conservazione dell'archiviazione. Aggiorna l'elenco se la configurazione è cambiata.",
+      "loadFailed": "Impossibile caricare la politica di conservazione dell'archiviazione.",
+      "empty": "Nessuno spazio di archiviazione dei backup trovato.",
+      "default": "Valore predefinito di Proxmox",
+      "edit": "Modifica",
+      "editTitle": "Conservazione per {storage}",
+      "effect": "Si applica alle future esecuzioni dei backup che ereditano questa politica di archiviazione. Il salvataggio non elimina i backup esistenti. I backup protetti rimangono protetti.",
+      "cancel": "Annulla",
+      "save": "Salva conservazione",
+      "useDefault": "Usa l'impostazione predefinita di Proxmox (nessuna policy su questo storage)"
     }
   },
   "healthStatus": {
diff --git a/AppImage/messages/pt/common.json b/AppImage/messages/pt/common.json
index b2ec6909..d60c1806 100644
--- a/AppImage/messages/pt/common.json
+++ b/AppImage/messages/pt/common.json
@@ -353,7 +353,7 @@
       "downloadJson": "Baixar JSON",
       "delete": "Excluir",
       "confirmDelete": "Excluir este registro de teste?",
-      "note": "Os resultados dos testes são armazenados localmente e usados ​​para gerar relatórios SMART detalhados."
+      "note": "Os resultados dos testes são armazenados localmente e usados para gerar relatórios SMART detalhados."
     },
     "smartReport": {
       "title": "Relatório de saúde SMART",
@@ -595,8 +595,8 @@
         "availableSpare": "Porcentagem de blocos NAND sobressalentes restantes para substituição de blocos defeituosos. Um alerta é acionado abaixo do limite.",
         "availableSpareThreshold": "Mínimo definido pelo fabricante para peças sobressalentes disponíveis. Abaixo disso, a unidade sinaliza um aviso crítico.",
         "percentageUsed": "Impulsione a estimativa da resistência consumida com base nos ciclos de gravação reais versus nominais. 100% significa que o TBW avaliado foi atingido; a unidade pode continuar funcionando além disso.",
-        "mediaErrors": "Erros de leitura/gravação irrecuperáveis ​​no flash NAND. Qualquer valor diferente de zero indica dano celular permanente. Contagem crescente significa substituição em breve.",
-        "mediaIntegrityErrors": "Erros irrecuperáveis ​​detectados pelo controlador. Diferente de zero significa risco de corrupção de dados.",
+        "mediaErrors": "Erros de leitura/gravação irrecuperáveis no flash NAND. Qualquer valor diferente de zero indica dano celular permanente. Contagem crescente significa substituição em breve.",
+        "mediaIntegrityErrors": "Erros irrecuperáveis detectados pelo controlador. Diferente de zero significa risco de corrupção de dados.",
         "unsafeShutdowns": "Perdas de energia sem descarga ou desligamento adequado. Contagens muito altas correm o risco de corrupção de metadados e problemas de firmware.",
         "nvmePowerCycles": "Ciclos totais de ligar/desligar. A ciclagem frequente aumenta o desgaste do conector e do capacitor.",
         "nvmePowerOnHours": "Total de horas acumuladas em que o inversor esteve ligado desde a fabricação.",
@@ -624,7 +624,7 @@
         "reallocatedSectorCount": "Setores defeituosos substituídos por setores sobressalentes do pool de reserva. Uma contagem crescente significa degradação da unidade.",
         "retiredBlockCount": "Blocos NAND retirados devido a desgaste ou falha (SSD). Semelhante à contagem de setores realocados para HDDs.",
         "reallocatedEventCount": "Número de operações de remapeamento realizadas. Cada evento significa que um setor defeituoso foi substituído.",
-        "currentPendingSector": "Setores instáveis ​​esperando para serem remapeados na próxima gravação. Eles podem ser resolvidos ou serem realocados permanentemente.",
+        "currentPendingSector": "Setores instáveis esperando para serem remapeados na próxima gravação. Eles podem ser resolvidos ou serem realocados permanentemente.",
         "pendingSectors": "Setores esperando para serem remapeados. Eles podem ser resolvidos ou realocados.",
         "offlineUncorrectable": "Setores que falharam durante a verificação offline e não puderam ser corrigidos. Indica possível perda de dados.",
         "offlineUncorrectableSectorCount": "Setores incorrigíveis encontrados durante a verificação em segundo plano. Os dados sobre estes setores são perdidos.",
@@ -667,7 +667,7 @@
         "endToEndError": "Corrupção de dados detectada entre o cache do controlador e a interface do host. Deve ser sempre zero.",
         "endToEndErrorDetectionCount": "Número de erros de paridade no caminho de dados. Diferente de zero indica problemas no controlador.",
         "wearLevelingCount": "Média de ciclos de apagamento por bloco NAND (SSD). VALOR mais baixo significa mais desgaste consumido.",
-        "wearRangeDelta": "Diferença entre blocos mais usados ​​e menos usados ​​(SSD). Valores altos indicam desgaste irregular.",
+        "wearRangeDelta": "Diferença entre blocos mais usados e menos usados (SSD). Valores altos indicam desgaste irregular.",
         "mediaWearoutIndicator": "Estimativa de vida útil restante do SSD Intel. Começa em 100 e diminui para 0 conforme a resistência é consumida.",
         "ssdLifeLeft": "Porcentagem estimada de vida útil restante do SSD com base no desgaste da NAND.",
         "percentLifetimeRemain": "Porcentagem estimada de vida útil restante. 100 significa novo; 0 significa fim da vida útil nominal.",
@@ -744,7 +744,7 @@
         "nvmeWarningTitle": "Aviso crítico NVMe ativo (0x{value})",
         "nvmeWarningText": "O controlador NVMe gerou um alerta. Faça backup dos dados imediatamente e investigue mais a fundo.",
         "nvmeMediaTitle": "Erros de mídia NVMe detectados ({count})",
-        "nvmeMediaText": "Erros irrecuperáveis ​​de flash NAND indicam danos físicos. Faça backup dos dados e planeje a substituição.",
+        "nvmeMediaText": "Erros irrecuperáveis de flash NAND indicam danos físicos. Faça backup dos dados e planeje a substituição.",
         "unsafeTitle": "Contagem alta de desligamentos inseguros ({count})",
         "unsafeText": "Perdas frequentes de energia aumentam o risco de corrupção do firmware. Garanta energia estável ou use um UPS.",
         "seagateTitle": "Seagate Raw_Read_Error_Rate - Comportamento normal",
@@ -1110,7 +1110,21 @@
       "available": "Backups disponíveis",
       "loading": "Carregando backups...",
       "empty": "Nenhum backup encontrado",
-      "emptyHint": "Crie seu primeiro backup usando o botão acima"
+      "emptyHint": "Crie seu primeiro backup usando o botão acima",
+      "refresh": "Atualizar",
+      "refreshFailed": "Não foi possível atualizar as cópias de segurança. Atualize novamente para confirmar o seu estado atual.",
+      "deleteSelected": "Eliminar selecionadas ({count})",
+      "deletedCount": "{count} cópia(s) de segurança eliminada(s).",
+      "unconfirmedCount": "A eliminação de {count} cópia(s) de segurança não foi confirmada. Atualize a lista e verifique as tarefas do Proxmox antes de tentar novamente.",
+      "deleteFailed": "Não foi possível confirmar a eliminação. Atualize a lista e verifique as tarefas do Proxmox antes de tentar novamente.",
+      "selectHint": "Selecione cópias de segurança sem proteção (até 20 por lote)",
+      "selectBackup": "Selecionar cópia de segurança",
+      "protected": "Protegida",
+      "confirmTitle": "Eliminar {count} cópia(s) de segurança?",
+      "confirmDescription": "Estes arquivos de cópia de segurança da VM/CT {vmid} serão eliminados permanentemente. As cópias protegidas estão excluídas. Isto não elimina o convidado.",
+      "deleting": "À espera que o Proxmox termine de eliminar os arquivos selecionados…",
+      "cancel": "Cancelar",
+      "confirmDelete": "Eliminar cópias de segurança"
     },
     "updatesPanel": {
       "pendingTitle": "Atualizações de pacote pendentes",
@@ -1304,8 +1318,8 @@
         "Sábado"
       ],
       "runSkippedStatus": "execução ignorada",
-      "reasonStoppedContainer": "Container está parado;a atualização agendada foi ignorada.",
-      "reasonStoppedContainerHistorical": "o contêiner foi interrompido no horário de atualização agendado."
+      "reasonStoppedContainer": "O contêiner está parado; a atualização agendada foi ignorada.",
+      "reasonStoppedContainerHistorical": "O contêiner estava parado no horário da atualização agendada."
     },
     "cronChip": {
       "detected": "cron do host detectado",
@@ -1771,7 +1785,7 @@
     },
     "healthMonitor": {
       "title": "Monitor de Saúde",
-      "description": "Configure por quanto tempo os alertas dispensados ​​permanecem ocultos para cada categoria. As alterações se aplicam a alertas ignorados existentes e futuros.",
+      "description": "Configure por quanto tempo os alertas dispensados permanecem ocultos para cada categoria. As alterações se aplicam a alertas ignorados existentes e futuros.",
       "category": "Categoria",
       "suppressionDuration": "Duração da Supressão",
       "hours": "Horas",
@@ -1781,7 +1795,7 @@
       "footerNote": "Essas configurações se aplicam quando você descarta um aviso do Health Monitor. Alertas críticos de temperatura da CPU sempre aparecem para proteger seu hardware.",
       "activeSuppressions": "Supressões Ativas",
       "activeSuppressionsDescription": "Alertas que você ocultou do Health Monitor. As demissões permanentes só podem ser revertidas aqui. A edição requer o Health Monitor",
-      "noActiveSuppressions": "Sem supressões ativas. Os alertas dispensados ​​do Health Monitor aparecerão aqui.",
+      "noActiveSuppressions": "Sem supressões ativas. Os alertas dispensados do Health Monitor aparecerão aqui.",
       "permanent": "Permanente",
       "daysRemaining": "{count}d restantes",
       "hoursRemaining": "{count}h restantes",
@@ -2111,7 +2125,13 @@
         "inactiveFooter": "Habilite notificações para receber alertas de sistema, integridade e segurança por meio dos canais configurados.",
         "notificationLanguage": "Idioma de notificação",
         "selectNotificationLanguage": "Selecione o idioma de notificação",
-        "notificationLanguageHint": "Usado para notificações determinísticas de tempo de execução, mesmo quando a IA está desabilitada."
+        "notificationLanguageHint": "Usado para notificações determinísticas de tempo de execução, mesmo quando a IA está desabilitada.",
+        "appriseServiceHelp": "Configuração do Slack e do Matrix",
+        "appriseSlackSteps": "Crie um webhook de entrada na sua aplicação Slack para o canal de destino e cole o seu URL HTTPS completo no campo URL do Apprise. Não é necessária qualquer conversão.",
+        "appriseSlackDocs": "Formatos de URL e configuração do Slack",
+        "appriseMatrixSteps": "Utilize uma conta de notificações que possa publicar na sala. Substitua o utilizador, a palavra-passe, o homeserver e o ID completo da sala do exemplo; codifique os caracteres especiais das credenciais para URL. O esquema matrixs usa HTTPS. Consulte a documentação sobre o suporte de tokens, SSO e salas cifradas na versão do Apprise instalada.",
+        "appriseMatrixDocs": "Formatos de URL e configuração do Matrix",
+        "appriseServiceFinish": "Ative o Apprise, introduza o seu URL, escolha as categorias de notificação ou os eventos individuais, guarde e utilize Enviar teste. Estes exemplos não alteram o URL guardado. Este canal do Apprise tem um destino; utilize a API do Apprise para vários serviços em simultâneo."
       },
       "ai": {
         "title": "Aprimoramento de IA",
@@ -3567,7 +3587,7 @@
         "hour": "Passada 1h",
         "day": "Passadas 24 horas",
         "week": "Passado 7 dias",
-        "month": "Passados ​​30 dias",
+        "month": "Passados 30 dias",
         "year": "Último 1 ano"
       },
       "last": {
@@ -4019,7 +4039,7 @@
     },
     "backends": {
       "borgDescription": "Repositório Borg para backups de host desduplicados.",
-      "borgDescriptionTimerOnly": "Os destinos Borg são usados ​​pelos temporizadores do Monitor, não pelos trabalhos PVE vzdump.",
+      "borgDescriptionTimerOnly": "Os destinos Borg são usados pelos temporizadores do Monitor, não pelos trabalhos PVE vzdump.",
       "borgShortDescription": "Repositório Borg desduplicado",
       "local": "Local",
       "localDescription": "Pasta neste host ou em uma unidade USB montada.",
@@ -4547,7 +4567,7 @@
       "customPickDescriptionMiddle": "através do",
       "destructiveTitle": "A restauração completa REMOVERÁ o seguinte (criado após o backup)",
       "noPathsMatch": "Nenhum caminho corresponde ao filtro.",
-      "noRestorablePaths": "Este backup não contém caminhos restauráveis ​​— apenas a restauração completa é significativa aqui.",
+      "noRestorablePaths": "Este backup não contém caminhos restauráveis — apenas a restauração completa é significativa aqui.",
       "olderThanTargetKernel": "é mais antigo que o kernel alvo",
       "operatorConfigDescription": "As seguintes configurações criadas pelo operador serão mescladas no destino automaticamente, sem alterar os padrões vinculados ao kernel. É executado na restauração completa e personalizada.",
       "operatorConfigTitle": "Configuração do operador reaplicada por meio de mesclagem independente de kernel",
@@ -4756,6 +4776,24 @@
       "thursday": "Quinta-feira",
       "tuesday": "Terça-feira",
       "wednesday": "Quarta-feira"
+    },
+    "storageRetention": {
+      "title": "Retenção do armazenamento",
+      "keepAll": "Manter todas as cópias de segurança",
+      "description": "Retenção predefinida de cópias de segurança guardada no Proxmox. As tarefas de cópia com uma política explícita substituem este valor predefinido.",
+      "refresh": "Atualizar",
+      "saved": "Retenção do armazenamento guardada. Não foi executada nenhuma limpeza.",
+      "choosePolicy": "Escolha Manter todas ou pelo menos uma quantidade de retenção superior a zero.",
+      "saveFailed": "Não foi possível guardar a retenção do armazenamento. Atualize a lista se a configuração tiver mudado.",
+      "loadFailed": "Não foi possível carregar a retenção do armazenamento.",
+      "empty": "Não foram encontrados armazenamentos de cópias de segurança.",
+      "default": "Predefinição do Proxmox",
+      "edit": "Editar",
+      "editTitle": "Retenção para {storage}",
+      "effect": "Aplica-se às futuras cópias de segurança que herdem esta política de armazenamento. Guardar não elimina as cópias existentes. As cópias protegidas permanecem protegidas.",
+      "cancel": "Cancelar",
+      "save": "Guardar retenção",
+      "useDefault": "Use o padrão Proxmox (nenhuma política neste armazenamento)"
     }
   },
   "healthStatus": {
@@ -4912,7 +4950,7 @@
     },
     "noIssues": "Nenhum problema detectado",
     "updateNow": "Atualizar agora",
-    "dismissedItems": "Itens dispensados ​​({count})",
+    "dismissedItems": "Itens dispensados ({count})",
     "permanent": "Permanente",
     "dismissed": "Dispensado",
     "wasStatus": "era {status}",
diff --git a/AppImage/messages/sk/common.json b/AppImage/messages/sk/common.json
index ca64c6fe..692fcce6 100644
--- a/AppImage/messages/sk/common.json
+++ b/AppImage/messages/sk/common.json
@@ -1131,7 +1131,21 @@
       "available": "Dostupné zálohy",
       "loading": "Načítavam zálohy...",
       "empty": "Nenašli sa žiadne zálohy",
-      "emptyHint": "Prvú zálohu vytvoríte tlačidlom vyššie"
+      "emptyHint": "Prvú zálohu vytvoríte tlačidlom vyššie",
+      "refresh": "Obnoviť",
+      "refreshFailed": "Nepodarilo sa obnoviť zálohy. Obnovte ich znova, aby ste potvrdili ich aktuálny stav.",
+      "deleteSelected": "Odstrániť vybrané ({count})",
+      "deletedCount": "Odstránené zálohy: {count}.",
+      "unconfirmedCount": "Odstránenie záloh ({count}) nebolo potvrdené. Pred ďalším pokusom obnovte zoznam a skontrolujte úlohy v Proxmoxe.",
+      "deleteFailed": "Odstránenie sa nepodarilo potvrdiť. Pred ďalším pokusom obnovte zoznam a skontrolujte úlohy v Proxmoxe.",
+      "selectHint": "Vyberte nechránené zálohy (najviac 20 v jednej dávke)",
+      "selectBackup": "Vybrať zálohu",
+      "protected": "Chránená",
+      "confirmTitle": "Odstrániť zálohy ({count})?",
+      "confirmDescription": "Tieto archívy záloh pre VM/CT {vmid} budú natrvalo odstránené. Chránené zálohy sú vylúčené. Hosť sa tým neodstráni.",
+      "deleting": "Čaká sa, kým Proxmox dokončí odstránenie vybraných archívov…",
+      "cancel": "Zrušiť",
+      "confirmDelete": "Odstrániť zálohy"
     },
     "updatesPanel": {
       "pendingTitle": "Čakajúce aktualizácie balíkov",
@@ -2110,7 +2124,13 @@
         "inactiveFooter": "Zapnite notifikácie a dostávajte upozornenia o systéme, stave a bezpečnosti cez nastavené kanály.",
         "notificationLanguage": "Jazyk notifikácií",
         "selectNotificationLanguage": "Vyberte jazyk notifikácií",
-        "notificationLanguageHint": "Používa sa pre spoľahlivé runtime notifikácie aj vtedy, keď je AI vypnutá."
+        "notificationLanguageHint": "Používa sa pre spoľahlivé runtime notifikácie aj vtedy, keď je AI vypnutá.",
+        "appriseServiceHelp": "Nastavenie Slack a Matrix",
+        "appriseSlackSteps": "V aplikácii Slack vytvorte prichádzajúci webhook pre cieľový kanál a vložte jeho úplnú HTTPS URL do poľa URL Apprise. Nie je potrebný žiadny prevod.",
+        "appriseSlackDocs": "Formáty URL a nastavenie Slack",
+        "appriseMatrixSteps": "Použite účet pre oznámenia, ktorý môže odosielať správy do miestnosti. Nahraďte vzorového používateľa, heslo, domovský server a úplné ID miestnosti; špeciálne znaky v prihlasovacích údajoch zakódujte pre URL. Schéma matrixs používa HTTPS. Podporu tokenov, SSO a šifrovaných miestností v nainštalovanej verzii Apprise nájdete v dokumentácii.",
+        "appriseMatrixDocs": "Formáty URL a nastavenie Matrix",
+        "appriseServiceFinish": "Povoľte Apprise, zadajte svoju URL, vyberte kategórie oznámení alebo jednotlivé udalosti, uložte a potom použite Odoslať test. Tieto príklady nemenia uloženú URL. Tento kanál Apprise má jeden cieľ; pre viac služieb naraz použite API Apprise."
       },
       "ai": {
         "title": "AI vylepšenie",
@@ -4755,6 +4775,24 @@
       "thursday": "štvrtok",
       "tuesday": "utorok",
       "wednesday": "streda"
+    },
+    "storageRetention": {
+      "title": "Uchovávanie záloh úložiska",
+      "keepAll": "Ponechať všetky zálohy",
+      "description": "Predvolená politika uchovávania záloh uložená v Proxmoxe. Zálohovacie úlohy s vlastnou politikou majú pred týmto predvoleným nastavením prednosť.",
+      "refresh": "Obnoviť",
+      "saved": "Politika uchovávania záloh úložiska bola uložená. Prerezávanie sa nevykonalo.",
+      "choosePolicy": "Vyberte Ponechať všetky alebo aspoň jeden počet uchovávaných záloh väčší ako nula.",
+      "saveFailed": "Nepodarilo sa uložiť politiku uchovávania záloh úložiska. Ak sa konfigurácia zmenila, obnovte zoznam.",
+      "loadFailed": "Nepodarilo sa načítať politiku uchovávania záloh úložiska.",
+      "empty": "Nenašli sa žiadne úložiská záloh.",
+      "default": "Predvolené nastavenie Proxmoxu",
+      "edit": "Upraviť",
+      "editTitle": "Uchovávanie záloh pre {storage}",
+      "effect": "Platí pre budúce zálohovania, ktoré preberajú túto politiku úložiska. Uložením sa existujúce zálohy neodstránia. Chránené zálohy zostanú chránené.",
+      "cancel": "Zrušiť",
+      "save": "Uložiť uchovávanie záloh",
+      "useDefault": "Použite predvolené nastavenie Proxmox (žiadne pravidlá pre toto úložisko)"
     }
   },
   "healthStatus": {
diff --git a/AppImage/messages/sv/common.json b/AppImage/messages/sv/common.json
index cc5121a9..5a74449a 100644
--- a/AppImage/messages/sv/common.json
+++ b/AppImage/messages/sv/common.json
@@ -1110,7 +1110,21 @@
       "available": "Tillgängliga säkerhetskopior",
       "loading": "Laddar säkerhetskopior...",
       "empty": "Inga säkerhetskopior hittades",
-      "emptyHint": "Skapa din första säkerhetskopia med knappen ovan"
+      "emptyHint": "Skapa din första säkerhetskopia med knappen ovan",
+      "refresh": "Uppdatera",
+      "refreshFailed": "Det gick inte att uppdatera säkerhetskopiorna. Uppdatera igen för att bekräfta deras aktuella tillstånd.",
+      "deleteSelected": "Ta bort markerade ({count})",
+      "deletedCount": "{count} säkerhetskopior har tagits bort.",
+      "unconfirmedCount": "Borttagning av {count} säkerhetskopior har inte bekräftats. Uppdatera listan och kontrollera Proxmox uppgifter innan du försöker igen.",
+      "deleteFailed": "Borttagningen kunde inte bekräftas. Uppdatera listan och kontrollera Proxmox uppgifter innan du försöker igen.",
+      "selectHint": "Välj oskyddade säkerhetskopior (upp till 20 per omgång)",
+      "selectBackup": "Välj säkerhetskopia",
+      "protected": "Skyddad",
+      "confirmTitle": "Ta bort {count} säkerhetskopior?",
+      "confirmDescription": "Dessa säkerhetskopieringsarkiv för VM/CT {vmid} kommer att tas bort permanent. Skyddade säkerhetskopior är undantagna. Detta tar inte bort gästen.",
+      "deleting": "Väntar på att Proxmox ska slutföra borttagningen av de valda arkiven…",
+      "cancel": "Avbryt",
+      "confirmDelete": "Ta bort säkerhetskopior"
     },
     "updatesPanel": {
       "pendingTitle": "Väntande paketuppdateringar",
@@ -1303,8 +1317,8 @@
         "fredag",
         "lördag"
       ],
-      "runSkippedStatus": "kör hoppade över",
-      "reasonStoppedContainer": "Behållaren är stoppad;schemalagd uppdatering hoppades över.",
+      "runSkippedStatus": "körning överhoppad",
+      "reasonStoppedContainer": "Behållaren är stoppad; den schemalagda uppdateringen hoppades över.",
       "reasonStoppedContainerHistorical": "Behållaren stoppades vid den schemalagda uppdateringstiden."
     },
     "cronChip": {
@@ -2111,7 +2125,13 @@
         "inactiveFooter": "Aktivera aviseringar för att ta emot system-, hälso- och säkerhetsvarningar via de konfigurerade kanalerna.",
         "notificationLanguage": "Aviseringsspråk",
         "selectNotificationLanguage": "Välj språk för meddelanden",
-        "notificationLanguageHint": "Används för deterministiska körtidsmeddelanden även när AI är inaktiverat."
+        "notificationLanguageHint": "Används för deterministiska körtidsmeddelanden även när AI är inaktiverat.",
+        "appriseServiceHelp": "Konfiguration av Slack och Matrix",
+        "appriseSlackSteps": "Skapa en inkommande webhook i din Slack-app för målkanalen och klistra sedan in dess fullständiga HTTPS-URL i fältet Apprise-URL. Ingen omvandling behövs.",
+        "appriseSlackDocs": "URL-format och konfiguration för Slack",
+        "appriseMatrixSteps": "Använd ett aviseringskonto som får skicka meddelanden till rummet. Ersätt exemplets användare, lösenord, hemserver och fullständiga rums-ID; URL-koda specialtecken i inloggningsuppgifterna. Schemat matrixs använder HTTPS. Se dokumentationen för stöd för token, SSO och krypterade rum i din installerade Apprise-version.",
+        "appriseMatrixDocs": "URL-format och konfiguration för Matrix",
+        "appriseServiceFinish": "Aktivera Apprise, ange din URL, välj aviseringskategorier eller enskilda händelser, spara och använd sedan Skicka test. Dessa exempel ändrar inte din sparade URL. Denna Apprise-kanal har ett mål; använd Apprise-API för flera tjänster samtidigt."
       },
       "ai": {
         "title": "AI-förbättring",
@@ -4756,6 +4776,24 @@
       "thursday": "torsdag",
       "tuesday": "tisdag",
       "wednesday": "onsdag"
+    },
+    "storageRetention": {
+      "title": "Lagringens bevarandepolicy",
+      "keepAll": "Behåll alla säkerhetskopior",
+      "description": "Standardpolicy för bevarande av säkerhetskopior, sparad i Proxmox. Säkerhetskopieringsjobb med en uttrycklig policy åsidosätter denna standard.",
+      "refresh": "Uppdatera",
+      "saved": "Lagringens bevarandepolicy har sparats. Ingen gallring har körts.",
+      "choosePolicy": "Välj Behåll alla eller minst ett bevarandeantal som är större än noll.",
+      "saveFailed": "Det gick inte att spara lagringens bevarandepolicy. Uppdatera listan om konfigurationen har ändrats.",
+      "loadFailed": "Det gick inte att läsa in lagringens bevarandepolicy.",
+      "empty": "Ingen lagring för säkerhetskopior hittades.",
+      "default": "Proxmox standard",
+      "edit": "Redigera",
+      "editTitle": "Bevarande för {storage}",
+      "effect": "Gäller framtida säkerhetskopieringar som ärver denna lagringspolicy. Att spara tar inte bort befintliga säkerhetskopior. Skyddade säkerhetskopior förblir skyddade.",
+      "cancel": "Avbryt",
+      "save": "Spara bevarandepolicy",
+      "useDefault": "Använd Proxmox-standard (ingen policy för denna lagring)"
     }
   },
   "healthStatus": {
diff --git a/AppImage/scripts/build_appimage.sh b/AppImage/scripts/build_appimage.sh
index a932ec90..ea1f497e 100755
--- a/AppImage/scripts/build_appimage.sh
+++ b/AppImage/scripts/build_appimage.sh
@@ -184,6 +184,7 @@ done
 cp "$SCRIPT_DIR/oci_manager.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  oci_manager.py not found"
 cp "$SCRIPT_DIR/flask_oci_routes.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  flask_oci_routes.py not found"
 cp "$SCRIPT_DIR/flask_vm_backup_routes.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  flask_vm_backup_routes.py not found"
+cp "$SCRIPT_DIR/guest_backup_archives.py" "$APP_DIR/usr/bin/"
 cp "$SCRIPT_DIR/flask_audit_routes.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  flask_audit_routes.py not found"
 cp "$SCRIPT_DIR/audit_store.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  audit_store.py not found"
 cp "$SCRIPT_DIR/audit_checks.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  audit_checks.py not found"
diff --git a/AppImage/scripts/flask_proxmenux_routes.py b/AppImage/scripts/flask_proxmenux_routes.py
index 48da2fbe..a5fa8266 100644
--- a/AppImage/scripts/flask_proxmenux_routes.py
+++ b/AppImage/scripts/flask_proxmenux_routes.py
@@ -35,7 +35,7 @@ TOOL_METADATA = {
     'system_utils':         {'name': 'System Utilities',                       'function': 'install_system_utils',         'version': '1.0'},
     'network_optimization': {'name': 'Network Optimizations',                 'function': 'apply_network_optimizations',  'version': '1.0'},
     'bashrc_custom':        {'name': 'Bashrc Customization',                  'function': 'customize_bashrc',             'version': '1.0'},
-    'figurine':             {'name': 'Figurine',                              'function': 'configure_figurine',           'version': '1.0'},
+    'figurine':             {'name': 'Figurine',                              'function': 'configure_figurine',           'version': '1.2'},
     'fastfetch':            {'name': 'Fastfetch',                             'function': 'configure_fastfetch',          'version': '1.0'},
     'log2ram':              {'name': 'Log2ram (SSD Protection)',               'function': 'configure_log2ram',            'version': '1.0'},
     'zfs_autotrim':         {'name': 'ZFS Autotrim',                          'function': 'enable_zfs_autotrim',          'version': '1.0'},
diff --git a/AppImage/scripts/flask_server.py b/AppImage/scripts/flask_server.py
index 187b8608..9411b0ac 100644
--- a/AppImage/scripts/flask_server.py
+++ b/AppImage/scripts/flask_server.py
@@ -97,6 +97,8 @@ from flask_notification_routes import notification_bp  # noqa: E402
 from flask_oci_routes import oci_bp  # noqa: E402
 from flask_audit_routes import audit_bp  # noqa: E402
 from flask_vm_backup_routes import vm_backup_bp  # noqa: E402
+from guest_backup_archives import (BackupArchiveError, delete_guest_backups,
+                                   guest_backup_deletion_status)  # noqa: E402
 from notification_manager import notification_manager, resolve_notification_hostname  # noqa: E402
 import post_install_versions  # noqa: E402  — Sprint 12A: detect post-install function updates
 from jwt_middleware import require_auth, require_auth_or_ticket, require_admin_scope  # noqa: E402
@@ -13309,6 +13311,32 @@ def api_create_backup(vmid):
     except Exception as e:
         return jsonify({'error': str(e)}), 500
 
+@app.route('/api/vms/<int:vmid>/backups/delete', methods=['POST'])
+@require_admin_scope
+def api_delete_vm_backups(vmid):
+    """Delete an explicitly confirmed selection, revalidated by Proxmox."""
+    try:
+        return jsonify(delete_guest_backups(vmid, request.get_json(silent=True)))
+    except BackupArchiveError as error:
+        return jsonify({'error': str(error)}), error.code
+    finally:
+        # Native deletion may have started even if the pvesh response was lost.
+        _vm_cache_invalidate(vmid, _vm_backups_cache)
+
+
+@app.route('/api/vms/<int:vmid>/backups/delete-status', methods=['GET'])
+@require_admin_scope
+def api_vm_backup_deletion_status(vmid):
+    """Only poll deletion tasks started here for this guest."""
+    try:
+        result = guest_backup_deletion_status(vmid, request.args.get('task'))
+        if result['status'] != 'pending':
+            _vm_cache_invalidate(vmid, _vm_backups_cache)
+        return jsonify(result)
+    except BackupArchiveError as error:
+        return jsonify({'error': str(error)}), error.code
+
+
 @app.route('/api/vms/<int:vmid>/backups', methods=['GET'])
 @require_auth
 def api_vm_backups(vmid):
@@ -13389,6 +13417,7 @@ def api_vm_backups(vmid):
                             'timestamp': ctime,
                             'date': datetime.fromtimestamp(ctime).strftime('%Y-%m-%d %H:%M') if ctime else '',
                             'notes': item.get('notes', ''),
+                            'protected': item.get('protected', False) not in (False, 0, '0', '', None),
                         })
                 except Exception:
                     pass
diff --git a/AppImage/scripts/flask_vm_backup_routes.py b/AppImage/scripts/flask_vm_backup_routes.py
index be83d8f9..78e77919 100644
--- a/AppImage/scripts/flask_vm_backup_routes.py
+++ b/AppImage/scripts/flask_vm_backup_routes.py
@@ -16,6 +16,9 @@ Endpoints, all under /api/vm-backup-jobs:
   DELETE /<id>             delete a job (its backups are kept)
   POST   /<id>/toggle      enable / disable
   POST   /<id>/run         run it now, as a Proxmox task on each node
+
+Storage retention is read/edited under /api/vm-backup-storages. Saving a
+policy only changes the native storage configuration; it never runs pruning.
 """
 
 import json
@@ -229,6 +232,58 @@ def options():
     })
 
 
+@vm_backup_bp.route("/api/vm-backup-storages", methods=["GET"])
+@require_auth
+def backup_storage_retention():
+    ok, storages = _pvesh_json(["get", "/storage"])
+    if not ok or not isinstance(storages, list):
+        return _err(storages if not ok else "Invalid storage inventory", 502)
+    return jsonify({"storages": [
+        {"id": storage["storage"], "type": storage.get("type", ""),
+         "prune_backups": _flat(storage.get("prune-backups") or ""),
+         "digest": storage.get("digest", "")}
+        for storage in storages
+        if isinstance(storage, dict) and storage.get("storage")
+        and "backup" in (storage.get("content") or "").split(",")
+    ]})
+
+
+@vm_backup_bp.route("/api/vm-backup-storages/<storage_id>", methods=["PUT"])
+@require_admin_scope
+def update_backup_storage_retention(storage_id):
+    if not STORAGE_RE.fullmatch(storage_id):
+        return _err("Invalid storage")
+    data = request.get_json(silent=True)
+    if not isinstance(data, dict):
+        return _err("A retention policy and current configuration digest are required")
+    digest, prune = data.get("digest"), data.get("prune_backups")
+    if not isinstance(digest, str) or not re.fullmatch(r"[a-fA-F0-9]{40}", digest):
+        return _err("Refresh the storage list before editing its retention")
+    # An empty policy removes the storage setting, so the Proxmox default applies.
+    if not isinstance(prune, str) or (prune and not PRUNE_RE.fullmatch(prune)):
+        return _err("Invalid retention policy")
+    pairs = [part.split("=", 1) for part in prune.split(",")] if prune else []
+    keys = [key for key, _ in pairs]
+    if (len(keys) != len(set(keys)) or
+            ("keep-all" in keys and (len(keys) != 1 or pairs[0][1] != "1")) or
+            any(int(value) < 1 for _, value in pairs)):
+        return _err("Choose keep-all=1 or one or more positive retention counts")
+    # Check that this is still a backup storage, then let Proxmox check the
+    # digest under its storage lock. Other storage settings are never passed.
+    ok, storage = _pvesh_json(["get", f"/storage/{storage_id}"])
+    if not ok:
+        return _err(storage, 502)
+    if not isinstance(storage, dict) or "backup" not in (storage.get("content") or "").split(","):
+        return _err("This storage does not accept backups", 409)
+    if storage.get("digest") != digest:
+        return _err("Storage configuration changed; refresh before saving", 409)
+    change = ["--prune-backups", prune] if prune else ["--delete", "prune-backups"]
+    ok, out = _pvesh(["set", f"/storage/{storage_id}", "--digest", digest, *change])
+    if not ok:
+        return _err(out, 409)
+    return jsonify({"success": True})
+
+
 @vm_backup_bp.route("/api/vm-backup-jobs", methods=["POST"])
 @require_admin_scope
 def create_job():
diff --git a/AppImage/scripts/guest_backup_archives.py b/AppImage/scripts/guest_backup_archives.py
new file mode 100644
index 00000000..7458c631
--- /dev/null
+++ b/AppImage/scripts/guest_backup_archives.py
@@ -0,0 +1,172 @@
+# ==========================================================
+# ProxMenux Monitor - Guest backup archives
+# Author      : Jonatan
+# GitHub      : github.com/jcastro
+# Maintainer  : MacRimi
+# Copyright   : (c) 2026 MacRimi & contributors
+# License     : (GPL-3.0) (https://github.com/MacRimi/ProxMenux/blob/main/LICENSE)
+# Version     : 1.0
+# Last Updated: 16/10/2026
+# ==========================================================
+# Description:
+# Deletes explicitly selected VM/CT backups through the native Proxmox
+# storage API after a fresh inventory/protection check. Tracks native
+# deletion tasks so an accepted operation is not mistaken for completion.
+# No filesystem paths or cached inventory authorize deletion.
+# ==========================================================
+
+import json
+import re
+import socket
+import subprocess
+import threading
+import time
+from concurrent.futures import ThreadPoolExecutor
+
+
+MAX_SELECTION = 20
+REMOVED_RE = re.compile(r"Removed volume '[^'\n]+'")
+STORAGE_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{0,63}")
+NODE_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9-]{0,62}")
+_tasks = {}
+_lock = threading.Lock()
+
+
+class BackupArchiveError(Exception):
+    def __init__(self, message, code=400):
+        super().__init__(message)
+        self.code = code
+
+
+def _pvesh(args, timeout=20):
+    try:
+        result = subprocess.run(["pvesh", *args, "--output-format", "json"],
+                                capture_output=True, text=True, timeout=timeout)
+    except (OSError, subprocess.TimeoutExpired) as error:
+        raise BackupArchiveError("Proxmox command unavailable or timed out; outcome unconfirmed", 502) from error
+    if result.returncode:
+        raise BackupArchiveError((result.stderr or "Proxmox command failed").strip()[:1000], 502)
+    output = result.stdout.strip()
+    try:
+        # pvesh can print no bytes for the API's successful null result.
+        return json.loads(output or "null")
+    except (ValueError, TypeError) as error:
+        # With --delay, a deletion that ends in time prints the line of its
+        # task log instead of JSON. Only that exact line is accepted.
+        if args[0] == "delete" and REMOVED_RE.fullmatch(output):
+            return output
+        raise BackupArchiveError("Invalid Proxmox response; outcome unconfirmed", 502) from error
+
+
+def _node():
+    # Same local storage/node scope as the guest's existing backup list.
+    node = socket.gethostname().split(".")[0]
+    if not NODE_RE.fullmatch(node):
+        raise BackupArchiveError("Invalid local node name", 502)
+    return node
+
+
+def _selection(vmid, data):
+    if not 100 <= vmid <= 999999999:
+        raise BackupArchiveError("Invalid VM/CT ID")
+    if not isinstance(data, dict) or data.get("confirm") is not True:
+        raise BackupArchiveError("Explicit confirmation is required")
+    selected = data.get("backups")
+    if not isinstance(selected, list) or not 1 <= len(selected) <= MAX_SELECTION:
+        raise BackupArchiveError(f"Select between 1 and {MAX_SELECTION} backups")
+    seen = set()
+    for item in selected:
+        if not isinstance(item, dict):
+            raise BackupArchiveError("Invalid backup selection")
+        storage, volid = item.get("storage"), item.get("volid")
+        if not isinstance(storage, str) or not STORAGE_RE.fullmatch(storage):
+            raise BackupArchiveError("Invalid backup storage")
+        if (not isinstance(volid, str) or not volid.startswith(storage + ":")
+                or len(volid) > 512 or not re.fullmatch(r"[A-Za-z0-9_:./+@-]+", volid)
+                or any(part in ("", ".", "..") for part in volid.split(":", 1)[1].split("/"))):
+            raise BackupArchiveError("Invalid backup volume ID")
+        if volid in seen:
+            raise BackupArchiveError("Duplicate backup selection")
+        seen.add(volid)
+    return [{"storage": item["storage"], "volid": item["volid"]} for item in selected]
+
+
+def _protected(value):
+    # Fail closed for an unexpected protection value, including the text 'true'.
+    return value not in (None, False, 0, "0", "")
+
+
+def _remember_task(task, vmid, node, volid):
+    # These are server-returned task IDs, never arbitrary client paths.
+    if (not isinstance(task, str) or not task.startswith(f"UPID:{node}:")
+            or ":imgdel:" not in task or "/" in task or len(task) > 1024):
+        raise BackupArchiveError("Unexpected deletion task; outcome unconfirmed", 502)
+    with _lock:
+        now = time.monotonic()
+        expired = [key for key, entry in _tasks.items() if now - entry["created"] > 3600]
+        for key in expired:
+            del _tasks[key]
+        # Bound even failed/unpolled jobs; expiry does not cancel a PVE task.
+        if len(_tasks) >= 512:
+            del _tasks[min(_tasks, key=lambda key: _tasks[key]["created"])]
+        _tasks[task] = {"vmid": vmid, "node": node, "volid": volid, "created": now}
+
+
+def delete_guest_backups(vmid, data):
+    selected = _selection(vmid, data)
+    node = _node()
+    inventory = {}
+    # Preflight the entire batch before deleting anything. An unavailable
+    # storage or a protected/stale/cross-guest selection fails the whole batch.
+    for storage in sorted({item["storage"] for item in selected}):
+        entries = _pvesh(["get", f"/nodes/{node}/storage/{storage}/content",
+                          "--content", "backup", "--vmid", str(vmid)])
+        if not isinstance(entries, list):
+            raise BackupArchiveError("Invalid backup inventory", 502)
+        for entry in entries:
+            if (isinstance(entry, dict) and entry.get("content") == "backup"
+                    and isinstance(entry.get("volid"), str)):
+                inventory[(storage, entry.get("volid"))] = entry
+    for item in selected:
+        entry = inventory.get((item["storage"], item["volid"]))
+        if entry is None or str(entry.get("vmid")) != str(vmid):
+            raise BackupArchiveError("Backup no longer exists or does not belong to this VM/CT", 409)
+        if _protected(entry.get("protected")):
+            raise BackupArchiveError("Protected backups cannot be deleted", 409)
+
+    def remove(item):
+        try:
+            # Proxmox also enforces protection at deletion time. It removes
+            # associated notes/log files and returns null only after success.
+            task = _pvesh(["delete", f'/nodes/{node}/storage/{item["storage"]}/content/{item["volid"]}',
+                            "--delay", "1"])
+            if isinstance(task, str) and task.startswith("UPID:"):
+                _remember_task(task, vmid, node, item["volid"])
+                return {**item, "status": "pending", "task": task}
+            if task is None or task == f"Removed volume '{item['volid']}'":
+                return {**item, "status": "deleted"}
+            return {**item, "status": "unconfirmed", "error": "Invalid Proxmox response; outcome unconfirmed"}
+        except BackupArchiveError as error:
+            return {**item, "status": "unconfirmed", "error": str(error)}
+
+    with ThreadPoolExecutor(max_workers=min(4, len(selected)), thread_name_prefix="backup-delete") as pool:
+        results = list(pool.map(remove, selected))
+    return {"results": results}
+
+
+def guest_backup_deletion_status(vmid, task):
+    with _lock:
+        entry = _tasks.get(task) if isinstance(task, str) else None
+        if not entry or entry["vmid"] != vmid or time.monotonic() - entry["created"] > 3600:
+            raise BackupArchiveError("Deletion task unknown or expired; refresh the backup list", 409)
+        entry = entry.copy()
+    status = _pvesh(["get", f'/nodes/{entry["node"]}/tasks/{task}/status'])
+    if not isinstance(status, dict) or status.get("status") not in ("running", "stopped"):
+        raise BackupArchiveError("Invalid deletion task status", 502)
+    result = {"volid": entry["volid"], "status": "pending"}
+    if status["status"] == "stopped":
+        if status.get("exitstatus") == "OK":
+            result["status"] = "deleted"
+        else:
+            result.update(status="unconfirmed", error=status.get("exitstatus") or "Deletion outcome unconfirmed")
+    return result
diff --git a/AppImage/scripts/notification_channels.py b/AppImage/scripts/notification_channels.py
index c2bff230..ba9aaa4d 100644
--- a/AppImage/scripts/notification_channels.py
+++ b/AppImage/scripts/notification_channels.py
@@ -1564,7 +1564,7 @@ class AppriseChannel(NotificationChannel):
             return apprise_mod.NotifyType.FAILURE
         if sev == 'WARNING':
             return apprise_mod.NotifyType.WARNING
-        if sev == 'SUCCESS':
+        if sev in ('SUCCESS', 'OK'):
             return apprise_mod.NotifyType.SUCCESS
         return apprise_mod.NotifyType.INFO
 
diff --git a/AppImage/tests/pbs-navigation.cjs b/AppImage/tests/pbs-navigation.cjs
index 5ceac8dc..418cc32b 100644
--- a/AppImage/tests/pbs-navigation.cjs
+++ b/AppImage/tests/pbs-navigation.cjs
@@ -24,3 +24,46 @@ for (const [data, error, expected] of [
   assert.equal(sandbox.exports.ProxmoxDashboard().type, expected)
 }
 console.log('PASS: PBS dashboard routing and loading gate do not mount PVE prewarmers')
+
+// The PVE Backup tab keeps native guest retention alongside jobs when adding
+// its PBS connection view. Exercise the shipped JSX for all three selections.
+const backupSource = fs.readFileSync(path.join(__dirname, '../components/backup-tab.tsx'), 'utf8')
+const backupTree = ts.createSourceFile('backup-tab.tsx', backupSource, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX)
+const backupTab = backupTree.statements.find(node => ts.isFunctionDeclaration(node) && node.name?.text === 'BackupTab')
+assert.ok(backupTab, 'Backup tab must keep a platform-specific view switch')
+const backupCode = ts.transpileModule(ts.createPrinter().printNode(ts.EmitHint.Unspecified, backupTab, backupTree), {
+  compilerOptions: { module: ts.ModuleKind.CommonJS, jsx: ts.JsxEmit.ReactJSX },
+}).outputText
+const HostBackup = () => {}, VmBackupJobs = () => {}, BackupStorageRetention = () => {}, PBSPanel = () => {}
+for (const [view, expected] of [
+  ['host', [HostBackup]], ['guests', [VmBackupJobs, BackupStorageRetention]], ['pbs', [PBSPanel]],
+]) {
+  const selected = []
+  const sandbox = {
+    exports: {}, HostBackup, VmBackupJobs, BackupStorageRetention, PBSPanel, DatabaseBackup: () => {},
+    useT: () => key => key, useState: () => [view, value => selected.push(value)],
+    require: () => ({ jsx: (type, props) => ({ type, props }), jsxs: (type, props) => ({ type, props }), Fragment: Symbol('Fragment') }),
+  }
+  vm.runInNewContext(backupCode, sandbox)
+  const visible = [], mountedHosts = [], buttons = []
+  const components = new Set([HostBackup, VmBackupJobs, BackupStorageRetention, PBSPanel])
+  function walk(node, hidden = false) {
+    if (Array.isArray(node)) { node.forEach(item => walk(item, hidden)); return }
+    if (!node || typeof node !== 'object') return
+    hidden ||= node.props?.className === 'hidden'
+    if (node.type === HostBackup) mountedHosts.push(node)
+    if (components.has(node.type) && !hidden) visible.push(node.type)
+    if (node.type === 'button') buttons.push(node)
+    walk(node.props?.children, hidden)
+  }
+  walk(sandbox.exports.BackupTab())
+  assert.deepEqual(visible, expected, `visible backup panels for ${view}`)
+  assert.equal(mountedHosts.length, 1, 'host backup progress must stay mounted across view changes')
+  assert.equal(buttons.length, 3)
+  assert.equal(buttons.filter(button => button.props['aria-pressed']).length, 1)
+  const pbsButton = buttons.find(button => button.props.children === 'pbs.title')
+  assert.ok(pbsButton, 'PBS navigation button must exist')
+  pbsButton.props.onClick()
+  assert.deepEqual(selected, ['pbs'])
+}
+console.log('PASS: host progress stays mounted, guest jobs and retention stay together, and PBS navigation remains separate')
diff --git a/lang/de.json b/lang/de.json
index fc5f6e47..6f0347b5 100644
--- a/lang/de.json
+++ b/lang/de.json
@@ -7079,6 +7079,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Nicht unterstütztes OCI-LXC AppArmor-Profil:",
   "Unsupported OCI-LXC seccomp profile:": "Nicht unterstütztes OCI-LXC seccomp Profil:",
   "Unsupported Terminal": "Nicht unterstütztes Terminal",
+  "Unsupported architecture for Figurine:": "Nicht unterstützte Architektur für Figurine:",
   "Unsupported architecture:": "Nicht unterstützte Architektur:",
   "Unsupported backup compression": "Nicht unterstützte Backup-Komprimierung",
   "Unsupported credential pattern:": "Nicht unterstütztes credential-Muster:",
@@ -7968,8 +7969,8 @@
   "qBittorrent: invalid login response or missing session cookie": "qBittorrent: ungültige Anmeldeantwort oder fehlendes Sitzungscookie",
   "raw USB disk — no filesystem (will be FORMATTED)": "Raw-USB-Festplatte – kein Dateisystem (wird FORMATTIERT)",
   "read-only": "Read-Only",
-  "reboot-quick alias added": "reboot-quick-Alias ​​hinzugefügt",
-  "reboot-quick alias is already configured": "reboot-quick Alias ​​ist bereits konfiguriert",
+  "reboot-quick alias added": "reboot-quick-Alias hinzugefügt",
+  "reboot-quick alias is already configured": "reboot-quick Alias ist bereits konfiguriert",
   "recognition": "Erkennung",
   "recognition only": "Nur Erkennung",
   "recommended": "empfohlen",
diff --git a/lang/es.json b/lang/es.json
index 5aebd84c..4de8be5d 100644
--- a/lang/es.json
+++ b/lang/es.json
@@ -328,7 +328,7 @@
   "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Después de este cambio LXC → VM, reinicie el host para que el nuevo estado de enlace se aplique limpiamente.",
   "Airsonic Advanced web interface": "Interfaz web de Airsonic Advanced",
   "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-advanced es un servidor de streaming multimedia gratuito y basado en web que da acceso a tu música desde cualquier lugar. Úsalo para compartir tu música con amigos o para escuchar la tuya en el trabajo. Puede transmitir a varios reproductores a la vez, por ejemplo a uno en la cocina y a otro en el salón.",
-  "Aliases added to .bashrc": "Alias ​​agregados a .bashrc",
+  "Aliases added to .bashrc": "Alias agregados a .bashrc",
   "Alist Sync web interface": "Interfaz web de Alist Sync",
   "All": "Todos",
   "All Available Scripts": "Todos los scripts disponibles",
@@ -2415,7 +2415,7 @@
   "Fastfetch will start automatically in the console": "Fastfetch se iniciará automáticamente en la consola",
   "Ferdium is a desktop app that helps you organize how you use your favourite apps by combining them into one application.": "Ferdium es una aplicación de escritorio que te ayuda a organizar el uso de tus aplicaciones favoritas reuniéndolas en una sola.",
   "Fetching NVIDIA driver versions supported by your GPU...": "Obteniendo versiones del controlador NVIDIA compatibles con su GPU...",
-  "Figurine installation and configuration completed successfully.": "La instalación y configuración deFigurine se completó con éxito.",
+  "Figurine installation and configuration completed successfully.": "La instalación y configuración de Figurine se completó correctamente.",
   "Figurine is not installed.": "Figurine no está instalado.",
   "Figurine removed from system": "Figurine desinstalado del sistema",
   "File bind mounts do not support spaces:": "Los bind mounts de archivo no admiten espacios:",
@@ -7054,6 +7054,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Perfil OCI-LXC sin soporte:",
   "Unsupported OCI-LXC seccomp profile:": "Perfil sin soporte OCI-LXC seccomp:",
   "Unsupported Terminal": "Terminal no compatible",
+  "Unsupported architecture for Figurine:": "Arquitectura no compatible con Figurine:",
   "Unsupported architecture:": "Arquitectura sin soporte:",
   "Unsupported backup compression": "Compresión de backup sin soporte",
   "Unsupported credential pattern:": "Patrón credential sin soporte:",
diff --git a/lang/fr.json b/lang/fr.json
index 1468b4ad..c4f9199b 100644
--- a/lang/fr.json
+++ b/lang/fr.json
@@ -330,7 +330,7 @@
   "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Après ce commutateur LXC → VM, redémarrez l'hôte afin que le nouvel état de liaison soit appliqué proprement.",
   "Airsonic Advanced web interface": "Interface web Airsonic Advanced",
   "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-Advanced est un flux multimédia gratuit, basé sur le web, offrant un accès ubiquitious à votre musique. Utilisez-le pour partager votre musique avec des amis, ou pour écouter votre propre musique au travail. Vous pouvez diffuser simultanément vers plusieurs joueurs, par exemple vers un joueur dans votre cuisine et un autre dans votre salon.",
-  "Aliases added to .bashrc": "Alias ​​ajoutés à .bashrc",
+  "Aliases added to .bashrc": "Alias ajoutés à .bashrc",
   "Alist Sync web interface": "Alist Interface web Sync",
   "All": "Tous",
   "All Available Scripts": "Tous les scripts disponibles",
@@ -2802,7 +2802,7 @@
   "How do you want to add it?": "Comment veux-tu l’ajouter ?",
   "How do you want to authenticate this backup target?": "Comment souhaitez-vous authentifier cette cible de sauvegarde ?",
   "How do you want to select the": "Comment voulez-vous sélectionner le",
-  "How do you want to select the HOST folder to mount?": "Comment souhaitez-vous sélectionner le dossier HOST à ​​monter ?",
+  "How do you want to select the HOST folder to mount?": "Comment souhaitez-vous sélectionner le dossier HOST à monter ?",
   "How do you want to select the NFS server?": "Comment voulez-vous sélectionner le serveur NFS ?",
   "How do you want to select the Samba server?": "Comment voulez-vous sélectionner le serveur Samba ?",
   "How do you want to select the folder to export?": "Comment voulez-vous sélectionner le dossier à exporter ?",
@@ -4334,7 +4334,7 @@
   "Not all shared directories were verified": "Tous les répertoires partagés n'ont pas été vérifiés",
   "Not an OVH server, skipping RTM installation": "Pas un serveur OVH, sautant l'installation RTM",
   "Not currently mounted": "Non monté actuellement",
-  "Not currently mounted — skipping umount.": "Non monté actuellement – ​​ignorer umount.",
+  "Not currently mounted — skipping umount.": "Non monté actuellement – ignorer umount.",
   "Not declared": "Non déclaré",
   "Not enough free space for the backup": "Pas assez d'espace libre pour la sauvegarde",
   "Not enough free space on {storage}. Free some space or select another storage.": "Pas assez d’espace libre sur {storage}. Libérez de l'espace ou sélectionnez un autre stockage.",
@@ -7078,6 +7078,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Profil OCI-LXC AppArmor non soutenu :",
   "Unsupported OCI-LXC seccomp profile:": "Profil de seccomp OCI-LXC non pris en charge:",
   "Unsupported Terminal": "Terminal non pris en charge",
+  "Unsupported architecture for Figurine:": "Architecture non prise en charge pour Figurine :",
   "Unsupported architecture:": "Architecture non supportée :",
   "Unsupported backup compression": "compression de sauvegarde non prise en charge",
   "Unsupported credential pattern:": "Modèle credential non pris en charge:",
diff --git a/lang/it.json b/lang/it.json
index e3f39021..89ebefa2 100644
--- a/lang/it.json
+++ b/lang/it.json
@@ -7079,6 +7079,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Profilo OCI-LXC AppArmor non supportato:",
   "Unsupported OCI-LXC seccomp profile:": "Profilo seccomp OCI-LXC non supportato:",
   "Unsupported Terminal": "Terminale non supportato",
+  "Unsupported architecture for Figurine:": "Architettura non supportata da Figurine:",
   "Unsupported architecture:": "Architettura non supportata:",
   "Unsupported backup compression": "Compressione backup non supportata",
   "Unsupported credential pattern:": "Schema credenziali non supportato:",
diff --git a/lang/pt.json b/lang/pt.json
index cc7eed1d..eedb6075 100644
--- a/lang/pt.json
+++ b/lang/pt.json
@@ -4215,7 +4215,7 @@
   "No format-safe disks are available.": "Nenhum disco de formato seguro está disponível.",
   "No free ProxMenux private /24 network is available": "Nenhuma rede privada ProxMenux livre 24 está disponível",
   "No gasket DKMS registrations remain.": "Não restam registos DKMS de gasket.",
-  "No group creation required — uses world-writable sticky bit permissions.": "Não é necessária a criação de grupos — usa permissões de sticky bit graváveis ​​mundialmente.",
+  "No group creation required — uses world-writable sticky bit permissions.": "Não é necessária a criação de grupos — usa permissões de sticky bit graváveis mundialmente.",
   "No guest selected.": "Nenhum convidado selecionado.",
   "No host VFIO reconfiguration expected": "Nenhuma reconfiguração VFIO do host é esperada",
   "No host VFIO/native binding changes were required.": "Nenhuma alteração de ligação VFIO/nativa do host foi necessária.",
@@ -4432,7 +4432,7 @@
   "Only an installed standalone OCI instance can adopt external changes": "Somente uma instância OCI autônoma instalada pode adotar alterações externas",
   "Only backed-up Proxmox volumes can be adopted": "Somente volumes Proxmox com backup podem ser adotados",
   "Only convert to privileged if absolutely necessary for your use case.": "Converta para privilegiado apenas se for absolutamente necessário para o seu caso de uso.",
-  "Only fully free disks are shown (not system-used and not referenced by VM/LXC).": "Somente discos totalmente livres são mostrados (não usados ​​pelo sistema e não referenciados pelo VM/LXC).",
+  "Only fully free disks are shown (not system-used and not referenced by VM/LXC).": "Somente discos totalmente livres são mostrados (não usados pelo sistema e não referenciados pelo VM/LXC).",
   "Only if using enterprise subscription": "Somente se estiver usando assinatura corporativa",
   "Only if using no-subscription repository": "Somente se estiver usando repositório sem assinatura",
   "Only needed if you mounted the filesystem in step 6b": "Necessário apenas se você montou o sistema de arquivos na etapa 6b",
@@ -7079,6 +7079,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Perfil do AppArmor OCI-LXC não suportado:",
   "Unsupported OCI-LXC seccomp profile:": "Perfil OCI-LXC seccomp não suportado:",
   "Unsupported Terminal": "Terminal não suportado",
+  "Unsupported architecture for Figurine:": "Arquitetura não suportada pelo Figurine:",
   "Unsupported architecture:": "Arquitetura não suportada:",
   "Unsupported backup compression": "Compressão de backup não suportada",
   "Unsupported credential pattern:": "Padrão credential não suportado:",
diff --git a/lang/sk.json b/lang/sk.json
index 45e9c485..8dd89f3e 100644
--- a/lang/sk.json
+++ b/lang/sk.json
@@ -2668,7 +2668,7 @@
   "HAOS One is a community image that runs Docker inside the container. The LXC stays unprivileged, but the inner AppArmor profiles may not be available. The first start downloads Home Assistant Core and its add-ons. If the check fails, the CT and /mnt/data are kept for diagnosis.": "HAOS One je obraz spoločenstva, ktorý prevádzkuje Docker vnútri kontajnera. LXC zostáva neprivilegovaný, ale vnútorné profily AppArmor nemusí byť k dispozícii. Prvý štart stiahne Home Assistant jadro a jeho doplnky. Ak kontrola zlyhá, CT a / mnt/ dáta sa uchovávajú na určenie diagnózy.",
   "HAOS One profile declined": "Profil HAOS One klesol",
   "HAOS One requires an unprivileged unmanaged LXC with nesting and keyctl, 2 cores, 2048 MB RAM, rootfs of at least 12 GB and /mnt/data of at least 16 GB on a container volume included in backups": "HAOS One requires an unprivileged unmanaged LXC with nestering and keyctl, 2 cores, 2048 MB RAM, rootfs najmenej 12 GB a /mnt/data najmenej 16 GB on a container volume included in backions",
-  "HTML5 Network Speed Test Server.": "HTML5 Network Speed ​​Test Server.",
+  "HTML5 Network Speed Test Server.": "HTML5 Network Speed Test Server.",
   "HTTP service check without a saved URL": "Kontrola služby HTTP bez uloženého URL",
   "Habridge emulates Philips Hue API to other home automation gateways such as an Amazon Echo/Dot Gen 1 (gen 2 has issues discovering ha-bridge) or other systems that support Philips Hue. The Bridge handles basic commands such as On, Off and brightness commands of the hue protocol. This bridge can control most devices that have a distinct API.": "Habridge napodobňuje Philipsa Spoločnosť Amazon tvrdí, že spoločnosť LuxOpCo by mala mať prístup k webovým stránkam spoločnosti LuxOpCo. Most riadi základné príkazy, ako je On, Off a jas príkazy protokolu odtieňov. Tento most môže ovládať väčšinu zariadení, ktoré majú odlišné API.",
   "HandBrake is an open-source tool, built by volunteers, for converting video from nearly any format to a selection of modern, widely supported codecs.": "HandBrake je open-source nástroj, postavený dobrovoľníkmi, pre konverziu video z takmer akéhokoľvek formátu na výber moderných, široko podporovaných kodekov.",
@@ -7080,6 +7080,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Nepodporovaný profil OCI-LXC AppArmor:",
   "Unsupported OCI-LXC seccomp profile:": "Nepodporovaný profil OCI-LXC seccomp:",
   "Unsupported Terminal": "Nepodporovaný terminál",
+  "Unsupported architecture for Figurine:": "Nepodporovaná architektúra pre Figurine:",
   "Unsupported architecture:": "Nepodporovaná architektúra:",
   "Unsupported backup compression": "Nepodporovaná kompresia zálohy",
   "Unsupported credential pattern:": "Nepodporovaný credential vzor:",
diff --git a/lang/sv.json b/lang/sv.json
index 9b931d05..14657f58 100644
--- a/lang/sv.json
+++ b/lang/sv.json
@@ -330,7 +330,7 @@
   "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Efter denna LXC → VM-switch, starta om värden så att det nya bindningsläget tillämpas korrekt.",
   "Airsonic Advanced web interface": "Airsonic Advanced webbgränssnitt",
   "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-advanced är en gratis, webbaserad media streamer, som ger ubiquitious tillgång till din musik. Använd den för att dela din musik med vänner, eller för att lyssna på din egen musik på jobbet. Du kan strömma till flera spelare samtidigt, till exempel till en spelare i ditt kök och en annan i ditt vardagsrum.",
-  "Aliases added to .bashrc": "Alias ​​har lagts till i .bashrc",
+  "Aliases added to .bashrc": "Alias har lagts till i .bashrc",
   "Alist Sync web interface": "Alist Sync webbgränssnitt",
   "All": "Alla",
   "All Available Scripts": "Alla tillgängliga skript",
@@ -2143,7 +2143,7 @@
   "Etherpad admin page": "Etherpad admin sida",
   "Every 12 hours": "Var 12:e timme",
   "Every 3 hours": "Var 3:e timme",
-  "Every 6 hours": "Var 6:e ​​timme",
+  "Every 6 hours": "Var 6:e timme",
   "Every fail2ban jail ships disabled. Enable the ones you need in /config/fail2ban/jail.local, taking the ready-made jails in /config/fail2ban/jail.d/ as reference, then restart the container.": "Varje fail2ban fängslade fartyg. Möjliggöra de du behöver i /config / fail2ban /jail.local, ta de färdiga fängelserna i /config / fail2ban /jail.d / som referens, sedan starta om behållaren.",
   "Every hour": "Varje timme",
   "Every member of the stack is back to its previous installation.": "Varje medlem av stacken är tillbaka till sin tidigare installation.",
@@ -2668,7 +2668,7 @@
   "HAOS One is a community image that runs Docker inside the container. The LXC stays unprivileged, but the inner AppArmor profiles may not be available. The first start downloads Home Assistant Core and its add-ons. If the check fails, the CT and /mnt/data are kept for diagnosis.": "HAOS One är en gemenskapsbild som kör Docker inuti behållaren. LXC är oprivilegierad, men de inre AppArmor-profilerna kanske inte är tillgängliga. Den första starten hämtar Home Assistant Core och dess tillägg. Om kontrollen misslyckas, CT och /mnt / data hålls för diagnos.",
   "HAOS One profile declined": "HAOS One-profilen minskade",
   "HAOS One requires an unprivileged unmanaged LXC with nesting and keyctl, 2 cores, 2048 MB RAM, rootfs of at least 12 GB and /mnt/data of at least 16 GB on a container volume included in backups": "HAOS One requires en oprivilegierad ohanterad LXC med häckning och keyctl, 2 kärnor, 2048 MB RAM, rötter på minst 12 GB och /mnt / data på minst 16 GB på en behållarvolym som ingår i backups",
-  "HTML5 Network Speed Test Server.": "HTML5 Network Speed ​​Test Server.",
+  "HTML5 Network Speed Test Server.": "HTML5 Network Speed Test Server.",
   "HTTP service check without a saved URL": "HTTP service check utan sparad URL",
   "Habridge emulates Philips Hue API to other home automation gateways such as an Amazon Echo/Dot Gen 1 (gen 2 has issues discovering ha-bridge) or other systems that support Philips Hue. The Bridge handles basic commands such as On, Off and brightness commands of the hue protocol. This bridge can control most devices that have a distinct API.": "Habridge emulerar Philips Hue API till andra hemautomatiseringsgateways som Amazon Echo / Dot Gen 1 (gen 2 har problem med att upptäcka ha-bro) eller andra system som stöder Philips Hue. Bron hanterar grundläggande kommandon som On, Off och ljusstyrka kommandon av nyansprotokollet. Denna bro kan styra de flesta enheter som har ett tydligt API.",
   "HandBrake is an open-source tool, built by volunteers, for converting video from nearly any format to a selection of modern, widely supported codecs.": "HandBrake är ett open-source verktyg, byggt av volontärer, för att konvertera video från nästan alla format till ett urval av moderna, allmänt stödda codecs.",
@@ -7079,6 +7079,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Ostödd OCI-LXC AppArmor-profil:",
   "Unsupported OCI-LXC seccomp profile:": "Unsupported OCI-LXC seccomp profil:",
   "Unsupported Terminal": "Terminal som inte stöds",
+  "Unsupported architecture for Figurine:": "Arkitekturen stöds inte av Figurine:",
   "Unsupported architecture:": "Ostödd arkitektur:",
   "Unsupported backup compression": "Unsupported backup komprimering",
   "Unsupported credential pattern:": "Unsupported credential mönster:",
diff --git a/scripts/post_install/customizable_post_install.sh b/scripts/post_install/customizable_post_install.sh
index 93db9dc1..ca60b752 100644
--- a/scripts/post_install/customizable_post_install.sh
+++ b/scripts/post_install/customizable_post_install.sh
@@ -3039,15 +3039,27 @@ register_tool "fastfetch" true "$FUNC_VERSION"
 
 
 configure_figurine() {
-    local FUNC_VERSION="1.1"
+    local FUNC_VERSION="1.2"
     pmx_journal_context "configure_figurine" "$FUNC_VERSION"
     # description: Install Figurine (ASCII-art hostname banner) and wire it into the SSH login flow.
     msg_info2 "$(translate "Installing and configuring Figurine...")"
     # `FIGURINE_VERSION` env var allows pinning to a specific release;
     # default tracks the last tested upstream tag. Audit Tier 6 —
     # recursos remotos sin pinning de versión.
-    local version="${FIGURINE_VERSION:-2.0.0}"
-    local file="figurine_linux_amd64_v${version}.tar.gz"
+    local version="${FIGURINE_VERSION:-2.1.1}"
+    # Prefer the Debian userspace ABI; the upstream 32-bit ARM build requires ARMv7.
+    local arch
+    arch="$(dpkg --print-architecture 2>/dev/null || uname -m)"
+    case "$arch" in
+        amd64|x86_64) arch="amd64" ;;
+        arm64|aarch64) arch="arm64" ;;
+        armhf|armv7l|armv8l) arch="arm" ;;
+        *)
+            msg_error "$(translate "Unsupported architecture for Figurine:") $arch"
+            return 1
+            ;;
+    esac
+    local file="figurine_linux_${arch}_v${version}.tar.gz"
     local url="https://github.com/arsham/figurine/releases/download/v${version}/${file}"
     local temp_dir; temp_dir=$(mktemp -d)
     local install_dir="/usr/local/bin"
diff --git a/tests/test_apprise_service_help.cjs b/tests/test_apprise_service_help.cjs
new file mode 100644
index 00000000..d2f0d131
--- /dev/null
+++ b/tests/test_apprise_service_help.cjs
@@ -0,0 +1,30 @@
+// Render the real help component; only its translation provider is replaced.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const vm = require('node:vm');
+const ts = require('typescript');
+const React = require('react');
+const { renderToStaticMarkup } = require('react-dom/server');
+const source = fs.readFileSync('AppImage/components/apprise-service-help.tsx', 'utf8');
+const js = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, jsx: ts.JsxEmit.ReactJSX } }).outputText;
+const english = JSON.parse(fs.readFileSync('AppImage/messages/en/common.json'));
+function resolve(catalog, key) { return key.split('.').reduce((value, part) => value?.[part], catalog); }
+for (const locale of ['en', 'es', 'de', 'fr', 'it', 'pt', 'sk', 'sv', 'missing']) {
+  const catalog = locale === 'missing' ? {} : JSON.parse(fs.readFileSync(`AppImage/messages/${locale}/common.json`));
+  const context = { exports: {}, require: name => name === '../lib/i18n/provider' ? {
+    useT: () => key => resolve(catalog, key) ?? resolve(english, key),
+  } : require(name) };
+  vm.runInNewContext(js, context);
+  const html = renderToStaticMarkup(React.createElement(context.exports.AppriseServiceHelp));
+  assert.ok(html.includes('https://hooks.slack.com/services/TOKEN_A/TOKEN_B/TOKEN_C'));
+  assert.ok(html.includes('matrixs://USER:PASSWORD@matrix.example.com/!ROOM_ID:matrix.example.com'));
+  assert.ok(html.includes('https://appriseit.com/services/slack/'));
+  assert.ok(html.includes('https://appriseit.com/services/matrix/'));
+  assert.ok(!html.includes('settings.notifications.'), `${locale}: no unresolved labels`);
+}
+for (const [, key] of source.matchAll(/t\("([^"]+)"\)/g)) assert.ok(resolve(english, key), key);
+assert.ok(!source.includes('onChange') && !source.includes('fetch(') && !source.includes('updateChannel'));
+const settings = fs.readFileSync('AppImage/components/notification-settings.tsx', 'utf8');
+const section = settings.slice(settings.indexOf('<TabsContent value="apprise"'), settings.indexOf('</TabsContent>', settings.indexOf('<TabsContent value="apprise"')));
+for (const part of ['<AppriseServiceHelp />', 'renderChannelCategories("apprise")', 'handleTest("apprise")']) assert.ok(section.includes(part));
+console.log('PASS: real provider-help JSX, shipped locales and English fallback, no secret mutation, native category/test controls retained');
diff --git a/tests/test_apprise_services.py b/tests/test_apprise_services.py
new file mode 100644
index 00000000..fffb158e
--- /dev/null
+++ b/tests/test_apprise_services.py
@@ -0,0 +1,137 @@
+"""Real Apprise Slack/Matrix plugins with the HTTP boundary replaced.
+
+No provider account or network is used. These contracts run against both
+the minimum bundled Apprise version and the current tested version.
+"""
+import gc
+import json
+from pathlib import Path
+import sys
+import unittest
+from unittest.mock import patch
+from urllib.parse import urlparse
+
+import apprise
+import requests
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "AppImage/scripts"))
+from notification_channels import create_channel
+
+SLACK = "https://hooks.slack.com/services/T00000000/B00000000/fixturesecret1234567890"
+MATRIX = "matrixs://notify:fixture-password@matrix.example.test/!room:matrix.example.test"
+
+
+class AppriseServiceTests(unittest.TestCase):
+    def setUp(self):
+        self.calls = []
+        self.status = 200
+        self.transport = patch.object(requests.Session, "request", side_effect=self.http)
+        self.transport.start()
+        self.addCleanup(self.transport.stop)
+        self.sleep = patch("notification_channels.time.sleep")
+        self.sleep.start()
+        self.addCleanup(self.sleep.stop)
+        self.addCleanup(gc.collect)
+
+    def http(self, method, url, **kwargs):
+        self.calls.append((method, url, kwargs))
+        response = requests.Response()
+        response.status_code = self.status
+        response.url = url
+        response.reason = "OK" if self.status == 200 else "Rejected"
+        response._content_consumed = True
+        host, path = urlparse(url).hostname, urlparse(url).path
+        if host == "hooks.slack.com":
+            self.assertTrue(path.startswith("/services/"))
+            response._content = b"ok" if self.status == 200 else b"invalid_auth"
+        else:
+            self.assertEqual(host, "matrix.example.test", "no unexpected destinations")
+            if self.status != 200:
+                payload = {"errcode": "M_FORBIDDEN", "error": "Invalid credentials"}
+            elif path == "/.well-known/matrix/client":
+                payload = {"m.homeserver": {"base_url": "https://" + host}}
+            elif path.endswith("/login"):
+                payload = {"access_token": "fixture-token", "home_server": host, "user_id": "@notify:" + host}
+            elif path.endswith("/joined_rooms"):
+                payload = {"joined_rooms": ["!room:" + host]}
+            elif "/join/" in path:
+                payload = {"room_id": "!room:" + host}
+            elif "/send/" in path:
+                payload = {"event_id": "$fixture"}
+            elif path.endswith("/logout"):
+                payload = {}
+            elif path.endswith("/versions"):
+                payload = {"versions": ["v1.1"]}
+            else:
+                raise AssertionError("Unhandled Matrix request: " + path)
+            response._content = json.dumps(payload).encode()
+        return response
+
+    def send(self, url):
+        channel = create_channel("apprise", {"url": url})
+        self.assertIsNotNone(channel)
+        return channel.send("ProxMenux probe", "Controlled message", "WARNING")
+
+    def test_slack_accepts_the_native_webhook_without_conversion(self):
+        result = self.send(SLACK)
+        self.assertTrue(result["success"], result)
+        self.assertTrue(any(url == SLACK for _, url, _ in self.calls))
+        self.assertIn("Controlled message", str(self.calls))
+
+    def test_slack_apprise_scheme_uses_the_same_transport(self):
+        result = self.send(SLACK.replace("https://hooks.slack.com/services/", "slack://"))
+        self.assertTrue(result["success"], result)
+        self.assertTrue(any(url == SLACK for _, url, _ in self.calls))
+
+    def test_matrix_authenticates_and_delivers_to_the_full_room_id_over_https(self):
+        result = self.send(MATRIX)
+        self.assertTrue(result["success"], result)
+        sends = [(url, kwargs) for _, url, kwargs in self.calls if "/send/" in url]
+        self.assertTrue(sends, self.calls)
+        self.assertTrue(all(url.startswith("https://matrix.example.test/") for url, _ in sends))
+        self.assertTrue(all(kwargs.get("verify", True) for _, kwargs in sends))
+        self.assertIn("Controlled message", str(sends))
+        self.assertTrue(any(url.endswith("/login") for _, url, _ in self.calls))
+
+    def test_test_button_contract_uses_the_same_provider(self):
+        ok, error = create_channel("apprise", {"url": SLACK}).test()
+        self.assertTrue(ok, error)
+        self.assertTrue(self.calls)
+
+    def test_rejected_slack_webhook_is_not_reported_as_delivered(self):
+        self.status = 403
+        result = self.send(SLACK)
+        self.assertFalse(result["success"])
+        self.assertTrue(result["error"])
+
+    def test_invalid_matrix_credentials_are_not_reported_as_delivered(self):
+        self.status = 403
+        result = self.send(MATRIX)
+        self.assertFalse(result["success"])
+        self.assertFalse(any("/send/" in url for _, url, _ in self.calls))
+
+    def test_invalid_urls_and_missing_library_fail_before_any_request(self):
+        channel = create_channel("apprise", {"url": "not-a-url"})
+        self.assertFalse(channel.send("Probe", "Body")["success"])
+        channel = create_channel("apprise", {"url": SLACK})
+        with patch.object(channel, "_load_apprise", return_value=None):
+            self.assertFalse(channel.send("Probe", "Body")["success"])
+        self.assertEqual(self.calls, [])
+
+    def test_connection_failure_never_claims_delivery(self):
+        for url in (SLACK, MATRIX):
+            with patch.object(requests.Session, "request", side_effect=requests.ConnectionError("fixture connection failure")):
+                result = self.send(url)
+            self.assertFalse(result["success"])
+            self.assertTrue(result["error"])
+
+    def test_severity_mapping_keeps_native_notification_semantics(self):
+        channel = create_channel("apprise", {"url": SLACK})
+        for severity, expected in (("CRITICAL", apprise.NotifyType.FAILURE), ("WARNING", apprise.NotifyType.WARNING),
+                                   ("INFO", apprise.NotifyType.INFO), ("OK", apprise.NotifyType.SUCCESS),
+                                   ("SUCCESS", apprise.NotifyType.SUCCESS)):
+            self.assertEqual(channel._severity_to_notify_type(apprise, severity), expected)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_backup_storage_retention.cjs b/tests/test_backup_storage_retention.cjs
new file mode 100644
index 00000000..218be9fd
--- /dev/null
+++ b/tests/test_backup_storage_retention.cjs
@@ -0,0 +1,27 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const vm = require('node:vm');
+const ts = require('typescript');
+const source = fs.readFileSync('AppImage/lib/backup-retention.ts', 'utf8');
+const context = { exports: {} };
+vm.runInNewContext(ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS } }).outputText, context);
+const { parseRetention, buildRetention } = context.exports;
+for (const policy of ['keep-all=1', 'keep-last=3', 'keep-last=3,keep-weekly=2', 'keep-hourly=24,keep-daily=7,keep-monthly=12,keep-yearly=2']) {
+  const { fields, keepAll } = parseRetention(policy);
+  assert.equal(buildRetention(fields, keepAll), policy);
+}
+assert.equal(buildRetention({}, false), '', 'empty policy remains explicit');
+assert.equal(buildRetention({}, true), 'keep-all=1');
+assert.equal(buildRetention({ daily: '3', hourly: '0', last: '' }, false), 'keep-daily=3');
+assert.equal(buildRetention({ last: '3' }, true), 'keep-last=3', 'existing job editor precedence preserved');
+const component = fs.readFileSync('AppImage/components/backup-storage-retention.tsx', 'utf8');
+const english = JSON.parse(fs.readFileSync('AppImage/messages/en/common.json')).backup.storageRetention;
+for (const [, key] of component.matchAll(/t\("backup\.storageRetention\.([A-Za-z]+)"/g)) {
+  assert.ok(typeof english[key] === 'string' && english[key], `translation: ${key}`);
+}
+assert.ok(component.includes('digest: editing.digest'));
+assert.ok(component.includes('method: "PUT"'));
+assert.ok(!component.includes('/prune'));
+assert.ok(fs.readFileSync('AppImage/components/vm-backup-jobs.tsx', 'utf8').includes('from "../lib/backup-retention"'));
+assert.ok(fs.readFileSync('AppImage/components/backup-tab.tsx', 'utf8').includes('<BackupStorageRetention />'));
+console.log('PASS: shared native retention properties, keep-all/count round trips, explicit empty policy, translations and digest wiring');
diff --git a/tests/test_figurine_installation.py b/tests/test_figurine_installation.py
new file mode 100644
index 00000000..2e7e7b36
--- /dev/null
+++ b/tests/test_figurine_installation.py
@@ -0,0 +1,204 @@
+"""Exercise the real Figurine installer with isolated files and no network/root access."""
+
+import ast
+import importlib.util
+import io
+from pathlib import Path
+import re
+import subprocess
+import tarfile
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = ROOT / "scripts/post_install/customizable_post_install.sh"
+FUNCTION = re.search(
+    r"^configure_figurine\(\) \{\n.*?^\}", SCRIPT.read_text(), re.M | re.S
+).group(0)
+VERSION = re.search(r'FIGURINE_VERSION:-([^}]+)', FUNCTION).group(1)
+FUNCTION_VERSION = re.search(r'local FUNC_VERSION="([^"]+)"', FUNCTION).group(1)
+
+
+class FigurineInstallation(unittest.TestCase):
+    def run_installer(self, arch="amd64", *, kernel="x86_64", dpkg_exit=0,
+                      release=None, download_exit=0, package="valid", existing=True):
+        with tempfile.TemporaryDirectory(prefix="figurine-test-") as directory:
+            root = Path(directory)
+            binary_dir = root / "bin"
+            profile_dir = root / "profile.d"
+            binary_dir.mkdir()
+            profile_dir.mkdir()
+            (root / "tmp").mkdir()
+            binary = binary_dir / "figurine"
+            profile = profile_dir / "figurine.sh"
+            bashrc = root / "bashrc"
+            if existing:
+                binary.write_text("previous binary\n")
+                binary.chmod(0o755)
+                profile.write_text("previous profile\n")
+                bashrc.write_text("# previous bashrc\n")
+            archive = root / "fixture.tar.gz"
+            payload = b"#!/bin/sh\nprintf 'fixture Figurine\\n'\n"
+            if package == "corrupt":
+                archive.write_bytes(b"invalid tarball")
+            else:
+                with tarfile.open(archive, "w:gz") as tar:
+                    name = "deploy/figurine" if package == "valid" else "README"
+                    member = tarfile.TarInfo(name)
+                    member.size = len(payload)
+                    tar.addfile(member, io.BytesIO(payload))
+
+            # Relocate every installer filesystem boundary, including its login script.
+            function = (FUNCTION.replace("/usr/local/bin", str(binary_dir))
+                        .replace("/etc/profile.d", str(profile_dir))
+                        .replace("/root/.bashrc", str(bashrc)))
+            harness = r'''
+translate() { printf '%s' "$1"; }
+msg_info2() { :; }
+msg_info() { :; }
+msg_ok() { :; }
+msg_success() { :; }
+msg_error() { printf '%s\n' "$*" >&2; }
+pmx_journal_context() { :; }
+pmx_write_file() { cat > "$1"; }
+pmx_append_file() { cat >> "$1"; }
+pmx_edit_file() { :; }
+chown() { :; }
+dpkg() {
+    [[ "$TEST_DPKG_EXIT" == 0 ]] || return "$TEST_DPKG_EXIT"
+    printf '%s\n' "$TEST_ARCH"
+}
+uname() { printf '%s\n' "$TEST_KERNEL"; }
+wget() {
+    [[ "$1" == -qO ]] || return 90
+    printf '%s\n' "$3" >> "$TEST_ROOT/downloads"
+    [[ "$TEST_DOWNLOAD_EXIT" == 0 ]] || return "$TEST_DOWNLOAD_EXIT"
+    cp "$TEST_ROOT/fixture.tar.gz" "$2"
+}
+register_tool() { printf '%s\n' "$*" > "$TEST_ROOT/registered"; }
+'''
+            harness += function + "\nconfigure_figurine\nexit \"$?\"\n"
+            environment = {
+                "PATH": f"{binary_dir}:/usr/bin:/bin",
+                "HOME": str(root),
+                "TMPDIR": str(root / "tmp"),
+                "LC_ALL": "C",
+                "TEST_ROOT": str(root),
+                "TEST_ARCH": arch,
+                "TEST_DPKG_EXIT": str(dpkg_exit),
+                "TEST_KERNEL": kernel,
+                "TEST_DOWNLOAD_EXIT": str(download_exit),
+            }
+            if release is not None:
+                environment["FIGURINE_VERSION"] = release
+            result = subprocess.run(
+                ["/bin/bash", "--noprofile", "--norc"], input=harness,
+                text=True, capture_output=True, env=environment, timeout=10,
+            )
+            return {
+                "result": result,
+                "binary": binary.read_bytes(),
+                "mode": binary.stat().st_mode & 0o777,
+                "profile": profile.read_text(),
+                "bashrc": bashrc.read_text(),
+                "downloads": (root / "downloads").read_text() if (root / "downloads").exists() else "",
+                "registered": (root / "registered").read_text() if (root / "registered").exists() else "",
+                "payload": payload,
+                "binary_path": str(binary),
+            }
+
+    def test_installs_release_matching_debian_userspace(self):
+        for arch, asset in (("amd64", "amd64"), ("arm64", "arm64"), ("armhf", "arm")):
+            with self.subTest(arch=arch):
+                state = self.run_installer(arch)
+                self.assertEqual(state["result"].returncode, 0, state["result"].stderr)
+                self.assertEqual(state["downloads"],
+                                 f"https://github.com/arsham/figurine/releases/download/v{VERSION}/"
+                                 f"figurine_linux_{asset}_v{VERSION}.tar.gz\n")
+                self.assertEqual(state["binary"], state["payload"])
+                self.assertEqual(state["mode"], 0o755)
+                self.assertIn(f'{state["binary_path"]} -f "3d.flf" $(hostname)', state["profile"])
+                self.assertEqual(state["registered"], f"figurine true {FUNCTION_VERSION}\n")
+
+    def test_falls_back_to_kernel_when_dpkg_is_unavailable(self):
+        for kernel, asset in (("x86_64", "amd64"), ("aarch64", "arm64"),
+                              ("armv7l", "arm"), ("armv8l", "arm")):
+            with self.subTest(kernel=kernel):
+                state = self.run_installer("", kernel=kernel, dpkg_exit=127)
+                self.assertEqual(state["result"].returncode, 0, state["result"].stderr)
+                self.assertIn(f"figurine_linux_{asset}_v{VERSION}.tar.gz", state["downloads"])
+
+    def test_userspace_takes_precedence_over_kernel(self):
+        state = self.run_installer("armhf", kernel="aarch64")
+        self.assertEqual(state["result"].returncode, 0, state["result"].stderr)
+        self.assertIn(f"figurine_linux_arm_v{VERSION}.tar.gz", state["downloads"])
+
+    def test_fresh_install_creates_binary_banner_and_aliases(self):
+        state = self.run_installer(existing=False)
+        self.assertEqual(state["result"].returncode, 0, state["result"].stderr)
+        self.assertEqual(state["binary"], state["payload"])
+        self.assertIn(' -f "3d.flf" $(hostname)', state["profile"])
+        self.assertIn("shopt -s expand_aliases", state["bashrc"])
+        self.assertIn("alias aptup='apt update && apt dist-upgrade'", state["bashrc"])
+        self.assertEqual(state["registered"], f"figurine true {FUNCTION_VERSION}\n")
+
+    def test_unsupported_architecture_fails_before_changes_or_download(self):
+        for arch in ("i386", "riscv64", "armel", "armv6l", "ppc64el", ""):
+            with self.subTest(arch=arch):
+                state = self.run_installer(arch)
+                self.assertNotEqual(state["result"].returncode, 0)
+                self.assertIn("Unsupported architecture for Figurine:", state["result"].stderr)
+                self.assertEqual(state["downloads"], "")
+                self.assert_preserved(state)
+                self.assertEqual(state["bashrc"], "# previous bashrc\n")
+
+    def assert_preserved(self, state):
+        self.assertEqual(state["binary"], b"previous binary\n")
+        self.assertEqual(state["profile"], "previous profile\n")
+        self.assertEqual(state["registered"], "")
+
+    def test_download_failure_preserves_previous_installation(self):
+        state = self.run_installer(download_exit=8)
+        self.assertNotEqual(state["result"].returncode, 0)
+        self.assertIn("Failed to download Figurine", state["result"].stderr)
+        self.assert_preserved(state)
+
+    def test_invalid_packages_preserve_previous_installation(self):
+        for package, error in (("corrupt", "Failed to extract package"),
+                               ("missing", "Binary not found in extracted content.")):
+            with self.subTest(package=package):
+                state = self.run_installer(package=package)
+                self.assertNotEqual(state["result"].returncode, 0)
+                self.assertIn(error, state["result"].stderr)
+                self.assert_preserved(state)
+
+    def test_release_override_is_preserved(self):
+        state = self.run_installer("arm64", release="2.1.0")
+        self.assertEqual(state["result"].returncode, 0, state["result"].stderr)
+        self.assertIn("/v2.1.0/figurine_linux_arm64_v2.1.0.tar.gz", state["downloads"])
+
+    def test_existing_installation_is_offered_the_update_once(self):
+        spec = importlib.util.spec_from_file_location(
+            "post_install_versions", ROOT / "AppImage/scripts/post_install_versions.py")
+        versions = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(versions)
+        metadata = versions.parse_post_install_script(SCRIPT)
+        installed = {"figurine": {"installed": True, "version": "1.1", "source": "custom"}}
+        updates = versions._detect_updates({}, metadata, installed)
+        self.assertEqual(len(updates), 1)
+        self.assertEqual(updates[0]["available_version"], FUNCTION_VERSION)
+        self.assertEqual(updates[0]["function"], "configure_figurine")
+        installed["figurine"]["version"] = FUNCTION_VERSION
+        self.assertEqual(versions._detect_updates({}, metadata, installed), [])
+
+        tree = ast.parse((ROOT / "AppImage/scripts/flask_proxmenux_routes.py").read_text())
+        fallback = next(ast.literal_eval(node.value) for node in tree.body
+                        if isinstance(node, ast.Assign)
+                        and any(isinstance(t, ast.Name) and t.id == "TOOL_METADATA"
+                                for t in node.targets))
+        self.assertEqual(fallback["figurine"]["version"], FUNCTION_VERSION)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_guest_backup_archives.cjs b/tests/test_guest_backup_archives.cjs
new file mode 100644
index 00000000..6544c9df
--- /dev/null
+++ b/tests/test_guest_backup_archives.cjs
@@ -0,0 +1,69 @@
+// Run the shipped deletion client with only its authenticated transport replaced.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const vm = require('node:vm');
+const ts = require('typescript');
+const source = fs.readFileSync('AppImage/lib/guest-backup-archives.ts', 'utf8');
+const js = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2020 } }).outputText;
+const backup = { volid: 'local:backup/vzdump-lxc-100-fixture.tar.zst', storage: 'local' };
+
+async function run(responses) {
+  const calls = [];
+  const context = { exports: {}, AbortSignal, Date, setTimeout: callback => callback(), require: name => {
+    assert.equal(name, './api-config');
+    return { fetchApi: async (path, options) => {
+      calls.push({ path, options });
+      assert.ok(responses.length, `unexpected call: ${path}`);
+      const response = responses.shift();
+      if (response instanceof Error) throw response;
+      return response;
+    } };
+  } };
+  vm.runInNewContext(js, context);
+  let results, error;
+  try { results = JSON.parse(JSON.stringify(await context.exports.deleteGuestBackups(100, [backup]))); }
+  catch (caught) { error = caught; }
+  return { calls, results, error };
+}
+
+(async () => {
+  const success = await run([{ results: [{ volid: backup.volid, status: 'deleted' }] }]);
+  assert.equal(success.results[0].status, 'deleted');
+  assert.deepEqual(JSON.parse(success.calls[0].options.body), { confirm: true, backups: [backup] });
+  assert.equal(success.calls[0].options.method, 'POST');
+  assert.equal(success.calls.length, 1);
+  const task = 'UPID:pve1:01:02:03:imgdel:100:root@pam:';
+  const pending = { results: [{ volid: backup.volid, status: 'pending', task }] };
+  const completed = await run([pending, { volid: backup.volid, status: 'pending' }, { volid: backup.volid, status: 'deleted' }]);
+  assert.equal(completed.results[0].status, 'deleted');
+  assert.equal(completed.calls.length, 3);
+  assert.equal(completed.calls[1].path, `/api/vms/100/backups/delete-status?task=${encodeURIComponent(task)}`);
+  assert.equal(completed.calls.filter(call => call.options.method === 'POST').length, 1);
+  const failed = await run([pending, { volid: backup.volid, status: 'unconfirmed', error: 'protected' }]);
+  assert.equal(failed.results[0].status, 'unconfirmed');
+  const lostPost = await run([new Error('network failure')]);
+  assert.equal(lostPost.error.message, 'network failure');
+  assert.equal(lostPost.calls.length, 1, 'never retry destructive POST');
+  const lostStatus = await run([pending, new Error('timeout'), new Error('timeout'), new Error('timeout')]);
+  assert.equal(lostStatus.results[0].status, 'unconfirmed');
+  assert.equal(lostStatus.calls.length, 4, 'bounded read failures');
+  for (const response of [{ results: [] }, { results: [{ volid: 'other', status: 'deleted' }] },
+                           { results: [{ volid: backup.volid, status: 'accepted' }] }]) {
+    assert.equal((await run([response])).error.message, 'deletionUnconfirmed');
+  }
+  const foreignStatus = await run([pending, { volid: 'other', status: 'deleted' }]);
+  assert.equal(foreignStatus.results[0].status, 'unconfirmed');
+
+  const component = fs.readFileSync('AppImage/components/guest-backup-list.tsx', 'utf8');
+  const english = JSON.parse(fs.readFileSync('AppImage/messages/en/common.json')).vmLxc.backups;
+  for (const [, key] of component.matchAll(/t\("vmLxc\.backups\.([A-Za-z]+)"/g)) {
+    assert.ok(typeof english[key] === 'string' && english[key].length, `English translation: ${key}`);
+  }
+  assert.ok(component.includes('disabled={disabled || !!backup.protected'));
+  assert.ok(component.includes('!backup.protected'));
+  assert.ok(component.includes('DialogDescription'));
+  const parent = fs.readFileSync('AppImage/components/virtual-machines.tsx', 'utf8');
+  assert.ok(parent.includes('<GuestBackupList'));
+  assert.ok(parent.includes('await fetchVmBackups(selectedVM.vmid, true)'));
+  console.log('PASS: native task completion, partial/unconfirmed outcomes, lost responses, no destructive retries, translated UI and forced refresh');
+})().catch(error => { console.error(error); process.exitCode = 1; });
diff --git a/tests/test_guest_backup_archives.py b/tests/test_guest_backup_archives.py
new file mode 100644
index 00000000..f9ff6769
--- /dev/null
+++ b/tests/test_guest_backup_archives.py
@@ -0,0 +1,239 @@
+"""Guest archive deletion contract. No real Proxmox commands or backups."""
+
+import ast
+import copy
+import importlib.util
+import json
+from pathlib import Path
+import subprocess
+import sys
+import types
+import unittest
+from unittest.mock import Mock, patch
+
+from flask import Flask, jsonify, request
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPTS = ROOT / "AppImage/scripts"
+sys.path.insert(0, str(SCRIPTS))
+import guest_backup_archives as archives
+
+VOLUME = "local:backup/vzdump-lxc-100-2026_10_16-12_00_00.tar.zst"
+OTHER = VOLUME.replace("12_00_00", "13_00_00")
+TASK = "UPID:pve1:00000001:00000002:00000003:imgdel:100:root@pam:"
+
+
+class DeletionTests(unittest.TestCase):
+    def setUp(self):
+        self.node = patch.object(archives, "_node", return_value="pve1")
+        self.node.start()
+        self.addCleanup(self.node.stop)
+        self.inventory = [{"volid": VOLUME, "vmid": 100, "content": "backup", "protected": False}]
+        self.calls = []
+        self.response = None
+        archives._tasks.clear()
+
+    def run_pvesh(self, args, **kwargs):
+        self.calls.append(args)
+        if args[0] == "get" and args[1].endswith("/content"):
+            return copy.deepcopy(self.inventory)
+        if args[0] == "delete":
+            if isinstance(self.response, Exception):
+                raise self.response
+            return self.response
+        return {"status": "stopped", "exitstatus": "OK"}
+
+    def delete(self, volumes=(VOLUME,), **kwargs):
+        data = {"confirm": True, "backups": [{"storage": v.split(":")[0], "volid": v} for v in volumes]}
+        data.update(kwargs)
+        with patch.object(archives, "_pvesh", side_effect=self.run_pvesh):
+            return archives.delete_guest_backups(100, data)
+
+    def test_success_uses_guest_filtered_native_inventory_and_delete(self):
+        self.assertEqual(self.delete()["results"], [{"storage": "local", "volid": VOLUME, "status": "deleted"}])
+        self.assertEqual(self.calls, [
+            ["get", "/nodes/pve1/storage/local/content", "--content", "backup", "--vmid", "100"],
+            ["delete", f"/nodes/pve1/storage/local/content/{VOLUME}", "--delay", "1"],
+        ])
+
+    def test_a_deletion_that_ends_within_the_delay_prints_its_log_and_counts_as_deleted(self):
+        # Real pvesh output on a directory storage: the task log, not JSON.
+        run = subprocess.CompletedProcess([], 0, stdout=f"Removed volume '{VOLUME}'\n", stderr="")
+        with patch.object(archives.subprocess, "run", return_value=run):
+            self.assertEqual(archives._pvesh(["delete", f"/nodes/pve1/storage/local/content/{VOLUME}", "--delay", "1"]),
+                             f"Removed volume '{VOLUME}'")
+        self.response = f"Removed volume '{VOLUME}'"
+        self.assertEqual(self.delete()["results"][0]["status"], "deleted")
+        self.response = "Removed volume 'local:backup/another-archive.tar.zst'"
+        self.assertEqual(self.delete()["results"][0]["status"], "unconfirmed")
+        with patch.object(archives.subprocess, "run", return_value=run), self.assertRaises(archives.BackupArchiveError):
+            archives._pvesh(["get", "/nodes/pve1/storage/local/content"])
+
+    def test_bad_payloads_and_paths_never_reach_proxmox(self):
+        payloads = [None, [], {}, {"confirm": 1}, {"confirm": True, "backups": []},
+                    {"confirm": True, "backups": [None]}, {"confirm": True, "backups": [VOLUME]},
+                    {"confirm": True, "backups": [{"storage": "local", "volid": VOLUME}] * 21}]
+        for volid in ("local:../etc/passwd", "local:backup/../x", "local:/etc/pve/storage.cfg", "local:backup//x",
+                      "local:backup/x%2fy", "local:backup/x\n--force", "local:backup/x;touch /tmp/x", "other:backup/x"):
+            payloads.append({"confirm": True, "backups": [{"storage": "local", "volid": volid}]})
+        for storage in ("../local", "-x", "local\n", 2, None):
+            payloads.append({"confirm": True, "backups": [{"storage": storage, "volid": VOLUME}]})
+        with patch.object(archives, "_pvesh") as run:
+            for data in payloads:
+                with self.subTest(data=data), self.assertRaises(archives.BackupArchiveError):
+                    archives.delete_guest_backups(100, data)
+            for vmid in (0, 99, 1000000000):
+                with self.assertRaises(archives.BackupArchiveError):
+                    archives.delete_guest_backups(vmid, {"confirm": True, "backups": [{"storage": "local", "volid": VOLUME}]})
+        run.assert_not_called()
+
+    def test_duplicate_selection_rejected_before_commands(self):
+        with self.assertRaises(archives.BackupArchiveError):
+            self.delete((VOLUME, VOLUME))
+        self.assertEqual(self.calls, [])
+
+    def test_newly_protected_archives_fail_the_whole_batch(self):
+        self.inventory.append({"volid": OTHER, "vmid": 100, "content": "backup", "protected": True})
+        for protection in (True, 1, "1", "true", "unexpected"):
+            self.inventory[-1]["protected"] = protection
+            with self.subTest(protection=protection), self.assertRaises(archives.BackupArchiveError) as error:
+                self.delete((VOLUME, OTHER))
+            self.assertEqual(error.exception.code, 409)
+        self.assertFalse(any(call[0] == "delete" for call in self.calls))
+
+    def test_missing_cross_guest_and_non_backup_volumes_are_never_deleted(self):
+        for entries in ([], [{"volid": VOLUME, "vmid": 101, "content": "backup"}],
+                        [{"volid": VOLUME, "content": "backup"}],
+                        [{"volid": VOLUME, "vmid": 100, "content": "images"}]):
+            self.inventory = entries
+            with self.subTest(entries=entries), self.assertRaises(archives.BackupArchiveError):
+                self.delete()
+        self.assertFalse(any(call[0] == "delete" for call in self.calls))
+
+    def test_storage_failure_prevents_every_delete(self):
+        def unavailable(args):
+            self.assertEqual(args[0], "get")
+            raise archives.BackupArchiveError("offline", 502)
+        with patch.object(archives, "_pvesh", side_effect=unavailable), self.assertRaises(archives.BackupArchiveError):
+            archives.delete_guest_backups(100, {"confirm": True, "backups": [
+                {"volid": VOLUME, "storage": "local"}, {"volid": "nas:backup/x", "storage": "nas"}]})
+
+    def test_partial_native_errors_remain_unconfirmed(self):
+        self.inventory.append({"volid": OTHER, "vmid": 100, "content": "backup"})
+        def native(args):
+            if args[0] == "delete" and OTHER in args[1]:
+                raise archives.BackupArchiveError("backup is protected", 502)
+            return self.run_pvesh(args)
+        with patch.object(archives, "_pvesh", side_effect=native):
+            result = archives.delete_guest_backups(100, {"confirm": True, "backups": [
+                {"volid": v, "storage": "local"} for v in (VOLUME, OTHER)]})
+        self.assertEqual([item["status"] for item in result["results"]], ["deleted", "unconfirmed"])
+        self.assertIn("protected", result["results"][1]["error"])
+
+    def test_native_task_is_not_a_success_until_exit_ok(self):
+        self.response = TASK
+        result = self.delete()["results"][0]
+        self.assertEqual(result["status"], "pending")
+        for native, expected in (({"status": "running"}, "pending"),
+                                 ({"status": "stopped", "exitstatus": "OK"}, "deleted"),
+                                 ({"status": "stopped", "exitstatus": "cannot delete protected backup"}, "unconfirmed"),
+                                 ({"status": "stopped"}, "unconfirmed")):
+            with patch.object(archives, "_pvesh", return_value=native) as run:
+                answer = archives.guest_backup_deletion_status(100, TASK)
+            self.assertEqual(answer["status"], expected)
+            run.assert_called_once_with(["get", f"/nodes/pve1/tasks/{TASK}/status"])
+
+    def test_poll_cannot_read_arbitrary_tasks_or_other_guests(self):
+        self.response = TASK
+        self.delete()
+        with patch.object(archives, "_pvesh") as run:
+            for vmid, task in ((101, TASK), (100, "../../status"), (100, None), (100, TASK + "x")):
+                with self.assertRaises(archives.BackupArchiveError):
+                    archives.guest_backup_deletion_status(vmid, task)
+            archives._tasks[TASK]["created"] -= 3601
+            with self.assertRaises(archives.BackupArchiveError):
+                archives.guest_backup_deletion_status(100, TASK)
+        run.assert_not_called()
+
+    def test_invalid_native_task_answers_never_claim_success(self):
+        for response in ("", {}, [TASK], TASK.replace("imgdel", "vzdump"), TASK.replace("pve1", "pve2")):
+            self.response = response
+            with self.subTest(response=response):
+                self.assertEqual(self.delete()["results"][0]["status"], "unconfirmed")
+
+    def test_pvesh_uses_argv_and_handles_failure_and_timeout(self):
+        with patch.object(archives.subprocess, "run", return_value=types.SimpleNamespace(returncode=0, stdout="null")) as run:
+            self.assertIsNone(archives._pvesh(["delete", "/native/path"]))
+        self.assertEqual(run.call_args.args[0], ["pvesh", "delete", "/native/path", "--output-format", "json"])
+        self.assertNotIn("shell", run.call_args.kwargs)
+        with patch.object(archives.subprocess, "run", return_value=types.SimpleNamespace(returncode=0, stdout="")):
+            self.assertIsNone(archives._pvesh(["delete", "/native/path"]))
+        for response in (types.SimpleNamespace(returncode=1, stderr="protected", stdout=""),
+                         types.SimpleNamespace(returncode=0, stdout="not JSON")):
+            with patch.object(archives.subprocess, "run", return_value=response), self.assertRaises(archives.BackupArchiveError):
+                archives._pvesh(["delete", "/native/path"])
+        for error in (FileNotFoundError(), subprocess.TimeoutExpired("pvesh", 20)):
+            with patch.object(archives.subprocess, "run", side_effect=error), self.assertRaises(archives.BackupArchiveError):
+                archives._pvesh(["delete", "/native/path"])
+
+
+class RouteTests(unittest.TestCase):
+    """Compile the real route bodies/decorators without starting host services."""
+    def setUp(self):
+        auth = types.ModuleType("auth_manager")
+        auth.load_auth_config = lambda: {"enabled": True}
+        auth.verify_token = lambda token: "tester" if token == "admin" else None
+        auth.verify_token_full = lambda token: ("tester", "full_admin" if token == "admin" else "read_only")
+        spec = importlib.util.spec_from_file_location("guest_backup_test_middleware", SCRIPTS / "jwt_middleware.py")
+        middleware = importlib.util.module_from_spec(spec)
+        with patch.dict(sys.modules, auth_manager=auth):
+            spec.loader.exec_module(middleware)
+        self.app = Flask(__name__)
+        self.service = Mock(return_value={"results": []})
+        self.status = Mock(return_value={"volid": VOLUME, "status": "deleted"})
+        self.invalidate = Mock()
+        self.namespace = {"app": self.app, "require_admin_scope": middleware.require_admin_scope,
+                          "request": request, "jsonify": jsonify, "BackupArchiveError": archives.BackupArchiveError,
+                          "delete_guest_backups": self.service, "guest_backup_deletion_status": self.status,
+                          "_vm_cache_invalidate": self.invalidate, "_vm_backups_cache": {}}
+        source = ast.parse((SCRIPTS / "flask_server.py").read_text())
+        wanted = {"api_delete_vm_backups", "api_vm_backup_deletion_status"}
+        routes = [node for node in source.body if isinstance(node, ast.FunctionDef) and node.name in wanted]
+        self.assertEqual(len(routes), 2)
+        exec(compile(ast.Module(body=routes, type_ignores=[]), "flask_server.py", "exec"), self.namespace)
+        self.client = self.app.test_client()
+
+    def test_both_routes_reject_unauthenticated_and_read_only_requests(self):
+        for headers, status in (({}, 401), ({"Authorization": "Bearer reader"}, 403)):
+            self.assertEqual(self.client.post("/api/vms/100/backups/delete", json={}, headers=headers).status_code, status)
+            self.assertEqual(self.client.get("/api/vms/100/backups/delete-status?task=x", headers=headers).status_code, status)
+        self.service.assert_not_called()
+        self.status.assert_not_called()
+        self.invalidate.assert_not_called()
+
+    def test_admin_route_passes_payload_and_invalidates_even_after_errors(self):
+        data = {"confirm": True, "backups": [{"storage": "local", "volid": VOLUME}]}
+        headers = {"Authorization": "Bearer admin"}
+        self.assertEqual(self.client.post("/api/vms/100/backups/delete", json=data, headers=headers).status_code, 200)
+        self.service.assert_called_once_with(100, data)
+        self.invalidate.assert_called_once_with(100, {})
+        self.service.side_effect = archives.BackupArchiveError("protected", 409)
+        self.assertEqual(self.client.post("/api/vms/100/backups/delete", json=data, headers=headers).status_code, 409)
+        self.assertEqual(self.invalidate.call_count, 2)
+
+    def test_poll_invalidates_only_after_completion(self):
+        headers = {"Authorization": "Bearer admin"}
+        self.status.return_value = {"status": "pending"}
+        self.client.get("/api/vms/100/backups/delete-status?task=x", headers=headers)
+        self.invalidate.assert_not_called()
+        self.status.return_value = {"status": "deleted"}
+        self.client.get("/api/vms/100/backups/delete-status?task=x", headers=headers)
+        self.status.assert_called_with(100, "x")
+        self.invalidate.assert_called_once_with(100, {})
+
+    def test_runtime_module_is_shipped(self):
+        self.assertIn('cp "$SCRIPT_DIR/guest_backup_archives.py" "$APP_DIR/usr/bin/"', (SCRIPTS / "build_appimage.sh").read_text())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_vm_backup_jobs_api.py b/tests/test_vm_backup_jobs_api.py
index cd7a2fda..b5e50396 100644
--- a/tests/test_vm_backup_jobs_api.py
+++ b/tests/test_vm_backup_jobs_api.py
@@ -1,5 +1,6 @@
 """VM/CT backup jobs API: what reaches pvesh, with pvesh itself replaced."""
 import importlib
+import importlib.util
 import json
 import sys
 import types
@@ -23,6 +24,34 @@ GUESTS = [{"vmid": 100, "name": "web", "type": "qemu", "node": "pve1"},
           {"vmid": 200, "name": "other", "type": "qemu", "node": "pve2"}]
 
 
+@unittest.skipIf(Flask is None, "Flask runtime required")
+class StorageRetentionAuthorizationTests(unittest.TestCase):
+    def test_real_authentication_guard_blocks_read_only_writes_before_pvesh(self):
+        scripts = Path(__file__).resolve().parents[1] / "AppImage/scripts"
+        auth = types.ModuleType("auth_manager")
+        auth.load_auth_config = lambda: {"enabled": True}
+        auth.verify_token = lambda token: "tester" if token in ("admin", "reader") else None
+        auth.verify_token_full = lambda token: ("tester", "full_admin" if token == "admin" else "read_only")
+        spec = importlib.util.spec_from_file_location("storage_retention_middleware", scripts / "jwt_middleware.py")
+        middleware = importlib.util.module_from_spec(spec)
+        with patch.dict(sys.modules, auth_manager=auth):
+            spec.loader.exec_module(middleware)
+        spec = importlib.util.spec_from_file_location("storage_retention_auth_routes", scripts / "flask_vm_backup_routes.py")
+        routes = importlib.util.module_from_spec(spec)
+        with patch.dict(sys.modules, jwt_middleware=middleware):
+            spec.loader.exec_module(routes)
+        app = Flask(__name__)
+        app.register_blueprint(routes.vm_backup_bp)
+        client = app.test_client()
+        data = {"digest": "a" * 40, "prune_backups": "keep-last=3"}
+        with patch.object(routes, "_pvesh") as run:
+            self.assertEqual(client.get("/api/vm-backup-storages").status_code, 401)
+            self.assertEqual(client.put("/api/vm-backup-storages/local", json=data).status_code, 401)
+            self.assertEqual(client.put("/api/vm-backup-storages/local", json=data,
+                                        headers={"Authorization": "Bearer reader"}).status_code, 403)
+        run.assert_not_called()
+
+
 @unittest.skipIf(Flask is None, "Flask runtime required")
 class VmBackupJobsApiTests(unittest.TestCase):
     def setUp(self):
@@ -73,9 +102,63 @@ class VmBackupJobsApiTests(unittest.TestCase):
 
     def test_reading_needs_a_session_and_changing_needs_an_administrator(self):
         guards = dict((name, kind) for kind, name in self.guards)
-        self.assertEqual({name for name, kind in guards.items() if kind == "auth"}, {"list_jobs", "options", "get_job"})
+        self.assertEqual({name for name, kind in guards.items() if kind == "auth"}, {"list_jobs", "options", "get_job", "backup_storage_retention"})
         self.assertEqual({name for name, kind in guards.items() if kind == "admin"},
-                         {"create_job", "update_job", "delete_job", "toggle_job", "run_job"})
+                         {"create_job", "update_job", "delete_job", "toggle_job", "run_job", "update_backup_storage_retention"})
+
+    def test_storage_retention_lists_only_backup_storages_and_no_secrets(self):
+        with patch.object(self.routes, "_pvesh_json", return_value=(True, [
+            {"storage": "local", "type": "dir", "content": "backup,iso", "digest": "a" * 40,
+             "prune-backups": {"keep-last": 3}, "password": "private"},
+            {"storage": "images", "type": "dir", "content": "images", "digest": "a" * 40},
+        ])):
+            answer = self.client.get("/api/vm-backup-storages").get_json()
+        self.assertEqual(answer, {"storages": [{"id": "local", "type": "dir", "digest": "a" * 40, "prune_backups": "keep-last=3"}]})
+
+    def storage_policy(self, prune="keep-last=3,keep-weekly=2", digest="a" * 40, current=None):
+        if current is None:
+            current = {"storage": "local", "content": "backup,iso", "digest": "a" * 40}
+        with patch.object(self.routes, "_pvesh_json", return_value=(True, current)), self.pvesh():
+            return self.client.put("/api/vm-backup-storages/local", json={"digest": digest, "prune_backups": prune})
+
+    def test_saving_native_storage_retention_never_runs_pruning_or_changes_other_properties(self):
+        response = self.storage_policy()
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(self.changes(), [["set", "/storage/local", "--digest", "a" * 40,
+                                          "--prune-backups", "keep-last=3,keep-weekly=2"]])
+        self.calls.clear()
+        self.assertEqual(self.storage_policy("keep-all=1").status_code, 200)
+        self.assertEqual(self.changes()[0][-1], "keep-all=1")
+
+    def test_an_empty_policy_returns_the_storage_to_the_proxmox_default(self):
+        self.assertEqual(self.storage_policy("").status_code, 200)
+        self.assertEqual(self.changes(), [["set", "/storage/local", "--digest", "a" * 40, "--delete", "prune-backups"]])
+
+    def test_invalid_storage_retention_is_rejected_before_commands(self):
+        invalid = [None, [], {}, {"digest": "a" * 40, "prune_backups": []}]
+        for prune in ("keep-last=3,keep-daily=0", "keep-last=-1", "keep-all=0", "keep-all=2", "keep-last=0", "keep-last=1,keep-last=2",
+                      "keep-all=1,keep-last=2", "keep-last=2 --delete path", "keep-last=1\n", "keep-other=1"):
+            invalid.append({"digest": "a" * 40, "prune_backups": prune})
+        invalid += [{"digest": "invalid", "prune_backups": "keep-last=1"}]
+        with patch.object(self.routes, "_pvesh") as run:
+            for data in invalid:
+                with self.subTest(data=data):
+                    self.assertEqual(self.client.put("/api/vm-backup-storages/local", json=data).status_code, 400)
+            self.assertEqual(self.client.put("/api/vm-backup-storages/-bad", json=invalid[-1]).status_code, 400)
+        run.assert_not_called()
+
+    def test_stale_storage_configuration_or_non_backup_storage_is_not_overwritten(self):
+        for current in ({"content": "backup", "digest": "b" * 40},
+                        {"content": "images", "digest": "a" * 40}):
+            self.assertEqual(self.storage_policy(current=current).status_code, 409)
+        self.assertEqual(self.changes(), [])
+
+    def test_native_storage_update_failure_is_visible(self):
+        with patch.object(self.routes, "_pvesh_json", return_value=(True, {"content": "backup", "digest": "a" * 40})), \
+                patch.object(self.routes, "_pvesh", return_value=(False, "configuration changed under lock")):
+            response = self.client.put("/api/vm-backup-storages/local", json={"digest": "a" * 40, "prune_backups": "keep-last=3"})
+        self.assertEqual(response.status_code, 409)
+        self.assertIn("changed", response.get_json()["error"])
 
     def test_the_list_gives_text_properties_and_the_host_backups_that_hang_from_a_job(self):
         with self.pvesh(), patch.object(self.routes, "_host_backups_attached",
diff --git a/web/app/[locale]/docs/post-install/optional/page.tsx b/web/app/[locale]/docs/post-install/optional/page.tsx
index 258b0b4e..5f1bc657 100644
--- a/web/app/[locale]/docs/post-install/optional/page.tsx
+++ b/web/app/[locale]/docs/post-install/optional/page.tsx
@@ -312,25 +312,31 @@ EOF
       <p className="text-lg mb-2">{t("figurine.automates")}</p>
       <CopyableCode
         code={`
-# Check for previous installation and remove if found
-if command -v figurine &> /dev/null; then
-  rm -f "/usr/local/bin/figurine"
-fi
-
 # Download and install Figurine
-version="2.0.0"
-file="figurine_linux_amd64_v\${version}.tar.gz"
+(
+set -e
+version="\${FIGURINE_VERSION:-2.1.1}"
+arch="$(dpkg --print-architecture 2>/dev/null || uname -m)"
+case "$arch" in
+  amd64|x86_64) arch="amd64" ;;
+  arm64|aarch64) arch="arm64" ;;
+  armhf|armv7l|armv8l) arch="arm" ;;
+  *) echo "Unsupported architecture for Figurine: $arch" >&2; exit 1 ;;
+esac
+file="figurine_linux_\${arch}_v\${version}.tar.gz"
 url="https://github.com/arsham/figurine/releases/download/v\${version}/\${file}"
-wget -qO "/tmp/\${file}" "\${url}"
-tar -xf "/tmp/\${file}" -C "/tmp"
-mv "/tmp/deploy/figurine" "/usr/local/bin/figurine"
-chmod +x "/usr/local/bin/figurine"
+temp_dir="$(mktemp -d)"
+trap 'rm -rf "$temp_dir"' EXIT
+wget -qO "\${temp_dir}/\${file}" "\${url}"
+tar -xf "\${temp_dir}/\${file}" -C "$temp_dir"
+install -m 0755 "\${temp_dir}/deploy/figurine" "/usr/local/bin/figurine"
 
 # Create welcome message script
 cat << 'EOF' > "/etc/profile.d/figurine.sh"
 /usr/local/bin/figurine -f "3d.flf" $(hostname)
 EOF
 chmod +x "/etc/profile.d/figurine.sh"
+)
   `}
       />
 
diff --git a/web/messages/en/docs/post-install/optional.json b/web/messages/en/docs/post-install/optional.json
index a7221f42..dc3a1d04 100644
--- a/web/messages/en/docs/post-install/optional.json
+++ b/web/messages/en/docs/post-install/optional.json
@@ -119,9 +119,9 @@
     "intro": "This option installs and configures Figurine, a tool that creates stylish ASCII text banners for your terminal, displaying your hostname in a visually appealing 3D format.",
     "doesLabel": "What it does:",
     "doesItems": [
-      "Downloads and installs Figurine v2.0.0 from GitHub",
+      "Downloads and installs Figurine v2.1.1 from GitHub for the host architecture (AMD64, ARM64 or ARMv7)",
       "Creates a welcome message that displays your hostname in 3D ASCII art when you log in",
-      "Automatically removes any previous Figurine installation if present",
+      "Updates an existing Figurine binary after download and extraction succeed",
       "Sets up the welcome message to run automatically at login"
     ],
     "practicalLabel": "Practical Use:",
diff --git a/web/messages/es/docs/post-install/optional.json b/web/messages/es/docs/post-install/optional.json
index 0882f1ac..a2ab138a 100644
--- a/web/messages/es/docs/post-install/optional.json
+++ b/web/messages/es/docs/post-install/optional.json
@@ -119,9 +119,9 @@
     "intro": "Esta opción instala y configura Figurine, una herramienta que crea banners de texto ASCII con estilo para tu terminal, mostrando tu hostname en un formato 3D atractivo visualmente.",
     "doesLabel": "Qué hace:",
     "doesItems": [
-      "Descarga e instala Figurine v2.0.0 desde GitHub",
+      "Descarga e instala Figurine v2.1.1 desde GitHub para la arquitectura del host (AMD64, ARM64 o ARMv7)",
       "Crea un mensaje de bienvenida que muestra tu hostname en ASCII art 3D al hacer login",
-      "Elimina automáticamente cualquier instalación previa de Figurine si la hay",
+      "Actualiza el binario existente de Figurine tras descargar y extraer el paquete correctamente",
       "Configura el mensaje de bienvenida para que se ejecute automáticamente al hacer login"
     ],
     "practicalLabel": "Uso práctico:",