merge: schedule hours name the panel server's zone, and the retention text is one key per language
merge: a restored customer config is checked by directive and path, not by bytes
merge: the stall watchdog judges progress by restic's own counters
fix(backup): a customer config restore refuses vhost and include files that leave the customer's area, naming file, line and directive
fix(backup): the stall watchdog judges a run by restic's own progress counters instead of the bytes it moves
fix(i18n): the retention of a schedule is one key with the number as a parameter in every language
docs(backup): the customer documentation and the schema say the schedule hour is read in the panel server's time zone, not UTC
docs(audit): investigate and decide what a forged restore snapshot can set inside the customer path
merge: the audit log names the acting person and reports schedule times in the schedule's zone
merge: backup quick view, log ordering and pool rendering from the panel
feat(audit): the log sorts on the server by the columns the endpoint allows, and the user column names a person, a system process or only an id
docs(notes): measure what customer vhosts contain beyond the template and propose a content check for restored configs
docs(notes): record the audit log baseline of the test box before the user-name fix
fix(audit): the audit log names the acting person
docs(notes): the interface fixture on the test box is removed
feat(backup): the count of older snapshots names its source and time, and deleting history entries says the backups stay
fix(backup): a restore report counts databases, not problems, and a config-only restore no longer claims files and databases came back
docs(notes): fixture cases for the backup interface on the test box and the cancel chain from the button to the audit entry
fix(backup): the quick view of the snapshots no longer reports zero legacy snapshots where the repository holds them, and says where its count comes from
fix(logs): the audit log and the notification log list the newest entries first unless an order is asked for
fix(prestashop): a direct link to one installation opens it instead of saying there are none
fix(a11y): ten of seventeen settings sections had unnamed switches, inputs or a low-contrast tag, and the gate only ever scanned the default section
docs(notes): re-measure the full and mail restore of the testing build, with the foreign-path snapshot and the server restore
docs(changelog): add the testing pill for v2026.10.07.07
fix(backup): after a config restore the customer's PHP pool is rendered from the panel instead of being read from the snapshot
merge: the german restore report says wiederhergestellt throughout
merge: the uptime mail names its time zone, and a dead rate-limit formatter is gone
merge: the stall watchdog gives the upload tail its own budget, and the docs name what lftp and ssh already do
docs: CLAUDE.md carries invariants and signposts, domain knowledge moves to docs/
docs: drop the three hand-kept code inventories and the dead path that made reading them mandatory
docs(notes): the test box was starved by clamd, not by the backup runs, and the healthy tail ran 27 minutes without counter progress
docs(notes): record the watchdog confirmation runs so far and the box that stopped answering during them
docs(notes): re-measure the audit's key figures at the end of the day
docs(notes): the measurements that wait after the pause
merge: a backup checks what the panel says must be in the snapshot and reports what is not
docs(notes): exact lines for the enhance import order
fix(backup): a gap is read again over two minutes before it counts, so a deletion that takes a while no longer makes a healthy run incomplete
feat(backup): the incomplete view words an expected item per kind in all 15 languages, and the note states when the check can raise a false alarm
fix(backup): the expectation leaves out what the records place on another server and names a certificate by its lineage path
feat(backup): a run reports what the panel expected in the snapshot and it lacks, and settles each gap against the records before it counts
merge: a backup target on the customer's own host must carry its own credentials, and saving one without them is refused
fix(backup): a schedule that points at its own host must carry its own credentials, saved or refused up front
docs(i18n): the baseline header states the enforced shrink-only rule
merge: an ftp backup no longer installs a package mid-run, and lftp's own timeouts are nailed down by a test
docs(notes): the silent-target time is a measurement with a spread, not one number
docs(backup): the FTP stall times are stated as the order of magnitude they were measured at
docs(backup): how an FTP target that goes silent or transfers extremely slowly is handled
fix(backup): a missing lftp stops an FTP operation with a message instead of being installed in the middle of it
merge: a forged mail snapshot cannot set ownership, setuid or device files in a maildir
Merge branch 'main' of https://git.netcell-it.de/projekte/netcell-webpanel
merge: punctuation guardrail, typography, restore wording and the setup wizard in six languages
fix(backup): a mail restore no longer trusts a forged snapshot's device nodes, setuid bits or escaping symlinks
fix(i18n): the untranslated guardrail's baseline can only shrink — --update refuses to add, --accept-new with a reason is the one way in
docs(backup): ssh usually ends a silent SFTP target before the stall budgets, which are the fallback
fix(i18n): the first-run setup wizard is translated in Spanish, French, Italian, Dutch, Polish and Turkish
feat(i18n): a guardrail for English copies in the other languages — a ratchet with a baseline of 1361, new copies fail the release gate
fix(i18n): the onboarding was an English copy in six languages — 24 of 45 texts, including 'Package created!' and 'Customer Created!', are translated in es, fr, it, nl, pl and tr
docs(notes): the sort order is as required, and the test account was a database insert, not the product path
docs(notes): measure the audit log naming, the pool render, the config directive check and the blackholes of the testing build on the test box
docs(notes): record the #87 renewal-hook merge and the regex-vs-parser-semantics lesson
merge: a forged certbot renewal conf can no longer carry root hooks into a restore
fix(backup): the watchdog gives the upload tail its own budget and keeps the scan phase strict
fix(backup): a restored renewal config can't smuggle a root hook past certbot's own timer
docs(notes): what restic's json stream offers during the upload tail, and the slow-but-healthy run
docs(changelog): regenerate the testing index for the current build
docs(notes): correct the embedding finding — the health endpoint answers while the embeddings endpoint hangs
fix(backup): normalize what a forged restore snapshot can set inside the customer's web root
docs(notes): audit the engineering system and propose a target design, measured not assumed
feat(i18n): fail the release on punctuation the language does not allow
fix(i18n): French no-break spaces, Chinese and Japanese full-width signs in every file, not only the backup texts
Merge remote-tracking branch 'origin/fix/ja-restore-term' into fix/typography-source
fix(i18n): one dash in every language, French protected spaces and the Japanese colon in the whole backup file
fix(i18n): French uses protected spaces before colon, semicolon and question mark in the backup texts, Chinese and Japanese use their own dash and colon
fix(i18n): German says wiederhergestellt for restoring in the restore report as everywhere else
fix(i18n): Japanese says 復元 for restoring a backup everywhere instead of mixing it with リストア
refactor(acme): remove the rate-limit message formatter nothing calls
fix(uptime): the outage mail names its time zone, taken from the same source as the schedules
merge: the a11y gate keeps chromium's caches inside its own work dir and on disk, not in tmpfs
docs(changelog): regenerate the testing index for the current build
docs(notes): a release commit above a merge did not prove what the package held
fix(a11y-gate): scope Chromium's caches and browser profile into the run's own work dir, prefer a disk-backed tmp root
docs(adr): record why instructions and knowledge are separated and why no generator replaces the inventories
merge: the a11y gate scans the two toolkit detail pages, and a missing site url is a dash instead of a nameless link