From 11e247f59ef03c3cd2c7bb235596a2f4cfd436e5 Mon Sep 17 00:00:00 2001
From: Helix <267227783+helix-nine@users.noreply.github.com>
Date: Fri, 21 Aug 2026 16:38:03 +0000
Subject: [PATCH 1/3] chore: bump Nextcloud to 34.0.3; 33.0.8:3 -> 34.0.3:0

Bumps the bundled Nextcloud image from 33.0.8 to 34.0.3, crossing the
major from the 33 series to 34. The 33 line has not moved since 33.0.8,
so 34.0.3 is the only upstream release available.

nextcloud:34.0.3-apache is published for amd64 and arm64. Postgres and
Valkey track floating majors and are unchanged; Nextcloud 34's system
requirements still list PostgreSQL 17 as supported.

Nextcloud 34 adds appstore, files_lock and office to core/shipped.json's
defaultEnabled, and appstore to alwaysEnabled. The preserved-defaults
list in the Disable Non-default Apps action is a hand-maintained mirror
of that file, so all three are added. appstore in particular is
load-bearing: occ app:disable exits non-zero on an alwaysEnabled app and
the action runs under execFail, so without it the action would throw.

UPDATING.md documented only a patch bump. It now records the four extra
checks a major needs, which is what this bump had to do by hand.

Release notes describe the Nextcloud 34 feature set rather than the
34.0.1-34.0.3 point fixes: every one of those was backported to the 33
line too, so a user arriving from 33.0.8 already has them.

Does not merge as-is. An install still on 32.0.11:0 is offered this
update, migrates through the version graph, and then fails init on the
one-major-at-a-time guard. See the PR description.
---
 UPDATING.md                                   |   7 ++
 nextcloud.Dockerfile                          |   2 +-
 package-lock.json                             |   2 +-
 .../maintenance/disableUnstableApps.ts        |   3 +
 startos/versions/current.ts                   | 112 +++++++++++++++++-
 5 files changed, 118 insertions(+), 8 deletions(-)

diff --git a/UPDATING.md b/UPDATING.md
index dcc9048..3eb9c1e 100644
--- a/UPDATING.md
+++ b/UPDATING.md
@@ -37,6 +37,13 @@ Current pin: `valkey/valkey:9-alpine` in `startos/manifest/index.ts` (`images.va
 
 **Nextcloud** — bump the `NEXTCLOUD_VERSION` `ARG` default in `nextcloud.Dockerfile` to the new patch version (e.g. `32.0.9` → `32.0.10`). The `-apache` suffix is appended by the `FROM` line; don't include it in the ARG value.
 
+A **major** bump (e.g. `33.0.8` → `34.0.3`) needs four more checks:
+
+- Diff `core/shipped.json` between the two tags and add whatever the new major appends to `defaultEnabled` and `alwaysEnabled` to the `defaultApps` list in `startos/actions/maintenance/disableUnstableApps.ts`. `occ app:disable` exits non-zero on an `alwaysEnabled` app, and the action runs under `execFail`, so one missing id breaks the recovery action a locked-out user is told to run.
+- Check `$OC_VersionCanBeUpgradedFrom` in the new tag's `version.php`. Nextcloud upgrades one major at a time, so every version the registry still lists must be within one major of the new image — `startos/init/bootstrapNextcloud.ts` refuses the rest and StartOS rolls the update back.
+- Diff `config/config.sample.php` between the two tags against the keys `startos/fileModels/config.php.ts` models, and against the defaults the README and `instructions.md` quote.
+- Re-check the new major's system requirements page for the supported PostgreSQL and PHP versions.
+
 **Postgres** — change the `dockerTag` value in `images.postgres.source` in `startos/manifest/index.ts`. The pin tracks the `17` major; bumping across major versions (e.g. `17` → `18`) requires a data migration in `startos/versions/`.
 
 **Valkey** — change the `dockerTag` value in `images.valkey.source` in `startos/manifest/index.ts`. The pin tracks the `9` major.
diff --git a/nextcloud.Dockerfile b/nextcloud.Dockerfile
index e72e66f..620768e 100644
--- a/nextcloud.Dockerfile
+++ b/nextcloud.Dockerfile
@@ -1,4 +1,4 @@
-ARG NEXTCLOUD_VERSION=33.0.8
+ARG NEXTCLOUD_VERSION=34.0.3
 FROM nextcloud:${NEXTCLOUD_VERSION}-apache
 
 RUN apt-get update \
diff --git a/package-lock.json b/package-lock.json
index a23f727..ed88aad 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1620,7 +1620,7 @@
       }
     },
     "node_modules/filebrowser-startos": {
-      "resolved": "git+ssh://git@github.com/Start9Labs/filebrowser-startos.git#c35ff453de36cc649d67ebc9d3a391111cc78dd8",
+      "resolved": "git+ssh://git@github.com/Start9Labs/filebrowser-startos.git#ed1240894fdc3a63877b528e906e101753392e1e",
       "dependencies": {
         "@start9labs/start-sdk": "2.0.9"
       }
diff --git a/startos/actions/maintenance/disableUnstableApps.ts b/startos/actions/maintenance/disableUnstableApps.ts
index d6e6c0b..9a10b5d 100644
--- a/startos/actions/maintenance/disableUnstableApps.ts
+++ b/startos/actions/maintenance/disableUnstableApps.ts
@@ -33,6 +33,7 @@ export const disableUnstableApps = sdk.Action.withoutInput(
           'activity',
           'admin_audit',
           'app_api',
+          'appstore',
           'bruteforcesettings',
           'calendar',
           'circles',
@@ -48,6 +49,7 @@ export const disableUnstableApps = sdk.Action.withoutInput(
           'files',
           'files_downloadlimit',
           'files_external',
+          'files_lock',
           'files_pdfviewer',
           'files_reminders',
           'files_sharing',
@@ -59,6 +61,7 @@ export const disableUnstableApps = sdk.Action.withoutInput(
           'nextcloud_announcements',
           'notifications',
           'oauth2',
+          'office',
           'password_policy',
           'photos',
           'privacy',
diff --git a/startos/versions/current.ts b/startos/versions/current.ts
index 97571bb..94cd6b3 100644
--- a/startos/versions/current.ts
+++ b/startos/versions/current.ts
@@ -1,13 +1,113 @@
 import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
 
 export const current = VersionInfo.of({
-  version: '33.0.8:3',
+  version: '34.0.3:0',
   releaseNotes: {
-    en_US: `New optional dependency on **Coturn** relays Nextcloud Talk's voice and video calls through NAT and restrictive firewalls, so a call connects even when both parties are behind one. Turn it on with **Relay Talk Calls Through Coturn** in the Configure action; it needs the Talk app installed in Nextcloud and Coturn running with a public domain of its own. Talk's existing STUN and TURN entries are left alone.`,
-    es_ES: `La nueva dependencia opcional de **Coturn** retransmite las llamadas de voz y vídeo de Nextcloud Talk a través de NAT y de cortafuegos restrictivos, de modo que una llamada se establece incluso cuando ambas partes están detrás de uno. Actívela con **Retransmitir las llamadas de Talk a través de Coturn** en la acción Configuración; requiere la aplicación Talk instalada en Nextcloud y Coturn en ejecución con su propio dominio público. Las entradas STUN y TURN que Talk ya tuviera se dejan intactas.`,
-    de_DE: `Die neue optionale Abhängigkeit **Coturn** leitet die Sprach- und Videoanrufe von Nextcloud Talk durch NAT und restriktive Firewalls, sodass ein Anruf auch dann zustande kommt, wenn beide Seiten dahinter sitzen. Einschalten mit **Talk-Anrufe über Coturn weiterleiten** in der Aktion Konfiguration; erforderlich sind die in Nextcloud installierte Talk-App und ein laufendes Coturn mit eigener öffentlicher Domain. Bereits vorhandene STUN- und TURN-Einträge von Talk bleiben unangetastet.`,
-    pl_PL: `Nowa opcjonalna zależność **Coturn** przekazuje połączenia głosowe i wideo Nextcloud Talk przez NAT i restrykcyjne zapory, dzięki czemu połączenie zestawia się nawet wtedy, gdy obie strony są za nimi. Włącz ją opcją **Przekazuj połączenia Talk przez Coturn** w akcji Konfiguracja; wymaga zainstalowanej w Nextcloud aplikacji Talk oraz działającego Coturn z własną domeną publiczną. Istniejące wpisy STUN i TURN aplikacji Talk pozostają nietknięte.`,
-    fr_FR: `La nouvelle dépendance optionnelle **Coturn** relaie les appels audio et vidéo de Nextcloud Talk à travers le NAT et les pare-feu restrictifs, de sorte qu'un appel aboutit même lorsque les deux parties se trouvent derrière l'un d'eux. Activez-la avec **Relayer les appels Talk via Coturn** dans l'action Configuration ; elle nécessite l'application Talk installée dans Nextcloud et un Coturn démarré avec un domaine public qui lui est propre. Les entrées STUN et TURN déjà présentes dans Talk ne sont pas modifiées.`,
+    en_US: `Updated Nextcloud to 34.0.3 — a major upgrade from the Nextcloud 33 series.
+
+**New in Nextcloud 34**
+
+- A redesigned top bar: apps move into a launcher menu, and the search box sits in the middle.
+- Calendars can now be shared with, and edited on, another Nextcloud server.
+- Temporary file locking ships with Nextcloud. Lock a shared file while you work on it so nobody overwrites your changes.
+- A new **Office** section in the navigation, with a chooser for which office suite to use.
+- The Files list gains filters in the top bar, a marker for recently created files, and a warning before you create a hidden file.
+- Contacts can be filtered by team, and team members can be found on federated servers.
+
+Nextcloud backported the 34.0.1–34.0.3 maintenance fixes to the 33 line as well, so coming from 33.0.8 you already have them. The features above are what this update adds.
+
+**Worth knowing**
+
+- Apps you installed yourself from the Nextcloud app store may need updates of their own. Nextcloud 34 removes several long-deprecated interfaces; an app still using them is disabled during the upgrade, or breaks the web interface. If the interface stops loading, run **Disable Non-default Apps** from the Maintenance group, then re-enable your apps one at a time.
+- The update runs a database schema change, so it takes longer than a maintenance release.
+- PHP moves to 8.5, the version Nextcloud 34 recommends.
+- Nextcloud Desktop clients older than 3.2.50 are refused. Any client from the last few years is well past that.
+
+Full changelog: https://github.com/nextcloud-releases/server/releases/tag/v34.0.3`,
+    es_ES: `Nextcloud actualizado a 34.0.3: una actualización mayor desde la serie 33 de Nextcloud.
+
+**Novedades de Nextcloud 34**
+
+- Barra superior rediseñada: las aplicaciones pasan a un menú de acceso y el cuadro de búsqueda queda en el centro.
+- Los calendarios ya se pueden compartir con otro servidor Nextcloud y editarse en él.
+- El bloqueo temporal de archivos viene incluido en Nextcloud. Bloquee un archivo compartido mientras trabaja en él para que nadie sobrescriba sus cambios.
+- Una nueva sección **Office** en la navegación, con un selector de la suite ofimática que desee usar.
+- La lista de Archivos incorpora filtros en la barra superior, una marca para los archivos creados recientemente y un aviso antes de crear un archivo oculto.
+- Los contactos se pueden filtrar por equipo, y los miembros de un equipo se pueden buscar en servidores federados.
+
+Nextcloud también retroportó a la serie 33 las correcciones de mantenimiento de 34.0.1 a 34.0.3, así que si viene de 33.0.8 ya las tiene. Lo que aporta esta actualización son las novedades anteriores.
+
+**Conviene saber**
+
+- Las aplicaciones que haya instalado usted desde la tienda de Nextcloud pueden necesitar su propia actualización. Nextcloud 34 elimina varias interfaces obsoletas desde hace tiempo; una aplicación que aún las use se desactiva durante la actualización o rompe la interfaz web. Si la interfaz deja de cargarse, ejecute **Desactivar aplicaciones no predeterminadas** en el grupo Mantenimiento y vuelva a activar sus aplicaciones una a una.
+- La actualización ejecuta un cambio de esquema en la base de datos, por lo que tarda más que una versión de mantenimiento.
+- PHP pasa a la versión 8.5, la recomendada por Nextcloud 34.
+- Los clientes de Nextcloud Desktop anteriores a la versión 3.2.50 se rechazan. Cualquier cliente de los últimos años supera con creces esa versión.
+
+Registro de cambios completo: https://github.com/nextcloud-releases/server/releases/tag/v34.0.3`,
+    de_DE: `Nextcloud auf 34.0.3 aktualisiert — ein Upgrade auf eine neue Hauptversion, ausgehend von der Nextcloud-Reihe 33.
+
+**Neu in Nextcloud 34**
+
+- Neu gestaltete Kopfleiste: Die Apps wandern in ein Startmenü, das Suchfeld sitzt in der Mitte.
+- Kalender lassen sich jetzt mit einem anderen Nextcloud-Server teilen und dort bearbeiten.
+- Das temporäre Sperren von Dateien gehört zum Lieferumfang von Nextcloud. Sperren Sie eine freigegebene Datei, während Sie daran arbeiten, damit niemand Ihre Änderungen überschreibt.
+- Ein neuer Bereich **Office** in der Navigation, mit einer Auswahl der zu verwendenden Office-Suite.
+- Die Dateiliste erhält Filter in der Kopfleiste, eine Markierung für kürzlich erstellte Dateien und eine Warnung, bevor Sie eine versteckte Datei anlegen.
+- Kontakte lassen sich nach Team filtern, und Teammitglieder können auf föderierten Servern gefunden werden.
+
+Nextcloud hat die Wartungskorrekturen aus 34.0.1 bis 34.0.3 auch in die Reihe 33 zurückportiert; wer von 33.0.8 kommt, hat sie also bereits. Was dieses Update bringt, sind die Neuerungen oben.
+
+**Wissenswert**
+
+- Selbst installierte Apps aus dem Nextcloud App Store benötigen möglicherweise ein eigenes Update. Nextcloud 34 entfernt mehrere seit Langem veraltete Schnittstellen; eine App, die sie noch nutzt, wird beim Upgrade deaktiviert oder macht die Weboberfläche unbrauchbar. Lädt die Oberfläche nicht mehr, führen Sie **Nicht-Standard-Apps deaktivieren** in der Gruppe Wartung aus und aktivieren Sie Ihre Apps anschließend einzeln wieder.
+- Das Update führt eine Schemaänderung an der Datenbank durch und dauert daher länger als eine Wartungsversion.
+- PHP wechselt auf 8.5, die von Nextcloud 34 empfohlene Version.
+- Nextcloud-Desktop-Clients älter als 3.2.50 werden abgewiesen. Jeder Client der letzten Jahre liegt weit darüber.
+
+Vollständiges Änderungsprotokoll: https://github.com/nextcloud-releases/server/releases/tag/v34.0.3`,
+    pl_PL: `Zaktualizowano Nextcloud do wersji 34.0.3 — to aktualizacja do nowej wersji głównej, wychodząca z serii 33.
+
+**Nowości w Nextcloud 34**
+
+- Przeprojektowany górny pasek: aplikacje trafiają do menu uruchamiania, a pole wyszukiwania znajduje się pośrodku.
+- Kalendarze można teraz udostępniać innemu serwerowi Nextcloud i tam je edytować.
+- Tymczasowe blokowanie plików jest częścią Nextcloud. Zablokuj udostępniony plik na czas pracy nad nim, aby nikt nie nadpisał Twoich zmian.
+- Nowa sekcja **Office** w nawigacji, z wyborem pakietu biurowego.
+- Lista plików zyskuje filtry w górnym pasku, oznaczenie ostatnio utworzonych plików i ostrzeżenie przed utworzeniem pliku ukrytego.
+- Kontakty można filtrować według zespołu, a członków zespołu wyszukiwać na serwerach federacyjnych.
+
+Nextcloud przeniósł poprawki konserwacyjne z wersji 34.0.1–34.0.3 także do serii 33, więc przechodząc z 33.0.8 już je masz. Ta aktualizacja wnosi opisane wyżej nowości.
+
+**Warto wiedzieć**
+
+- Aplikacje zainstalowane samodzielnie ze sklepu Nextcloud mogą wymagać własnych aktualizacji. Nextcloud 34 usuwa kilka od dawna przestarzałych interfejsów; aplikacja, która wciąż z nich korzysta, zostaje wyłączona podczas aktualizacji albo psuje interfejs webowy. Jeśli interfejs przestanie się ładować, uruchom **Wyłącz niestandardowe aplikacje** z grupy Konserwacja, a następnie włączaj swoje aplikacje pojedynczo.
+- Aktualizacja wykonuje zmianę schematu bazy danych, więc trwa dłużej niż wydanie konserwacyjne.
+- PHP przechodzi na wersję 8.5, zalecaną przez Nextcloud 34.
+- Klienty Nextcloud Desktop starsze niż 3.2.50 są odrzucane. Każdy klient z ostatnich lat jest znacznie nowszy.
+
+Pełny dziennik zmian: https://github.com/nextcloud-releases/server/releases/tag/v34.0.3`,
+    fr_FR: `Nextcloud mis à jour vers 34.0.3 — une mise à niveau majeure depuis la série Nextcloud 33.
+
+**Nouveautés de Nextcloud 34**
+
+- Barre supérieure repensée : les applications passent dans un menu de lancement et le champ de recherche se place au centre.
+- Les agendas peuvent désormais être partagés avec un autre serveur Nextcloud et modifiés depuis celui-ci.
+- Le verrouillage temporaire des fichiers est fourni avec Nextcloud. Verrouillez un fichier partagé pendant que vous y travaillez pour que personne n'écrase vos modifications.
+- Une nouvelle section **Office** dans la navigation, avec un sélecteur de suite bureautique.
+- La liste des fichiers gagne des filtres dans la barre supérieure, un repère pour les fichiers créés récemment et un avertissement avant la création d'un fichier caché.
+- Les contacts peuvent être filtrés par équipe, et les membres d'une équipe recherchés sur des serveurs fédérés.
+
+Nextcloud a également rétroporté vers la série 33 les correctifs de maintenance de 34.0.1 à 34.0.3 : en venant de 33.0.8, vous les avez déjà. Ce que cette mise à jour apporte, ce sont les nouveautés ci-dessus.
+
+**Bon à savoir**
+
+- Les applications que vous avez installées depuis la boutique Nextcloud peuvent nécessiter leur propre mise à jour. Nextcloud 34 supprime plusieurs interfaces obsolètes de longue date ; une application qui les utilise encore est désactivée pendant la mise à niveau, ou casse l'interface web. Si l'interface ne se charge plus, lancez **Désactiver les applications non standard** dans le groupe Maintenance, puis réactivez vos applications une par une.
+- La mise à jour effectue une modification du schéma de la base de données ; elle prend donc plus de temps qu'une version de maintenance.
+- PHP passe à la version 8.5, celle que Nextcloud 34 recommande.
+- Les clients Nextcloud Desktop antérieurs à 3.2.50 sont refusés. Tout client des dernières années est bien au-delà.
+
+Journal des modifications complet : https://github.com/nextcloud-releases/server/releases/tag/v34.0.3`,
   },
   migrations: {
     up: async () => {},

From 01ae564f63612abb502cc32c512c8a5bf0e24d2d Mon Sep 17 00:00:00 2001
From: Matt Hill <9935159+MattDHill@users.noreply.github.com>
Date: Sat, 22 Aug 2026 18:05:24 -0600
Subject: [PATCH 2/3] fix: harden the recovery paths Nextcloud 34 leans on
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 34 release notes point users at Disable Non-default Apps, and a major
upgrade is the event that leaves an app disabled but on disk. Both paths
were built for the quieter case.

Disable Non-default Apps ran every occ app:disable concurrently under
execFail, so the first non-zero exit rejected Promise.all and withTemp
destroyed the subcontainer under the still-running siblings — and the
"these were disabled" report was never returned. occ app:disable runs the
app's own uninstall repair steps, so a fataling app is both the likeliest
one to fail and the reason the action was run. Disables now run one at a
time through exec, and the result reports what was disabled and what was
not. Reading the enabled-app list moved into readEnabledApps, which
tolerates a PHP notice ahead of occ's JSON and a missing `enabled` key
rather than dying with a bare SyntaxError or TypeError.

talk-turn decided Talk was usable from the presence of custom_apps/spreed.
occ registers an app's command namespace only while the app is enabled, and
occ upgrade disables any app without a release for the new major, so after
a major upgrade the check passed while talk:turn:add did not exist: allOk
stayed false, the signature was never recorded, and the relay silently
stopped being applied while every chain build retried. It now reads the
enabled set. hasNextcloudApp keeps its presence semantics for the App
Commands prechecks, which must work with the service stopped.

The one-major-at-a-time guard named the problem but not the remedy. The
Marketplace version list still offers the intermediate releases, so the
message and the release notes now spell out the two-step update.

Closes #127
Closes #128
---
 README.md                                     |  4 +-
 instructions.md                               |  4 +-
 .../maintenance/disableUnstableApps.ts        | 51 +++++++++++--------
 startos/i18n/dictionaries/default.ts          |  5 ++
 startos/i18n/dictionaries/translations.ts     | 12 +++++
 startos/init/bootstrapNextcloud.ts            |  5 +-
 startos/main.ts                               | 19 ++++---
 startos/utils.ts                              | 46 ++++++++++++++---
 startos/versions/current.ts                   |  5 ++
 9 files changed, 111 insertions(+), 40 deletions(-)

diff --git a/README.md b/README.md
index 832f242..4d695e3 100644
--- a/README.md
+++ b/README.md
@@ -143,7 +143,7 @@ The four general settings — default locale, default phone region, the maintena
 - **Cost:** seconds, then a restart.
 - **Repeat safety:** idempotent; the form is pre-filled.
 
-**Relaying is advertised only once Coturn has a public domain.** With the toggle on but Coturn lacking one, no relay is configured and nothing reports that as an error — Talk falls back to direct connections, which is what it would do anyway. The toggle also does nothing until the Talk app itself is installed from the Nextcloud app store; until then the oneshot logs that it is waiting and applies the setting on a later start.
+**Relaying is advertised only once Coturn has a public domain.** With the toggle on but Coturn lacking one, no relay is configured and nothing reports that as an error — Talk falls back to direct connections, which is what it would do anyway. The toggle also does nothing until the Talk app itself is installed from the Nextcloud app store **and enabled** — `occ` exposes an app's command namespace only while it is enabled, and a major Nextcloud upgrade disables any app without a compatible release. Until then the oneshot logs that it is waiting and applies the setting on a later start.
 
 **Only the entries this package added are ever touched.** The `talk-turn` oneshot records what it applied and deletes exactly that before writing the new set, so Talk's default `stun.nextcloud.com:443` and anything an admin added by hand survive. Removing that default is a deliberate choice left to the admin — see Limitations.
 
@@ -161,7 +161,7 @@ Surfaces another StartOS service's files as a folder in Nextcloud Files, using N
 
 - **Reset Admin Password** generates a new password for a chosen admin account and shows it once. Only while running; the account list is read live.
 - **Disable Maintenance Mode** clears a stuck maintenance flag. Only while running. **Wait first** — brief maintenance mode after an update or a restart is normal, and this is for when it has lasted more than about fifteen minutes.
-- **Disable Non-default Apps** turns off every app that is not part of Nextcloud's default set. It is the recovery for an app that has made the UI return an Internal Server Error. Only while running, and **stable apps must be re-enabled individually afterwards.**
+- **Disable Non-default Apps** turns off every enabled app that Nextcloud does not ship, preserving the bundled set plus Calendar and Contacts. It is the recovery for an app that has made the UI return an Internal Server Error. Apps are disabled one at a time, and the result lists any that could not be — a fataling app is exactly what this action targets, so its own failure must not hide what did get disabled. Only while running, and **stable apps must be re-enabled individually afterwards.**
 - **Scan Files** rebuilds the file-cache index, which is what makes files added outside Nextcloud — over WebDAV's back door, rsync, or an external-storage mount — appear with correct sizes and turn up in search.
 - **Repair** runs Nextcloud's built-in repair routine against database inconsistencies, stale cache entries, and broken shares.
 
diff --git a/instructions.md b/instructions.md
index 01d20e0..dcca41b 100644
--- a/instructions.md
+++ b/instructions.md
@@ -37,7 +37,7 @@ Point a Nextcloud desktop or mobile client (or any WebDAV client) at the **WebDA
 - **External Storage** — surface another StartOS service's storage as a folder in your Nextcloud **Files**, using Nextcloud's built-in External Storage app. The action lists a dropdown for each supported service **you have installed** (today just **File Browser** → a `/FileBrowser` folder). Each dropdown is **Not mounted** (off), **Available to all users**, or **Available to specific users** (which then lets you pick exactly which Nextcloud users see it). The folder is read-write, so you can **move files out of it into Nextcloud**. Nextcloud must be **running** to run this action (it reads your live user list). Files other services add to File Browser appear automatically when you open the folder — so File Browser acts as the shared hub: point any service that should be visible in Nextcloud at File Browser.
 - **Reset Admin Password** — pick an admin user and generate a new random password. Use this if the admin password is lost or you want to rotate it.
 - **Disable Maintenance Mode** (Maintenance group) — runs `occ maintenance:mode --off`. Brief maintenance mode after an update or restart is normal — wait at least 15 minutes before resorting to this. Nextcloud version updates now run as part of the StartOS update step and roll back cleanly if they fail, so you should rarely need this.
-- **Disable Non-default Apps** (Maintenance group) — disables every non-default Nextcloud app. Use this if a third-party app has broken the UI with an Internal Server Error. Stable apps must then be re-enabled individually from the Nextcloud Apps page.
+- **Disable Non-default Apps** (Maintenance group) — disables every enabled app that Nextcloud does not ship, keeping the bundled set plus Calendar and Contacts. Use this if a third-party app has broken the UI with an Internal Server Error. The result lists what was disabled, and separately anything that could not be, so a single stuck app does not stop the rest. Stable apps must then be re-enabled individually from the Nextcloud Apps page.
 - **Scan Files** (Maintenance group) — queues a background rebuild of the file cache after files are synced into Nextcloud externally (rclone, rsync, SFTP, etc.). Run this if externally synced files appear stale, show wrong sizes, or are missing from search. On a large library the scan can take many minutes; progress shows as the **File Scan** health check on the service status page, and StartOS posts a notification when it finishes.
 - **Repair** (Maintenance group) — queues a background run of Nextcloud's built-in repair routine, fixing database inconsistencies, stale cache entries, and broken shares. Run this if files appear missing, shares return errors, or after a crash or abrupt shutdown. Progress shows as the **Repair** health check on the service status page, and StartOS posts a notification when it finishes.
 - **Download Machine Learning Models for Recognize** (App Commands group) — queues a background download of the ML models the Recognize app needs for object and face detection (~1-2 GB). Install the Recognize app from the Nextcloud App Store first. Progress shows on the service status page while the download is in flight, and StartOS posts a notification when it finishes.
@@ -50,7 +50,7 @@ Nextcloud Talk places calls directly between the two participants, which fails w
 
 Two things have to be in place first:
 
-1. **Install the Talk app** in Nextcloud, from **Apps** in the Nextcloud web UI.
+1. **Install the Talk app** in Nextcloud, from **Apps** in the Nextcloud web UI. It also has to stay enabled — a Nextcloud major upgrade disables any app that has no compatible release yet, and relaying is not applied again until you update Talk and re-enable it.
 2. **Install the separate Coturn service** from the StartOS marketplace, start it, and give it a public domain of its own, as its own instructions describe.
 
 Then turn the toggle on. Until all three are done, calls still work wherever a direct connection is possible, and nothing reports the missing relay as an error.
diff --git a/startos/actions/maintenance/disableUnstableApps.ts b/startos/actions/maintenance/disableUnstableApps.ts
index 9a10b5d..c9591e9 100644
--- a/startos/actions/maintenance/disableUnstableApps.ts
+++ b/startos/actions/maintenance/disableUnstableApps.ts
@@ -1,6 +1,6 @@
 import { i18n } from '../../i18n'
 import { sdk } from '../../sdk'
-import { nextcloudMount } from '../../utils'
+import { nextcloudMount, readEnabledApps } from '../../utils'
 
 export const disableUnstableApps = sdk.Action.withoutInput(
   // id
@@ -23,6 +23,7 @@ export const disableUnstableApps = sdk.Action.withoutInput(
   // the execution function
   async ({ effects }) => {
     const disabledApps: string[] = []
+    const failedApps: string[] = []
     await sdk.SubContainer.withTemp(
       effects,
       { imageId: 'nextcloud' },
@@ -90,32 +91,40 @@ export const disableUnstableApps = sdk.Action.withoutInput(
           'workflowengine',
         ]
 
-        const res = await sub.execFail(
-          ['php', 'occ', 'app:list', '--enabled', '--output=json'],
-          { user: 'www-data' },
-        )
-
-        const parsed = JSON.parse(res.stdout as string) as {
-          enabled: Record<string, string>
+        // Sequential, and tolerating failure: `occ app:disable` runs the app's
+        // own uninstall repair steps, so a fataling app — the very thing this
+        // action exists to escape — can exit non-zero or outlast exec's 30 s
+        // timeout. That must cost only its own line in the report.
+        for (const app of Object.keys(await readEnabledApps(sub))) {
+          if (defaultApps.includes(app)) continue
+          const res = await sub.exec(['php', 'occ', 'app:disable', app], {
+            user: 'www-data',
+          })
+          if (res.exitCode === 0) {
+            disabledApps.push(app)
+          } else {
+            failedApps.push(app)
+            console.error(
+              `disable-unstable-apps: could not disable ${app}: ${res.stdout.toString()} ${res.stderr.toString()}`,
+            )
+          }
         }
-
-        await Promise.all(
-          Object.keys(parsed.enabled).map((app) => {
-            if (!defaultApps.includes(app)) {
-              disabledApps.push(app)
-              return sub.execFail(['php', 'occ', 'app:disable', app], {
-                user: 'www-data',
-              })
-            }
-          }),
-        )
       },
     )
 
+    const list = (apps: string[]) =>
+      `<ul>${apps.map((app) => `<li>${app}</li>`).join('')}</ul>`
+
     return {
       version: '1',
-      title: i18n('Success'),
-      message: `${i18n('The following apps have been disabled:')} <ul>${disabledApps.map((app) => `<li>${app}</li>`).join('')}</ul>`,
+      title: failedApps.length ? i18n('Partially Successful') : i18n('Success'),
+      message:
+        (disabledApps.length
+          ? `${i18n('The following apps have been disabled:')} ${list(disabledApps)}`
+          : i18n('No non-default apps were enabled.')) +
+        (failedApps.length
+          ? `${i18n('These apps could not be disabled. The service logs say why:')} ${list(failedApps)}`
+          : ''),
       result: null,
     }
   },
diff --git a/startos/i18n/dictionaries/default.ts b/startos/i18n/dictionaries/default.ts
index 7d0a29d..0094961 100644
--- a/startos/i18n/dictionaries/default.ts
+++ b/startos/i18n/dictionaries/default.ts
@@ -197,6 +197,11 @@ const dict = {
 
   // versions/from035x.ts: 0.3.5x migration progress
   'Updating file permissions': 134,
+
+  // disableUnstableApps.ts: per-app outcome report
+  'Partially Successful': 137,
+  'No non-default apps were enabled.': 138,
+  'These apps could not be disabled. The service logs say why:': 139,
 } as const
 
 /**
diff --git a/startos/i18n/dictionaries/translations.ts b/startos/i18n/dictionaries/translations.ts
index aaabc2f..ab6ec76 100644
--- a/startos/i18n/dictionaries/translations.ts
+++ b/startos/i18n/dictionaries/translations.ts
@@ -139,6 +139,9 @@ export default {
     134: 'Actualizando permisos de archivos',
     135: 'Retransmitir las llamadas de Talk a través de Coturn',
     136: 'Retransmita las llamadas de Talk a través del servicio Coturn para que se establezcan cuando ambas partes están detrás de NAT o de un cortafuegos restrictivo. Requiere que la aplicación Talk esté instalada en Nextcloud y que Coturn esté instalado y en ejecución con su propio dominio público; hasta que ambos lo estén, las llamadas recurren a una conexión directa.',
+    137: 'Parcialmente correcto',
+    138: 'No había ninguna aplicación no predeterminada activada.',
+    139: 'Estas aplicaciones no se pudieron desactivar. El registro del servicio indica el motivo:',
   },
   de_DE: {
     0: 'Starte Nextcloud...',
@@ -278,6 +281,9 @@ export default {
     134: 'Dateiberechtigungen werden aktualisiert',
     135: 'Talk-Anrufe über Coturn weiterleiten',
     136: 'Talk-Anrufe über den Coturn-Dienst weiterleiten, damit sie auch zustande kommen, wenn beide Seiten hinter NAT oder einer restriktiven Firewall sitzen. Erfordert, dass die Talk-App in Nextcloud installiert ist und dass Coturn installiert ist, läuft und eine eigene öffentliche Domain hat; bis beides zutrifft, fallen Anrufe auf eine Direktverbindung zurück.',
+    137: 'Teilweise erfolgreich',
+    138: 'Es waren keine Nicht-Standard-Apps aktiviert.',
+    139: 'Diese Apps konnten nicht deaktiviert werden. Das Dienstprotokoll nennt den Grund:',
   },
   pl_PL: {
     0: 'Uruchamianie Nextcloud...',
@@ -417,6 +423,9 @@ export default {
     134: 'Aktualizowanie uprawnień plików',
     135: 'Przekazuj połączenia Talk przez Coturn',
     136: 'Przekazuj połączenia Talk przez usługę Coturn, aby zestawiały się, gdy obie strony są za NAT-em lub restrykcyjną zaporą. Wymaga zainstalowanej w Nextcloud aplikacji Talk oraz zainstalowanego i uruchomionego Coturn z własną domeną publiczną; dopóki nie ma obu, połączenia wracają do trybu bezpośredniego.',
+    137: 'Częściowo pomyślnie',
+    138: 'Żadne niestandardowe aplikacje nie były włączone.',
+    139: 'Tych aplikacji nie udało się wyłączyć. Powód znajdziesz w dzienniku usługi:',
   },
   fr_FR: {
     0: 'Démarrage de Nextcloud...',
@@ -556,5 +565,8 @@ export default {
     134: 'Mise à jour des permissions des fichiers',
     135: 'Relayer les appels Talk via Coturn',
     136: "Relayer les appels Talk via le service Coturn pour qu'ils aboutissent lorsque les deux parties sont derrière un NAT ou un pare-feu restrictif. Nécessite que l'application Talk soit installée dans Nextcloud et que Coturn soit installé et démarré avec un domaine public qui lui est propre ; tant que ce n'est pas le cas, les appels se rabattent sur une connexion directe.",
+    137: 'Partiellement réussi',
+    138: "Aucune application non standard n'était activée.",
+    139: "Ces applications n'ont pas pu être désactivées. Le journal du service en indique la raison :",
   },
 } satisfies Record<string, LangDict>
diff --git a/startos/init/bootstrapNextcloud.ts b/startos/init/bootstrapNextcloud.ts
index 30433c0..c63c25f 100644
--- a/startos/init/bootstrapNextcloud.ts
+++ b/startos/init/bootstrapNextcloud.ts
@@ -165,8 +165,9 @@ async function runUpstreamUpgrade(effects: T.Effects, progress: InitProgress) {
   if (image[0] > installed[0] + 1) {
     throw new Error(
       `Cannot update Nextcloud from major version ${installed[0]} directly to ${image[0]}. ` +
-        `Nextcloud only supports upgrading one major version at a time, and one or more intermediate ` +
-        `major releases were skipped.`,
+        `Nextcloud only supports upgrading one major version at a time. Update to a release ` +
+        `bundling Nextcloud ${installed[0] + 1} first — open this service in the Marketplace and ` +
+        `pick it from the version list — then update again.`,
     )
   }
 
diff --git a/startos/main.ts b/startos/main.ts
index fa466b2..c9a1dc3 100644
--- a/startos/main.ts
+++ b/startos/main.ts
@@ -27,7 +27,7 @@ import {
   getPostgresEnv,
   getPostgresSub,
   getValkeySub,
-  hasNextcloudApp,
+  readEnabledApps,
   nextcloudMount,
   TALK_APP,
   uiPort,
@@ -810,10 +810,11 @@ const EMPTY_TALK_TURN: TalkTurnApplied = {
  * Coturn's shared secret rather than the secret itself: enough for a rotated
  * secret to re-apply, without a second copy of it on this volume.
  *
- * Talk is installed by the user from the Nextcloud app store, so with its files
- * absent there is no `occ talk:*` namespace to call. That is left as a retry
- * rather than an error: the signature is not written, so the next chain build
- * applies the config once Talk is actually there.
+ * Talk is installed by the user from the Nextcloud app store, and `occ` exposes
+ * its `talk:*` namespace only while the app is enabled — which a major
+ * Nextcloud upgrade revokes from any app without a compatible release. Either
+ * way that is left as a retry rather than an error: the signature is not
+ * written, so the next chain build applies the config once Talk is back.
  */
 async function reconcileTalkTurn(
   subc: Awaited<ReturnType<typeof getNextcloudSub>>,
@@ -844,9 +845,13 @@ async function reconcileTalkTurn(
     return
   }
 
-  if (!(await hasNextcloudApp(TALK_APP))) {
+  const enabled = await readEnabledApps(subc).catch((e) => {
+    console.warn(`talk-turn: ${e}`)
+    return {}
+  })
+  if (!(TALK_APP in enabled)) {
     console.warn(
-      'talk-turn: the Talk (spreed) app is not installed in Nextcloud; leaving its STUN/TURN settings alone until it is',
+      'talk-turn: the Talk (spreed) app is not enabled in Nextcloud; leaving its STUN/TURN settings alone until it is',
     )
     return
   }
diff --git a/startos/utils.ts b/startos/utils.ts
index 7802dff..9e1a6b3 100644
--- a/startos/utils.ts
+++ b/startos/utils.ts
@@ -1,5 +1,6 @@
 import { sdk } from './sdk'
-import { T, utils } from '@start9labs/start-sdk'
+import { SubContainer, T, utils } from '@start9labs/start-sdk'
+import { manifest } from './manifest'
 
 export const uiPort = 80 as const
 export const NEXTCLOUD_PATH = '/var/www/html' as const
@@ -11,9 +12,9 @@ export const NEXTCLOUD_VOLUME_HOST = '/media/startos/volumes/nextcloud' as const
  * True if a Nextcloud app's files are present on the volume. Checks both
  * `custom_apps/` (user-installed) and `apps/` (built-in).
  *
- * Note: this only checks file presence, not whether the app is enabled in
- * Nextcloud's database. An installed-but-disabled app passes this check;
- * running its `occ` namespace would then fail.
+ * Presence only, and it needs no database, so it works with the service
+ * stopped. An app that is present but disabled passes; where the app's `occ`
+ * namespace itself has to exist, use `readEnabledApps`.
  */
 export async function hasNextcloudApp(name: string): Promise<boolean> {
   const { stat } = await import('node:fs/promises')
@@ -40,8 +41,41 @@ export async function requireNextcloudApp(
   if (!(await hasNextcloudApp(name))) throw new Error(errorMessage)
 }
 
-// Nextcloud Talk's app directory name. Talk is installed by the user from the
-// Nextcloud app store, so its `occ talk:*` namespace only exists once it is.
+/**
+ * The apps Nextcloud currently has enabled, keyed by app id. `occ` registers an
+ * app's command namespace only while that app is enabled, and a major upgrade
+ * disables any app without a compatible release while leaving its files in
+ * place — so a directory on disk says nothing about whether `occ <app>:*` will
+ * resolve.
+ *
+ * Reads the database, so only call this where Postgres is up.
+ */
+export async function readEnabledApps(
+  sub: SubContainer<typeof manifest>,
+): Promise<Record<string, string>> {
+  const res = await sub.exec(
+    ['php', 'occ', 'app:list', '--enabled', '--output=json'],
+    { user: 'www-data' },
+  )
+  const stdout = res.stdout.toString()
+  const fail = () =>
+    new Error(
+      `could not read Nextcloud's enabled app list; occ exited ${res.exitCode}: ${stdout} ${res.stderr.toString()}`,
+    )
+  if (res.exitCode !== 0) throw fail()
+  try {
+    // A PHP startup or deprecation notice lands on stdout ahead of occ's JSON.
+    const { enabled } = JSON.parse(stdout.slice(stdout.indexOf('{'))) as {
+      enabled?: Record<string, string>
+    }
+    return enabled ?? {}
+  } catch {
+    throw fail()
+  }
+}
+
+// Nextcloud Talk's app id, which is also its directory name. Talk is installed
+// by the user from the Nextcloud app store.
 export const TALK_APP = 'spreed'
 
 // The external Coturn package Talk relays calls through.
diff --git a/startos/versions/current.ts b/startos/versions/current.ts
index 94cd6b3..b44bc9a 100644
--- a/startos/versions/current.ts
+++ b/startos/versions/current.ts
@@ -18,6 +18,7 @@ Nextcloud backported the 34.0.1–34.0.3 maintenance fixes to the 33 line as wel
 
 **Worth knowing**
 
+- If your server is still on Nextcloud 32, update to the latest Nextcloud 33 release first — open Nextcloud in the Marketplace and pick it from the version list — then update again. Nextcloud only upgrades one major version at a time, so a 32 → 34 update is refused and rolled back.
 - Apps you installed yourself from the Nextcloud app store may need updates of their own. Nextcloud 34 removes several long-deprecated interfaces; an app still using them is disabled during the upgrade, or breaks the web interface. If the interface stops loading, run **Disable Non-default Apps** from the Maintenance group, then re-enable your apps one at a time.
 - The update runs a database schema change, so it takes longer than a maintenance release.
 - PHP moves to 8.5, the version Nextcloud 34 recommends.
@@ -39,6 +40,7 @@ Nextcloud también retroportó a la serie 33 las correcciones de mantenimiento d
 
 **Conviene saber**
 
+- Si su servidor sigue en Nextcloud 32, actualice primero a la última versión de Nextcloud 33 —abra Nextcloud en el Mercado y elíjala en la lista de versiones— y después vuelva a actualizar. Nextcloud solo actualiza una versión mayor cada vez, por lo que una actualización de 32 a 34 se rechaza y se revierte.
 - Las aplicaciones que haya instalado usted desde la tienda de Nextcloud pueden necesitar su propia actualización. Nextcloud 34 elimina varias interfaces obsoletas desde hace tiempo; una aplicación que aún las use se desactiva durante la actualización o rompe la interfaz web. Si la interfaz deja de cargarse, ejecute **Desactivar aplicaciones no predeterminadas** en el grupo Mantenimiento y vuelva a activar sus aplicaciones una a una.
 - La actualización ejecuta un cambio de esquema en la base de datos, por lo que tarda más que una versión de mantenimiento.
 - PHP pasa a la versión 8.5, la recomendada por Nextcloud 34.
@@ -60,6 +62,7 @@ Nextcloud hat die Wartungskorrekturen aus 34.0.1 bis 34.0.3 auch in die Reihe 33
 
 **Wissenswert**
 
+- Läuft Ihr Server noch mit Nextcloud 32, aktualisieren Sie zuerst auf die neueste Version der Reihe 33 — öffnen Sie Nextcloud im Marktplatz und wählen Sie sie in der Versionsliste aus — und aktualisieren Sie danach erneut. Nextcloud aktualisiert immer nur eine Hauptversion auf einmal; ein Update von 32 auf 34 wird daher abgelehnt und zurückgerollt.
 - Selbst installierte Apps aus dem Nextcloud App Store benötigen möglicherweise ein eigenes Update. Nextcloud 34 entfernt mehrere seit Langem veraltete Schnittstellen; eine App, die sie noch nutzt, wird beim Upgrade deaktiviert oder macht die Weboberfläche unbrauchbar. Lädt die Oberfläche nicht mehr, führen Sie **Nicht-Standard-Apps deaktivieren** in der Gruppe Wartung aus und aktivieren Sie Ihre Apps anschließend einzeln wieder.
 - Das Update führt eine Schemaänderung an der Datenbank durch und dauert daher länger als eine Wartungsversion.
 - PHP wechselt auf 8.5, die von Nextcloud 34 empfohlene Version.
@@ -81,6 +84,7 @@ Nextcloud przeniósł poprawki konserwacyjne z wersji 34.0.1–34.0.3 także do
 
 **Warto wiedzieć**
 
+- Jeśli Twój serwer nadal działa na Nextcloud 32, zaktualizuj najpierw do najnowszego wydania z serii 33 — otwórz Nextcloud w Rynku i wybierz je z listy wersji — a potem zaktualizuj ponownie. Nextcloud aktualizuje tylko o jedną wersję główną naraz, więc aktualizacja z 32 do 34 zostanie odrzucona i wycofana.
 - Aplikacje zainstalowane samodzielnie ze sklepu Nextcloud mogą wymagać własnych aktualizacji. Nextcloud 34 usuwa kilka od dawna przestarzałych interfejsów; aplikacja, która wciąż z nich korzysta, zostaje wyłączona podczas aktualizacji albo psuje interfejs webowy. Jeśli interfejs przestanie się ładować, uruchom **Wyłącz niestandardowe aplikacje** z grupy Konserwacja, a następnie włączaj swoje aplikacje pojedynczo.
 - Aktualizacja wykonuje zmianę schematu bazy danych, więc trwa dłużej niż wydanie konserwacyjne.
 - PHP przechodzi na wersję 8.5, zalecaną przez Nextcloud 34.
@@ -102,6 +106,7 @@ Nextcloud a également rétroporté vers la série 33 les correctifs de maintena
 
 **Bon à savoir**
 
+- Si votre serveur est encore sous Nextcloud 32, mettez-le d'abord à niveau vers la dernière version de la série 33 — ouvrez Nextcloud dans la Place de marché et choisissez-la dans la liste des versions — puis mettez à jour de nouveau. Nextcloud ne franchit qu'une version majeure à la fois : une mise à jour de 32 vers 34 est refusée et annulée.
 - Les applications que vous avez installées depuis la boutique Nextcloud peuvent nécessiter leur propre mise à jour. Nextcloud 34 supprime plusieurs interfaces obsolètes de longue date ; une application qui les utilise encore est désactivée pendant la mise à niveau, ou casse l'interface web. Si l'interface ne se charge plus, lancez **Désactiver les applications non standard** dans le groupe Maintenance, puis réactivez vos applications une par une.
 - La mise à jour effectue une modification du schéma de la base de données ; elle prend donc plus de temps qu'une version de maintenance.
 - PHP passe à la version 8.5, celle que Nextcloud 34 recommande.

From c4c4e1674a43db116e6519ce6095c39646f6e6da Mon Sep 17 00:00:00 2001
From: Matt Hill <9935159+MattDHill@users.noreply.github.com>
Date: Mon, 24 Aug 2026 09:04:07 -0600
Subject: [PATCH 3/3] feat: let users cap how long deleted files are kept
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Nextcloud's default trashbin_retention_obligation is `auto`: keep a
deleted file at least 30 days, then remove it only as disk space is
needed. On a server with room to spare nothing ever triggers that second
condition, so trash accumulates for the life of the instance with no way
to bound it from StartOS.

Adds it to the Configure action as a preset list writing `auto, <days>`
for 7 through 365, plus the Nextcloud default and `disabled`. Only the
maximum is offered — Nextcloud's `D1, D2` form also sets a guaranteed
minimum, which would hold files past the cap the user picked.

Also corrects the Nextcloud 34 release note for the new Office section.
The shipped `office` app is a document overview page, not an editor, and
it opens files in whatever office suite is configured — of which this
package bundles none.

Closes #63
---
 README.md                                 |  6 +++--
 instructions.md                           |  2 +-
 startos/actions/setConfig.ts              | 10 +++++++-
 startos/fileModels/config.php.ts          |  5 +++-
 startos/i18n/dictionaries/default.ts      |  4 +++
 startos/i18n/dictionaries/translations.ts |  8 ++++++
 startos/utils.ts                          | 15 ++++++++++++
 startos/versions/current.ts               | 30 +++++++++++++++++++----
 8 files changed, 70 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 4d695e3..1a980c9 100644
--- a/README.md
+++ b/README.md
@@ -137,12 +137,14 @@ Eleven actions in three groups, plus one hidden.
 
 ### Configure
 
-The four general settings — default locale, default phone region, the maintenance-window start hour, and whether new accounts are seeded with skeleton files — plus the Talk call-relay toggle.
+The five general settings — default locale, default phone region, how long deleted files are kept, the maintenance-window start hour, and whether new accounts are seeded with skeleton files — plus the Talk call-relay toggle.
 
-- **What it changes:** the first four are keys in `config.php`. **Relay Talk Calls Through Coturn** is a flag in `store.json`; through it the package's Coturn dependency and Nextcloud Talk's own STUN/TURN settings, which the `talk-turn` oneshot reconciles on the next start.
+- **What it changes:** the first five are keys in `config.php`. **Relay Talk Calls Through Coturn** is a flag in `store.json`; through it the package's Coturn dependency and Nextcloud Talk's own STUN/TURN settings, which the `talk-turn` oneshot reconciles on the next start.
 - **Cost:** seconds, then a restart.
 - **Repeat safety:** idempotent; the form is pre-filled.
 
+**Delete Files in Trash** sets `trashbin_retention_obligation`. Nextcloud's default (`auto`) keeps a deleted file for at least 30 days and then removes it only as disk space is needed, so on a server with room to spare the trash grows without bound; the presets write `auto, <days>` to cap it, or `disabled` to keep everything. Only the maximum is offered — Nextcloud's `D1, D2` form also sets a guaranteed floor, which would hold files past the cap the user chose.
+
 **Relaying is advertised only once Coturn has a public domain.** With the toggle on but Coturn lacking one, no relay is configured and nothing reports that as an error — Talk falls back to direct connections, which is what it would do anyway. The toggle also does nothing until the Talk app itself is installed from the Nextcloud app store **and enabled** — `occ` exposes an app's command namespace only while it is enabled, and a major Nextcloud upgrade disables any app without a compatible release. Until then the oneshot logs that it is waiting and applies the setting on a later start.
 
 **Only the entries this package added are ever touched.** The `talk-turn` oneshot records what it applied and deletes exactly that before writing the new set, so Talk's default `stun.nextcloud.com:443` and anything an admin added by hand survive. Removing that default is a deliberate choice left to the admin — see Limitations.
diff --git a/instructions.md b/instructions.md
index dcca41b..1209fe4 100644
--- a/instructions.md
+++ b/instructions.md
@@ -33,7 +33,7 @@ Point a Nextcloud desktop or mobile client (or any WebDAV client) at the **WebDA
 
 ### Actions
 
-- **Configure** — set the default locale, default phone region, the UTC start hour of Nextcloud's nightly maintenance window for background jobs, a toggle to stop seeding new user accounts with Nextcloud's default skeleton files (sample documents, photos, README), and **Relay Talk Calls Through Coturn** (see below).
+- **Configure** — set the default locale, default phone region, how long deleted files are kept before Nextcloud removes them for good (**Delete Files in Trash** — by default they are kept at least 30 days and then cleared only when disk space runs short, so trash can pile up on a server with room to spare), the UTC start hour of Nextcloud's nightly maintenance window for background jobs, a toggle to stop seeding new user accounts with Nextcloud's default skeleton files (sample documents, photos, README), and **Relay Talk Calls Through Coturn** (see below).
 - **External Storage** — surface another StartOS service's storage as a folder in your Nextcloud **Files**, using Nextcloud's built-in External Storage app. The action lists a dropdown for each supported service **you have installed** (today just **File Browser** → a `/FileBrowser` folder). Each dropdown is **Not mounted** (off), **Available to all users**, or **Available to specific users** (which then lets you pick exactly which Nextcloud users see it). The folder is read-write, so you can **move files out of it into Nextcloud**. Nextcloud must be **running** to run this action (it reads your live user list). Files other services add to File Browser appear automatically when you open the folder — so File Browser acts as the shared hub: point any service that should be visible in Nextcloud at File Browser.
 - **Reset Admin Password** — pick an admin user and generate a new random password. Use this if the admin password is lost or you want to rotate it.
 - **Disable Maintenance Mode** (Maintenance group) — runs `occ maintenance:mode --off`. Brief maintenance mode after an update or restart is normal — wait at least 15 minutes before resorting to this. Nextcloud version updates now run as part of the StartOS update step and roll back cleanly if they fail, so you should rarely need this.
diff --git a/startos/actions/setConfig.ts b/startos/actions/setConfig.ts
index db52672..67af2e9 100644
--- a/startos/actions/setConfig.ts
+++ b/startos/actions/setConfig.ts
@@ -2,7 +2,7 @@ import { configPhp } from '../fileModels/config.php'
 import { storeJson } from '../fileModels/store.json'
 import { i18n } from '../i18n'
 import { sdk } from '../sdk'
-import { locales, phoneRegions } from '../utils'
+import { locales, phoneRegions, trashRetention } from '../utils'
 
 const { InputSpec, Value } = sdk
 
@@ -23,6 +23,14 @@ export const inputSpec = InputSpec.of({
     default: 'US',
     values: phoneRegions,
   }),
+  trashbin_retention_obligation: Value.select({
+    name: i18n('Delete Files in Trash'),
+    description: i18n(
+      "How long Nextcloud keeps a deleted file in each user's Deleted Files before removing it for good. By default files are kept for at least 30 days and then removed only as disk space is needed, so trash can grow without bound on a server with room to spare. Setting a limit removes them on schedule instead. Restoring a file is only possible while it is still in Deleted Files.",
+    ),
+    default: 'auto',
+    values: trashRetention,
+  }),
   maintenance_window_start: Value.number({
     name: i18n('Maintenance Window Start Time'),
     description: i18n(
diff --git a/startos/fileModels/config.php.ts b/startos/fileModels/config.php.ts
index b8e021a..8a9e7ed 100644
--- a/startos/fileModels/config.php.ts
+++ b/startos/fileModels/config.php.ts
@@ -1,6 +1,6 @@
 import { FileHelper, z } from '@start9labs/start-sdk'
 import { sdk } from '../sdk'
-import { locales, phoneRegions } from '../utils'
+import { locales, phoneRegions, trashRetention } from '../utils'
 
 const UPDATER_SERVER_URL = 'http://updates.disabled.invalid/'
 
@@ -22,6 +22,9 @@ const shape = z.object({
   default_phone_region: z
     .enum(Object.keys(phoneRegions) as [string, ...string[]])
     .catch('US'),
+  trashbin_retention_obligation: z
+    .enum(Object.keys(trashRetention) as [string, ...string[]])
+    .catch('auto'),
   maintenance_window_start: z.number().int().min(0).catch(24),
   overwriteprotocol: z.null().optional().catch(undefined),
   'memcache.local': z
diff --git a/startos/i18n/dictionaries/default.ts b/startos/i18n/dictionaries/default.ts
index 0094961..4882618 100644
--- a/startos/i18n/dictionaries/default.ts
+++ b/startos/i18n/dictionaries/default.ts
@@ -202,6 +202,10 @@ const dict = {
   'Partially Successful': 137,
   'No non-default apps were enabled.': 138,
   'These apps could not be disabled. The service logs say why:': 139,
+
+  // setConfig.ts: trash retention
+  'Delete Files in Trash': 140,
+  "How long Nextcloud keeps a deleted file in each user's Deleted Files before removing it for good. By default files are kept for at least 30 days and then removed only as disk space is needed, so trash can grow without bound on a server with room to spare. Setting a limit removes them on schedule instead. Restoring a file is only possible while it is still in Deleted Files.": 141,
 } as const
 
 /**
diff --git a/startos/i18n/dictionaries/translations.ts b/startos/i18n/dictionaries/translations.ts
index ab6ec76..f0b67e4 100644
--- a/startos/i18n/dictionaries/translations.ts
+++ b/startos/i18n/dictionaries/translations.ts
@@ -142,6 +142,8 @@ export default {
     137: 'Parcialmente correcto',
     138: 'No había ninguna aplicación no predeterminada activada.',
     139: 'Estas aplicaciones no se pudieron desactivar. El registro del servicio indica el motivo:',
+    140: 'Eliminar los archivos de la papelera',
+    141: 'Cuánto tiempo conserva Nextcloud un archivo borrado en los Archivos eliminados de cada usuario antes de suprimirlo definitivamente. De forma predeterminada los archivos se conservan al menos 30 días y solo se suprimen cuando hace falta espacio en disco, por lo que la papelera puede crecer sin límite en un servidor con espacio de sobra. Si establece un límite, se suprimen según ese plazo. Un archivo solo se puede restaurar mientras siga en los Archivos eliminados.',
   },
   de_DE: {
     0: 'Starte Nextcloud...',
@@ -284,6 +286,8 @@ export default {
     137: 'Teilweise erfolgreich',
     138: 'Es waren keine Nicht-Standard-Apps aktiviert.',
     139: 'Diese Apps konnten nicht deaktiviert werden. Das Dienstprotokoll nennt den Grund:',
+    140: 'Dateien im Papierkorb löschen',
+    141: 'Wie lange Nextcloud eine gelöschte Datei im Papierkorb jedes Benutzers aufbewahrt, bevor sie endgültig entfernt wird. Standardmäßig bleiben Dateien mindestens 30 Tage erhalten und werden erst entfernt, wenn Speicherplatz benötigt wird — auf einem Server mit reichlich Platz kann der Papierkorb dadurch unbegrenzt wachsen. Mit einem Limit werden sie stattdessen planmäßig entfernt. Wiederherstellen lässt sich eine Datei nur, solange sie noch im Papierkorb liegt.',
   },
   pl_PL: {
     0: 'Uruchamianie Nextcloud...',
@@ -426,6 +430,8 @@ export default {
     137: 'Częściowo pomyślnie',
     138: 'Żadne niestandardowe aplikacje nie były włączone.',
     139: 'Tych aplikacji nie udało się wyłączyć. Powód znajdziesz w dzienniku usługi:',
+    140: 'Usuwanie plików z kosza',
+    141: 'Jak długo Nextcloud przechowuje usunięty plik w Usuniętych plikach każdego użytkownika, zanim skasuje go bezpowrotnie. Domyślnie pliki są przechowywane co najmniej 30 dni i usuwane dopiero wtedy, gdy potrzebne jest miejsce na dysku, więc na serwerze z zapasem miejsca kosz może rosnąć bez ograniczeń. Ustawienie limitu powoduje usuwanie ich zgodnie z harmonogramem. Plik można przywrócić tylko dopóki znajduje się w Usuniętych plikach.',
   },
   fr_FR: {
     0: 'Démarrage de Nextcloud...',
@@ -568,5 +574,7 @@ export default {
     137: 'Partiellement réussi',
     138: "Aucune application non standard n'était activée.",
     139: "Ces applications n'ont pas pu être désactivées. Le journal du service en indique la raison :",
+    140: 'Suppression des fichiers de la corbeille',
+    141: "Durée pendant laquelle Nextcloud conserve un fichier supprimé dans les Fichiers supprimés de chaque utilisateur avant de l'effacer définitivement. Par défaut les fichiers sont conservés au moins 30 jours puis effacés uniquement lorsque de l'espace disque est nécessaire : sur un serveur disposant de place, la corbeille peut donc croître sans limite. Définir une limite les efface selon ce délai. Un fichier ne peut être restauré que tant qu'il se trouve encore dans les Fichiers supprimés.",
   },
 } satisfies Record<string, LangDict>
diff --git a/startos/utils.ts b/startos/utils.ts
index 9e1a6b3..fe34416 100644
--- a/startos/utils.ts
+++ b/startos/utils.ts
@@ -133,6 +133,21 @@ export const locales = {
   pl: 'Polish',
 } as const
 
+// `trashbin_retention_obligation` values. The first component is the minimum
+// retention and the second the maximum; `auto` in either position means "as
+// space is needed". Nextcloud's grammar also allows `D1, D2`, which guarantees
+// a floor — not offered here, since a floor can hold files past the maximum a
+// user picked to reclaim space.
+export const trashRetention = {
+  auto: 'Default (at least 30 days, then as space is needed)',
+  'auto, 7': 'Delete after 7 days',
+  'auto, 30': 'Delete after 30 days',
+  'auto, 90': 'Delete after 90 days',
+  'auto, 180': 'Delete after 180 days',
+  'auto, 365': 'Delete after 365 days',
+  disabled: 'Never delete automatically',
+} as const
+
 export const phoneRegions = {
   US: 'United States',
   GB: 'United Kingdom',
diff --git a/startos/versions/current.ts b/startos/versions/current.ts
index b44bc9a..6510d59 100644
--- a/startos/versions/current.ts
+++ b/startos/versions/current.ts
@@ -5,12 +5,16 @@ export const current = VersionInfo.of({
   releaseNotes: {
     en_US: `Updated Nextcloud to 34.0.3 — a major upgrade from the Nextcloud 33 series.
 
+**New in this package**
+
+- **Delete Files in Trash**, a new setting in the Configure action. Nextcloud keeps a deleted file for at least 30 days and then clears it only when disk space runs short, so on a server with room to spare the trash grows without bound. You can now cap it at 7 to 365 days, or keep everything.
+
 **New in Nextcloud 34**
 
 - A redesigned top bar: apps move into a launcher menu, and the search box sits in the middle.
 - Calendars can now be shared with, and edited on, another Nextcloud server.
 - Temporary file locking ships with Nextcloud. Lock a shared file while you work on it so nobody overwrites your changes.
-- A new **Office** section in the navigation, with a chooser for which office suite to use.
+- A new **Office** section in the navigation gathers your documents, spreadsheets and presentations on one page. Editing them still needs an office suite, which Nextcloud does not bundle.
 - The Files list gains filters in the top bar, a marker for recently created files, and a warning before you create a hidden file.
 - Contacts can be filtered by team, and team members can be found on federated servers.
 
@@ -27,12 +31,16 @@ Nextcloud backported the 34.0.1–34.0.3 maintenance fixes to the 33 line as wel
 Full changelog: https://github.com/nextcloud-releases/server/releases/tag/v34.0.3`,
     es_ES: `Nextcloud actualizado a 34.0.3: una actualización mayor desde la serie 33 de Nextcloud.
 
+**Novedades de este paquete**
+
+- **Eliminar los archivos de la papelera**, un nuevo ajuste en la acción Configuración. Nextcloud conserva un archivo borrado al menos 30 días y solo lo suprime cuando escasea el espacio en disco, de modo que en un servidor con espacio de sobra la papelera crece sin límite. Ahora puede limitarla de 7 a 365 días, o conservarlo todo.
+
 **Novedades de Nextcloud 34**
 
 - Barra superior rediseñada: las aplicaciones pasan a un menú de acceso y el cuadro de búsqueda queda en el centro.
 - Los calendarios ya se pueden compartir con otro servidor Nextcloud y editarse en él.
 - El bloqueo temporal de archivos viene incluido en Nextcloud. Bloquee un archivo compartido mientras trabaja en él para que nadie sobrescriba sus cambios.
-- Una nueva sección **Office** en la navegación, con un selector de la suite ofimática que desee usar.
+- Una nueva sección **Office** en la navegación reúne sus documentos, hojas de cálculo y presentaciones en una sola página. Para editarlos sigue haciendo falta una suite ofimática, que Nextcloud no incluye.
 - La lista de Archivos incorpora filtros en la barra superior, una marca para los archivos creados recientemente y un aviso antes de crear un archivo oculto.
 - Los contactos se pueden filtrar por equipo, y los miembros de un equipo se pueden buscar en servidores federados.
 
@@ -49,12 +57,16 @@ Nextcloud también retroportó a la serie 33 las correcciones de mantenimiento d
 Registro de cambios completo: https://github.com/nextcloud-releases/server/releases/tag/v34.0.3`,
     de_DE: `Nextcloud auf 34.0.3 aktualisiert — ein Upgrade auf eine neue Hauptversion, ausgehend von der Nextcloud-Reihe 33.
 
+**Neu in diesem Paket**
+
+- **Dateien im Papierkorb löschen**, eine neue Einstellung in der Aktion Konfiguration. Nextcloud bewahrt eine gelöschte Datei mindestens 30 Tage auf und entfernt sie erst, wenn der Speicherplatz knapp wird — auf einem Server mit reichlich Platz wächst der Papierkorb also unbegrenzt. Sie können ihn jetzt auf 7 bis 365 Tage begrenzen oder alles behalten.
+
 **Neu in Nextcloud 34**
 
 - Neu gestaltete Kopfleiste: Die Apps wandern in ein Startmenü, das Suchfeld sitzt in der Mitte.
 - Kalender lassen sich jetzt mit einem anderen Nextcloud-Server teilen und dort bearbeiten.
 - Das temporäre Sperren von Dateien gehört zum Lieferumfang von Nextcloud. Sperren Sie eine freigegebene Datei, während Sie daran arbeiten, damit niemand Ihre Änderungen überschreibt.
-- Ein neuer Bereich **Office** in der Navigation, mit einer Auswahl der zu verwendenden Office-Suite.
+- Ein neuer Bereich **Office** in der Navigation fasst Ihre Dokumente, Tabellen und Präsentationen auf einer Seite zusammen. Zum Bearbeiten ist weiterhin eine Office-Suite nötig, die Nextcloud nicht mitliefert.
 - Die Dateiliste erhält Filter in der Kopfleiste, eine Markierung für kürzlich erstellte Dateien und eine Warnung, bevor Sie eine versteckte Datei anlegen.
 - Kontakte lassen sich nach Team filtern, und Teammitglieder können auf föderierten Servern gefunden werden.
 
@@ -71,12 +83,16 @@ Nextcloud hat die Wartungskorrekturen aus 34.0.1 bis 34.0.3 auch in die Reihe 33
 Vollständiges Änderungsprotokoll: https://github.com/nextcloud-releases/server/releases/tag/v34.0.3`,
     pl_PL: `Zaktualizowano Nextcloud do wersji 34.0.3 — to aktualizacja do nowej wersji głównej, wychodząca z serii 33.
 
+**Nowości w tym pakiecie**
+
+- **Usuwanie plików z kosza**, nowe ustawienie w akcji Konfiguracja. Nextcloud przechowuje usunięty plik co najmniej 30 dni i kasuje go dopiero wtedy, gdy zaczyna brakować miejsca na dysku, więc na serwerze z zapasem miejsca kosz rośnie bez ograniczeń. Teraz możesz ograniczyć go do 7–365 dni albo zachować wszystko.
+
 **Nowości w Nextcloud 34**
 
 - Przeprojektowany górny pasek: aplikacje trafiają do menu uruchamiania, a pole wyszukiwania znajduje się pośrodku.
 - Kalendarze można teraz udostępniać innemu serwerowi Nextcloud i tam je edytować.
 - Tymczasowe blokowanie plików jest częścią Nextcloud. Zablokuj udostępniony plik na czas pracy nad nim, aby nikt nie nadpisał Twoich zmian.
-- Nowa sekcja **Office** w nawigacji, z wyborem pakietu biurowego.
+- Nowa sekcja **Office** w nawigacji zbiera dokumenty, arkusze i prezentacje na jednej stronie. Do ich edycji nadal potrzebny jest pakiet biurowy, którego Nextcloud nie dostarcza.
 - Lista plików zyskuje filtry w górnym pasku, oznaczenie ostatnio utworzonych plików i ostrzeżenie przed utworzeniem pliku ukrytego.
 - Kontakty można filtrować według zespołu, a członków zespołu wyszukiwać na serwerach federacyjnych.
 
@@ -93,12 +109,16 @@ Nextcloud przeniósł poprawki konserwacyjne z wersji 34.0.1–34.0.3 także do
 Pełny dziennik zmian: https://github.com/nextcloud-releases/server/releases/tag/v34.0.3`,
     fr_FR: `Nextcloud mis à jour vers 34.0.3 — une mise à niveau majeure depuis la série Nextcloud 33.
 
+**Nouveautés de ce paquet**
+
+- **Suppression des fichiers de la corbeille**, un nouveau réglage dans l'action Configuration. Nextcloud conserve un fichier supprimé au moins 30 jours et ne l'efface que lorsque l'espace disque vient à manquer : sur un serveur disposant de place, la corbeille grossit donc sans limite. Vous pouvez désormais la plafonner de 7 à 365 jours, ou tout conserver.
+
 **Nouveautés de Nextcloud 34**
 
 - Barre supérieure repensée : les applications passent dans un menu de lancement et le champ de recherche se place au centre.
 - Les agendas peuvent désormais être partagés avec un autre serveur Nextcloud et modifiés depuis celui-ci.
 - Le verrouillage temporaire des fichiers est fourni avec Nextcloud. Verrouillez un fichier partagé pendant que vous y travaillez pour que personne n'écrase vos modifications.
-- Une nouvelle section **Office** dans la navigation, avec un sélecteur de suite bureautique.
+- Une nouvelle section **Office** dans la navigation regroupe vos documents, feuilles de calcul et présentations sur une seule page. Les modifier nécessite toujours une suite bureautique, que Nextcloud ne fournit pas.
 - La liste des fichiers gagne des filtres dans la barre supérieure, un repère pour les fichiers créés récemment et un avertissement avant la création d'un fichier caché.
 - Les contacts peuvent être filtrés par équipe, et les membres d'une équipe recherchés sur des serveurs fédérés.