diff --git a/Apps/MetaTransportIpfs/docker-compose.yml b/Apps/MetaTransportIpfs/docker-compose.yml
index b2e29a3..d630ef3 100644
--- a/Apps/MetaTransportIpfs/docker-compose.yml
+++ b/Apps/MetaTransportIpfs/docker-compose.yml
@@ -9,6 +9,10 @@ name: metatransportipfs
 # `tmp/` → `cache/` promote is one rename(2), and the hull reads plugin-written
 # files directly). Its own settings live in its state dir (config.json), edited
 # through MetaShare's dashboard.
+#
+# A headless service: no tile link, no Caddy route, no AppShield. Its config
+# page is reached only through MetaShare (Plugins → configure, proxied by
+# /api/plugins/<name>/ui/*), behind MetaShare's own perimeter.
 
 services:
   metashare-ipfs:
@@ -53,45 +57,9 @@ services:
       retries: 10
       start_period: 30s
     networks:
-      - metatransportipfs
-      - pcs
-
-  # OIDC perimeter in front of the plugin's own config page (the tile link).
-  # MetaShare's dashboard embeds the same page through its own proxy.
-  metatransportipfs:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metatransportipfs
-    hostname: metatransportipfs
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metashare-ipfs"
-      BACKEND_PORT: "3000"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metatransportipfs-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metatransportipfs-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metatransportipfs-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metashare-ipfs
-    networks:
-      - metatransportipfs
       - pcs
 
 networks:
-  metatransportipfs:
-    name: metatransportipfs
-    driver: bridge
   pcs:
     name: ${APP_NET:-pcs}
     external: true
@@ -104,9 +72,6 @@ x-casaos:
   category: Media
   tags: ["media", "needs-public-ip"]
   developer: Aptero Team
-  main: metatransportipfs
-  webui_port: 80
-  index: /config
 
   description:
     en_us: |
@@ -161,8 +126,7 @@ x-casaos:
         driven by it. MetaShare picks it up automatically within ~10 s; check
         **MetaShare → Plugins**, where it shows as *live*.
 
-        Settings: **MetaShare → Plugins → ipfs → configure** (or this app's own
-        tile). Saving restarts the plugin to apply.
+        Settings: **MetaShare → Plugins → ipfs → configure**. Saving restarts the plugin to apply.
 
 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 x-compose-app:
@@ -171,6 +135,7 @@ x-compose-app:
     - path: /DATA/AppData/metatransportipfs/state
       user: $PUID
       group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metatransportipfs-${domain}
-  webui-path: "/config"
+  # An extension of MetaShare: no tile of its own, nested under MetaShare's,
+  # and listed in the store under MetaShare's Extensions. Presentation only —
+  # lifecycle and backups stay per-app.
+  parent: metashare
diff --git a/Apps/MetaTransportNzb/docker-compose.yml b/Apps/MetaTransportNzb/docker-compose.yml
index 9542491..2d2dd36 100644
--- a/Apps/MetaTransportNzb/docker-compose.yml
+++ b/Apps/MetaTransportNzb/docker-compose.yml
@@ -9,6 +9,10 @@ name: metatransportnzb
 # `tmp/` → `cache/` promote is one rename(2), and the hull reads plugin-written
 # files directly). Its own settings live in its state dir (config.json), edited
 # through MetaShare's dashboard.
+#
+# A headless service: no tile link, no Caddy route, no AppShield. Its config
+# page is reached only through MetaShare (Plugins → configure, proxied by
+# /api/plugins/<name>/ui/*), behind MetaShare's own perimeter.
 
 services:
   metashare-nzb:
@@ -39,45 +43,9 @@ services:
       retries: 10
       start_period: 30s
     networks:
-      - metatransportnzb
-      - pcs
-
-  # OIDC perimeter in front of the plugin's own config page (the tile link).
-  # MetaShare's dashboard embeds the same page through its own proxy.
-  metatransportnzb:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metatransportnzb
-    hostname: metatransportnzb
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metashare-nzb"
-      BACKEND_PORT: "3000"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metatransportnzb-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metatransportnzb-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metatransportnzb-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metashare-nzb
-    networks:
-      - metatransportnzb
       - pcs
 
 networks:
-  metatransportnzb:
-    name: metatransportnzb
-    driver: bridge
   pcs:
     name: ${APP_NET:-pcs}
     external: true
@@ -90,9 +58,6 @@ x-casaos:
   category: Media
   tags: ["media"]
   developer: Aptero Team
-  main: metatransportnzb
-  webui_port: 80
-  index: /config
 
   description:
     en_us: |
@@ -143,8 +108,7 @@ x-casaos:
         driven by it. MetaShare picks it up automatically within ~10 s; check
         **MetaShare → Plugins**, where it shows as *live*.
 
-        Settings: **MetaShare → Plugins → nzb → configure** (or this app's own
-        tile). Saving restarts the plugin to apply.
+        Settings: **MetaShare → Plugins → nzb → configure**. Saving restarts the plugin to apply.
 
 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 x-compose-app:
@@ -153,6 +117,7 @@ x-compose-app:
     - path: /DATA/AppData/metatransportnzb/state
       user: $PUID
       group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metatransportnzb-${domain}
-  webui-path: "/config"
+  # An extension of MetaShare: no tile of its own, nested under MetaShare's,
+  # and listed in the store under MetaShare's Extensions. Presentation only —
+  # lifecycle and backups stay per-app.
+  parent: metashare
diff --git a/Apps/MetaTransportTorrent/docker-compose.yml b/Apps/MetaTransportTorrent/docker-compose.yml
index 7c95dd9..042df67 100644
--- a/Apps/MetaTransportTorrent/docker-compose.yml
+++ b/Apps/MetaTransportTorrent/docker-compose.yml
@@ -9,6 +9,10 @@ name: metatransporttorrent
 # `tmp/` → `cache/` promote is one rename(2), and the hull reads plugin-written
 # files directly). Its own settings live in its state dir (config.json), edited
 # through MetaShare's dashboard.
+#
+# A headless service: no tile link, no Caddy route, no AppShield. Its config
+# page is reached only through MetaShare (Plugins → configure, proxied by
+# /api/plugins/<name>/ui/*), behind MetaShare's own perimeter.
 
 services:
   metashare-torrent:
@@ -43,45 +47,9 @@ services:
       retries: 10
       start_period: 30s
     networks:
-      - metatransporttorrent
-      - pcs
-
-  # OIDC perimeter in front of the plugin's own config page (the tile link).
-  # MetaShare's dashboard embeds the same page through its own proxy.
-  metatransporttorrent:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metatransporttorrent
-    hostname: metatransporttorrent
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metashare-torrent"
-      BACKEND_PORT: "3000"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metatransporttorrent-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metatransporttorrent-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metatransporttorrent-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metashare-torrent
-    networks:
-      - metatransporttorrent
       - pcs
 
 networks:
-  metatransporttorrent:
-    name: metatransporttorrent
-    driver: bridge
   pcs:
     name: ${APP_NET:-pcs}
     external: true
@@ -94,9 +62,6 @@ x-casaos:
   category: Media
   tags: ["media"]
   developer: Aptero Team
-  main: metatransporttorrent
-  webui_port: 80
-  index: /config
 
   description:
     en_us: |
@@ -152,8 +117,7 @@ x-casaos:
         driven by it. MetaShare picks it up automatically within ~10 s; check
         **MetaShare → Plugins**, where it shows as *live*.
 
-        Settings: **MetaShare → Plugins → torrent → configure** (or this app's own
-        tile). Saving restarts the plugin to apply.
+        Settings: **MetaShare → Plugins → torrent → configure**. Saving restarts the plugin to apply.
 
 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 x-compose-app:
@@ -162,6 +126,7 @@ x-compose-app:
     - path: /DATA/AppData/metatransporttorrent/state
       user: $PUID
       group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metatransporttorrent-${domain}
-  webui-path: "/config"
+  # An extension of MetaShare: no tile of its own, nested under MetaShare's,
+  # and listed in the store under MetaShare's Extensions. Presentation only —
+  # lifecycle and backups stay per-app.
+  parent: metashare