meta-core claims model: pin meta-core 2.0.1, meta-read 1.4.1, meta-watch 1.1.0, meta-search 1.3.2, meta-share 2.7.0, gateway 1.1.1, meta-sort 1.1.1, plugins 1.1.0; signing keys + db-cache backup exclude

Apps/MetaCore/docker-compose.yml

@@ -5,7 +5,7 @@ services:
   # Public ingress goes through the `metacore` hash-lock proxy below — this
   # service has no public Caddy labels and no exposed host ports.
   metacore-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:1.2.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.0.1
     container_name: metacore-app
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
     # instead of swap. Both values must move together or swap comes back.
@@ -29,7 +29,9 @@ services:
 
     volumes:
       # Shared infrastructure state: the metadata store (db/meta-core.db, SQLite),
-      # the leader lock, identity and mounts.
+      # the leader lock, identity and mounts. Since meta-core 2.0.0 also
+      # db-cache/cache.db: every index/derived table, rebuilt from db/ on
+      # demand — so it is excluded from backups (see x-compose-app.backup).
       # Lives inside /DATA/AppData/metacore/ so CasaOS archives it on uninstall.
       - ${DATA_ROOT:-/DATA}/AppData/metacore/meta-core:/meta-core:rw
 
@@ -99,7 +101,7 @@ services:
       BACKEND_HOST: "metacore-app"
       BACKEND_PORT: "80"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
 
     depends_on:
       - metacore-app
@@ -153,15 +155,15 @@ x-casaos:
     en_us: |
       **The infrastructure foundation for the MetaMesh media management ecosystem.**
 
-      MetaCore provides the shared services that power all MetaMesh applications: distributed leader election, Redis database, WebDAV file serving, remote mount management, and service discovery.
+      MetaCore provides the shared services that power all MetaMesh applications: distributed leader election, embedded SQLite database, WebDAV file serving, remote mount management, and service discovery.
 
       **Key Features:**
       - **Leader Election** - Automatic flock-based leader election with failover support
-      - **Redis Database** - Centralized metadata storage for all MetaMesh services
+      - **SQLite Database** - Centralized metadata storage for all MetaMesh services: a backed-up truth file plus a rebuildable index cache
       - **WebDAV File Serving** - Cached file access for all services via HTTP
       - **Mount Management** - Add NFS, SMB, and rclone remote mounts from the dashboard
       - **File Watcher** - Monitors folders and notifies services of new files
-      - **Metadata Editor** - Browse and edit file metadata stored in Redis
+      - **Metadata Editor** - Browse and edit file metadata stored in SQLite
       - **Service Discovery** - Automatic registration and discovery of MetaMesh services
       - **OIDC Single Sign-On** - Dashboard protected by Yundera's built-in Authelia (auto-registered, no secrets to configure)
 
@@ -172,23 +174,23 @@ x-casaos:
     fr_fr: |
       **La fondation d'infrastructure pour l'ecosysteme de gestion de medias MetaMesh.**
 
-      MetaCore fournit les services partages qui alimentent toutes les applications MetaMesh : election de leader distribuee, base de donnees Redis, service de fichiers WebDAV, gestion de montages distants et decouverte de services.
+      MetaCore fournit les services partages qui alimentent toutes les applications MetaMesh : election de leader distribuee, base de donnees SQLite embarquee, service de fichiers WebDAV, gestion de montages distants et decouverte de services.
 
       **Fonctionnalites Cles:**
       - **Election de Leader** - Election automatique basee sur flock avec support de basculement
-      - **Base de Donnees Redis** - Stockage centralise des metadonnees pour tous les services
+      - **Base de Donnees SQLite** - Stockage centralise des metadonnees pour tous les services : un fichier de verite sauvegarde et un cache d'index reconstructible
       - **Service de Fichiers WebDAV** - Acces aux fichiers en cache via HTTP
       - **Gestion des Montages** - Ajout de montages NFS, SMB et rclone depuis le tableau de bord
       - **Surveillance de Fichiers** - Surveille les dossiers et notifie les services des nouveaux fichiers
-      - **Editeur de Metadonnees** - Parcourir et editer les metadonnees stockees dans Redis
+      - **Editeur de Metadonnees** - Parcourir et editer les metadonnees stockees dans SQLite
       - **Decouverte de Services** - Enregistrement et decouverte automatiques des services
       - **SSO OIDC** - Tableau de bord protege par l'Authelia integre de Yundera (auto-enregistre, aucun secret a configurer)
 
       **Installez ceci EN PREMIER** avant MetaSort, MetaFuse ou MetaStremio.
 
   tagline:
-    en_us: MetaMesh infrastructure - Leader election, Redis, WebDAV, and service discovery
+    en_us: MetaMesh infrastructure - Leader election, SQLite, WebDAV, and service discovery
-    fr_fr: Infrastructure MetaMesh - Election de leader, Redis, WebDAV et decouverte de services
+    fr_fr: Infrastructure MetaMesh - Election de leader, SQLite, WebDAV et decouverte de services
 
   title:
     en_us: MetaCore
@@ -237,6 +239,11 @@ x-compose-app:
     - path: /DATA/AppData/metacore/meta-core
       user: $PUID
       group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (META_CORE_CACHE_PATH default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metacore/meta-core/db-cache
+      user: $PUID
+      group: $PGID
     - path: /DATA/AppData/metacore/cache
       user: $PUID
       group: $PGID
@@ -246,6 +253,12 @@ x-compose-app:
     - path: /DATA/AppData/metacore/plugin/share
       user: $PUID
       group: $PGID
+  # The index cache is derived data: meta-core rebuilds it from db/meta-core.db
+  # (the truth file, which IS backed up) when it is missing or stale. Never
+  # back it up — a restore brings it back empty and it repopulates on boot.
+  backup:
+    exclude:
+      - meta-core/db-cache/
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metacore-${domain}
   webui-path: "/"

Apps/MetaFeederProwlarr/docker-compose.yml

@@ -40,7 +40,7 @@ services:
     # package, published as ${{ github.repository }}) was renamed. The old
     # `meta-feeder-indexer` package still exists but is frozen at 1.0.23 and
     # receives no further pushes. The APP keeps the `metafeederprowlarr` name.
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-torznab:1.0.45
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-torznab:1.1.0
     cpu_shares: 30
     container_name: metafeederprowlarr-feeder
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -76,10 +76,15 @@ services:
       # was dropped — its 500 did match the default.
       META_GATEWAY_PROWLARR_PAGE_SIZE: "20"
       TZ: "$TZ"
+      # Own claim-signing key (self-published records); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederprowlarr-feeder.key"
     volumes:
       # Persist feeder config (config.json saved via the config UI) + redb cache.
       # Transient librqbit downloads go to the container's /tmp (off backup).
       - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/state:/data/meta-feeder:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/keys:/keys:rw
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://localhost:8080/health"]
       interval: 5s
@@ -102,7 +107,7 @@ services:
   # No healthcheck: these plugin images don't ship one (curl absent).
   # ---------------------------------------------------------------------------
   metafeederprowlarr-filename-parser:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
     cpu_shares: 30
     container_name: metafeederprowlarr-filename-parser
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -118,11 +123,17 @@ services:
       # (meta-sort's Scan card) sees it as bound elsewhere, never addable.
       BEACON_BINDS: "metafeederprowlarr-feeder"
       EMIT_TITLE_TAGS: "true"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederprowlarr-filename-parser.key"
+    volumes:
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/keys:/keys:rw
     networks:
       - metafeederprowlarr
 
   metafeederprowlarr-tmdb:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
     cpu_shares: 30
     container_name: metafeederprowlarr-tmdb
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -145,8 +156,13 @@ services:
       # unavailable" and silently writes no posters/backdrops, so every record then
       # fails meta-watch's poster gate. Drop only after re-tagging the plugin.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederprowlarr-tmdb.key"
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/tmdb-cache:/cache
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/keys:/keys:rw
     networks:
       - metafeederprowlarr
       - pcs
@@ -255,3 +271,6 @@ x-compose-app:
     - path: /DATA/AppData/metafeederprowlarr/tmdb-cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metafeederprowlarr/keys
+      user: $PUID
+      group: $PGID

Apps/MetaFeederTribler/docker-compose.yml

@@ -71,7 +71,7 @@ services:
   # from the MetaGateway dashboard (configure panel).
   # ---------------------------------------------------------------------------
   metafeedertribler-feeder:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-tribler:1.0.9
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-tribler:1.1.0
     cpu_shares: 30
     container_name: metafeedertribler-feeder
     hostname: metafeedertribler-feeder
@@ -93,10 +93,15 @@ services:
       META_FEEDER_CALLBACK_URL: "http://metafeedertribler-feeder:8080/enrich/callback"
       META_FEEDER_STATE_DIR: "/data/meta-feeder"
       TZ: "$TZ"
+      # Own claim-signing key (self-published records); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeedertribler-feeder.key"
     volumes:
       # Persist feeder config (config.json pre-seeded + editable via UI) + redb
       # cache. config.json lives at gateway/tribler/config.json under this dir.
       - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/state:/data/meta-feeder:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/keys:/keys:rw
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://localhost:8080/health"]
       interval: 5s
@@ -123,7 +128,7 @@ services:
   # images don't ship one (curl absent).
   # ---------------------------------------------------------------------------
   metafeedertribler-filename-parser:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
     cpu_shares: 30
     container_name: metafeedertribler-filename-parser
     hostname: metafeedertribler-filename-parser
@@ -136,11 +141,17 @@ services:
       BEACON_BINDS: "metafeedertribler-feeder"
       PORT: "8080"
       EMIT_TITLE_TAGS: "true"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeedertribler-filename-parser.key"
+    volumes:
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/keys:/keys:rw
     networks:
       - metafeedertribler
 
   metafeedertribler-tmdb:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
     cpu_shares: 30
     container_name: metafeedertribler-tmdb
     hostname: metafeedertribler-tmdb
@@ -155,8 +166,13 @@ services:
       CACHE_DIR: "/cache"
       # Posters land in the shared meta-core (over pcs) so the ingester seeds them.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeedertribler-tmdb.key"
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/tmdb-cache:/cache
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/keys:/keys:rw
     networks:
       - metafeedertribler
       - pcs
@@ -275,3 +291,6 @@ x-compose-app:
     - path: /DATA/AppData/metafeedertribler/tribler-seed
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metafeedertribler/keys
+      user: $PUID
+      group: $PGID

Apps/MetaFeederUsenet/docker-compose.yml

@@ -101,7 +101,7 @@ services:
   # images don't ship one (curl absent).
   # ---------------------------------------------------------------------------
   metafeederusenet-filename-parser:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
     cpu_shares: 30
     container_name: metafeederusenet-filename-parser
     mem_limit: 256m
@@ -115,11 +115,17 @@ services:
       # (meta-sort's Scan card) sees it as bound elsewhere, never addable.
       BEACON_BINDS: "metafeederusenet-feeder"
       EMIT_TITLE_TAGS: "true"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederusenet-filename-parser.key"
+    volumes:
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederusenet/keys:/keys:rw
     networks:
       - metafeederusenet
 
   metafeederusenet-tmdb:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
     cpu_shares: 30
     container_name: metafeederusenet-tmdb
     mem_limit: 384m
@@ -137,8 +143,13 @@ services:
       # the sibling feeder apps' identical note: the published image needs
       # this, unlike the source build the dev stack runs).
       WEBDAV_URL: "http://metacore-app:9000/webdav"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederusenet-tmdb.key"
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metafeederusenet/tmdb-cache:/cache
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederusenet/keys:/keys:rw
     networks:
       - metafeederusenet
       - pcs
@@ -252,6 +263,9 @@ x-compose-app:
     - path: /DATA/AppData/metafeederusenet/tmdb-cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metafeederusenet/keys
+      user: $PUID
+      group: $PGID
   # No web UI: Maison files it under Services. Configured from MetaGateway.
   # Shown from the tile menu.
   tips:

Apps/MetaFuse/docker-compose.yml

@@ -4,7 +4,7 @@ services:
   # Backend service. Reachable on the pcs network as `metafuse-app`.
   # Public ingress goes through the `metafuse` hash-lock proxy below.
   metafuse-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-fuse:1.1.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-fuse:1.1.6
     cpu_shares: 50
     container_name: metafuse-app
     hostname: metafuse-app
@@ -77,7 +77,7 @@ services:
       BACKEND_HOST: "metafuse-app"
       BACKEND_PORT: "80"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
 
     depends_on:
       - metafuse-app

Apps/MetaGateway/docker-compose.yml

@@ -35,7 +35,7 @@ services:
   # ===========================================================================
   metagateway-core:
     # 1.0.1 carries the new meta-core API (records cids/ set, identity).
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:1.0.24
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.0.1
     container_name: metagateway-core
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
     # instead of swap. Mirrors the dev sub-stack limits.
@@ -50,6 +50,8 @@ services:
       - 9000
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metagateway/metacore:/meta-core:rw
+      # (meta-core 2.0.0 keeps its rebuildable index cache at
+      # /meta-core/db-cache/cache.db inside this bind — excluded from backups.)
       - ${DATA_ROOT:-/DATA}/AppData/metagateway/files:/files:rw
     environment:
       - BASE_URL=http://metagateway-core:9000
@@ -81,7 +83,7 @@ services:
     # MetaShare app's `metashare-<tier>` hostnames, which on a shared `pcs`
     # would be ANOTHER hull's plugins writing to another /data).
     #  - 3000  HTTP API   - 3001  plugin callback API (internal only)
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.6.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
     container_name: metagateway-share
     # The swarm and blockstore moved to the ipfs plugin, so the hull needs far
     # less than the monolith did.
@@ -103,6 +105,9 @@ services:
       # hull's; ipfs/blocks.redb is the ipfs plugin's corner of the SAME folder
       # (layout unchanged from 1.0.x, so an existing cache carries over).
       - ${DATA_ROOT:-/DATA}/AppData/metagateway/share-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metagateway/keys:/keys:rw
     environment:
       META_CORE_URL: "http://metagateway-core:9000"
       BASE_URL: "http://metagateway-share:3000"
@@ -110,6 +115,8 @@ services:
       META_SHARE_PLUGIN_IPFS_URL: "http://metagateway-share-ipfs:3000"
       META_SHARE_PLUGIN_TORRENT_URL: "off"
       META_SHARE_PLUGIN_NZB_URL: "off"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metagateway-share.key"
       TZ: "$TZ"
     depends_on:
       metagateway-core:
@@ -184,8 +191,12 @@ services:
     # P2P listen/announce so it's discoverable + dialable off-host + the
     # 2026-07 discovery/filters fixes that make the meta-search fan-out
     # actually route `fileType:video` queries here.
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-gateway:1.0.43
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-gateway:1.1.1
     container_name: metagateway-app
+    # Run as the PUID that Maison creates the app folders with (as the Shared
+    # variant does). The image default user (uid 10001) cannot write them on a
+    # fresh install: "create ipfs dir … Permission denied".
+    user: "1000:1000"
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
     # instead of swap. Mirrors the dev sub-stack limits.
     # 1g -> 2g (2026-09-30): the DHT-joined dispatcher runs at ~1.2 GiB on
@@ -207,6 +218,9 @@ services:
       # gateway-config.json (feeders map) + gateway-enabled.json, written by
       # pre-install-cmd. Runtime redb caches also live here.
       - ${DATA_ROOT:-/DATA}/AppData/metagateway/state:/data/meta-gateway:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metagateway/keys:/keys:rw
     environment:
       # NOTE: `meta_core_url` (and `meta_share_url`) live in gateway-config.json
       # since v1.0.12 — no longer read from env. The pre-install-cmd below seeds
@@ -215,6 +229,9 @@ services:
       # libp2p identify agent_version) — without it meta-search can't HTTP-fetch
       # /api/gateway/plugins on this gateway to populate its routing table.
       META_GATEWAY_PEER_ID: "metagateway"
+      # Own claim-signing key for the records it auto-stores in its meta-core;
+      # generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metagateway-app.key"
       # MUST be resolvable BY A REMOTE PEER — it is advertised verbatim in the
       # identify `baseUrl=` token and used for nothing else in-process. A
       # docker-internal name here (the old `http://metagateway-app:3000`) makes
@@ -306,7 +323,7 @@ services:
       BACKEND_HOST: "metagateway-app"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
     depends_on:
       - metagateway-app
     labels:
@@ -385,7 +402,7 @@ services:
     expose: ["80"]
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metagateway-core"
       BACKEND_PORT: "80"
       LISTEN_PORT: "80"
@@ -414,7 +431,7 @@ services:
     expose: ["80"]
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metagateway-share"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -609,6 +626,11 @@ x-compose-app:
     - path: /DATA/AppData/metagateway/metacore
       user: $PUID
       group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metagateway/metacore/db-cache
+      user: $PUID
+      group: $PGID
     - path: /DATA/AppData/metagateway/files
       user: $PUID
       group: $PGID
@@ -624,6 +646,14 @@ x-compose-app:
     - path: /DATA/AppData/metagateway/share-ipfs-state
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metagateway/keys
+      user: $PUID
+      group: $PGID
+  # Derived data only: meta-core rebuilds its index cache from the truth file
+  # (metacore/db/meta-core.db, which IS backed up). keys/ stays backed up.
+  backup:
+    exclude:
+      - metacore/db-cache/
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metagateway-${domain}
   webui-path: "/"

Apps/MetaGatewayShared/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # co-located metashare-app then seeds the resolved CIDs.
   # ---------------------------------------------------------------------------
   metagateway-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-gateway:1.0.43
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-gateway:1.1.1
     container_name: metagateway-app
     hostname: metagateway-app
     restart: unless-stopped
@@ -55,6 +55,9 @@ services:
     volumes:
       # gateway-config.json (source definitions, feeder URLs) + dispatcher state.
       - ${DATA_ROOT:-/DATA}/AppData/metagateway/state:/data/meta-gateway:rw
+      # Claim-signing key (meta-core 2.0.0 claims model) for the records the
+      # dispatcher writes to metacore-app. Config — backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metagateway/keys:/keys:rw
     environment:
       # Advertised verbatim in this peer's libp2p identify `agent_version`
       # (`baseUrl=...`) and used for NOTHING else in-process — see
@@ -72,6 +75,8 @@ services:
       # carve-out in the Caddy labels below is what makes this URL answerable.
       META_GATEWAY_BASE_URL: "https://metagateway-${APP_DOMAIN}"
       META_GATEWAY_PEER_ID: "metagateway"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metagateway-app.key"
       # --- cross-node discoverability (added 2026-08-26) ---------------------
       # WITHOUT META_GATEWAY_PUBLIC_ADDR meta-gateway starts in local/mDNS-only
       # mode: it loads NO kad bootstraps, sets kad_provide_enabled=false, and so
@@ -193,7 +198,7 @@ services:
       BACKEND_HOST: "metagateway-app"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
     depends_on:
       - metagateway-app
     labels:
@@ -356,6 +361,9 @@ x-compose-app:
     - path: /DATA/AppData/metagateway/state
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metagateway/keys
+      user: $PUID
+      group: $PGID
     - path: /DATA/AppData/metagateway/card
       user: 10001
       group: 999

Apps/MetaPluginAnimeDetector/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginanimedetector-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-anime-detector:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-anime-detector:1.1.0
     cpu_shares: 30
     container_name: metapluginanimedetector-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -49,6 +49,13 @@ services:
       # Nothing to configure: this plugin takes its work from the /process
       # payload and writes back through the caller. No key, no WebDAV.
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginanimedetector-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginanimedetector/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -124,3 +131,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginanimedetector/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginFFmpeg/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginffmpeg-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-ffmpeg:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-ffmpeg:1.1.0
     cpu_shares: 30
     container_name: metapluginffmpeg-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginffmpeg-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metapluginffmpeg/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginffmpeg/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -144,3 +150,6 @@ x-compose-app:
     - path: /DATA/AppData/metapluginffmpeg/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metapluginffmpeg/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginFileInfo/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginfileinfo-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-file-info:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-file-info:1.1.0
     cpu_shares: 30
     container_name: metapluginfileinfo-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginfileinfo-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metapluginfileinfo/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginfileinfo/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -142,3 +148,6 @@ x-compose-app:
     - path: /DATA/AppData/metapluginfileinfo/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metapluginfileinfo/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginFilenameParser/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginfilenameparser-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
     cpu_shares: 30
     container_name: metapluginfilenameparser-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -54,6 +54,13 @@ services:
       # Blank = off = the plugin's own default, which is MetaSort's semantics.
       EMIT_TITLE_TAGS: "${EMIT_TITLE_TAGS:-}"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginfilenameparser-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginfilenameparser/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -136,3 +143,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginfilenameparser/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginFullHash/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metapluginfullhash-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-fullhash:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-fullhash:1.1.0
     cpu_shares: 30
     container_name: metapluginfullhash-plugin
     # 2 GB, swap disabled (memswap_limit == mem_limit) → OOM instead of
@@ -50,10 +50,16 @@ services:
       # Nothing to configure: this plugin takes its work from the /process
       # payload and writes back through the caller. No key, no WebDAV.
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginfullhash-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metapluginfullhash/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginfullhash/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -139,3 +145,6 @@ x-compose-app:
     - path: /DATA/AppData/metapluginfullhash/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metapluginfullhash/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginJellyfinNFO/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginjellyfinnfo-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-jellyfin-nfo:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-jellyfin-nfo:1.1.0
     cpu_shares: 30
     container_name: metapluginjellyfinnfo-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginjellyfinnfo-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginjellyfinnfo/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -133,3 +140,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginjellyfinnfo/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginLanguage/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginlanguage-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-language:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-language:1.1.0
     cpu_shares: 30
     container_name: metapluginlanguage-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -49,6 +49,13 @@ services:
       # Nothing to configure: this plugin takes its work from the /process
       # payload and writes back through the caller. No key, no WebDAV.
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginlanguage-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginlanguage/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -126,3 +133,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginlanguage/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginOpenSubtitles/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metapluginopensubtitles-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-opensubtitle:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-opensubtitle:1.1.0
     cpu_shares: 30
     container_name: metapluginopensubtitles-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginopensubtitles-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginopensubtitles/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -137,3 +144,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginopensubtitles/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginStillExtractor/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metapluginstillextractor-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-still-extractor:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-still-extractor:1.1.0
     cpu_shares: 30
     container_name: metapluginstillextractor-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginstillextractor-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginstillextractor/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -133,3 +140,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginstillextractor/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginSubtitle/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginsubtitle-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle:1.1.0
     cpu_shares: 30
     container_name: metapluginsubtitle-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginsubtitle-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitle/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -134,3 +141,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginsubtitle/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginSubtitleExtractor/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metapluginsubtitleextractor-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.1.0
     cpu_shares: 30
     container_name: metapluginsubtitleextractor-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginsubtitleextractor-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitleextractor/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitleextractor/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -145,3 +151,6 @@ x-compose-app:
     - path: /DATA/AppData/metapluginsubtitleextractor/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metapluginsubtitleextractor/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginTMDB/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metaplugintmdb-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
     cpu_shares: 30
     container_name: metaplugintmdb-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaplugintmdb-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metaplugintmdb/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metaplugintmdb/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -149,3 +155,6 @@ x-compose-app:
     - path: /DATA/AppData/metaplugintmdb/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metaplugintmdb/keys
+      user: $PUID
+      group: $PGID

Apps/MetaRead/docker-compose.yml

@@ -47,7 +47,7 @@ services:
   # consumer, not a library indexer.
   # ---------------------------------------------------------------------------
   metaread-core:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:1.0.24
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.0.1
     container_name: metaread-core
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM instead of
     # swap.
@@ -62,6 +62,8 @@ services:
       - 9000
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metaread/metacore:/meta-core:rw
+      # (meta-core 2.0.0 keeps its rebuildable index cache at
+      # /meta-core/db-cache/cache.db inside this bind — excluded from backups.)
     environment:
       - BASE_URL=http://metaread-core:9000
       - ENABLE_FILE_WATCHER=false
@@ -86,7 +88,7 @@ services:
   # peer count before suspecting the feeders.
   # ---------------------------------------------------------------------------
   metaread-search:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.2.10
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
     container_name: metaread-search
     mem_limit: 1g
     memswap_limit: 1g
@@ -103,6 +105,9 @@ services:
       # (beacon v2) instead of reading kv-leader.info off a shared
       # volume. See docs/project-architecture/beacon-v2.md.
       - ${DATA_ROOT:-/DATA}/AppData/metaread/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metaread/keys:/keys:rw
     environment:
       P2P_LISTEN: "/ip4/0.0.0.0/tcp/4001"
       # ⚠ The IPV4 spelling, never the bare APP_PUBLIC_IP: on an IPv6-primary
@@ -121,6 +126,8 @@ services:
       META_CORE_URL: "http://metaread-core:9000"
       BASE_URL: "http://metaread-search:3000"
       INTERNAL_BASE_URL: "http://metaread-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaread-search.key"
       TZ: "$TZ"
     depends_on:
       metaread-core:
@@ -154,7 +161,7 @@ services:
     # MetaShare app's `metashare-<tier>` hostnames, which on a shared `pcs`
     # would be ANOTHER hull's plugins writing to another /data).
     #  - 3000  HTTP API   - 3001  plugin callback API (internal only)
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.6.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
     container_name: metaread-share
     # The swarm and blockstore moved to the ipfs plugin, so the hull needs far
     # less than the monolith did.
@@ -176,6 +183,9 @@ services:
       # hull's; ipfs/blocks.redb is the ipfs plugin's corner of the SAME folder
       # (layout unchanged from 1.0.x, so an existing cache carries over).
       - ${DATA_ROOT:-/DATA}/AppData/metaread/share-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metaread/keys:/keys:rw
     environment:
       META_CORE_URL: "http://metaread-core:9000"
       BASE_URL: "http://metaread-share:3000"
@@ -183,6 +193,8 @@ services:
       META_SHARE_PLUGIN_IPFS_URL: "http://metaread-share-ipfs:3000"
       META_SHARE_PLUGIN_TORRENT_URL: "off"
       META_SHARE_PLUGIN_NZB_URL: "off"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaread-share.key"
       TZ: "$TZ"
     depends_on:
       metaread-core:
@@ -247,7 +259,7 @@ services:
   # My List, Continue Reading and reading positions live in the User Data Layer.
   # ---------------------------------------------------------------------------
   metaread-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.3.9.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.4.1
     container_name: metaread-app
     hostname: metaread-app
     restart: unless-stopped
@@ -303,7 +315,7 @@ services:
       - 80
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metaread-app"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -337,7 +349,7 @@ services:
       - 80
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metaread-share"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -367,7 +379,7 @@ services:
       - 80
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metaread-search"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -524,6 +536,11 @@ x-compose-app:
     - path: /DATA/AppData/metaread/metacore
       user: $PUID
       group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metaread/metacore/db-cache
+      user: $PUID
+      group: $PGID
     - path: /DATA/AppData/metaread/data
       user: $PUID
       group: $PGID
@@ -539,5 +556,13 @@ x-compose-app:
     - path: /DATA/AppData/metaread/metashare-config
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metaread/keys
+      user: $PUID
+      group: $PGID
+  # Derived data only: meta-core rebuilds its index cache from the truth file
+  # (metacore/db/meta-core.db, which IS backed up). keys/ stays backed up.
+  backup:
+    exclude:
+      - metacore/db-cache/
   webui-host: metaread-${domain}
   webui-path: "/"

Apps/MetaReadShared/docker-compose.yml

@@ -60,7 +60,7 @@ services:
   # peer count before suspecting the feeders.
   # ---------------------------------------------------------------------------
   metaread-search:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.2.10
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
     container_name: metaread-search
     # 2g, not the self-contained listing's 1g: on the shared core it indexes the
     # gateway box's whole catalogue (~830 MiB steady state on watch.nsl.sh).
@@ -79,6 +79,9 @@ services:
       # (beacon v2) instead of reading kv-leader.info off a shared
       # volume. See docs/project-architecture/beacon-v2.md.
       - ${DATA_ROOT:-/DATA}/AppData/metaread/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metaread/keys:/keys:rw
     environment:
       # Distinct from metawatch-search on the same core, so the two discovery
       # peers do not register under one name.
@@ -111,6 +114,8 @@ services:
       META_CORE_URL: "http://metacore-app:80"
       BASE_URL: "http://metaread-search:3000"
       INTERNAL_BASE_URL: "http://metaread-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaread-search.key"
       TZ: "$TZ"
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://localhost:3000/health"]
@@ -132,7 +137,7 @@ services:
   # User Data Layer.
   # ---------------------------------------------------------------------------
   metaread-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.3.9.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.4.1
     container_name: metaread-app
     hostname: metaread-app
     restart: unless-stopped
@@ -208,7 +213,7 @@ services:
       - 80
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metaread-search"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -361,6 +366,9 @@ x-compose-app:
     - path: /DATA/AppData/metaread/search-data
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metaread/keys
+      user: $PUID
+      group: $PGID
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metaread-${domain}
   webui-path: "/"

Apps/MetaShare/docker-compose.yml

@@ -13,7 +13,7 @@ services:
   #  - 3000  HTTP API + dashboard (proxied through the hash-lock + Caddy)
   #  - 3001  plugin callback API — internal only, never published
   metashare-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.6.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
     container_name: metashare-app
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM instead of
     # swap. The swarm, blockstore and torrent session moved to the plugins, so
@@ -42,6 +42,10 @@ services:
       # host folder, which they mount too — so the tmp/ → cache/ rename(2) stays
       # atomic. Layout unchanged from the monolith: existing caches carry over.
       - ${DATA_ROOT:-/DATA}/AppData/metashare/data:/data:rw
+      # Claim-signing key (meta-core 2.0.0 claims model): the hull's identity on
+      # the claims it writes (content links, archive marks, pointer resolves).
+      # Config — backed up, deliberately NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metashare/keys:/keys:rw
 
     environment:
       # Service registration / neighbour announce.
@@ -51,6 +55,8 @@ services:
       # Inter-peer fetch URL, announced in identify by the ipfs plugin. Same as
       # BASE_URL in prod (other peers fetch via the public Caddy URL).
       - INTERNAL_BASE_URL=https://metashare-$APP_DOMAIN
+      # Own claim-signing key; generated on first boot if missing.
+      - METAMESH_SIGNING_KEY_FILE=/keys/metashare-app.key
       - TZ=$TZ
 
     user: 0:0
@@ -86,7 +92,7 @@ services:
       BACKEND_HOST: "metashare-app"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
 
     depends_on:
       - metashare-app
@@ -276,6 +282,9 @@ x-compose-app:
     - path: /DATA/AppData/metashare/data
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metashare/keys
+      user: $PUID
+      group: $PGID
   # Fetched content only: everything under these can be pulled again off the
   # swarm/NNTP/HTTP (meta-share reclaim.rs, "cache means cache"). They are ~94G
   # on a busy peer, so without this every backup — and Maison's pre-update

Apps/MetaSort/docker-compose.yml

@@ -4,7 +4,7 @@ services:
   # Backend service. Reachable on the pcs network as `metasort-app`.
   # Public ingress goes through the `metasort` hash-lock proxy below.
   metasort-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-sort:1.0.13
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-sort:1.1.1
     container_name: metasort-app
     hostname: metasort-app
     restart: unless-stopped
@@ -39,6 +39,11 @@ services:
       - ${DATA_ROOT:-/DATA}/AppData/metasort/config/supervisord-metasort.conf:/etc/supervisor/conf.d/supervisord.conf:ro
       - ${DATA_ROOT:-/DATA}/AppData/metasort/config/nginx-metasort.conf:/etc/nginx/nginx.conf:ro
 
+      # Signing keys (meta-core 2.0.0 claims model): metasort-app.key is
+      # meta-sort's own identity; plugins/<pluginId>.key are minted per plugin
+      # and injected into the plugin containers it spawns. Config — backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metasort/keys:/keys:rw
+
     # Note: no /files mounts — files are accessed via WebDAV from MetaCore
     # (Architecture V3). MetaCore is the single source of truth for media files.
 
@@ -61,6 +66,8 @@ services:
       # Compose project label stamped on the plugin containers meta-sort spawns,
       # so they group under one stack instead of floating loose.
       - PLUGIN_STACK_NAME=metasort-plugins
+      # meta-sort's own claim-signing key; generated on first boot if missing.
+      - METAMESH_SIGNING_KEY_FILE=/keys/metasort-app.key
 
     # Note: Runs as root for nginx, Redis, and file management
     user: 0:0
@@ -89,7 +96,7 @@ services:
       BACKEND_HOST: "metasort-app"
       BACKEND_PORT: "80"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
 
     depends_on:
       - metasort-app
@@ -217,6 +224,9 @@ x-compose-app:
     - path: /DATA/AppData/metasort/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metasort/keys
+      user: $PUID
+      group: $PGID
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metasort-${domain}
   webui-path: "/"

Apps/MetaSort/seed/config/plugins.yml

@@ -15,7 +15,7 @@ defaults:
 plugins:
   file-info:
     enabled: true
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-file-info:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-file-info:1.1.0
     instances: 1
     resources:
       memory: 128m
@@ -23,7 +23,7 @@ plugins:
 
   ffmpeg:
     enabled: true
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-ffmpeg:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-ffmpeg:1.1.0
     instances: 1
     resources:
       memory: 512m
@@ -31,7 +31,7 @@ plugins:
 
   subtitle:
     enabled: true
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle:1.1.0
     instances: 1
     resources:
       memory: 128m
@@ -39,7 +39,7 @@ plugins:
 
   subtitle-extractor:
     enabled: true
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.1.0
     instances: 1
     resources:
       memory: 512m
@@ -48,7 +48,7 @@ plugins:
 
   still-extractor:
     enabled: true
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-still-extractor:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-still-extractor:1.1.0
     instances: 1
     resources:
       memory: 512m

Apps/MetaWatch/docker-compose.yml

@@ -29,7 +29,7 @@ services:
   metawatch-core:
     # 1.0.1 carries the identity API (commit 52f5b5c) required for MetaWatch
     # sign-in / keypair generation; 1.0.0 predates it.
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:1.0.24
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.0.1
     container_name: metawatch-core
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
     # instead of swap. Mirrors the dev sub-stack limits.
@@ -44,6 +44,8 @@ services:
       - 9000
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/metacore:/meta-core:rw
+      # (meta-core 2.0.0 keeps its rebuildable index cache at
+      # /meta-core/db-cache/cache.db inside this bind — excluded from backups.)
       # Subtitle store: player-uploaded subtitles land in /files/plugin/subtitles
       # (WebDAV PUT + POST /api/files/register, needs meta-core with that route).
       # Plugin output only — no /files/watch mount, watcher stays off.
@@ -72,7 +74,7 @@ services:
     # RSA-keyed bootstrap.libp2p.io nodes) and therefore to DISCOVER remote
     # gateways via the kad `metamesh-gateway` provider namespace. Without it
     # this peer only ever sees same-host mDNS peers.
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.2.10
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
     container_name: metawatch-search
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
     # instead of swap. Mirrors the dev sub-stack limits.
@@ -96,6 +98,9 @@ services:
       # swarm. Without this mount both are on the container's writable layer and
       # every image bump loses the prefs and re-fetches every poster.
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
     environment:
       P2P_LISTEN: "/ip4/0.0.0.0/tcp/4001"
       # Public IPFS DHT bootstraps by explicit /dns4/.../tcp/4001 (the nested
@@ -121,6 +126,8 @@ services:
       SEARCH_TIMEOUT_SECS: "300"
       META_CORE_URL: "http://metawatch-core:9000"
       BASE_URL: "http://metawatch-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-search.key"
       # Renamed at the 1.1.0 bump (2026-08-26), as the old note here said to do:
       # META_SHARE_PEER_API_URL was the pre-1.0.8 spelling and now only logs a
       # deprecation warning. Do NOT set both.
@@ -157,7 +164,7 @@ services:
     # MetaShare app's `metashare-<tier>` hostnames, which on a shared `pcs`
     # would be ANOTHER hull's plugins writing to another /data).
     #  - 3000  HTTP API   - 3001  plugin callback API (internal only)
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.6.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
     container_name: metawatch-share
     # The swarm and blockstore moved to the ipfs plugin, so the hull needs far
     # less than the monolith did.
@@ -179,6 +186,9 @@ services:
       # hull's; ipfs/blocks.redb is the ipfs plugin's corner of the SAME folder
       # (layout unchanged from 1.0.x, so an existing cache carries over).
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/share-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
     environment:
       META_CORE_URL: "http://metawatch-core:9000"
       BASE_URL: "http://metawatch-share:3000"
@@ -186,6 +196,8 @@ services:
       META_SHARE_PLUGIN_IPFS_URL: "http://metawatch-share-ipfs:3000"
       META_SHARE_PLUGIN_TORRENT_URL: "off"
       META_SHARE_PLUGIN_NZB_URL: "off"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-share.key"
       TZ: "$TZ"
     depends_on:
       metawatch-core:
@@ -250,8 +262,12 @@ services:
   # My List + Continue Watching persist in /DATA/AppData/metawatch/data.
   # ---------------------------------------------------------------------------
   metawatch-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.0.93
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.1.0
     container_name: metawatch-app
+    # Run as the PUID that Maison creates the app folders with (as the Shared
+    # variant does). The image default user (uid 10001) cannot write them on a
+    # fresh install: "create ipfs dir … Permission denied".
+    user: "1000:1000"
     hostname: metawatch-app
     restart: unless-stopped
     cpu_shares: 30
@@ -264,6 +280,9 @@ services:
       - 3000
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/data:/app/data
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
     environment:
       META_SHARE_URL: "http://metawatch-share:3000"
       META_SEARCH_URL: "http://metawatch-search:3000"
@@ -275,6 +294,8 @@ services:
       META_WATCH_SYNC_PEERS: "http://metawatch-search:3000"
       # This box's own core — subtitle store only (uploads + curated matches).
       META_CORE_URL: "http://metawatch-core:9000"
+      # Own claim-signing key for the subtitle-store claims it writes; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-app.key"
       TZ: "$TZ"
     depends_on:
       metawatch-search:
@@ -310,7 +331,7 @@ services:
       BACKEND_HOST: "metawatch-app"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
     depends_on:
       - metawatch-app
     labels:
@@ -359,7 +380,7 @@ services:
     expose: ["80"]
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metawatch-share"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -388,7 +409,7 @@ services:
     expose: ["80"]
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metawatch-search"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -526,6 +547,11 @@ x-compose-app:
     - path: /DATA/AppData/metawatch/metacore
       user: $PUID
       group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metawatch/metacore/db-cache
+      user: $PUID
+      group: $PGID
     - path: /DATA/AppData/metawatch/search-data
       user: $PUID
       group: $PGID
@@ -541,6 +567,14 @@ x-compose-app:
     - path: /DATA/AppData/metawatch/data
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metawatch/keys
+      user: $PUID
+      group: $PGID
+  # Derived data only: meta-core rebuilds its index cache from the truth file
+  # (metacore/db/meta-core.db, which IS backed up). keys/ stays backed up.
+  backup:
+    exclude:
+      - metacore/db-cache/
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metawatch-${domain}
   webui-path: "/"

Apps/MetaWatchShared/docker-compose.yml

@@ -45,7 +45,7 @@ services:
   # core of its own.
   # ---------------------------------------------------------------------------
   metawatch-search:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.2.10
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
     container_name: metawatch-search
     hostname: metawatch-search
     restart: unless-stopped
@@ -71,6 +71,9 @@ services:
       # swarm. Without this mount both are on the container's writable layer and
       # every image bump loses the prefs and re-fetches every poster.
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
     environment:
       P2P_LISTEN: "/ip4/0.0.0.0/tcp/4001"
       # Public IPFS DHT bootstraps by explicit /dns4/.../tcp/4001 (the nested
@@ -93,6 +96,8 @@ services:
       META_CORE_URL: "http://metacore-app:80"
       BASE_URL: "http://metawatch-search:3000"
       INTERNAL_BASE_URL: "http://metawatch-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-search.key"
       TZ: "$TZ"
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://localhost:3000/health"]
@@ -115,7 +120,7 @@ services:
   # owns the caddy_* labels directly and Caddy proxies straight to :3000.
   # ---------------------------------------------------------------------------
   metawatch-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.0.93
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.1.0
     container_name: metawatch-app
     hostname: metawatch-app
     restart: unless-stopped
@@ -130,6 +135,9 @@ services:
       - 3000
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/data:/app/data
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
     environment:
       # The STANDALONE MetaShare app — this variant ships no transport peer.
       META_SHARE_URL: "http://metashare-app:3000"
@@ -143,6 +151,8 @@ services:
       # variant has no private core: it writes to the standalone MetaCore app,
       # which already mounts /files and runs the watcher.
       META_CORE_URL: "http://metacore-app:80"
+      # Own claim-signing key for the subtitle-store claims it writes; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-app.key"
       TZ: "$TZ"
     depends_on:
       metawatch-search:
@@ -197,7 +207,7 @@ services:
       BACKEND_HOST: "metawatch-search"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
     depends_on:
       - metawatch-search
     labels:
@@ -346,6 +356,9 @@ x-compose-app:
     - path: /DATA/AppData/metawatch/data
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metawatch/keys
+      user: $PUID
+      group: $PGID
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metawatch-${domain}
   webui-path: "/"