meta-core claims model: pin meta-core 2.0.1, meta-read 1.4.1, meta-watch 1.1.0, meta-search 1.3.2, meta-share 2.7.0, gateway 1.1.1, meta-sort 1.1.1, plugins 1.1.0; signing keys + db-cache backup exclude

2026-10-27 19:08:14 +00:00
parent 26929835d3
commit fcd0a9703b
26 changed files with 415 additions and 70 deletions
@@ -5,7 +5,7 @@ services:
  # Public ingress goes through the `metacore` hash-lock proxy below — this
  # service has no public Caddy labels and no exposed host ports.
  metacore-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:1.2.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.0.1
    container_name: metacore-app
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
    # instead of swap. Both values must move together or swap comes back.
@@ -29,7 +29,9 @@ services:

    volumes:
      # Shared infrastructure state: the metadata store (db/meta-core.db, SQLite),
-      # the leader lock, identity and mounts.
+      # the leader lock, identity and mounts. Since meta-core 2.0.0 also
+      # db-cache/cache.db: every index/derived table, rebuilt from db/ on
+      # demand — so it is excluded from backups (see x-compose-app.backup).
      # Lives inside /DATA/AppData/metacore/ so CasaOS archives it on uninstall.
      - ${DATA_ROOT:-/DATA}/AppData/metacore/meta-core:/meta-core:rw

@@ -99,7 +101,7 @@ services:
      BACKEND_HOST: "metacore-app"
      BACKEND_PORT: "80"
      LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"

    depends_on:
      - metacore-app
@@ -153,15 +155,15 @@ x-casaos:
    en_us: |
      **The infrastructure foundation for the MetaMesh media management ecosystem.**

-      MetaCore provides the shared services that power all MetaMesh applications: distributed leader election, Redis database, WebDAV file serving, remote mount management, and service discovery.
+      MetaCore provides the shared services that power all MetaMesh applications: distributed leader election, embedded SQLite database, WebDAV file serving, remote mount management, and service discovery.

      **Key Features:**
      - **Leader Election** - Automatic flock-based leader election with failover support
-      - **Redis Database** - Centralized metadata storage for all MetaMesh services
+      - **SQLite Database** - Centralized metadata storage for all MetaMesh services: a backed-up truth file plus a rebuildable index cache
      - **WebDAV File Serving** - Cached file access for all services via HTTP
      - **Mount Management** - Add NFS, SMB, and rclone remote mounts from the dashboard
      - **File Watcher** - Monitors folders and notifies services of new files
-      - **Metadata Editor** - Browse and edit file metadata stored in Redis
+      - **Metadata Editor** - Browse and edit file metadata stored in SQLite
      - **Service Discovery** - Automatic registration and discovery of MetaMesh services
      - **OIDC Single Sign-On** - Dashboard protected by Yundera's built-in Authelia (auto-registered, no secrets to configure)

@@ -172,23 +174,23 @@ x-casaos:
    fr_fr: |
      **La fondation d'infrastructure pour l'ecosysteme de gestion de medias MetaMesh.**

-      MetaCore fournit les services partages qui alimentent toutes les applications MetaMesh : election de leader distribuee, base de donnees Redis, service de fichiers WebDAV, gestion de montages distants et decouverte de services.
+      MetaCore fournit les services partages qui alimentent toutes les applications MetaMesh : election de leader distribuee, base de donnees SQLite embarquee, service de fichiers WebDAV, gestion de montages distants et decouverte de services.

      **Fonctionnalites Cles:**
      - **Election de Leader** - Election automatique basee sur flock avec support de basculement
-      - **Base de Donnees Redis** - Stockage centralise des metadonnees pour tous les services
+      - **Base de Donnees SQLite** - Stockage centralise des metadonnees pour tous les services : un fichier de verite sauvegarde et un cache d'index reconstructible
      - **Service de Fichiers WebDAV** - Acces aux fichiers en cache via HTTP
      - **Gestion des Montages** - Ajout de montages NFS, SMB et rclone depuis le tableau de bord
      - **Surveillance de Fichiers** - Surveille les dossiers et notifie les services des nouveaux fichiers
-      - **Editeur de Metadonnees** - Parcourir et editer les metadonnees stockees dans Redis
+      - **Editeur de Metadonnees** - Parcourir et editer les metadonnees stockees dans SQLite
      - **Decouverte de Services** - Enregistrement et decouverte automatiques des services
      - **SSO OIDC** - Tableau de bord protege par l'Authelia integre de Yundera (auto-enregistre, aucun secret a configurer)

      **Installez ceci EN PREMIER** avant MetaSort, MetaFuse ou MetaStremio.

  tagline:
-    en_us: MetaMesh infrastructure - Leader election, Redis, WebDAV, and service discovery
-    fr_fr: Infrastructure MetaMesh - Election de leader, Redis, WebDAV et decouverte de services
+    en_us: MetaMesh infrastructure - Leader election, SQLite, WebDAV, and service discovery
+    fr_fr: Infrastructure MetaMesh - Election de leader, SQLite, WebDAV et decouverte de services

  title:
    en_us: MetaCore
@@ -237,6 +239,11 @@ x-compose-app:
    - path: /DATA/AppData/metacore/meta-core
      user: $PUID
      group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (META_CORE_CACHE_PATH default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metacore/meta-core/db-cache
+      user: $PUID
+      group: $PGID
    - path: /DATA/AppData/metacore/cache
      user: $PUID
      group: $PGID
@@ -246,6 +253,12 @@ x-compose-app:
    - path: /DATA/AppData/metacore/plugin/share
      user: $PUID
      group: $PGID
+  # The index cache is derived data: meta-core rebuilds it from db/meta-core.db
+  # (the truth file, which IS backed up) when it is missing or stale. Never
+  # back it up — a restore brings it back empty and it repopulates on boot.
+  backup:
+    exclude:
+      - meta-core/db-cache/
  # Same string as the caddy_0 label, so the tile link and the route agree.
  webui-host: metacore-${domain}
  webui-path: "/"
@@ -40,7 +40,7 @@ services:
    # package, published as ${{ github.repository }}) was renamed. The old
    # `meta-feeder-indexer` package still exists but is frozen at 1.0.23 and
    # receives no further pushes. The APP keeps the `metafeederprowlarr` name.
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-torznab:1.0.45
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-torznab:1.1.0
    cpu_shares: 30
    container_name: metafeederprowlarr-feeder
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -76,10 +76,15 @@ services:
      # was dropped — its 500 did match the default.
      META_GATEWAY_PROWLARR_PAGE_SIZE: "20"
      TZ: "$TZ"
+      # Own claim-signing key (self-published records); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederprowlarr-feeder.key"
    volumes:
      # Persist feeder config (config.json saved via the config UI) + redb cache.
      # Transient librqbit downloads go to the container's /tmp (off backup).
      - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/state:/data/meta-feeder:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/keys:/keys:rw
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8080/health"]
      interval: 5s
@@ -102,7 +107,7 @@ services:
  # No healthcheck: these plugin images don't ship one (curl absent).
  # ---------------------------------------------------------------------------
  metafeederprowlarr-filename-parser:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
    cpu_shares: 30
    container_name: metafeederprowlarr-filename-parser
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -118,11 +123,17 @@ services:
      # (meta-sort's Scan card) sees it as bound elsewhere, never addable.
      BEACON_BINDS: "metafeederprowlarr-feeder"
      EMIT_TITLE_TAGS: "true"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederprowlarr-filename-parser.key"
+    volumes:
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/keys:/keys:rw
    networks:
      - metafeederprowlarr

  metafeederprowlarr-tmdb:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
    cpu_shares: 30
    container_name: metafeederprowlarr-tmdb
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -145,8 +156,13 @@ services:
      # unavailable" and silently writes no posters/backdrops, so every record then
      # fails meta-watch's poster gate. Drop only after re-tagging the plugin.
      WEBDAV_URL: "http://metacore-app:9000/webdav"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederprowlarr-tmdb.key"
    volumes:
      - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/tmdb-cache:/cache
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/keys:/keys:rw
    networks:
      - metafeederprowlarr
      - pcs
@@ -255,3 +271,6 @@ x-compose-app:
    - path: /DATA/AppData/metafeederprowlarr/tmdb-cache
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metafeederprowlarr/keys
+      user: $PUID
+      group: $PGID
@@ -71,7 +71,7 @@ services:
  # from the MetaGateway dashboard (configure panel).
  # ---------------------------------------------------------------------------
  metafeedertribler-feeder:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-tribler:1.0.9
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-tribler:1.1.0
    cpu_shares: 30
    container_name: metafeedertribler-feeder
    hostname: metafeedertribler-feeder
@@ -93,10 +93,15 @@ services:
      META_FEEDER_CALLBACK_URL: "http://metafeedertribler-feeder:8080/enrich/callback"
      META_FEEDER_STATE_DIR: "/data/meta-feeder"
      TZ: "$TZ"
+      # Own claim-signing key (self-published records); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeedertribler-feeder.key"
    volumes:
      # Persist feeder config (config.json pre-seeded + editable via UI) + redb
      # cache. config.json lives at gateway/tribler/config.json under this dir.
      - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/state:/data/meta-feeder:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/keys:/keys:rw
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8080/health"]
      interval: 5s
@@ -123,7 +128,7 @@ services:
  # images don't ship one (curl absent).
  # ---------------------------------------------------------------------------
  metafeedertribler-filename-parser:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
    cpu_shares: 30
    container_name: metafeedertribler-filename-parser
    hostname: metafeedertribler-filename-parser
@@ -136,11 +141,17 @@ services:
      BEACON_BINDS: "metafeedertribler-feeder"
      PORT: "8080"
      EMIT_TITLE_TAGS: "true"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeedertribler-filename-parser.key"
+    volumes:
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/keys:/keys:rw
    networks:
      - metafeedertribler

  metafeedertribler-tmdb:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
    cpu_shares: 30
    container_name: metafeedertribler-tmdb
    hostname: metafeedertribler-tmdb
@@ -155,8 +166,13 @@ services:
      CACHE_DIR: "/cache"
      # Posters land in the shared meta-core (over pcs) so the ingester seeds them.
      WEBDAV_URL: "http://metacore-app:9000/webdav"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeedertribler-tmdb.key"
    volumes:
      - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/tmdb-cache:/cache
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/keys:/keys:rw
    networks:
      - metafeedertribler
      - pcs
@@ -275,3 +291,6 @@ x-compose-app:
    - path: /DATA/AppData/metafeedertribler/tribler-seed
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metafeedertribler/keys
+      user: $PUID
+      group: $PGID
@@ -101,7 +101,7 @@ services:
  # images don't ship one (curl absent).
  # ---------------------------------------------------------------------------
  metafeederusenet-filename-parser:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
    cpu_shares: 30
    container_name: metafeederusenet-filename-parser
    mem_limit: 256m
@@ -115,11 +115,17 @@ services:
      # (meta-sort's Scan card) sees it as bound elsewhere, never addable.
      BEACON_BINDS: "metafeederusenet-feeder"
      EMIT_TITLE_TAGS: "true"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederusenet-filename-parser.key"
+    volumes:
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederusenet/keys:/keys:rw
    networks:
      - metafeederusenet

  metafeederusenet-tmdb:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
    cpu_shares: 30
    container_name: metafeederusenet-tmdb
    mem_limit: 384m
@@ -137,8 +143,13 @@ services:
      # the sibling feeder apps' identical note: the published image needs
      # this, unlike the source build the dev stack runs).
      WEBDAV_URL: "http://metacore-app:9000/webdav"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederusenet-tmdb.key"
    volumes:
      - ${DATA_ROOT:-/DATA}/AppData/metafeederusenet/tmdb-cache:/cache
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederusenet/keys:/keys:rw
    networks:
      - metafeederusenet
      - pcs
@@ -252,6 +263,9 @@ x-compose-app:
    - path: /DATA/AppData/metafeederusenet/tmdb-cache
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metafeederusenet/keys
+      user: $PUID
+      group: $PGID
  # No web UI: Maison files it under Services. Configured from MetaGateway.
  # Shown from the tile menu.
  tips:
@@ -4,7 +4,7 @@ services:
  # Backend service. Reachable on the pcs network as `metafuse-app`.
  # Public ingress goes through the `metafuse` hash-lock proxy below.
  metafuse-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-fuse:1.1.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-fuse:1.1.6
    cpu_shares: 50
    container_name: metafuse-app
    hostname: metafuse-app
@@ -77,7 +77,7 @@ services:
      BACKEND_HOST: "metafuse-app"
      BACKEND_PORT: "80"
      LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"

    depends_on:
      - metafuse-app
@@ -35,7 +35,7 @@ services:
  # ===========================================================================
  metagateway-core:
    # 1.0.1 carries the new meta-core API (records cids/ set, identity).
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:1.0.24
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.0.1
    container_name: metagateway-core
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
    # instead of swap. Mirrors the dev sub-stack limits.
@@ -50,6 +50,8 @@ services:
      - 9000
    volumes:
      - ${DATA_ROOT:-/DATA}/AppData/metagateway/metacore:/meta-core:rw
+      # (meta-core 2.0.0 keeps its rebuildable index cache at
+      # /meta-core/db-cache/cache.db inside this bind — excluded from backups.)
      - ${DATA_ROOT:-/DATA}/AppData/metagateway/files:/files:rw
    environment:
      - BASE_URL=http://metagateway-core:9000
@@ -81,7 +83,7 @@ services:
    # MetaShare app's `metashare-<tier>` hostnames, which on a shared `pcs`
    # would be ANOTHER hull's plugins writing to another /data).
    #  - 3000  HTTP API   - 3001  plugin callback API (internal only)
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.6.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
    container_name: metagateway-share
    # The swarm and blockstore moved to the ipfs plugin, so the hull needs far
    # less than the monolith did.
@@ -103,6 +105,9 @@ services:
      # hull's; ipfs/blocks.redb is the ipfs plugin's corner of the SAME folder
      # (layout unchanged from 1.0.x, so an existing cache carries over).
      - ${DATA_ROOT:-/DATA}/AppData/metagateway/share-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metagateway/keys:/keys:rw
    environment:
      META_CORE_URL: "http://metagateway-core:9000"
      BASE_URL: "http://metagateway-share:3000"
@@ -110,6 +115,8 @@ services:
      META_SHARE_PLUGIN_IPFS_URL: "http://metagateway-share-ipfs:3000"
      META_SHARE_PLUGIN_TORRENT_URL: "off"
      META_SHARE_PLUGIN_NZB_URL: "off"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metagateway-share.key"
      TZ: "$TZ"
    depends_on:
      metagateway-core:
@@ -184,8 +191,12 @@ services:
    # P2P listen/announce so it's discoverable + dialable off-host + the
    # 2026-07 discovery/filters fixes that make the meta-search fan-out
    # actually route `fileType:video` queries here.
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-gateway:1.0.43
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-gateway:1.1.1
    container_name: metagateway-app
+    # Run as the PUID that Maison creates the app folders with (as the Shared
+    # variant does). The image default user (uid 10001) cannot write them on a
+    # fresh install: "create ipfs dir … Permission denied".
+    user: "1000:1000"
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
    # instead of swap. Mirrors the dev sub-stack limits.
    # 1g -> 2g (2026-09-30): the DHT-joined dispatcher runs at ~1.2 GiB on
@@ -207,6 +218,9 @@ services:
      # gateway-config.json (feeders map) + gateway-enabled.json, written by
      # pre-install-cmd. Runtime redb caches also live here.
      - ${DATA_ROOT:-/DATA}/AppData/metagateway/state:/data/meta-gateway:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metagateway/keys:/keys:rw
    environment:
      # NOTE: `meta_core_url` (and `meta_share_url`) live in gateway-config.json
      # since v1.0.12 — no longer read from env. The pre-install-cmd below seeds
@@ -215,6 +229,9 @@ services:
      # libp2p identify agent_version) — without it meta-search can't HTTP-fetch
      # /api/gateway/plugins on this gateway to populate its routing table.
      META_GATEWAY_PEER_ID: "metagateway"
+      # Own claim-signing key for the records it auto-stores in its meta-core;
+      # generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metagateway-app.key"
      # MUST be resolvable BY A REMOTE PEER — it is advertised verbatim in the
      # identify `baseUrl=` token and used for nothing else in-process. A
      # docker-internal name here (the old `http://metagateway-app:3000`) makes
@@ -306,7 +323,7 @@ services:
      BACKEND_HOST: "metagateway-app"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
    depends_on:
      - metagateway-app
    labels:
@@ -385,7 +402,7 @@ services:
    expose: ["80"]
    environment:
      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
      BACKEND_HOST: "metagateway-core"
      BACKEND_PORT: "80"
      LISTEN_PORT: "80"
@@ -414,7 +431,7 @@ services:
    expose: ["80"]
    environment:
      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
      BACKEND_HOST: "metagateway-share"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
@@ -609,6 +626,11 @@ x-compose-app:
    - path: /DATA/AppData/metagateway/metacore
      user: $PUID
      group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metagateway/metacore/db-cache
+      user: $PUID
+      group: $PGID
    - path: /DATA/AppData/metagateway/files
      user: $PUID
      group: $PGID
@@ -624,6 +646,14 @@ x-compose-app:
    - path: /DATA/AppData/metagateway/share-ipfs-state
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metagateway/keys
+      user: $PUID
+      group: $PGID
+  # Derived data only: meta-core rebuilds its index cache from the truth file
+  # (metacore/db/meta-core.db, which IS backed up). keys/ stays backed up.
+  backup:
+    exclude:
+      - metacore/db-cache/
  # Same string as the caddy_0 label, so the tile link and the route agree.
  webui-host: metagateway-${domain}
  webui-path: "/"
@@ -33,7 +33,7 @@ services:
  # co-located metashare-app then seeds the resolved CIDs.
  # ---------------------------------------------------------------------------
  metagateway-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-gateway:1.0.43
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-gateway:1.1.1
    container_name: metagateway-app
    hostname: metagateway-app
    restart: unless-stopped
@@ -55,6 +55,9 @@ services:
    volumes:
      # gateway-config.json (source definitions, feeder URLs) + dispatcher state.
      - ${DATA_ROOT:-/DATA}/AppData/metagateway/state:/data/meta-gateway:rw
+      # Claim-signing key (meta-core 2.0.0 claims model) for the records the
+      # dispatcher writes to metacore-app. Config — backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metagateway/keys:/keys:rw
    environment:
      # Advertised verbatim in this peer's libp2p identify `agent_version`
      # (`baseUrl=...`) and used for NOTHING else in-process — see
@@ -72,6 +75,8 @@ services:
      # carve-out in the Caddy labels below is what makes this URL answerable.
      META_GATEWAY_BASE_URL: "https://metagateway-${APP_DOMAIN}"
      META_GATEWAY_PEER_ID: "metagateway"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metagateway-app.key"
      # --- cross-node discoverability (added 2026-08-26) ---------------------
      # WITHOUT META_GATEWAY_PUBLIC_ADDR meta-gateway starts in local/mDNS-only
      # mode: it loads NO kad bootstraps, sets kad_provide_enabled=false, and so
@@ -193,7 +198,7 @@ services:
      BACKEND_HOST: "metagateway-app"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
    depends_on:
      - metagateway-app
    labels:
@@ -356,6 +361,9 @@ x-compose-app:
    - path: /DATA/AppData/metagateway/state
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metagateway/keys
+      user: $PUID
+      group: $PGID
    - path: /DATA/AppData/metagateway/card
      user: 10001
      group: 999
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: fast.
  # ---------------------------------------------------------------------------
  metapluginanimedetector-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-anime-detector:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-anime-detector:1.1.0
    cpu_shares: 30
    container_name: metapluginanimedetector-plugin
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -49,6 +49,13 @@ services:
      # Nothing to configure: this plugin takes its work from the /process
      # payload and writes back through the caller. No key, no WebDAV.
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginanimedetector-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginanimedetector/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -124,3 +131,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginanimedetector/keys
+      user: $PUID
+      group: $PGID
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: fast.
  # ---------------------------------------------------------------------------
  metapluginffmpeg-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-ffmpeg:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-ffmpeg:1.1.0
    cpu_shares: 30
    container_name: metapluginffmpeg-plugin
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
      # nothing. Every record then fails MetaWatch's poster gate.
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginffmpeg-plugin.key"
    volumes:
      # Plugin cache. Persisted so a recreate does not redo work that is
      # expensive to redo; safe to delete, it rebuilds.
      - ${DATA_ROOT:-/DATA}/AppData/metapluginffmpeg/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginffmpeg/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -144,3 +150,6 @@ x-compose-app:
    - path: /DATA/AppData/metapluginffmpeg/cache
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metapluginffmpeg/keys
+      user: $PUID
+      group: $PGID
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: fast.
  # ---------------------------------------------------------------------------
  metapluginfileinfo-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-file-info:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-file-info:1.1.0
    cpu_shares: 30
    container_name: metapluginfileinfo-plugin
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
      # nothing. Every record then fails MetaWatch's poster gate.
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginfileinfo-plugin.key"
    volumes:
      # Plugin cache. Persisted so a recreate does not redo work that is
      # expensive to redo; safe to delete, it rebuilds.
      - ${DATA_ROOT:-/DATA}/AppData/metapluginfileinfo/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginfileinfo/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -142,3 +148,6 @@ x-compose-app:
    - path: /DATA/AppData/metapluginfileinfo/cache
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metapluginfileinfo/keys
+      user: $PUID
+      group: $PGID
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: fast.
  # ---------------------------------------------------------------------------
  metapluginfilenameparser-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
    cpu_shares: 30
    container_name: metapluginfilenameparser-plugin
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -54,6 +54,13 @@ services:
      # Blank = off = the plugin's own default, which is MetaSort's semantics.
      EMIT_TITLE_TAGS: "${EMIT_TITLE_TAGS:-}"
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginfilenameparser-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginfilenameparser/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -136,3 +143,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginfilenameparser/keys
+      user: $PUID
+      group: $PGID
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: background.
  # ---------------------------------------------------------------------------
  metapluginfullhash-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-fullhash:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-fullhash:1.1.0
    cpu_shares: 30
    container_name: metapluginfullhash-plugin
    # 2 GB, swap disabled (memswap_limit == mem_limit) → OOM instead of
@@ -50,10 +50,16 @@ services:
      # Nothing to configure: this plugin takes its work from the /process
      # payload and writes back through the caller. No key, no WebDAV.
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginfullhash-plugin.key"
    volumes:
      # Plugin cache. Persisted so a recreate does not redo work that is
      # expensive to redo; safe to delete, it rebuilds.
      - ${DATA_ROOT:-/DATA}/AppData/metapluginfullhash/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginfullhash/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -139,3 +145,6 @@ x-compose-app:
    - path: /DATA/AppData/metapluginfullhash/cache
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metapluginfullhash/keys
+      user: $PUID
+      group: $PGID
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: fast.
  # ---------------------------------------------------------------------------
  metapluginjellyfinnfo-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-jellyfin-nfo:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-jellyfin-nfo:1.1.0
    cpu_shares: 30
    container_name: metapluginjellyfinnfo-plugin
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
      # nothing. Every record then fails MetaWatch's poster gate.
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginjellyfinnfo-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginjellyfinnfo/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -133,3 +140,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginjellyfinnfo/keys
+      user: $PUID
+      group: $PGID
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: fast.
  # ---------------------------------------------------------------------------
  metapluginlanguage-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-language:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-language:1.1.0
    cpu_shares: 30
    container_name: metapluginlanguage-plugin
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -49,6 +49,13 @@ services:
      # Nothing to configure: this plugin takes its work from the /process
      # payload and writes back through the caller. No key, no WebDAV.
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginlanguage-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginlanguage/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -126,3 +133,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginlanguage/keys
+      user: $PUID
+      group: $PGID
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: background.
  # ---------------------------------------------------------------------------
  metapluginopensubtitles-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-opensubtitle:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-opensubtitle:1.1.0
    cpu_shares: 30
    container_name: metapluginopensubtitles-plugin
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
      # nothing. Every record then fails MetaWatch's poster gate.
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginopensubtitles-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginopensubtitles/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -137,3 +144,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginopensubtitles/keys
+      user: $PUID
+      group: $PGID
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: background.
  # ---------------------------------------------------------------------------
  metapluginstillextractor-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-still-extractor:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-still-extractor:1.1.0
    cpu_shares: 30
    container_name: metapluginstillextractor-plugin
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
      # nothing. Every record then fails MetaWatch's poster gate.
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginstillextractor-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginstillextractor/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -133,3 +140,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginstillextractor/keys
+      user: $PUID
+      group: $PGID
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: fast.
  # ---------------------------------------------------------------------------
  metapluginsubtitle-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle:1.1.0
    cpu_shares: 30
    container_name: metapluginsubtitle-plugin
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
      # nothing. Every record then fails MetaWatch's poster gate.
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginsubtitle-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitle/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -134,3 +141,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginsubtitle/keys
+      user: $PUID
+      group: $PGID
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: background.
  # ---------------------------------------------------------------------------
  metapluginsubtitleextractor-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.1.0
    cpu_shares: 30
    container_name: metapluginsubtitleextractor-plugin
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
      # nothing. Every record then fails MetaWatch's poster gate.
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginsubtitleextractor-plugin.key"
    volumes:
      # Plugin cache. Persisted so a recreate does not redo work that is
      # expensive to redo; safe to delete, it rebuilds.
      - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitleextractor/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitleextractor/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -145,3 +151,6 @@ x-compose-app:
    - path: /DATA/AppData/metapluginsubtitleextractor/cache
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metapluginsubtitleextractor/keys
+      user: $PUID
+      group: $PGID
@@ -33,7 +33,7 @@ services:
  # consumer on the box can reach it by name. Default queue: background.
  # ---------------------------------------------------------------------------
  metaplugintmdb-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.0.5
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
    cpu_shares: 30
    container_name: metaplugintmdb-plugin
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
      # nothing. Every record then fails MetaWatch's poster gate.
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaplugintmdb-plugin.key"
    volumes:
      # Plugin cache. Persisted so a recreate does not redo work that is
      # expensive to redo; safe to delete, it rebuilds.
      - ${DATA_ROOT:-/DATA}/AppData/metaplugintmdb/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metaplugintmdb/keys:/keys:rw
    networks:
      - pcs
 networks:
@@ -149,3 +155,6 @@ x-compose-app:
    - path: /DATA/AppData/metaplugintmdb/cache
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metaplugintmdb/keys
+      user: $PUID
+      group: $PGID
@@ -47,7 +47,7 @@ services:
  # consumer, not a library indexer.
  # ---------------------------------------------------------------------------
  metaread-core:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:1.0.24
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.0.1
    container_name: metaread-core
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM instead of
    # swap.
@@ -62,6 +62,8 @@ services:
      - 9000
    volumes:
      - ${DATA_ROOT:-/DATA}/AppData/metaread/metacore:/meta-core:rw
+      # (meta-core 2.0.0 keeps its rebuildable index cache at
+      # /meta-core/db-cache/cache.db inside this bind — excluded from backups.)
    environment:
      - BASE_URL=http://metaread-core:9000
      - ENABLE_FILE_WATCHER=false
@@ -86,7 +88,7 @@ services:
  # peer count before suspecting the feeders.
  # ---------------------------------------------------------------------------
  metaread-search:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.2.10
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
    container_name: metaread-search
    mem_limit: 1g
    memswap_limit: 1g
@@ -103,6 +105,9 @@ services:
      # (beacon v2) instead of reading kv-leader.info off a shared
      # volume. See docs/project-architecture/beacon-v2.md.
      - ${DATA_ROOT:-/DATA}/AppData/metaread/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metaread/keys:/keys:rw
    environment:
      P2P_LISTEN: "/ip4/0.0.0.0/tcp/4001"
      # ⚠ The IPV4 spelling, never the bare APP_PUBLIC_IP: on an IPv6-primary
@@ -121,6 +126,8 @@ services:
      META_CORE_URL: "http://metaread-core:9000"
      BASE_URL: "http://metaread-search:3000"
      INTERNAL_BASE_URL: "http://metaread-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaread-search.key"
      TZ: "$TZ"
    depends_on:
      metaread-core:
@@ -154,7 +161,7 @@ services:
    # MetaShare app's `metashare-<tier>` hostnames, which on a shared `pcs`
    # would be ANOTHER hull's plugins writing to another /data).
    #  - 3000  HTTP API   - 3001  plugin callback API (internal only)
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.6.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
    container_name: metaread-share
    # The swarm and blockstore moved to the ipfs plugin, so the hull needs far
    # less than the monolith did.
@@ -176,6 +183,9 @@ services:
      # hull's; ipfs/blocks.redb is the ipfs plugin's corner of the SAME folder
      # (layout unchanged from 1.0.x, so an existing cache carries over).
      - ${DATA_ROOT:-/DATA}/AppData/metaread/share-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metaread/keys:/keys:rw
    environment:
      META_CORE_URL: "http://metaread-core:9000"
      BASE_URL: "http://metaread-share:3000"
@@ -183,6 +193,8 @@ services:
      META_SHARE_PLUGIN_IPFS_URL: "http://metaread-share-ipfs:3000"
      META_SHARE_PLUGIN_TORRENT_URL: "off"
      META_SHARE_PLUGIN_NZB_URL: "off"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaread-share.key"
      TZ: "$TZ"
    depends_on:
      metaread-core:
@@ -247,7 +259,7 @@ services:
  # My List, Continue Reading and reading positions live in the User Data Layer.
  # ---------------------------------------------------------------------------
  metaread-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.3.9.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.4.1
    container_name: metaread-app
    hostname: metaread-app
    restart: unless-stopped
@@ -303,7 +315,7 @@ services:
      - 80
    environment:
      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
      BACKEND_HOST: "metaread-app"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
@@ -337,7 +349,7 @@ services:
      - 80
    environment:
      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
      BACKEND_HOST: "metaread-share"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
@@ -367,7 +379,7 @@ services:
      - 80
    environment:
      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
      BACKEND_HOST: "metaread-search"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
@@ -524,6 +536,11 @@ x-compose-app:
    - path: /DATA/AppData/metaread/metacore
      user: $PUID
      group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metaread/metacore/db-cache
+      user: $PUID
+      group: $PGID
    - path: /DATA/AppData/metaread/data
      user: $PUID
      group: $PGID
@@ -539,5 +556,13 @@ x-compose-app:
    - path: /DATA/AppData/metaread/metashare-config
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metaread/keys
+      user: $PUID
+      group: $PGID
+  # Derived data only: meta-core rebuilds its index cache from the truth file
+  # (metacore/db/meta-core.db, which IS backed up). keys/ stays backed up.
+  backup:
+    exclude:
+      - metacore/db-cache/
  webui-host: metaread-${domain}
  webui-path: "/"
@@ -60,7 +60,7 @@ services:
  # peer count before suspecting the feeders.
  # ---------------------------------------------------------------------------
  metaread-search:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.2.10
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
    container_name: metaread-search
    # 2g, not the self-contained listing's 1g: on the shared core it indexes the
    # gateway box's whole catalogue (~830 MiB steady state on watch.nsl.sh).
@@ -79,6 +79,9 @@ services:
      # (beacon v2) instead of reading kv-leader.info off a shared
      # volume. See docs/project-architecture/beacon-v2.md.
      - ${DATA_ROOT:-/DATA}/AppData/metaread/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metaread/keys:/keys:rw
    environment:
      # Distinct from metawatch-search on the same core, so the two discovery
      # peers do not register under one name.
@@ -111,6 +114,8 @@ services:
      META_CORE_URL: "http://metacore-app:80"
      BASE_URL: "http://metaread-search:3000"
      INTERNAL_BASE_URL: "http://metaread-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaread-search.key"
      TZ: "$TZ"
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:3000/health"]
@@ -132,7 +137,7 @@ services:
  # User Data Layer.
  # ---------------------------------------------------------------------------
  metaread-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.3.9.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.4.1
    container_name: metaread-app
    hostname: metaread-app
    restart: unless-stopped
@@ -208,7 +213,7 @@ services:
      - 80
    environment:
      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
      BACKEND_HOST: "metaread-search"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
@@ -361,6 +366,9 @@ x-compose-app:
    - path: /DATA/AppData/metaread/search-data
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metaread/keys
+      user: $PUID
+      group: $PGID
  # Same string as the caddy_0 label, so the tile link and the route agree.
  webui-host: metaread-${domain}
  webui-path: "/"
@@ -13,7 +13,7 @@ services:
  #  - 3000  HTTP API + dashboard (proxied through the hash-lock + Caddy)
  #  - 3001  plugin callback API — internal only, never published
  metashare-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.6.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
    container_name: metashare-app
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM instead of
    # swap. The swarm, blockstore and torrent session moved to the plugins, so
@@ -42,6 +42,10 @@ services:
      # host folder, which they mount too — so the tmp/ → cache/ rename(2) stays
      # atomic. Layout unchanged from the monolith: existing caches carry over.
      - ${DATA_ROOT:-/DATA}/AppData/metashare/data:/data:rw
+      # Claim-signing key (meta-core 2.0.0 claims model): the hull's identity on
+      # the claims it writes (content links, archive marks, pointer resolves).
+      # Config — backed up, deliberately NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metashare/keys:/keys:rw

    environment:
      # Service registration / neighbour announce.
@@ -51,6 +55,8 @@ services:
      # Inter-peer fetch URL, announced in identify by the ipfs plugin. Same as
      # BASE_URL in prod (other peers fetch via the public Caddy URL).
      - INTERNAL_BASE_URL=https://metashare-$APP_DOMAIN
+      # Own claim-signing key; generated on first boot if missing.
+      - METAMESH_SIGNING_KEY_FILE=/keys/metashare-app.key
      - TZ=$TZ

    user: 0:0
@@ -86,7 +92,7 @@ services:
      BACKEND_HOST: "metashare-app"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"

    depends_on:
      - metashare-app
@@ -276,6 +282,9 @@ x-compose-app:
    - path: /DATA/AppData/metashare/data
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metashare/keys
+      user: $PUID
+      group: $PGID
  # Fetched content only: everything under these can be pulled again off the
  # swarm/NNTP/HTTP (meta-share reclaim.rs, "cache means cache"). They are ~94G
  # on a busy peer, so without this every backup — and Maison's pre-update
@@ -4,7 +4,7 @@ services:
  # Backend service. Reachable on the pcs network as `metasort-app`.
  # Public ingress goes through the `metasort` hash-lock proxy below.
  metasort-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-sort:1.0.13
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-sort:1.1.1
    container_name: metasort-app
    hostname: metasort-app
    restart: unless-stopped
@@ -39,6 +39,11 @@ services:
      - ${DATA_ROOT:-/DATA}/AppData/metasort/config/supervisord-metasort.conf:/etc/supervisor/conf.d/supervisord.conf:ro
      - ${DATA_ROOT:-/DATA}/AppData/metasort/config/nginx-metasort.conf:/etc/nginx/nginx.conf:ro

+      # Signing keys (meta-core 2.0.0 claims model): metasort-app.key is
+      # meta-sort's own identity; plugins/<pluginId>.key are minted per plugin
+      # and injected into the plugin containers it spawns. Config — backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metasort/keys:/keys:rw
+
    # Note: no /files mounts — files are accessed via WebDAV from MetaCore
    # (Architecture V3). MetaCore is the single source of truth for media files.

@@ -61,6 +66,8 @@ services:
      # Compose project label stamped on the plugin containers meta-sort spawns,
      # so they group under one stack instead of floating loose.
      - PLUGIN_STACK_NAME=metasort-plugins
+      # meta-sort's own claim-signing key; generated on first boot if missing.
+      - METAMESH_SIGNING_KEY_FILE=/keys/metasort-app.key

    # Note: Runs as root for nginx, Redis, and file management
    user: 0:0
@@ -89,7 +96,7 @@ services:
      BACKEND_HOST: "metasort-app"
      BACKEND_PORT: "80"
      LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"

    depends_on:
      - metasort-app
@@ -217,6 +224,9 @@ x-compose-app:
    - path: /DATA/AppData/metasort/cache
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metasort/keys
+      user: $PUID
+      group: $PGID
  # Same string as the caddy_0 label, so the tile link and the route agree.
  webui-host: metasort-${domain}
  webui-path: "/"
@@ -15,7 +15,7 @@ defaults:
 plugins:
  file-info:
    enabled: true
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-file-info:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-file-info:1.1.0
    instances: 1
    resources:
      memory: 128m
@@ -23,7 +23,7 @@ plugins:

  ffmpeg:
    enabled: true
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-ffmpeg:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-ffmpeg:1.1.0
    instances: 1
    resources:
      memory: 512m
@@ -31,7 +31,7 @@ plugins:

  subtitle:
    enabled: true
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle:1.1.0
    instances: 1
    resources:
      memory: 128m
@@ -39,7 +39,7 @@ plugins:

  subtitle-extractor:
    enabled: true
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.1.0
    instances: 1
    resources:
      memory: 512m
@@ -48,7 +48,7 @@ plugins:

  still-extractor:
    enabled: true
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-still-extractor:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-still-extractor:1.1.0
    instances: 1
    resources:
      memory: 512m
@@ -29,7 +29,7 @@ services:
  metawatch-core:
    # 1.0.1 carries the identity API (commit 52f5b5c) required for MetaWatch
    # sign-in / keypair generation; 1.0.0 predates it.
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:1.0.24
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.0.1
    container_name: metawatch-core
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
    # instead of swap. Mirrors the dev sub-stack limits.
@@ -44,6 +44,8 @@ services:
      - 9000
    volumes:
      - ${DATA_ROOT:-/DATA}/AppData/metawatch/metacore:/meta-core:rw
+      # (meta-core 2.0.0 keeps its rebuildable index cache at
+      # /meta-core/db-cache/cache.db inside this bind — excluded from backups.)
      # Subtitle store: player-uploaded subtitles land in /files/plugin/subtitles
      # (WebDAV PUT + POST /api/files/register, needs meta-core with that route).
      # Plugin output only — no /files/watch mount, watcher stays off.
@@ -72,7 +74,7 @@ services:
    # RSA-keyed bootstrap.libp2p.io nodes) and therefore to DISCOVER remote
    # gateways via the kad `metamesh-gateway` provider namespace. Without it
    # this peer only ever sees same-host mDNS peers.
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.2.10
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
    container_name: metawatch-search
    # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
    # instead of swap. Mirrors the dev sub-stack limits.
@@ -96,6 +98,9 @@ services:
      # swarm. Without this mount both are on the container's writable layer and
      # every image bump loses the prefs and re-fetches every poster.
      - ${DATA_ROOT:-/DATA}/AppData/metawatch/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
    environment:
      P2P_LISTEN: "/ip4/0.0.0.0/tcp/4001"
      # Public IPFS DHT bootstraps by explicit /dns4/.../tcp/4001 (the nested
@@ -121,6 +126,8 @@ services:
      SEARCH_TIMEOUT_SECS: "300"
      META_CORE_URL: "http://metawatch-core:9000"
      BASE_URL: "http://metawatch-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-search.key"
      # Renamed at the 1.1.0 bump (2026-08-26), as the old note here said to do:
      # META_SHARE_PEER_API_URL was the pre-1.0.8 spelling and now only logs a
      # deprecation warning. Do NOT set both.
@@ -157,7 +164,7 @@ services:
    # MetaShare app's `metashare-<tier>` hostnames, which on a shared `pcs`
    # would be ANOTHER hull's plugins writing to another /data).
    #  - 3000  HTTP API   - 3001  plugin callback API (internal only)
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.6.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
    container_name: metawatch-share
    # The swarm and blockstore moved to the ipfs plugin, so the hull needs far
    # less than the monolith did.
@@ -179,6 +186,9 @@ services:
      # hull's; ipfs/blocks.redb is the ipfs plugin's corner of the SAME folder
      # (layout unchanged from 1.0.x, so an existing cache carries over).
      - ${DATA_ROOT:-/DATA}/AppData/metawatch/share-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
    environment:
      META_CORE_URL: "http://metawatch-core:9000"
      BASE_URL: "http://metawatch-share:3000"
@@ -186,6 +196,8 @@ services:
      META_SHARE_PLUGIN_IPFS_URL: "http://metawatch-share-ipfs:3000"
      META_SHARE_PLUGIN_TORRENT_URL: "off"
      META_SHARE_PLUGIN_NZB_URL: "off"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-share.key"
      TZ: "$TZ"
    depends_on:
      metawatch-core:
@@ -250,8 +262,12 @@ services:
  # My List + Continue Watching persist in /DATA/AppData/metawatch/data.
  # ---------------------------------------------------------------------------
  metawatch-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.0.93
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.1.0
    container_name: metawatch-app
+    # Run as the PUID that Maison creates the app folders with (as the Shared
+    # variant does). The image default user (uid 10001) cannot write them on a
+    # fresh install: "create ipfs dir … Permission denied".
+    user: "1000:1000"
    hostname: metawatch-app
    restart: unless-stopped
    cpu_shares: 30
@@ -264,6 +280,9 @@ services:
      - 3000
    volumes:
      - ${DATA_ROOT:-/DATA}/AppData/metawatch/data:/app/data
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
    environment:
      META_SHARE_URL: "http://metawatch-share:3000"
      META_SEARCH_URL: "http://metawatch-search:3000"
@@ -275,6 +294,8 @@ services:
      META_WATCH_SYNC_PEERS: "http://metawatch-search:3000"
      # This box's own core — subtitle store only (uploads + curated matches).
      META_CORE_URL: "http://metawatch-core:9000"
+      # Own claim-signing key for the subtitle-store claims it writes; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-app.key"
      TZ: "$TZ"
    depends_on:
      metawatch-search:
@@ -310,7 +331,7 @@ services:
      BACKEND_HOST: "metawatch-app"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
    depends_on:
      - metawatch-app
    labels:
@@ -359,7 +380,7 @@ services:
    expose: ["80"]
    environment:
      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
      BACKEND_HOST: "metawatch-share"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
@@ -388,7 +409,7 @@ services:
    expose: ["80"]
    environment:
      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
      BACKEND_HOST: "metawatch-search"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
@@ -526,6 +547,11 @@ x-compose-app:
    - path: /DATA/AppData/metawatch/metacore
      user: $PUID
      group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metawatch/metacore/db-cache
+      user: $PUID
+      group: $PGID
    - path: /DATA/AppData/metawatch/search-data
      user: $PUID
      group: $PGID
@@ -541,6 +567,14 @@ x-compose-app:
    - path: /DATA/AppData/metawatch/data
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metawatch/keys
+      user: $PUID
+      group: $PGID
+  # Derived data only: meta-core rebuilds its index cache from the truth file
+  # (metacore/db/meta-core.db, which IS backed up). keys/ stays backed up.
+  backup:
+    exclude:
+      - metacore/db-cache/
  # Same string as the caddy_0 label, so the tile link and the route agree.
  webui-host: metawatch-${domain}
  webui-path: "/"
@@ -45,7 +45,7 @@ services:
  # core of its own.
  # ---------------------------------------------------------------------------
  metawatch-search:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.2.10
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
    container_name: metawatch-search
    hostname: metawatch-search
    restart: unless-stopped
@@ -71,6 +71,9 @@ services:
      # swarm. Without this mount both are on the container's writable layer and
      # every image bump loses the prefs and re-fetches every poster.
      - ${DATA_ROOT:-/DATA}/AppData/metawatch/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
    environment:
      P2P_LISTEN: "/ip4/0.0.0.0/tcp/4001"
      # Public IPFS DHT bootstraps by explicit /dns4/.../tcp/4001 (the nested
@@ -93,6 +96,8 @@ services:
      META_CORE_URL: "http://metacore-app:80"
      BASE_URL: "http://metawatch-search:3000"
      INTERNAL_BASE_URL: "http://metawatch-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-search.key"
      TZ: "$TZ"
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:3000/health"]
@@ -115,7 +120,7 @@ services:
  # owns the caddy_* labels directly and Caddy proxies straight to :3000.
  # ---------------------------------------------------------------------------
  metawatch-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.0.93
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.1.0
    container_name: metawatch-app
    hostname: metawatch-app
    restart: unless-stopped
@@ -130,6 +135,9 @@ services:
      - 3000
    volumes:
      - ${DATA_ROOT:-/DATA}/AppData/metawatch/data:/app/data
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
    environment:
      # The STANDALONE MetaShare app — this variant ships no transport peer.
      META_SHARE_URL: "http://metashare-app:3000"
@@ -143,6 +151,8 @@ services:
      # variant has no private core: it writes to the standalone MetaCore app,
      # which already mounts /files and runs the watcher.
      META_CORE_URL: "http://metacore-app:80"
+      # Own claim-signing key for the subtitle-store claims it writes; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-app.key"
      TZ: "$TZ"
    depends_on:
      metawatch-search:
@@ -197,7 +207,7 @@ services:
      BACKEND_HOST: "metawatch-search"
      BACKEND_PORT: "3000"
      LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
    depends_on:
      - metawatch-search
    labels:
@@ -346,6 +356,9 @@ x-compose-app:
    - path: /DATA/AppData/metawatch/data
      user: $PUID
      group: $PGID
+    - path: /DATA/AppData/metawatch/keys
+      user: $PUID
+      group: $PGID
  # Same string as the caddy_0 label, so the tile link and the route agree.
  webui-host: metawatch-${domain}
  webui-path: "/"