diff --git a/templates/audiobookshelf/docker-compose.yml b/templates/audiobookshelf/docker-compose.yml
index d01559b..009782c 100644
--- a/templates/audiobookshelf/docker-compose.yml
+++ b/templates/audiobookshelf/docker-compose.yml
@@ -5,20 +5,28 @@
 #
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH        - Hangoskönyv tár útvonal
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
+#
+# Storage layout (felhom userdata convention):
+#   Hangoskönyvek → ${USERDATA_PATH}/media/audiobooks   (írható)
+#   Podcastok     → ${USERDATA_PATH}/media/podcasts      (írható)
+# Run-identity: user 1000:1000 so files land group-writable for the shared content group
+# (GID 1000); the userdata dirs are setgid 2775. If the image fails to start healthy as
+# 1000, the controller/operator reverts to root and relies on setgid (see REPORT).
 
 services:
   audiobookshelf:
     image: ghcr.io/advplyr/audiobookshelf:2.19.5
     container_name: audiobookshelf
     restart: unless-stopped
+    user: "1000:1000"
     environment:
       - TZ=Europe/Budapest
     volumes:
       - audiobookshelf_config:/config
       - audiobookshelf_metadata:/metadata
-      - ${HDD_PATH}/media/audiobooks:/audiobooks
-      - ${HDD_PATH}/media/podcasts:/podcasts
+      - ${USERDATA_PATH}/media/audiobooks:/audiobooks
+      - ${USERDATA_PATH}/media/podcasts:/podcasts
     networks:
       - traefik-public
     deploy:
diff --git a/templates/calibre-web/.felhom.yml b/templates/calibre-web/.felhom.yml
index bd8d6c9..8cb532d 100644
--- a/templates/calibre-web/.felhom.yml
+++ b/templates/calibre-web/.felhom.yml
@@ -57,7 +57,7 @@ app_info:
     - 'Nyisd meg a books.DOMAIN címet a böngészőben'
     - 'Jelentkezz be: admin / admin123'
     - 'Változtasd meg azonnal a jelszót'
-    - 'Dobj egy könyvet az ingest mappába - automatikusan feldolgozza'
+    - 'Dobj egy könyvet a Fájlkezelőben (FileBrowser) az import/calibre mappába — automatikusan feldolgozza és a media/books könyvtárba helyezi'
 
   prerequisites:
     - 'Külső HDD szükséges az e-könyvek tárolásához'
diff --git a/templates/calibre-web/docker-compose.yml b/templates/calibre-web/docker-compose.yml
index d5b2f26..f810b0b 100644
--- a/templates/calibre-web/docker-compose.yml
+++ b/templates/calibre-web/docker-compose.yml
@@ -5,12 +5,13 @@
 #
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH        - E-könyvtár útvonal
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
 #
-# Storage layout:
-#   App config/DB    → calibre_web_config       (named volume, NVMe)
-#   Book ingest      → ${HDD_PATH}/media/books/ingest   (HDD, drop files here — processed and removed)
-#   Calibre library  → ${HDD_PATH}/media/books/library  (HDD, Calibre library storage)
+# Storage layout (felhom userdata convention):
+#   App config/DB    → calibre_web_config              (named volume, NVMe)
+#   Calibre library  → ${USERDATA_PATH}/media/books     (browsable, írható)
+#   Book ingest      → ${USERDATA_PATH}/import/calibre  (drop-zone — processed and removed)
+# Run-identity: PUID/PGID 1000 (shared content group); UMASK=002 so output is group-writable.
 #
 # First-time setup:
 #   Default login: admin / admin123 — change immediately!
@@ -24,10 +25,11 @@ services:
       - TZ=Europe/Budapest
       - PUID=1000
       - PGID=1000
+      - UMASK=002
     volumes:
       - calibre_web_config:/config
-      - ${HDD_PATH}/media/books/ingest:/cwa-book-ingest
-      - ${HDD_PATH}/media/books/library:/calibre-library
+      - ${USERDATA_PATH}/import/calibre:/cwa-book-ingest
+      - ${USERDATA_PATH}/media/books:/calibre-library
     networks:
       - traefik-public
     deploy:
diff --git a/templates/emby/docker-compose.yml b/templates/emby/docker-compose.yml
index c1c1fac..ed024ff 100644
--- a/templates/emby/docker-compose.yml
+++ b/templates/emby/docker-compose.yml
@@ -5,7 +5,10 @@
 #
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH        - Médiatár útvonal
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
+#
+# Storage layout (felhom userdata convention):
+#   Médiatár  → ${USERDATA_PATH}/media   (csak olvasható)
 
 services:
   emby:
@@ -18,7 +21,7 @@ services:
       - GID=1000
     volumes:
       - emby_config:/config
-      - ${HDD_PATH}/media:/media:ro
+      - ${USERDATA_PATH}/media:/media:ro
     networks:
       - traefik-public
     deploy:
diff --git a/templates/immich/.felhom.yml b/templates/immich/.felhom.yml
index 7ba611a..3d731ae 100644
--- a/templates/immich/.felhom.yml
+++ b/templates/immich/.felhom.yml
@@ -69,6 +69,11 @@ app_info:
     - 'Telepítsd az Immich alkalmazást a telefonodra (Android/iOS)'
     - 'Állítsd be az automatikus feltöltést az alkalmazásban'
     - 'Hívd meg a családtagokat külön fiókokkal'
+    # MOUNT-READY, REGISTRATION PENDING: a megosztott média/photos mappa be van csatolva
+    # /external/photos néven (csak olvasható), de az Immich CSAK akkor látja, ha az
+    # adminfelületen (Administration → External Libraries) regisztrálod a /external/photos
+    # útvonalat. Compose ezt NEM teszi meg automatikusan — ez egy telepítés utáni lépés.
+    - 'Külső könyvtár (opcionális): Administration → External Libraries → add /external/photos'
 
   prerequisites:
     - 'Külső HDD szükséges a fotók és videók tárolásához'
diff --git a/templates/immich/docker-compose.yml b/templates/immich/docker-compose.yml
index 5c3e572..e4ac41a 100644
--- a/templates/immich/docker-compose.yml
+++ b/templates/immich/docker-compose.yml
@@ -5,17 +5,25 @@
 #
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH        - HDD mount path (e.g., /mnt/hdd_1)
+#   HDD_PATH        - Drive namespace root (managed upload lives under appdata)
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
 #   DB_PASSWORD     - PostgreSQL password (auto-generated)
 #
-# Storage layout:
-#   User photos/videos → ${HDD_PATH}/appdata/immich  (HDD, host path)
-#   PostgreSQL data    → immich_postgres_data          (named volume, NVMe)
-#   ML model cache     → immich_ml_cache               (named volume, NVMe)
-#   Redis data         → immich_redis_data             (named volume, NVMe)
+# Storage layout (felhom userdata convention):
+#   Managed upload (Immich-owned) → ${HDD_PATH}/appdata/immich   (HDD, host path — app-managed)
+#   External photo library (RO)   → ${USERDATA_PATH}/media/photos → /external/photos
+#   PostgreSQL data    → immich_postgres_data   (named volume, NVMe)
+#   ML model cache     → immich_ml_cache         (named volume, NVMe)
+#   Redis data         → immich_redis_data       (named volume, NVMe)
+#
+# ⚠ EXTERNAL LIBRARY IS NOT WIRED BY COMPOSE: mounting /external/photos only makes the files
+#   visible to the container. To actually surface them in Immich you MUST register an External
+#   Library pointing at /external/photos in the Immich admin UI (Administration → External
+#   Libraries) or via the API — a POST-DEPLOY step. Until then photos sharing is "mount ready,
+#   registration pending". See .felhom.yml first_steps + REPORT.
 #
 # First-time setup:
-#   Create admin account on first visit.
+#   Create admin account on first visit, then register the External Library (see above).
 
 services:
   immich-server:
@@ -37,6 +45,7 @@ services:
       - TZ=Europe/Budapest
     volumes:
       - ${HDD_PATH}/appdata/immich:/usr/src/app/upload
+      - ${USERDATA_PATH}/media/photos:/external/photos:ro
     networks:
       - traefik-public
       - immich-internal
diff --git a/templates/jellyfin/docker-compose.yml b/templates/jellyfin/docker-compose.yml
index 2d4a794..abe0b4f 100644
--- a/templates/jellyfin/docker-compose.yml
+++ b/templates/jellyfin/docker-compose.yml
@@ -5,7 +5,10 @@
 #
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH        - Médiatár útvonal
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata) — a média a media/ alatt
+#
+# Storage layout (felhom userdata convention):
+#   Médiatár  → ${USERDATA_PATH}/media   (csak olvasható; a könyvtárakat az appban választod ki)
 
 services:
   jellyfin:
@@ -17,7 +20,7 @@ services:
     volumes:
       - jellyfin_config:/config
       - jellyfin_cache:/cache
-      - ${HDD_PATH}/media:/media:ro
+      - ${USERDATA_PATH}/media:/media:ro
     networks:
       - traefik-public
     deploy:
diff --git a/templates/komga/docker-compose.yml b/templates/komga/docker-compose.yml
index 34c274e..dbfaaae 100644
--- a/templates/komga/docker-compose.yml
+++ b/templates/komga/docker-compose.yml
@@ -5,18 +5,24 @@
 #
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH        - Képregénytár útvonal
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
+#
+# Storage layout (felhom userdata convention):
+#   Képregénytár → ${USERDATA_PATH}/media/comics   (írható)
+# Run-identity: user 1000:1000 for the shared content group (GID 1000); userdata dirs are
+# setgid 2775. Try-then-fallback to root if it won't start healthy as 1000 (see REPORT).
 
 services:
   komga:
     image: gotson/komga:1.20.0
     container_name: komga
     restart: unless-stopped
+    user: "1000:1000"
     environment:
       - TZ=Europe/Budapest
     volumes:
       - komga_config:/config
-      - ${HDD_PATH}/media/comics:/data
+      - ${USERDATA_PATH}/media/comics:/data
     networks:
       - traefik-public
     deploy:
diff --git a/templates/navidrome/docker-compose.yml b/templates/navidrome/docker-compose.yml
index 92f750f..f7bcf91 100644
--- a/templates/navidrome/docker-compose.yml
+++ b/templates/navidrome/docker-compose.yml
@@ -5,7 +5,10 @@
 #
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH        - Zenegyűjtemény útvonal
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
+#
+# Storage layout (felhom userdata convention):
+#   Zenegyűjtemény → ${USERDATA_PATH}/media/music   (csak olvasható)
 
 services:
   navidrome:
@@ -19,7 +22,7 @@ services:
       - ND_BASEURL=
     volumes:
       - navidrome_data:/data
-      - ${HDD_PATH}/media/music:/music:ro
+      - ${USERDATA_PATH}/media/music:/music:ro
     networks:
       - traefik-public
     deploy:
diff --git a/templates/paperless-ngx/.felhom.yml b/templates/paperless-ngx/.felhom.yml
index 8633f4d..7a41876 100644
--- a/templates/paperless-ngx/.felhom.yml
+++ b/templates/paperless-ngx/.felhom.yml
@@ -131,7 +131,7 @@ app_info:
     - 'Nyisd meg a paperless.DOMAIN címet a böngészőben'
     - 'Jelentkezz be: admin / admin'
     - 'Változtasd meg azonnal a jelszót'
-    - 'Tölts fel egy dokumentumot (PDF, kép) és várd meg az OCR feldolgozást'
+    - 'Tölts fel egy dokumentumot a webfelületen, VAGY dobd a Fájlkezelőben (FileBrowser) az import/paperless mappába — onnan automatikusan beolvassa és OCR-rel feldolgozza'
     - 'Hozz létre címkéket és levelezőket az automatikus rendszerezéshez'
 
   prerequisites:
diff --git a/templates/paperless-ngx/docker-compose.yml b/templates/paperless-ngx/docker-compose.yml
index 6e11f6e..0de89c1 100644
--- a/templates/paperless-ngx/docker-compose.yml
+++ b/templates/paperless-ngx/docker-compose.yml
@@ -5,17 +5,20 @@
 #
 # Environment variables:
 #   DOMAIN                  - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH                - HDD mount path (e.g., /mnt/hdd_1)
+#   HDD_PATH                - Drive namespace root (managed media/export under appdata)
+#   USERDATA_PATH           - Ügyfél-tartalom gyökér (<namespace>/userdata)
 #   PAPERLESS_SECRET_KEY    - Random secret (auto-generated)
 #   DB_PASSWORD             - PostgreSQL password (auto-generated)
 #   PAPERLESS_ADMIN_USER    - Initial admin username (default: admin)
 #   PAPERLESS_ADMIN_PASSWORD - Initial admin password
 #
-# Storage layout:
-#   Consume folder   → ${HDD_PATH}/appdata/paperless/consume   (HDD, drop files here)
-#   Document media   → ${HDD_PATH}/appdata/paperless/media      (HDD, originals + archive)
-#   Export folder    → ${HDD_PATH}/appdata/paperless/export     (HDD, for backups)
-#   App data/index   → paperless_data                            (named volume, NVMe)
+# Storage layout (felhom userdata convention):
+#   Consume drop-zone → ${USERDATA_PATH}/import/paperless  (browsable — drop files here via FileBrowser)
+#   Document media    → ${HDD_PATH}/appdata/paperless/media  (app-managed originals + archive)
+#   Export folder     → ${HDD_PATH}/appdata/paperless/export (app-managed backups)
+#   App data/index    → paperless_data                       (named volume, NVMe)
+# Run-identity: USERMAP_UID/GID 1000 → paperless consumes + DELETES from the import drop-zone
+# (group 1000, setgid 2775) without permission errors.
 #   PostgreSQL data  → paperless_postgres_data                   (named volume, NVMe)
 #   Redis data       → paperless_redis_data                      (named volume, NVMe)
 #
@@ -55,7 +58,7 @@ services:
     volumes:
       - paperless_data:/usr/src/paperless/data
       - ${HDD_PATH}/appdata/paperless/media:/usr/src/paperless/media
-      - ${HDD_PATH}/appdata/paperless/consume:/usr/src/paperless/consume
+      - ${USERDATA_PATH}/import/paperless:/usr/src/paperless/consume
       - ${HDD_PATH}/appdata/paperless/export:/usr/src/paperless/export
     networks:
       - traefik-public
diff --git a/templates/plex/docker-compose.yml b/templates/plex/docker-compose.yml
index ad40f75..e3516ed 100644
--- a/templates/plex/docker-compose.yml
+++ b/templates/plex/docker-compose.yml
@@ -6,7 +6,10 @@
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
 #   PLEX_CLAIM      - Plex Claim Token
-#   HDD_PATH        - Médiatár útvonal
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
+#
+# Storage layout (felhom userdata convention):
+#   Médiatár  → ${USERDATA_PATH}/media   (csak olvasható)
 
 services:
   plex:
@@ -19,7 +22,7 @@ services:
     volumes:
       - plex_config:/config
       - plex_transcode:/transcode
-      - ${HDD_PATH}/media:/media:ro
+      - ${USERDATA_PATH}/media:/media:ro
     networks:
       - traefik-public
     deploy:
diff --git a/templates/radarr/docker-compose.yml b/templates/radarr/docker-compose.yml
index 01952c1..0bdd049 100644
--- a/templates/radarr/docker-compose.yml
+++ b/templates/radarr/docker-compose.yml
@@ -5,7 +5,13 @@
 #
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH        - Médiatár útvonal
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
+#
+# Storage layout (felhom userdata convention):
+#   Filmtár    → ${USERDATA_PATH}/media/movies   (írható)
+#   Letöltések → ${USERDATA_PATH}/downloads      (SIBLING of media — same FS → hardlink/atomic move)
+# Run-identity: PUID/PGID 1000 (shared content group); UMASK=002 → group-writable output so
+# the media server + FileBrowser can manage the files radarr produces.
 
 services:
   radarr:
@@ -16,10 +22,11 @@ services:
       - TZ=Europe/Budapest
       - PUID=1000
       - PGID=1000
+      - UMASK=002
     volumes:
       - radarr_config:/config
-      - ${HDD_PATH}/media:/media
-      - ${HDD_PATH}/downloads:/downloads
+      - ${USERDATA_PATH}/media/movies:/media/movies
+      - ${USERDATA_PATH}/downloads:/downloads
     networks:
       - traefik-public
     deploy:
diff --git a/templates/romm/.felhom.yml b/templates/romm/.felhom.yml
index 079a6f4..3e394f1 100644
--- a/templates/romm/.felhom.yml
+++ b/templates/romm/.felhom.yml
@@ -75,14 +75,14 @@ app_info:
     - "Nyisd meg az arcade.DOMAIN címet a böngészőben"
     - "Jelentkezz be az alapértelmezett admin / admin fiókkal"
     - "Változtasd meg azonnal a jelszót a Settings menüben"
-    - "Töltsd fel a ROM fájlokat a library mappába (platform/játéknév struktúrával)"
+    - "Töltsd fel a ROM fájlokat a Fájlkezelőben (FileBrowser) a roms/ mappába, platform mappákba rendezve (pl. roms/gba/, roms/snes/)"
     - "Indíts egy Scan-t a bal oldali menüben a ROM-ok beolvasásához"
     - "Opcionális: állíts be metaadat-szolgáltatókat a borítóképek és leírások automatikus letöltéséhez (lásd lent)"
 
   prerequisites:
     - "Külső HDD szükséges a ROM fájlok és borítóképek tárolásához"
     - "Legalább 1 GB szabad RAM ajánlott (MariaDB + Redis + RomM)"
-    - "ROM fájlok platform mappákba rendezve (pl. library/gba/, library/snes/)"
+    - "ROM fájlok platform mappákba rendezve (pl. roms/gba/, roms/snes/)"
 
 # --- Optional config (configurable before or after deployment) ---
 optional_config:
diff --git a/templates/romm/docker-compose.yml b/templates/romm/docker-compose.yml
index f123413..b461fed 100644
--- a/templates/romm/docker-compose.yml
+++ b/templates/romm/docker-compose.yml
@@ -5,14 +5,15 @@
 #
 # Environment variables:
 #   DOMAIN                  - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH                - HDD mount path (e.g., /mnt/hdd_1)
+#   HDD_PATH                - Drive namespace root (appdata lives here)
+#   USERDATA_PATH           - Ügyfél-tartalom gyökér (<namespace>/userdata)
 #   DB_PASSWORD             - MariaDB user password (auto-generated)
 #   MYSQL_ROOT_PASSWORD     - MariaDB root password (auto-generated)
 #   ROMM_AUTH_SECRET_KEY    - Auth secret (auto-generated)
 #
-# Storage layout:
-#   ROM library    → ${HDD_PATH}/appdata/romm/library     (HDD, host path)
-#   Cover art etc  → ${HDD_PATH}/appdata/romm/resources   (HDD, host path)
+# Storage layout (felhom userdata convention):
+#   ROM library    → ${USERDATA_PATH}/roms                  (browsable — drop ROMs here via FileBrowser)
+#   Cover art etc  → ${HDD_PATH}/appdata/romm/resources     (app-internal, NOT browsable)
 #   App config     → romm_config                            (named volume, NVMe)
 #   MariaDB data   → romm_db_data                           (named volume, NVMe)
 #   Redis data     → romm_redis_data                        (named volume, NVMe)
@@ -62,7 +63,7 @@ services:
       - MOBYGAMES_API_KEY=${MOBYGAMES_API_KEY:-}
       - TZ=Europe/Budapest
     volumes:
-      - ${HDD_PATH}/appdata/romm/library:/romm/library
+      - ${USERDATA_PATH}/roms:/romm/library
       - ${HDD_PATH}/appdata/romm/resources:/romm/resources
       - romm_config:/romm/config
     networks:
diff --git a/templates/sonarr/docker-compose.yml b/templates/sonarr/docker-compose.yml
index 05219c4..8e21732 100644
--- a/templates/sonarr/docker-compose.yml
+++ b/templates/sonarr/docker-compose.yml
@@ -5,7 +5,12 @@
 #
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH        - Médiatár útvonal
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
+#
+# Storage layout (felhom userdata convention):
+#   Sorozattár → ${USERDATA_PATH}/media/tv     (írható)
+#   Letöltések → ${USERDATA_PATH}/downloads    (SIBLING of media — same FS → hardlink/atomic move)
+# Run-identity: PUID/PGID 1000 (shared content group); UMASK=002 → group-writable output.
 
 services:
   sonarr:
@@ -16,10 +21,11 @@ services:
       - TZ=Europe/Budapest
       - PUID=1000
       - PGID=1000
+      - UMASK=002
     volumes:
       - sonarr_config:/config
-      - ${HDD_PATH}/media:/media
-      - ${HDD_PATH}/downloads:/downloads
+      - ${USERDATA_PATH}/media/tv:/media/tv
+      - ${USERDATA_PATH}/downloads:/downloads
     networks:
       - traefik-public
     deploy: