v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

R-1111 reserveAttempt is the one limiter body (share password, escrow re-auth, dashboard sign-in). R-1112
family.json holds fingerprints; old files are converted at load. R-1113 the household's pass reuses its
family session. R-1109 the samba compose carries the smb.conf hash. R-1110 TestNoBareDrivePathToPathHelpers.
R-1114 shared_scripts.py resolves the felhom.eu sibling from a worktree. Each red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -2133,7 +2133,9 @@ that folder is never a dead end, and an install never runs into it silently (R-6
   page) and the household itself get through; `family_gate_except:` lists literal path prefixes left to the app's own
   login (anchored `^/prefix(/|$)`). Door file `family-gate-<app>.yml`, written before the first start; answerer
   `/__felhom_gate/family`; sign-in pages `/__family/start|login|logout` on the dashboard host; sessions 30 days in
-  `family.json`. A family cookie never opens the dashboard. `min_controller:` refuses a template too new for the box.
+  `family.json`, stored as their FINGERPRINT (sha256 of the cookie value, the dashboard's R-35 shape — v0.325.0, R-1112;
+  an older file is converted at load and rewritten). The household's pass reuses its one live family session (a new one
+  only when less than half of its life is left — R-1113). A family cookie never opens the dashboard. `min_controller:` refuses a template too new for the box.
   Code: `internal/family/`, `internal/stacks/family_gate.go`, `internal/web/family_gate.go`.
 - **A removed app restored from its backup gets its lock back (v0.286.0, R-773)** — with no app.yaml left, the restore
   (`PersistUnitRedeployConfig`) writes the lock record (`opened_by: restore`) and the block BEFORE anything starts; the
@@ -3951,7 +3953,9 @@ container recreation. Built by `controller/scripts/build-samba-image.sh` (never
 Pure renderers produce a hardened `smb.conf` (`server min protocol = SMB2`, `bind interfaces only`
 on `lo eth0`, `disable netbios = no`, `map to guest = never`, per-share `force user/group = felhom`
 so every SMB write lands as uid:gid 1000) and a compose file (`network_mode: host`, pinned image,
-config `:ro`, passdb volume, one bind per share — `:ro` for read-only shares as defence in depth).
+config `:ro`, passdb volume, one bind per share — `:ro` for read-only shares as defence in depth). The compose carries
+the label `felhom.smb-conf-sha256` (v0.325.0, R-1109): smb.conf is a bind-mounted FILE, so a change to it alone (a
+share renamed at the same folder) must change the compose too, or `compose up -d` keeps the old config running.
 
 `ensureSamba` joins `EnsureBaseStack` after filebrowser, gated on `SMB.Enabled` (the cloudflared
 conditional-deploy precedent); `ReconcileSamba` runs after every mutation. Both are idempotent —