v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

R-1111 reserveAttempt is the one limiter body (share password, escrow re-auth, dashboard sign-in). R-1112
family.json holds fingerprints; old files are converted at load. R-1113 the household's pass reuses its
family session. R-1109 the samba compose carries the smb.conf hash. R-1110 TestNoBareDrivePathToPathHelpers.
R-1114 shared_scripts.py resolves the felhom.eu sibling from a worktree. Each red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/offbox.go

@@ -1303,11 +1303,11 @@ func (m *Manager) offboxCandidateNSRoots() []string {
 // back to the unit dir mtime) and WARNs about the others. Independent of the app's live deploy state.
 func (m *Manager) discoverOffboxUnit(app string) (string, bool) {
 	var foundSrc, foundManifest []string
-	for _, nr := range m.offboxCandidateNSRoots() {
-		p := RecoveryUnitPath(nr, app)
+	for _, nsRoot := range m.offboxCandidateNSRoots() {
+		p := RecoveryUnitPath(nsRoot, app)
 		if fi, err := os.Stat(p); err == nil && fi.IsDir() {
 			foundSrc = append(foundSrc, p)
-			foundManifest = append(foundManifest, RecoveryUnitManifestPath(nr, app))
+			foundManifest = append(foundManifest, RecoveryUnitManifestPath(nsRoot, app))
 		}
 	}
 	switch len(foundSrc) {

controller/internal/backup/offbox_placement.go

@@ -164,8 +164,8 @@ func (m *Manager) RecordedUnitForStack(stack string) (RecordedPlacement, Recorde
 	}
 	addRoot(m.systemDataPath)
 
-	for _, root := range roots {
-		unit := RecoveryUnitPath(root, stack)
+	for _, nsRoot := range roots {
+		unit := RecoveryUnitPath(nsRoot, stack)
 		man := readManifest(filepath.Join(unit, "manifest.json"))
 		if man == nil {
 			continue

controller/internal/backup/removed_units.go

@@ -121,8 +121,8 @@ func (m *Manager) ListRemovedAppUnits() []RemovedAppUnit {
 	}
 	seen := make(map[string]bool)
 	var out []RemovedAppUnit
-	for _, root := range m.primaryUnitRoots() {
-		entries, err := os.ReadDir(PrimaryBackupPath(root))
+	for _, nsRoot := range m.primaryUnitRoots() {
+		entries, err := os.ReadDir(PrimaryBackupPath(nsRoot))
 		if err != nil {
 			continue
 		}
@@ -131,7 +131,7 @@ func (m *Manager) ListRemovedAppUnits() []RemovedAppUnit {
 			if !e.IsDir() || deployed[name] || seen[name] {
 				continue
 			}
-			unitDir := RecoveryUnitPath(root, name)
+			unitDir := RecoveryUnitPath(nsRoot, name)
 			man := readManifest(UnitManifestFile(unitDir))
 			if man == nil {
 				continue
@@ -149,7 +149,7 @@ func (m *Manager) ListRemovedAppUnits() []RemovedAppUnit {
 				StackName:   name,
 				DisplayName: display,
 				UnitDir:     unitDir,
-				DriveLabel:  m.driveLabelForRoot(root),
+				DriveLabel:  m.driveLabelForRoot(nsRoot),
 				Time:        newest.UTC().Format(time.RFC3339),
 			})
 		}