v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

R-1111 reserveAttempt is the one limiter body (share password, escrow re-auth, dashboard sign-in). R-1112
family.json holds fingerprints; old files are converted at load. R-1113 the household's pass reuses its
family session. R-1109 the samba compose carries the smb.conf hash. R-1110 TestNoBareDrivePathToPathHelpers.
R-1114 shared_scripts.py resolves the felhom.eu sibling from a worktree. Each red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/scripts/controller_gates.py

@@ -46,12 +46,17 @@ import sys
 SCRIPTS = os.path.dirname(os.path.abspath(__file__))
 CTRL = os.path.dirname(SCRIPTS)                 # <repo>/controller — every gate's cwd
 REPO = os.path.dirname(CTRL)                    # <repo> — the root REUSE.md lives here
-SHARED_REUSE = os.path.join(os.path.dirname(REPO), "felhom.eu", "scripts", "reuse_refs_check.py")
-SHARED_INSTRUCTIONS = os.path.join(
-    os.path.dirname(REPO), "felhom.eu", "scripts", "instructions_gate.py")
+# The felhom.eu sibling's scripts/: env override, else the main clone's sibling (a worktree outside git/), else
+# ../felhom.eu — one resolver for every gate that reads it (shared_scripts.py, R-1114).
+sys.path.insert(0, SCRIPTS)
+from shared_scripts import shared_scripts_dir, workspace_dir  # noqa: E402
+SHARED_DIR = shared_scripts_dir(REPO)
+# reuse_refs_check searches the sibling repos for cross-repo citations; from a worktree they sit beside the MAIN clone.
+GATE_ENV = dict(os.environ, FELHOM_WORKSPACE=workspace_dir(REPO))
+SHARED_REUSE = os.path.join(SHARED_DIR, "reuse_refs_check.py")
+SHARED_INSTRUCTIONS = os.path.join(SHARED_DIR, "instructions_gate.py")
 # R-389 — shared, like the two above: it lives in felhom.eu/scripts/ and is never copied.
-SHARED_OBSERVATIONS = os.path.join(
-    os.path.dirname(REPO), "felhom.eu", "scripts", "observations_gate.py")
+SHARED_OBSERVATIONS = os.path.join(SHARED_DIR, "observations_gate.py")
 
 # R-404 — the golden NOTICE. Lives here, beside the runner, because it is about THIS repo's
 # releases; it imports the felhom.eu gate rather than copying its comparison.
@@ -135,7 +140,7 @@ def run_gate(label, path, args):
                                     (" " + " ".join(args)) if args else ""))
     print("=" * 78, flush=True)
     # stream the gate's own output rather than capturing it — its diagnostics are the point.
-    return subprocess.call([sys.executable, path] + args, cwd=CTRL)
+    return subprocess.call([sys.executable, path] + args, cwd=CTRL, env=GATE_ENV)
 
 
 def main(argv):

controller/scripts/golden_notice.py

@@ -42,8 +42,9 @@ REPO_DEFAULT = os.path.dirname(CTRL)
 
 def load_gate(repo_root):
     """Import the sibling felhom.eu gate. Returns (module, tried_path) or (None, tried_path)."""
-    path = os.path.join(os.path.dirname(repo_root), "felhom.eu", "scripts",
-                        "golden_currency_gate.py")
+    sys.path.insert(0, HERE)
+    from shared_scripts import shared_scripts_dir  # R-1114: the main clone's sibling from a worktree too
+    path = os.path.join(shared_scripts_dir(repo_root), "golden_currency_gate.py")
     if not os.path.isfile(path):
         return None, path
     try:

controller/scripts/retrieval_promise_gate.py

@@ -57,8 +57,10 @@ GO_SOURCES = [
 # sibling clone is read the way controller_gates.py reads reuse_refs_check.py: CI clones felhom.eu
 # beside this repo, and an ABSENT clone is INCONCLUSIVE (exit 2) — never a pass on an empty list.
 # FELHOM_SHARED_SCRIPTS overrides the directory (the decoy suite uses it; nothing else should).
-_SHARED_SCRIPTS = os.environ.get("FELHOM_SHARED_SCRIPTS") or os.path.normpath(
-    os.path.join(_HERE, "..", "..", "..", "felhom.eu", "scripts"))
+# The lookup itself is shared_scripts.py's (R-1114): the env override first, then the main clone's sibling, so a
+# worktree outside git/ finds it too.
+from shared_scripts import shared_scripts_dir  # noqa: E402  (the script dir is on sys.path, above)
+_SHARED_SCRIPTS = shared_scripts_dir(os.path.normpath(os.path.join(_HERE, "..", "..")))
 if not os.path.isfile(os.path.join(_SHARED_SCRIPTS, "customer_copy_vocab.py")):
     print("retrieval-promise gate INCONCLUSIVE: the shared vocabulary is missing (%s) — the felhom.eu "
           "clone must sit beside this repo; without the stems nothing can be judged" %

controller/scripts/shared_scripts.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""shared_scripts.py — where the felhom.eu sibling clone's scripts/ directory is (R-1114).
+
+Four of this repo's gates use a script that lives ONCE in felhom.eu/scripts/ and is never copied
+(reuse_refs_check, instructions_gate, observations_gate; customer_copy_vocab for the retrieval-promise
+gate; golden_currency_gate for the golden notice). They used to look only at `<repo>/../felhom.eu`. In a
+git worktree outside `git/` (e.g. /mnt/5_hdd/felhom.eu/wt/<name>) that directory does not exist, the
+gates reported MISSING and the runner failed — measured 2026-10-16 night by two helper sessions.
+
+The order, one place for all of them:
+  1. FELHOM_SHARED_SCRIPTS, when set (the decoy suite points it at a fixture; nothing else should).
+  2. The MAIN clone's sibling: `git worktree list --porcelain` names the main working tree first. Used only
+     when repo_root IS a git top level, so a fixture directory inside the real repo never resolves to the
+     real felhom.eu.
+  3. `<repo_root>/../felhom.eu/scripts` — the normal clone and CI (which clones felhom.eu beside the repo).
+An absent directory is returned as-is: each caller already reports a missing shared script as a
+failure or INCONCLUSIVE, never a pass. Pinned by test_shared_scripts.py.
+"""
+import os
+import subprocess
+
+
+def _git(repo_root, *args):
+    try:
+        p = subprocess.run(["git", "-C", repo_root] + list(args), capture_output=True, text=True, timeout=20)
+    except (OSError, subprocess.SubprocessError):
+        return None
+    return p.stdout if p.returncode == 0 else None
+
+
+def main_clone(repo_root):
+    """The main working tree of the git repository repo_root is the top level of, or None."""
+    top = _git(repo_root, "rev-parse", "--show-toplevel")
+    if top is None or os.path.realpath(top.strip()) != os.path.realpath(repo_root):
+        return None
+    out = _git(repo_root, "worktree", "list", "--porcelain")
+    if not out:
+        return None
+    for line in out.splitlines():
+        if line.startswith("worktree "):
+            return line[len("worktree "):].strip()
+    return None
+
+
+def shared_scripts_dir(repo_root):
+    """felhom.eu/scripts for this repo root: env override, else the main clone's sibling, else ../felhom.eu."""
+    env = os.environ.get("FELHOM_SHARED_SCRIPTS")
+    if env:
+        return env
+    main = main_clone(repo_root)
+    if main:
+        cand = os.path.join(os.path.dirname(main), "felhom.eu", "scripts")
+        if os.path.isdir(cand):
+            return cand
+    return os.path.join(os.path.dirname(os.path.abspath(repo_root)), "felhom.eu", "scripts")
+
+
+def workspace_dir(repo_root):
+    """The directory the sibling repos live in: the main clone's parent (for a worktree outside git/), else
+    repo_root's parent. The runner hands it to the shared gates as FELHOM_WORKSPACE."""
+    main = main_clone(repo_root)
+    if main and os.path.isdir(os.path.join(os.path.dirname(main), "felhom.eu")):
+        return os.path.dirname(main)
+    return os.path.dirname(os.path.abspath(repo_root))

controller/scripts/test_shared_scripts.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""test_shared_scripts.py — the felhom.eu sibling is found from a worktree too (R-1114).
+
+Builds a throwaway workspace in a temp dir — a `git/` with a main clone and a felhom.eu sibling, and a
+worktree of the main clone under `wt/` — so nothing here reads the real repos. Git only; no docker.
+
+Red-proof (run 2026-10-17): with step 2 (the main clone) removed from shared_scripts_dir, W1 fails
+("worktree resolved to …/wt/felhom.eu/scripts").
+
+Run from `controller/`:  python3 scripts/test_shared_scripts.py
+Exit 0 all pass · 1 a case failed.
+"""
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+import shared_scripts  # noqa: E402
+
+fails = []
+
+
+def git(cwd, *args):
+    subprocess.run(["git", "-C", cwd] + list(args), check=True, capture_output=True,
+                   env=dict(os.environ, GIT_AUTHOR_NAME="t", GIT_AUTHOR_EMAIL="t@t", GIT_COMMITTER_NAME="t",
+                            GIT_COMMITTER_EMAIL="t@t"))
+
+
+def check(name, got, want):
+    if os.path.realpath(got) == os.path.realpath(want):
+        print("  ok  %s" % name)
+    else:
+        fails.append("%s: resolved to %s, want %s" % (name, got, want))
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="r1114-")
+    old_env = os.environ.pop("FELHOM_SHARED_SCRIPTS", None)
+    try:
+        ws = os.path.join(tmp, "git")
+        main_clone = os.path.join(ws, "felhom-controller")
+        sibling = os.path.join(ws, "felhom.eu", "scripts")
+        os.makedirs(main_clone)
+        os.makedirs(sibling)
+        git(main_clone, "init", "-q")
+        git(main_clone, "commit", "-q", "--allow-empty", "-m", "base")
+        wt = os.path.join(tmp, "wt", "b3")
+        os.makedirs(os.path.dirname(wt))
+        git(main_clone, "worktree", "add", "-q", "--detach", wt)
+
+        check("N1 the normal clone finds ../felhom.eu", shared_scripts.shared_scripts_dir(main_clone), sibling)
+        check("W1 a worktree outside git/ finds the MAIN clone's sibling",
+              shared_scripts.shared_scripts_dir(wt), sibling)
+        check("W2 a worktree's workspace is the MAIN clone's parent (FELHOM_WORKSPACE for reuse-refs)",
+              shared_scripts.workspace_dir(wt), ws)
+        check("N2 the normal clone's workspace is its parent", shared_scripts.workspace_dir(main_clone), ws)
+        # A fixture directory INSIDE a repo is not that repo's top level: it must not borrow the real sibling.
+        fixture = os.path.join(main_clone, "testdata", "fake-repo")
+        os.makedirs(fixture)
+        check("F1 a fixture dir inside a repo keeps its own ../felhom.eu",
+              shared_scripts.shared_scripts_dir(fixture), os.path.join(main_clone, "testdata", "felhom.eu", "scripts"))
+        check("G1 no git at all keeps ../felhom.eu", shared_scripts.shared_scripts_dir(os.path.join(tmp, "plain")),
+              os.path.join(tmp, "felhom.eu", "scripts"))
+        os.environ["FELHOM_SHARED_SCRIPTS"] = os.path.join(tmp, "override")
+        check("E1 FELHOM_SHARED_SCRIPTS wins", shared_scripts.shared_scripts_dir(wt), os.path.join(tmp, "override"))
+    finally:
+        os.environ.pop("FELHOM_SHARED_SCRIPTS", None)
+        if old_env is not None:
+            os.environ["FELHOM_SHARED_SCRIPTS"] = old_env
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    if fails:
+        print("\nFAIL:")
+        for f in fails:
+            print("  - " + f)
+        return 1
+    print("shared-scripts resolver OK")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())