[Tiyouw]

What and why

Codex account preparation links missing default-home runtime entries into another account home. After a physical account SQLite database closes and removes its sidecars, the next preparation can link the default database's WAL/SHM into that account. Share only known settings and conversations so databases, journals, auth, sockets, daemon state and unknown future names remain private. Refuse existing unsafe links without changing them or their targets.

Keep sessions, archived_sessions and thread-writer-locks in one canonical namespace, including first launch and concurrent starts within the daemon. Refuse conflicting namespaces or failure to establish required links. Honor the last explicit config CODEX_HOME before touching an unused generated home, using case-insensitive environment names on Windows. Explicit homes remain owner-managed; team-member isolation is unchanged.

Failed account preparation during restoration leaves the session stopped with exit code -1; continue propagates the failure. Adapted onto main cd071c6299c93b91c6e21643ca6c6c11156a39d7 after the restart changes in #31: retain keyAwaitsApp, restartVaultEnv, Lost reporting, TabAgent handling and the existing carry-on flow. The account guard runs after key-wait handling and before launching a restored session.

How it was tested

One signed-off commit: d62460b9fea93fa5de1d62e9234906e05a59f835. Only account-sharing code, its restoration guard, focused regressions and account documentation are changed.

Actual local Windows checks with Go 1.27.3, fresh synthetic homes and a private temporary/cache location:

• Complete go test ./core/accounts -count=1 -timeout=2m -v: 19 top-level tests passed, 2.904s. Includes real SQLite close/prepare/reopen cycles for two account databases, row ownership/integrity, canonical aliases with a live OS lock, legacy/dangling link refusal and explicit-home precedence.
• Focused daemon restore/continue/restart selection: passed, 0.915s. TestCodexRestoreRefusesUnsafeAccountHome passes for idle and mid-turn-tab records, including continue refusal, carry-on readiness refusal, unchanged journal/link and retained Lost reporting. TestContinueWithoutAConversation passes. Eleven existing restart tests that require sh skip on Windows; these skips are not native restart validation.
• go vet ./core/accounts ./daemon: passed. git diff --check: passed.
• The same SQLite regression on pristine upstream 048b78ece9b54ab5c2d5f32c1944eb738c82311c fails at cycle 0. The broad sharing path remains in the current base. This is a synthetic path-sharing reproduction, not historical corruption attribution.

This starts as Draft while CI runs for this exact head. Local checks do not establish full make test/make lint, native Linux/macOS flock/restart behavior, or authenticated lifecycle behavior.

• make test and make lint pass on this head
• Works the same for a session on this device and on a server (authenticated owner validation pending)
• Docs updated where behavior changed
• Commits signed off (git commit -s)

No protocol change, automatic legacy migration, recovery or private thread-index rebuilding is included. Real sign-in, fresh/resume/account switching, and owner-reviewed offline migration still need validation. Preserve matching physical databases/journals and canonical writer-lock identity during that separate review. No deployment is included.

Closes #37.