claude-multiacc 2.0.26 → 2.0.27

package/README.md

@@ -315,6 +315,45 @@ same ownership rule. Note that the **installed layout deliberately shares that t
 default codex pool this scan stays off and the usage endpoint remains codex's only limit
 signal. Claude accounts keep a private `sessions/` registry, so it is fully active there.
 
+A shared tree also gets **one shared rollout index**. codex refuses to start until its
+`state_<schema>.sqlite` has indexed every rollout under `$CODEX_HOME/sessions` (each file
+read whole), so a private index per account meant one full scan of the shared tree per
+account — 10 GB × 12 on a busy Mac — and any launch that met another process's unfinished
+scan died after 30 s with "timed out waiting for state db backfill … (status: running)",
+surfaced as the CLI's "local database appears to be damaged". A scan cut short (a probe with
+a timeout, Ctrl-C) also left its 15-minute worker lease behind, keeping the account
+unstartable long after its killer was gone. Since 2.0.27 `<acct>/state_N.sqlite` is a symlink
+to `~/.codex/state_N.sqlite`, exactly like the tree it describes: SQLite resolves the link
+before naming its `-wal`/`-shm` companions, so every process shares one lock set — the same
+multi-process mode a single `CODEX_HOME` already runs in. The shim applies this at every
+launch, and the index name the installed binary carries is linked ahead of time, so a codex
+schema bump still costs one backfill per machine rather than one per account.
+
+An account with **no index of its own** — every newly added one, and the case the change
+exists for — is simply linked. Nothing is renamed and nothing about the shared index's state
+can block it. An account that already has one is only ever moved while **nothing can open
+it** (no `-wal` and no `-shm` beside it). codex holds the state database through an sqlx pool
+whose connections are opened lazily and *by path* (`max_connections(5)`,
+`create_if_missing(true)`), so renaming an index under a live holder would leave its first
+connection on the old inode while every later one follows the new link — one process, two
+databases. A codex killed mid-write leaves the pair behind too, and the next clean session on
+that account removes it, so an account excluded this way rejoins on its own. Once it is
+closed, the account's index is either **retired** beside the link as `*.private` (never
+deleted, never overwritten — a second retirement gets its own suffix) when the home already
+has one, or **promoted** into the home when it does not. The promote goes through `link(2)`,
+which refuses an existing target: two shims racing to be the first to promote could otherwise
+rename one's fresh symlink onto the file the other had just promoted, leaving the shared index
+pointing at itself — `ELOOP`, every account on the machine unable to start, and repaired by
+neither codex nor the shim.
+
+Two things stop the sharing entirely. An account whose `sessions/` is a real directory keeps a
+private index — the rule is structural, not a heuristic. And codex's own corruption recovery
+has the last word: when it judges a database damaged it renames it (with its `-wal`/`-shm`)
+into `<CODEX_HOME>/db-backups/sqlite-<ts>-<n>/` and rebuilds, which under a link renames the
+*link*. A link sitting in that folder pointing at the shared file is codex's verdict on that
+file, so the account keeps the index codex rebuilt for it and that name is left alone —
+handing the link back would hand the damage back.
+
 **Auto-retry** (`-p`/`--print` only, default on, `CLAUDE_SHIM_RETRY=0` disables): on an
 auth- or rate-limit-looking failure the shim retries once on a different account and
 marks the failed one — a **10-minute cooldown** for a rate limit (it heals on its own),

package/bin/codex

@@ -122,6 +122,127 @@ sel_log() {
   printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*" 2>/dev/null >> "$ACC_ROOT/selection.log" || true
 }
 
+# ---- one index for the shared session tree -----------------------------------------
+# codex keeps a SQLite index of the rollout tree beside it (state_<schema>.sqlite) and
+# refuses to start until that index has been BACKFILLED from every rollout under
+# $CODEX_HOME/sessions — each file read whole. The installed layout shares one tree
+# across every account (<acct>/sessions -> ~/.codex/sessions), so a private index per
+# account meant one full scan of the whole tree per account: 10 GB × 12 on a busy Mac,
+# minutes each, and a launch that met another process's unfinished scan died after 30 s
+# with "timed out waiting for state db backfill … (status: running)" — surfaced as the
+# CLI's damaged-database message. A scan cut short (a probe with a timeout, Ctrl-C) also
+# left its 15-minute worker lease behind, so the account stayed unstartable long after
+# its killer was gone (my-mini 2026-09-09: six fresh accounts, every launch refused).
+#
+# A shared tree gets ONE shared index: <acct>/state_N.sqlite is a symlink to the same
+# file under ~/.codex, exactly like the tree it describes. SQLite resolves that symlink
+# before naming its -wal/-shm companions, so every process shares one lock set — the
+# multi-process mode a single CODEX_HOME already runs in. A private index that already
+# exists and nothing holds open is retired beside the link (never deleted), or promoted
+# into the home when the home has none yet; and the index the installed binary will
+# create next is linked ahead of time, so a schema bump still costs one backfill, not one
+# per account. Structural on purpose: a real (private) session tree keeps a private index.
+# lib/common.sh carries the same function for seeding — keep the two in step.
+# CORE — byte-identical in lib/common.sh; tests diff them.
+state_index_names() { # $1 acct dir, $2 home dir -> the index file names either side holds
+  local f name seen=" "
+  for f in "$2"/state_[0-9]*.sqlite "$1"/state_[0-9]*.sqlite; do
+    [ -e "$f" ] || [ -L "$f" ] || continue          # an unmatched glob is the pattern itself
+    name="${f##*/}"
+    case "$seen" in *" $name "*) continue ;; esac
+    seen="$seen$name "
+    printf '%s\n' "$name"
+  done
+}
+
+installed_state_index_name() { # the index file the installed binary creates; memoized per binary
+  local cache="$ACC_ROOT/.state-index" bin="$REAL" real id line name="" nat
+  # macOS `stat` reports a SYMLINK's own mtime, and codex is usually installed behind a
+  # stable launcher symlink — so the memo has to key on the file the link resolves to.
+  real="$(canon_path "$bin")"
+  id="$real:$(file_mtime "$real")"
+  if [ -f "$cache" ]; then
+    IFS= read -r line < "$cache" 2>/dev/null || line=""
+    case "$line" in "$id "*) printf '%s\n' "${line#"$id "}"; return 0 ;; esac
+  fi
+  # The npm launcher is a script; the schema name lives in the native binary vendored
+  # beside it. Try the launcher first (a bare binary answers directly), then the vendor.
+  for nat in "$bin" "$(dirname "$(canon_path "$bin")")"/../node_modules/@openai/codex-*/vendor/*/bin/codex; do
+    [ -f "$nat" ] || continue
+    name="$(LC_ALL=C grep -a -o -m1 'state_[0-9][0-9]*\.sqlite' "$nat" 2>/dev/null | head -1)"
+    [ -n "$name" ] && break
+  done
+  case "$name" in *[!A-Za-z0-9_.]*) name="" ;; esac
+  { printf '%s %s\n' "$id" "$name" > "$cache.$$" && mv -f "$cache.$$" "$cache"; } 2>/dev/null \
+    || rm -f "$cache.$$" 2>/dev/null
+  printf '%s\n' "$name"
+}
+
+# CORE — byte-identical in lib/common.sh; tests diff them.
+shared_index_rejected() { # $1 acct dir, $2 index name, $3 shared target
+  # True when codex's own corruption recovery moved THIS account's link out of the way:
+  # it renames the database it judged damaged (and its -wal/-shm) into
+  # <CODEX_HOME>/db-backups/sqlite-<ts>-<n>/ and rebuilds, and under a link that renames
+  # the LINK. A link sitting in there pointing at the shared file is codex's verdict on
+  # that file, so this account keeps the index codex rebuilt for it and this name is
+  # left alone — handing the link back would hand the damage back.
+  local marker
+  for marker in "$1"/db-backups/*/"$2"; do
+    [ -L "$marker" ] || continue
+    [ "$(readlink "$marker" 2>/dev/null)" = "$3" ] && return 0
+  done
+  return 1
+}
+
+# CORE — byte-identical in lib/common.sh; tests diff them.
+share_state_index_links() { # $1 acct dir, $2 home dir, $3 extra index name ('' for none)
+  local d="$1" home="$2" name names target link retired n
+  [ -L "$d" ] && return 0                              # adopted: the dir IS the home
+  [ -L "$d/sessions" ] || return 0                     # a private tree keeps its private index
+  [ "$(readlink "$d/sessions" 2>/dev/null)" = "$home/sessions" ] || return 0
+  [ -d "$home" ] || return 0
+  names="$(state_index_names "$d" "$home")"
+  case "${3:-}" in ''|*[!A-Za-z0-9_.]*) ;; *) names="$names $3" ;; esac
+  for name in $names; do
+    target="$home/$name"; link="$d/$name"
+    [ -L "$link" ] && continue                         # already shared (or pointed elsewhere on purpose)
+    shared_index_rejected "$d" "$name" "$target" && continue
+    if [ ! -e "$link" ]; then
+      ln -s "$target" "$link" 2>/dev/null || true      # a new account: the whole point
+      continue
+    fi
+    # This account has an index of its own, and MOVING one that a process can still open
+    # is unsafe. codex holds the state database through an sqlx pool that opens its
+    # connections lazily and BY PATH (max_connections(5), create_if_missing(true) —
+    # codex-rs/state/src/sqlite.rs open_read_write_pool), so a rename under a live holder
+    # leaves connection 1 on the old inode while every connection the pool opens
+    # afterwards follows the new link: one process, two databases. A -wal or a -shm beside
+    # the file is that proof. A codex killed mid-write leaves them behind too, and the
+    # next clean session on the account removes them, so this heals itself in time.
+    { [ -e "$link-wal" ] || [ -e "$link-shm" ]; } && continue
+    if [ -e "$target" ]; then
+      retired="$link.private"; n=0                     # never overwrite an earlier copy
+      while [ -e "$retired" ] && [ "$n" -lt 100 ]; do n=$((n+1)); retired="$link.private.$n"; done
+      [ -e "$retired" ] && continue
+      mv "$link" "$retired" 2>/dev/null || continue
+    else
+      # Atomic or nothing: link(2) refuses an existing target, so two shims racing to be
+      # the first to promote cannot rename one's fresh symlink onto the file the other
+      # just promoted — which is how a self-referential shared index (ELOOP, and every
+      # account on the Mac unable to start) could appear. A cross-device link simply
+      # fails and this account keeps its own index.
+      ln "$link" "$target" 2>/dev/null || continue
+      [ -L "$link" ] || rm -f "$link"
+    fi
+    ln -s "$target" "$link" 2>/dev/null || true
+  done
+  return 0
+}
+
+share_state_index() { # $1 acct dir — at launch: the home's index, plus the one this binary will create
+  share_state_index_links "$1" "${HOME:-/nonexistent}/.codex" "$(installed_state_index_name)"
+}
+
 marker_active() { # true if $1/.limited is still in force; clears cleanly-expired markers
   # Parity with bin/claude's client_marker_recovered, by construction: this shim has NO
   # telemetry-based clearing path. A marker leaves here only when its OWN reset epoch has
@@ -521,6 +642,7 @@ if [ -n "${CODEX_ACCOUNT:-}" ]; then
   d="$ACC_ROOT/$CODEX_ACCOUNT"
   if [ -d "$d" ]; then
     sel_log "$CODEX_ACCOUNT pinned pwd=$PWD"
+    share_state_index "$d"
     export CODEX_HOME="$d"
     export CODEX_SHIM_ACTIVE=1
     exec "$REAL" "$@"
@@ -805,6 +927,7 @@ if [ "${CODEX_SHIM_RETRY:-1}" != "0" ] && [ "${#eligible[@]}" -ge 2 ]; then
   fi
 fi
 
+share_state_index "$pick"
 if [ "$wants_retry" = "0" ]; then
   export CODEX_HOME="$pick"
   exec "$REAL" "$@"
@@ -906,6 +1029,7 @@ while :; do
     if [ -n "$next" ]; then
       sel_log "retry from=$(basename "$cur") to=$(basename "$next") rc=$rc"
       cur="$next"
+      share_state_index "$cur"
       # The account that actually serves the work is the one the next run should rotate
       # away from — not the one that bounced.
       remember_pick "$cur"

package/lib/common.sh

@@ -588,12 +588,101 @@ os.replace(sys.argv[1] + '.tmp', sys.argv[1])
 PYEOF
 }
 
+# ---- one index for the shared session tree -----------------------------------------
+# codex refuses to start until its rollout index (state_<schema>.sqlite) has been
+# backfilled from every rollout under $CODEX_HOME/sessions. The codex layout shares that
+# tree across accounts (<acct>/sessions -> ~/.codex/sessions), so the index is shared
+# the same way: <acct>/state_N.sqlite -> ~/.codex/state_N.sqlite. Otherwise every new
+# account re-reads the whole tree (10 GB on a busy Mac) before its first launch, and a
+# launch that meets another process's unfinished scan dies after 30 s with the CLI's
+# "local database appears to be damaged" message. bin/codex applies the same at every
+# launch (and pre-links the name the installed binary will create); seeding covers a
+# CODEX_HOME handed straight to the real binary. The two CORE functions below are
+# byte-identical with bin/codex — tests/run-tests.sh diffs them.
+# CORE — byte-identical in bin/codex; tests diff them.
+state_index_names() { # $1 acct dir, $2 home dir -> the index file names either side holds
+  local f name seen=" "
+  for f in "$2"/state_[0-9]*.sqlite "$1"/state_[0-9]*.sqlite; do
+    [ -e "$f" ] || [ -L "$f" ] || continue          # an unmatched glob is the pattern itself
+    name="${f##*/}"
+    case "$seen" in *" $name "*) continue ;; esac
+    seen="$seen$name "
+    printf '%s\n' "$name"
+  done
+}
+
+# CORE — byte-identical in bin/codex; tests diff them.
+shared_index_rejected() { # $1 acct dir, $2 index name, $3 shared target
+  # True when codex's own corruption recovery moved THIS account's link out of the way:
+  # it renames the database it judged damaged (and its -wal/-shm) into
+  # <CODEX_HOME>/db-backups/sqlite-<ts>-<n>/ and rebuilds, and under a link that renames
+  # the LINK. A link sitting in there pointing at the shared file is codex's verdict on
+  # that file, so this account keeps the index codex rebuilt for it and this name is
+  # left alone — handing the link back would hand the damage back.
+  local marker
+  for marker in "$1"/db-backups/*/"$2"; do
+    [ -L "$marker" ] || continue
+    [ "$(readlink "$marker" 2>/dev/null)" = "$3" ] && return 0
+  done
+  return 1
+}
+
+# CORE — byte-identical in bin/codex; tests diff them.
+share_state_index_links() { # $1 acct dir, $2 home dir, $3 extra index name ('' for none)
+  local d="$1" home="$2" name names target link retired n
+  [ -L "$d" ] && return 0                              # adopted: the dir IS the home
+  [ -L "$d/sessions" ] || return 0                     # a private tree keeps its private index
+  [ "$(readlink "$d/sessions" 2>/dev/null)" = "$home/sessions" ] || return 0
+  [ -d "$home" ] || return 0
+  names="$(state_index_names "$d" "$home")"
+  case "${3:-}" in ''|*[!A-Za-z0-9_.]*) ;; *) names="$names $3" ;; esac
+  for name in $names; do
+    target="$home/$name"; link="$d/$name"
+    [ -L "$link" ] && continue                         # already shared (or pointed elsewhere on purpose)
+    shared_index_rejected "$d" "$name" "$target" && continue
+    if [ ! -e "$link" ]; then
+      ln -s "$target" "$link" 2>/dev/null || true      # a new account: the whole point
+      continue
+    fi
+    # This account has an index of its own, and MOVING one that a process can still open
+    # is unsafe. codex holds the state database through an sqlx pool that opens its
+    # connections lazily and BY PATH (max_connections(5), create_if_missing(true) —
+    # codex-rs/state/src/sqlite.rs open_read_write_pool), so a rename under a live holder
+    # leaves connection 1 on the old inode while every connection the pool opens
+    # afterwards follows the new link: one process, two databases. A -wal or a -shm beside
+    # the file is that proof. A codex killed mid-write leaves them behind too, and the
+    # next clean session on the account removes them, so this heals itself in time.
+    { [ -e "$link-wal" ] || [ -e "$link-shm" ]; } && continue
+    if [ -e "$target" ]; then
+      retired="$link.private"; n=0                     # never overwrite an earlier copy
+      while [ -e "$retired" ] && [ "$n" -lt 100 ]; do n=$((n+1)); retired="$link.private.$n"; done
+      [ -e "$retired" ] && continue
+      mv "$link" "$retired" 2>/dev/null || continue
+    else
+      # Atomic or nothing: link(2) refuses an existing target, so two shims racing to be
+      # the first to promote cannot rename one's fresh symlink onto the file the other
+      # just promoted — which is how a self-referential shared index (ELOOP, and every
+      # account on the Mac unable to start) could appear. A cross-device link simply
+      # fails and this account keeps its own index.
+      ln "$link" "$target" 2>/dev/null || continue
+      [ -L "$link" ] || rm -f "$link"
+    fi
+    ln -s "$target" "$link" 2>/dev/null || true
+  done
+  return 0
+}
+
+codex_share_state_index() { # $1 acct dir — seed time: whatever index names exist already
+  share_state_index_links "$1" "${HOME:-/nonexistent}/.codex" ""
+}
+
 # Seed an account config dir so headless runs never prompt.
 #   claude: stripped .claude.json, copied settings.json, shared projects/ symlink
 #           (shared history => --continue/--resume work regardless of picked account).
 #   codex:  copied config.toml (carries project trust + settings, no identity),
-#           shared sessions/ symlink (=> `codex resume` finds every session), and a
-#           shared AGENTS.md symlink so global instructions apply under any account.
+#           shared sessions/ symlink (=> `codex resume` finds every session) with the
+#           shared rollout index that tree needs, and a shared AGENTS.md symlink so
+#           global instructions apply under any account.
 seed_account_dir() { # $1 = acct dir
   local d="$1"
   mkdir -p "$d"
@@ -608,6 +697,7 @@ seed_account_dir() { # $1 = acct dir
     if [ ! -e "$d/AGENTS.md" ] && [ -f "$HOME/.codex/AGENTS.md" ]; then
       ln -s "$HOME/.codex/AGENTS.md" "$d/AGENTS.md" 2>/dev/null || true
     fi
+    codex_share_state_index "$d"
     return 0
   fi
   if [ ! -f "$d/.claude.json" ] && [ -f "$HOME/.claude.json" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.26",
+  "version": "2.0.27",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -4906,6 +4906,296 @@ check "codex: sign-in as registered email refused" "already added as acct-01" "$
 n="$(grep -c '"email": "a@cx"' "$CX/accounts.json")"
 [ "$n" = "1" ] && t_ok "codex: no second entry for a re-signed-in email" || t_fail "codex dup signin" "count=$n"
 
+# ---- C11b. one index for the shared session tree ------------------------------------
+# codex refuses to start until state_<schema>.sqlite has indexed every rollout under
+# $CODEX_HOME/sessions. The layout shares that tree across accounts, so it must share
+# the index too — a private index per account re-read the whole tree per account and
+# stranded a 15-minute worker lease whenever a scan was cut short (my-mini 2026-09-09:
+# six fresh accounts refused every launch as "local database appears to be damaged").
+CXH="$WORK/cxhome"
+mkdir -p "$CXH/.codex/sessions"
+printf 'home index' > "$CXH/.codex/state_5.sqlite"
+# (a) seeding: a new account links the tree AND the index the home already has
+out="$(HOME="$CXH" FAKE_EMAIL=idx@cx codex-accounts add 2>&1)"
+nid="$(printf '%s' "$out" | sed -n 's/.*Registered \(acct-[0-9]*\) .*/\1/p' | head -1)"
+[ -n "$nid" ] || t_fail "codex shared index seed" "add did not register: $(printf '%s' "$out" | head -c 200)"
+[ "$(readlink "$CX/$nid/sessions" 2>/dev/null)" = "$CXH/.codex/sessions" ] \
+  && t_ok "codex: a new account shares the home's session tree" \
+  || t_fail "codex shared tree seed" "sessions -> $(readlink "$CX/$nid/sessions" 2>/dev/null)"
+[ "$(readlink "$CX/$nid/state_5.sqlite" 2>/dev/null)" = "$CXH/.codex/state_5.sqlite" ] \
+  && t_ok "codex: a new account shares the home's rollout index with that tree" \
+  || t_fail "codex shared index seed" "state_5.sqlite -> $(readlink "$CX/$nid/state_5.sqlite" 2>/dev/null)"
+[ -n "$nid" ] && codex-accounts remove "$nid" --yes >/dev/null 2>&1
+
+# The launch-time heal, on its own pool so nothing here leaks into the other codex tests.
+CXS="$WORK/cx-state"
+mkdir -p "$CXS/tmp" "$CXS/acct-01" "$CXS/acct-02" "$CXS/acct-03"
+: > "$CXS/.limits-kick"
+cat > "$CXS/accounts.json" <<EOF2
+{"version": 1, "server": "root@203.0.113.1", "server_root": "/root/.codex-accounts",
+ "server_repo": "/root/claude-multiacc", "threshold": 90,
+ "accounts": [
+  {"id": "acct-01", "email": "s1@cx", "home": "mac", "added_at": "2026-09-09T00:00:00Z"},
+  {"id": "acct-02", "email": "s2@cx", "home": "mac", "added_at": "2026-09-09T00:00:00Z"},
+  {"id": "acct-03", "email": "s3@cx", "home": "mac", "added_at": "2026-09-09T00:00:00Z"}]}
+EOF2
+for i in 01 02 03; do mk_cx_auth "$CXS/acct-$i/auth.json" "s$i@cx" "$FUTURE_EXP"; done
+CXH2="$WORK/cxhome2"
+mkdir -p "$CXH2/.codex/sessions"
+ln -s "$CXH2/.codex/sessions" "$CXS/acct-01/sessions"
+ln -s "$CXH2/.codex/sessions" "$CXS/acct-02/sessions"
+mkdir -p "$CXS/acct-03/sessions"                       # a PRIVATE tree
+printf 'closed private index' > "$CXS/acct-01/state_5.sqlite"
+printf 'open private index' > "$CXS/acct-02/state_5.sqlite"
+printf 'wal' > "$CXS/acct-02/state_5.sqlite-wal"
+printf 'shm' > "$CXS/acct-02/state_5.sqlite-shm"
+printf 'private tree index' > "$CXS/acct-03/state_5.sqlite"
+# (b) an OPEN private index (its -wal beside it) is never moved while the home has no index
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-02 codex 2>&1)"
+check "codex: launch on an account with an open private index" "CFG=acct-02" "$out"
+{ [ -f "$CXS/acct-02/state_5.sqlite" ] && [ ! -L "$CXS/acct-02/state_5.sqlite" ] \
+    && [ ! -e "$CXH2/.codex/state_5.sqlite" ]; } \
+  && t_ok "codex: an open private index is never promoted (one inode, two -shm files, is how WAL corrupts)" \
+  || t_fail "codex open index promote" "$(ls -la "$CXS/acct-02" "$CXH2/.codex" 2>&1 | head -c 400)"
+# a -shm on its own is just as much a live database as a -wal is
+mv "$CXS/acct-02/state_5.sqlite-wal" "$CXS/acct-02/held-wal"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-02 codex 2>&1)"
+check "codex: launch on an account whose index has only a -shm" "CFG=acct-02" "$out"
+{ [ -f "$CXS/acct-02/state_5.sqlite" ] && [ ! -e "$CXH2/.codex/state_5.sqlite" ]; } \
+  && t_ok "codex: a -shm alone also refuses the promote" \
+  || t_fail "codex shm promote" "$(ls -la "$CXS/acct-02" "$CXH2/.codex" 2>&1 | head -c 400)"
+mv "$CXS/acct-02/held-wal" "$CXS/acct-02/state_5.sqlite-wal"
+# (c) a CLOSED private index is promoted into the home and linked back
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-01 codex 2>&1)"
+check "codex: launch on an account with a closed private index" "CFG=acct-01" "$out"
+[ "$(cat "$CXH2/.codex/state_5.sqlite" 2>/dev/null)" = "closed private index" ] \
+  && t_ok "codex: the first closed private index becomes the home's shared index" \
+  || t_fail "codex index promote" "home index: $(cat "$CXH2/.codex/state_5.sqlite" 2>&1 | head -c 80)"
+[ "$(readlink "$CXS/acct-01/state_5.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_5.sqlite" ] \
+  && t_ok "codex: the promoting account links to the shared index" \
+  || t_fail "codex index promote link" "state_5.sqlite -> $(readlink "$CXS/acct-01/state_5.sqlite" 2>/dev/null)"
+# (d) the home has an index now, but the account's own is still OPEN: moving it would
+#     split its holder across two databases (codex's sqlx pool re-opens BY PATH), so it
+#     is left alone until the process that has it exits and clears its -wal/-shm.
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-02 codex 2>&1)"
+check "codex: relaunch on the account with the open private index" "CFG=acct-02" "$out"
+{ [ -f "$CXS/acct-02/state_5.sqlite" ] && [ ! -L "$CXS/acct-02/state_5.sqlite" ]; } \
+  && t_ok "codex: an index a process can still open is never moved, even once the home has one" \
+  || t_fail "codex open index retire" "$(ls "$CXS/acct-02" 2>&1 | tr '\n' ' ')"
+# (d2) its holder exited and SQLite removed the pair: now it is retired beside the link
+rm -f "$CXS/acct-02/state_5.sqlite-wal" "$CXS/acct-02/state_5.sqlite-shm"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-02 codex 2>&1)"
+check "codex: relaunch once the private index is closed" "CFG=acct-02" "$out"
+[ "$(readlink "$CXS/acct-02/state_5.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_5.sqlite" ] \
+  && t_ok "codex: a closed private index is retired for the shared one once the home has it" \
+  || t_fail "codex index retire" "state_5.sqlite -> $(readlink "$CXS/acct-02/state_5.sqlite" 2>/dev/null)"
+[ "$(cat "$CXS/acct-02/state_5.sqlite.private" 2>/dev/null)" = "open private index" ] \
+  && t_ok "codex: the retired index stays beside the link, never deleted" \
+  || t_fail "codex index retire files" "$(ls "$CXS/acct-02" 2>&1 | tr '\n' ' ')"
+[ "$(cat "$CXH2/.codex/state_5.sqlite" 2>/dev/null)" = "closed private index" ] \
+  && t_ok "codex: retiring never overwrites the shared index" \
+  || t_fail "codex index retire overwrite" "home index changed"
+# (d3) an account with NO index of its own is linked even while the shared one is in use —
+#      the case the whole change exists for, and the one liveness must never block
+mkdir -p "$CXS/acct-06" && ln -s "$CXH2/.codex/sessions" "$CXS/acct-06/sessions"
+mk_cx_auth "$CXS/acct-06/auth.json" s6@cx "$FUTURE_EXP"
+printf 'wal' > "$CXH2/.codex/state_5.sqlite-wal"
+printf 'shm' > "$CXH2/.codex/state_5.sqlite-shm"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-06 codex 2>&1)"
+check "codex: launch on a brand-new account while the shared index is in use" "CFG=acct-06" "$out"
+[ "$(readlink "$CXS/acct-06/state_5.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_5.sqlite" ] \
+  && t_ok "codex: an account with no index of its own is linked whatever the shared one is doing" \
+  || t_fail "codex new account link" "$(ls -la "$CXS/acct-06" 2>&1 | head -c 300)"
+rm -f "$CXH2/.codex/state_5.sqlite-wal" "$CXH2/.codex/state_5.sqlite-shm"
+# (e) a PRIVATE session tree keeps its private index
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-03 codex 2>&1)"
+check "codex: launch on an account with its own session tree" "CFG=acct-03" "$out"
+{ [ -f "$CXS/acct-03/state_5.sqlite" ] && [ ! -L "$CXS/acct-03/state_5.sqlite" ]; } \
+  && t_ok "codex: an account with a private session tree keeps its private index" \
+  || t_fail "codex private tree index" "$(ls -la "$CXS/acct-03" 2>&1 | head -c 300)"
+# (f) the index the INSTALLED binary will create is linked ahead of time, so a schema bump
+#     still costs one backfill per Mac, not one per account
+FAKEBIN_IDX="$WORK/fakebin-idx"
+mkdir -p "$FAKEBIN_IDX"
+{ cat "$FAKEBIN/codex"; printf '# rollout index name carried by the real binary: state_7.sqlite\n'; } > "$FAKEBIN_IDX/codex"
+chmod +x "$FAKEBIN_IDX/codex"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-01 PATH="$REPO_DIR/bin:$FAKEBIN_IDX:$PATH" codex 2>&1)"
+check "codex: launch through a binary that names a newer index" "CFG=acct-01" "$out"
+[ "$(readlink "$CXS/acct-01/state_7.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_7.sqlite" ] \
+  && t_ok "codex: the index the installed binary creates next is linked before it exists" \
+  || t_fail "codex index pre-link" "state_7.sqlite -> $(readlink "$CXS/acct-01/state_7.sqlite" 2>/dev/null)"
+[ ! -e "$CXH2/.codex/state_7.sqlite" ] && t_ok "codex: pre-linking creates nothing in the home itself" \
+  || t_fail "codex index pre-link home" "home gained state_7.sqlite"
+grep -q " state_7.sqlite$" "$CXS/.state-index" 2>/dev/null \
+  && t_ok "codex: the binary's index name is memoized per binary" \
+  || t_fail "codex index name memo" "$(cat "$CXS/.state-index" 2>&1)"
+# (f2) the launcher is a script that names no index; the schema name lives in the native
+#      binary vendored beside it — the branch that actually fires on an npm install
+VENDOR="$WORK/npm/node_modules/@openai/codex/bin"
+mkdir -p "$VENDOR" "$WORK/npm/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/bin"
+{ cat "$FAKEBIN/codex"; printf '# a launcher script naming no index\n'; } > "$VENDOR/codex.js"
+chmod +x "$VENDOR/codex.js"
+printf 'binary bytes state_8.sqlite more bytes' \
+  > "$WORK/npm/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/bin/codex"
+FAKEBIN_VENDOR="$WORK/fakebin-vendor"
+mkdir -p "$FAKEBIN_VENDOR"
+ln -s "$VENDOR/codex.js" "$FAKEBIN_VENDOR/codex"
+rm -f "$CXS/.state-index"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-01 PATH="$REPO_DIR/bin:$FAKEBIN_VENDOR:$PATH" codex 2>&1)"
+check "codex: launch through an npm launcher with a vendored binary" "CFG=acct-01" "$out"
+[ "$(readlink "$CXS/acct-01/state_8.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_8.sqlite" ] \
+  && t_ok "codex: the index name is read from the vendored binary when the launcher names none" \
+  || t_fail "codex vendored index name" "$(ls "$CXS/acct-01" 2>&1 | tr '\n' ' '); memo=$(cat "$CXS/.state-index" 2>&1)"
+grep -q "^$(cd "$(dirname "$VENDOR/codex.js")" && pwd -P)/codex.js:" "$CXS/.state-index" 2>/dev/null \
+  && t_ok "codex: the memo keys on the file the launcher symlink resolves to, not the link" \
+  || t_fail "codex memo key" "$(cat "$CXS/.state-index" 2>&1)"
+rm -f "$CXS/.state-index" "$CXS/acct-01/state_8.sqlite"
+# (g) an adopted account (the dir IS the home) is never rewritten
+ln -s "$CXH2/.codex" "$CXS/acct-04"
+python3 - "$CXS/accounts.json" <<'PYEOF'
+import json, sys
+doc = json.load(open(sys.argv[1]))
+doc['accounts'].append({'id': 'acct-04', 'email': 'adopted@cx', 'home': 'mac', 'added_at': '2026-09-09T00:00:00Z'})
+json.dump(doc, open(sys.argv[1], 'w'), indent=2)
+PYEOF
+mk_cx_auth "$CXH2/.codex/auth.json" adopted@cx "$FUTURE_EXP"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-04 codex 2>&1)"
+check "codex: launch on an adopted account" "CFG=acct-04" "$out"
+{ [ -f "$CXH2/.codex/state_5.sqlite" ] && [ ! -L "$CXH2/.codex/state_5.sqlite" ]; } \
+  && t_ok "codex: the home's own index is never turned into a link" \
+  || t_fail "codex adopted index" "$(ls -la "$CXH2/.codex" 2>&1 | head -c 300)"
+# (i) codex's own corruption recovery moved this account's LINK into db-backups/ and
+#     rebuilt a private index in its place: that is codex's verdict on the shared file,
+#     so the account keeps what codex rebuilt and this name is left alone entirely.
+mkdir -p "$CXS/acct-01/db-backups/sqlite-1700000000-0"
+mv "$CXS/acct-01/state_5.sqlite" "$CXS/acct-01/db-backups/sqlite-1700000000-0/state_5.sqlite"
+printf 'rebuilt after damage' > "$CXS/acct-01/state_5.sqlite"
+homesum="$(cat "$CXH2/.codex/state_5.sqlite" 2>/dev/null)"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-01 codex 2>&1)"
+check "codex: launch after codex rejected the shared index for this account" "CFG=acct-01" "$out"
+{ [ "$(cat "$CXS/acct-01/state_5.sqlite" 2>/dev/null)" = "rebuilt after damage" ] \
+    && [ ! -L "$CXS/acct-01/state_5.sqlite" ]; } \
+  && t_ok "codex: an account codex rebuilt for keeps that index instead of the shared one" \
+  || t_fail "codex rejected shared index" "$(ls -la "$CXS/acct-01" 2>&1 | head -c 400)"
+[ "$(cat "$CXH2/.codex/state_5.sqlite" 2>/dev/null)" = "$homesum" ] \
+  && t_ok "codex: the rejected shared index is left exactly as it was, for its other users" \
+  || t_fail "codex rejected shared index home" "home index changed"
+# the marker only speaks for the file it names: a link pointing elsewhere is not a verdict
+mkdir -p "$CXS/acct-05/db-backups/sqlite-1700000000-0"
+mkdir -p "$CXS/acct-05" && ln -s "$CXH2/.codex/sessions" "$CXS/acct-05/sessions"
+mk_cx_auth "$CXS/acct-05/auth.json" s5@cx "$FUTURE_EXP"
+ln -s "$CXH2/.codex/state_9.sqlite" "$CXS/acct-05/db-backups/sqlite-1700000000-0/state_5.sqlite"
+printf 'unrelated private index' > "$CXS/acct-05/state_5.sqlite"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-05 codex 2>&1)"
+check "codex: launch with a db-backups link naming another file" "CFG=acct-05" "$out"
+[ "$(readlink "$CXS/acct-05/state_5.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_5.sqlite" ] \
+  && t_ok "codex: a db-backups link that names a different file is not a verdict on the shared one" \
+  || t_fail "codex marker scope" "$(ls -la "$CXS/acct-05" 2>&1 | head -c 300)"
+# (j) a second retirement keeps the first retired copy
+rm "$CXS/acct-02/state_5.sqlite"
+printf 'second private index' > "$CXS/acct-02/state_5.sqlite"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-02 codex 2>&1)"
+check "codex: launch on an account retiring a second private index" "CFG=acct-02" "$out"
+{ [ "$(cat "$CXS/acct-02/state_5.sqlite.private" 2>/dev/null)" = "open private index" ] \
+    && [ "$(cat "$CXS"/acct-02/state_5.sqlite.private.[0-9]* 2>/dev/null)" = "second private index" ] \
+    && [ -L "$CXS/acct-02/state_5.sqlite" ]; } \
+  && t_ok "codex: retiring never overwrites an earlier retired copy" \
+  || t_fail "codex retire unique" "$(ls "$CXS/acct-02" 2>&1 | tr '\n' ' ')"
+# (k) several processes promoting the same account at once. `mv` here could rename one
+#     shim's fresh symlink onto the file another had just promoted, leaving
+#     ~/.codex/state_N.sqlite pointing at itself — ELOOP, every account on the Mac unable
+#     to start, and repaired by neither codex (ELOOP is not a corruption code) nor this
+#     shim (`[ -L "$link" ]` would skip the name forever). link(2) refuses an existing
+#     target, so the promote is atomic or it does not happen. The window is narrow, so
+#     this drives the core function directly and repeats until the odds are not the test's.
+CORE="$WORK/state-index-core.sh"
+{ printf '#!/usr/bin/env bash\nset -u\n'
+  awk '/^state_index_names\(\) \{/,/^}$/' "$REPO_DIR/bin/codex"
+  awk '/^shared_index_rejected\(\) \{/,/^}$/' "$REPO_DIR/bin/codex"
+  awk '/^share_state_index_links\(\) \{/,/^}$/' "$REPO_DIR/bin/codex"
+  printf 'share_state_index_links "$1" "$2" ""\n'; } > "$CORE"
+chmod +x "$CORE"
+# The losing interleave is: the winner promotes and links, THEN the loser acts on a
+# decision it made before either happened. Forcing it beats waiting for it — a `ln`/`mv`
+# that sleeps puts the loser inside that window on purpose, and the winner is injected
+# there. With the rename promote this renames the loser's own link onto its target; with
+# link(2) it simply refuses.
+SLOWBIN="$WORK/slowbin"
+mkdir -p "$SLOWBIN"
+for cmd in ln mv; do
+  printf '#!/usr/bin/env bash\nsleep 1\nfor c in /bin/%s /usr/bin/%s; do [ -x "$c" ] && exec "$c" "$@"; done\nexit 127\n' \
+    "$cmd" "$cmd" > "$SLOWBIN/$cmd"
+  chmod +x "$SLOWBIN/$cmd"
+done
+rd="$WORK/promote-interleave"
+mkdir -p "$rd/home/sessions" "$rd/acct"
+ln -s "$rd/home/sessions" "$rd/acct/sessions"
+printf 'the loser index' > "$rd/acct/state_5.sqlite"
+( PATH="$SLOWBIN:$PATH" "$CORE" "$rd/acct" "$rd/home" >/dev/null 2>&1 ) &
+slow=$!
+sleep 0.4                       # the loser has decided the home is empty, and not yet acted
+printf 'the winner index' > "$rd/home/state_5.sqlite"
+rm -f "$rd/acct/state_5.sqlite"
+ln -s "$rd/home/state_5.sqlite" "$rd/acct/state_5.sqlite"
+wait "$slow" 2>/dev/null
+{ [ -f "$rd/home/state_5.sqlite" ] && [ ! -L "$rd/home/state_5.sqlite" ] \
+    && [ "$(cat "$rd/home/state_5.sqlite" 2>/dev/null)" = "the winner index" ]; } \
+  && t_ok "codex: a promote that loses the race refuses instead of renaming onto the winner" \
+  || t_fail "codex promote atomicity" "shared index is $(ls -la "$rd/home/state_5.sqlite" 2>&1 | head -c 160)"
+[ "$(cat "$rd/acct/state_5.sqlite" 2>/dev/null)" = "the winner index" ] \
+  && t_ok "codex: the losing account still reads the shared index through its link" \
+  || t_fail "codex promote atomicity" "acct reads $(cat "$rd/acct/state_5.sqlite" 2>&1 | head -c 120)"
+
+races=0; bad=0; badwhy=""
+
+# (l) the heal belongs to the LAUNCH, not to the pin: an unpinned selection and a retry
+#     that rotates to another account must both link the account they actually serve.
+CXU="$WORK/cx-unpinned"; CXHU="$WORK/cxhome-unpinned"
+mkdir -p "$CXU/tmp" "$CXU/acct-01" "$CXU/acct-02" "$CXHU/.codex/sessions"
+: > "$CXU/.limits-kick"
+cat > "$CXU/accounts.json" <<EOF2
+{"version": 1, "server": "root@203.0.113.1", "server_root": "/root/.codex-accounts",
+ "server_repo": "/root/claude-multiacc", "threshold": 90,
+ "accounts": [
+  {"id": "acct-01", "email": "u1@cx", "home": "mac", "added_at": "2026-09-09T00:00:00Z"},
+  {"id": "acct-02", "email": "u2@cx", "home": "mac", "added_at": "2026-09-09T00:00:00Z"}]}
+EOF2
+for i in 01 02; do
+  mk_cx_auth "$CXU/acct-$i/auth.json" "u$i@cx" "$FUTURE_EXP"
+  ln -s "$CXHU/.codex/sessions" "$CXU/acct-$i/sessions"
+done
+printf 'the shared index' > "$CXHU/.codex/state_5.sqlite"
+cxlj 5 5 5 > "$CXU/acct-01/limits.json"
+cxlj 20 20 20 > "$CXU/acct-02/limits.json"
+out="$(HOME="$CXHU" CODEX_ACCOUNTS_DIR="$CXU" CODEX_MULTIACC_HEADROOM_BAND=0 codex 2>&1)"
+picked="$(printf '%s' "$out" | sed -n 's/.*CFG=\(acct-[0-9]*\).*/\1/p' | head -1)"
+{ [ -n "$picked" ] \
+    && [ "$(readlink "$CXU/$picked/state_5.sqlite" 2>/dev/null)" = "$CXHU/.codex/state_5.sqlite" ]; } \
+  && t_ok "codex: an unpinned launch links the account it selected ($picked)" \
+  || t_fail "codex unpinned heal" "picked=${picked:-none} $(ls -la "$CXU"/acct-0*/state_5.sqlite 2>&1 | head -c 300)"
+rm -f "$CXU"/acct-0*/state_5.sqlite
+echo "fail:acct-01" > "$FAKE_CTL2"
+out="$(HOME="$CXHU" CODEX_ACCOUNTS_DIR="$CXU" CODEX_MULTIACC_HEADROOM_BAND=0 codex exec "hello" < /dev/null 2>&1)"
+rm -f "$FAKE_CTL2" "$CXU/acct-01/.limited"
+case "$out" in *CFG=acct-02*) t_ok "codex: the retry rotated to the second account" ;;
+  *) t_fail "codex retry heal" "did not land on acct-02: $(printf '%s' "$out" | head -c 200)" ;; esac
+[ "$(readlink "$CXU/acct-02/state_5.sqlite" 2>/dev/null)" = "$CXHU/.codex/state_5.sqlite" ] \
+  && t_ok "codex: the account a retry rotates onto is linked too" \
+  || t_fail "codex retry heal" "acct-02 -> $(readlink "$CXU/acct-02/state_5.sqlite" 2>/dev/null)"
+
+# (h) the two copies of the core (shim + lib/common.sh) are byte-identical
+core_of() { # $1 file, $2 function name -> its body
+  awk -v fn="$2" '$0 ~ "^"fn"\\(\\) \\{" {p=1} p {print} p && /^}$/ {exit}' "$1"
+}
+for fn in state_index_names shared_index_rejected share_state_index_links; do
+  if [ "$(core_of "$REPO_DIR/bin/codex" "$fn")" = "$(core_of "$REPO_DIR/lib/common.sh" "$fn")" ] \
+     && [ -n "$(core_of "$REPO_DIR/bin/codex" "$fn")" ]; then
+    t_ok "codex: $fn is byte-identical in bin/codex and lib/common.sh"
+  else
+    t_fail "codex shared-index parity" "$fn differs between bin/codex and lib/common.sh"
+  fi
+done
+
 # ---- C12. login command + expired worklist + relogin --------------------------------
 # an account with no auth on this machine: login completes it
 codex-accounts import d@cx --id acct-04 --no-sync >/dev/null 2>&1
@@ -5635,8 +5925,11 @@ EOF
 grep -q "rt-rotated-new" "$CX/limits.log" \
   && t_fail "codex token leak" "a refresh token leaked into limits.log" \
   || t_ok "codex: limits.log leaks no tokens"
-# recently-expired token is left alone (a live codex session may own it) — even --force
-mk_cx_auth "$CX/acct-01/auth.json" a@cx "$((now - 100))"
+# recently-expired token is left alone (a live codex session may own it) — even --force.
+# The expiry is measured from NOW, not from the suite's start: the gate is a five-minute
+# window, and pinning it to $now silently makes this assertion depend on how long every
+# preceding test took.
+mk_cx_auth "$CX/acct-01/auth.json" a@cx "$(( $(date +%s) - 100 ))"
 cp "$CX/acct-01/auth.json" "$WORK/cx-recent.bak"
 rm -f "$CX/acct-01/limits.json" "$CX/acct-01/.oauth-refresh.json"
 out="$(CODEX_MULTIACC_TOKEN_URL="file://$WORK/cx-token-ok.json" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force 2>&1)"