# Context
Audience: AI coding agents first.

## Rule
Use these terms exactly. Do not invent synonyms for load-bearing concepts.

## Domain Vocabulary
- `account`: one identity and credential set for a tool (Codex, Claude Code, or Grok).
- `tool`: provider family key (`codex` | `claude` | `grok`).
- `slug`: immutable filesystem key for an account.
- `alias`: renameable display label for an account.
- `registry`: `AccountRegistry` state and files.
- `base dir`: registry root on disk.
- `account home`: isolated runtime home for one account.
- `legacy home`: old shared Codex home used during migration and courtesy-copy sync.
- `shared tier`: non-credential paths that every account home links to the legacy home.
- `real per-account tier`: credential and account-scoped runtime state that stays isolated.
- `courtesy copy`: the legacy `auth.json` mirror for the current default account.
- `default pointer`: the file that stores the current default account slug.
- `health snapshot`: one `AccountSnapshot` plus its cached rate-limit data.
- `healthy`: token alive and JSON-RPC reachable.
- `broken`: token dead, revoked, or auth fetch failed.
- `unknown`: no reliable health result because spawn, timeout, or IO failed.
- `routing rules`: project override, global default, and fallback chain.
- `fallback chain`: ordered replacement accounts for `cdx`.
- `account lock`: persistent human-controlled admission policy that blocks an account from new sessions, live health probes, and re-authentication without terminating sessions that already exist.
- `human override`: one-shot use of one explicitly named locked account through `--human-override-lock`, allowed only after non-agent terminal classification and exact `/dev/tty` confirmation; it never clears the account lock.
- `device-auth`: `codex login --device-auth` (Codex) or Grok OIDC device code (Grok).
- `roy-grok`: protected Grok account slug; local remove/re-auth blocked unless `SYSTRAY_ALLOW_ROY_GROK_MUTATION=1`.
- `GROK_HOME`: per-account Grok config dir (`auth.json` inside); active `~/.grok/auth.json` is a symlink to the default account.
- `decision record`: one ADR file that captures one architecture choice.
- `run log`: file capturing a non-interactive `cdx exec` child's combined stdout+stderr, under `~/.systray-ai/logs/cdx/`; `cdx exec` prints only its path. Shared-tier storage, not credential state (see ADR 0002).
- `account_locks.json`: shared-tier policy state keyed by `tool:slug`; it is not credential state (see ADR 0004).

## Rules
- Use `account` for the user identity. Do not call it a `profile` unless quoting external input.
- Treat `legacy home` as shared state only where the spec or ADR says so.
- Treat `courtesy copy` as a mirror, never as source of truth.
- Treat `broken` as an authoritative failure state. Do not soften it.
- Treat `unknown` as undecided, not failed.
- Treat an `account lock` as fail-closed admission state. Locked accounts stay out of automatic routing and explicit fallback chains.
- A `human override` MUST name exactly one account and MUST NOT mutate `account_locks.json`.
- Write a decision record when a boundary, data owner, on-disk contract, or process contract changes.

## Checks
- Every new concept gets a vocabulary entry before it appears in code or docs twice.
- Every architecture change has a matching ADR or an explicit reference to an existing one.
- Every storage path is classified as shared tier, courtesy copy, or real per-account tier.

## Existing Conventions
- Audit #34 lint gate: run `ruff check .` from the repository root.
- Audit #34 type gate: run `mypy .` from the repository root.