diff --git a/.agents/skills/harness-adapters/SKILL.md b/.agents/skills/harness-adapters/SKILL.md
index 0e441fd6d2b..8a2d0840eca 100644
--- a/.agents/skills/harness-adapters/SKILL.md
+++ b/.agents/skills/harness-adapters/SKILL.md
@@ -133,6 +133,10 @@ Claude Code's primary watcher protocol is the lowest-friction path: run `bin/fm-
 
 ## codex (VERIFIED 2026-06-11, codex-cli 0.139.0)
 
+For ship and scout launches, `fm-spawn.sh` refreshes a firstmate-owned isolated `CODEX_HOME` with no MCP servers or plugins before starting Codex.
+It copies only the captain home's current Codex authentication and model catalog, so the captain's `~/.codex` configuration remains untouched.
+Secondmate Codex launches intentionally retain their existing home behavior.
+
 | Fact | Value |
 |---|---|
 | Busy-pane signature | `esc to interrupt` (shown as `• Working (Xs • esc to interrupt)`) |
diff --git a/AGENTS.md b/AGENTS.md
index f634af7c0a4..7a855daf62a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -84,7 +84,9 @@ config/wedge-alarm  optional away-mode wedge-alarm active-alert directives; LOCA
 config/x-mode.env    generated X-mode watcher cadence; LOCAL, gitignored; source before arming watcher when present
 data/                personal fleet records; LOCAL, gitignored as a whole
   backlog.md         task queue, dependencies, history
-  captain.md         captain's personal preferences and working style; LOCAL, gitignored, canonical even if harness memory mirrors it, and updated with inspect-then-update
+  captain.md         this home's domain-local captain preferences and working style; LOCAL, gitignored, canonical even if harness memory mirrors it, and updated with inspect-then-update
+  captain-shared.md  main-authoritative shared captain preferences propagated read-only to secondmate homes; LOCAL, gitignored, owned by secondmate-provisioning
+  codex-crewmate/    task-private Codex homes for ship and scout launches; LOCAL, gitignored, owned by fm-codex-home.py and removed by teardown
   learnings.md       fleet-local operational facts and gotchas; LOCAL, gitignored; dated, evidence-backed, curated, and updated with inspect-then-update - rewrite and prune rather than append forever, the same contract as captain.md; created lazily, absent until this home has a learning to store
   projects.md        thin fleet navigation registry; firstmate-private, parsed by fm-project-mode.sh (section 6)
   secondmates.md      secondmate routing table; firstmate-private, maintained by fm-home-seed.sh (section 6)
@@ -95,8 +97,14 @@ state/               volatile runtime signals; gitignored
   <id>.status        appended by crewmates: "<state>: <note>" wake-event lines, not current-state truth
   <id>.turn-ended    touched by turn-end hooks
   <id>.grok-turnend-token   firstmate-owned grok hook registry token for the task; removed by teardown
-  <id>.meta          written by fm-spawn: window=, worktree=, project=, harness=, model=, effort=, kind=, mode=, yolo=, tasktmp=; kind=secondmate also records home= and projects=; a non-default runtime backend records further backend-specific fields (docs/configuration.md "Runtime backend"; bin/fm-backend.sh, section 8); fm-pr-check, including through fm-pr-merge, appends pr= and GitHub's pr_head= when available; fm-x-link appends x_request=, x_request_ts=, x_followups=, and optional x_platform=/x_reply_max_chars= for an X-mode-originated task (section 14)
-  <id>.check.sh      optional slow poll you write per task (e.g. merged-PR check)
+  <id>.meta          written by fm-spawn: window=, worktree=, project=, harness=, model=, effort=, kind=, mode=, yolo=, tasktmp=; Codex ship/scout tasks also record codex_crewmate_home=; kind=secondmate also records home= and projects=; a non-default runtime backend records further backend-specific fields (docs/configuration.md "Runtime backend"; bin/fm-backend.sh, section 8); fm-pr-check, including through fm-pr-merge, records one canonical pr= and GitHub's pr_head= when available; fm-x-link appends x_request=, x_request_ts=, x_followups=, and optional x_platform=/x_reply_max_chars= for an X-mode-originated task (section 14)
+  <id>.check.sh      authenticated slow poll; the watcher dispatches validated PR data and the byte-identified X shim through trusted repository scripts, runs registered custom checks from hash-validated private snapshots, and rejects every other state check without execution
+  <id>.check-trust   private content binding created by fm-check-register.sh for an intentional custom check
+  <id>.pr-poll       private validated data sidecar for the byte-static PR merge poll
+  <id>.pr-poll-registration  private transactional provenance record binding the task, canonical metadata identity, sidecar, and static poll publication
+  .pr-check-quarantine/  private non-runnable storage for checks neutralized by the non-executing migration
+  .pr-check-migration.log  private per-task outcomes distinguishing rebuilt or canonically registered replacement polls, quarantined unarmed polls, and incomplete migrations
+  .pr-check-migration-scan-v1  private marker proving the non-executing scan disabled every unsafe legacy check; .pr-check-migration-v1 separately records completed private repairs
   x-watch.check.sh   generated X-mode relay poll shim; present only when opted in (section 14)
   x-inbox/           generated X-mode pending mention payloads; fmx-respond drains it (section 14)
   x-context/         generated X-mode durable per-request reply context (platform/budget), keyed by request_id; survives inbox cleanup so a delayed follow-up recovers the original platform (section 14; bin/fm-x-lib.sh)
diff --git a/bin/backends/cmux.sh b/bin/backends/cmux.sh
index 69dc0b53bde..cc90f6dc5d3 100644
--- a/bin/backends/cmux.sh
+++ b/bin/backends/cmux.sh
@@ -620,8 +620,7 @@ fm_backend_cmux_window_of_workspace() {  # <workspace_id> -> "<window_id> <count
   done < <(printf '%s' "$wins" | jq -r '.[]? | .id' 2>/dev/null)
 }
 
-# fm_backend_cmux_kill: remove the task's whole workspace, best-effort (mirrors
-# every other backend's `kill` `|| true` contract). A cmux task owns one
+# fm_backend_cmux_kill: remove the task's whole workspace. A cmux task owns one
 # workspace, so teardown reclaims that workspace and all of its surfaces.
 #
 # The selected-workspace teardown bug (docs/cmux-backend.md "Closing the last
@@ -639,7 +638,12 @@ fm_backend_cmux_window_of_workspace() {  # <workspace_id> -> "<window_id> <count
 fm_backend_cmux_kill() {  # <target> [unused] [expected-label]
   local expected_label=${3:-} wsid wininfo win count
   if [ -n "$expected_label" ]; then
-    fm_backend_cmux_target_ready "$1" "$expected_label" || return 0
+    if ! fm_backend_cmux_target_ready "$1" "$expected_label"; then
+      [ "${FM_BACKEND_KILL_STRICT:-0}" = 1 ] && return 1
+      return 0
+    fi
+  elif [ "${FM_BACKEND_KILL_STRICT:-0}" = 1 ]; then
+    fm_backend_cmux_target_ready "$1" || return 1
   else
     fm_backend_cmux_parse_target "$1" || return 0
   fi
@@ -648,9 +652,9 @@ fm_backend_cmux_kill() {  # <target> [unused] [expected-label]
   win=${wininfo%% *}
   count=${wininfo##* }
   if [ -n "$win" ] && [ "$count" = 1 ]; then
-    fm_backend_cmux_cli new-workspace --window "$win" --focus false --id-format uuids >/dev/null 2>&1 || true
+    fm_backend_cmux_cli new-workspace --window "$win" --focus false --id-format uuids >/dev/null 2>&1 || [ "${FM_BACKEND_KILL_STRICT:-0}" != 1 ] || return 1
   fi
-  fm_backend_cmux_cli close-workspace --workspace "$wsid" >/dev/null 2>&1 || true
+  fm_backend_cmux_cli close-workspace --workspace "$wsid" >/dev/null 2>&1 || [ "${FM_BACKEND_KILL_STRICT:-0}" != 1 ]
 }
 
 # fm_backend_cmux_list_live: recovery/orphan discovery. Lists every workspace
diff --git a/bin/backends/herdr.sh b/bin/backends/herdr.sh
index 7874988b426..31de7c18ca2 100644
--- a/bin/backends/herdr.sh
+++ b/bin/backends/herdr.sh
@@ -875,12 +875,14 @@ fm_backend_herdr_send_text_submit() {  # <target> <text> <retries> <enter-sleep>
   done
 }
 
-# fm_backend_herdr_kill: remove the task's pane, best-effort (mirrors
-# tmux-kill-window's `|| true` contract). Verified: closing a tab's only pane
+# fm_backend_herdr_kill: remove the task's pane. Verified: closing a tab's only pane
 # closes the tab too, so a separate tab close is unnecessary.
 fm_backend_herdr_kill() {  # <target>
-  fm_backend_herdr_target_ready "$1" || return 0
-  fm_backend_herdr_cli "$FM_BACKEND_HERDR_SESSION" pane close "$FM_BACKEND_HERDR_PANE" >/dev/null 2>&1 || true
+  if ! fm_backend_herdr_target_ready "$1"; then
+    [ "${FM_BACKEND_KILL_STRICT:-0}" != 1 ] && return 0
+    return 1
+  fi
+  fm_backend_herdr_cli "$FM_BACKEND_HERDR_SESSION" pane close "$FM_BACKEND_HERDR_PANE" >/dev/null 2>&1 || [ "${FM_BACKEND_KILL_STRICT:-0}" != 1 ]
 }
 
 # fm_backend_herdr_classify_agent_status: map a raw `agent get` agent_status
diff --git a/bin/backends/orca.sh b/bin/backends/orca.sh
index dc9307de4f6..91da0309e71 100644
--- a/bin/backends/orca.sh
+++ b/bin/backends/orca.sh
@@ -331,6 +331,10 @@ fm_backend_orca_send_text_submit() {  # <terminal-id> <text> <retries> <enter-sl
 }
 
 fm_backend_orca_kill() {  # <terminal-id>
-  fm_backend_orca_tool_check || return 0
-  orca terminal close --terminal "$1" --json >/dev/null 2>&1 || true
+  fm_backend_orca_tool_check || [ "${FM_BACKEND_KILL_STRICT:-0}" != 1 ] || return 1
+  if [ "${FM_BACKEND_KILL_STRICT:-0}" = 1 ]; then
+    fm_backend_orca_run_json orca terminal close --terminal "$1" --json
+  else
+    orca terminal close --terminal "$1" --json >/dev/null 2>&1 || true
+  fi
 }
diff --git a/bin/backends/tmux.sh b/bin/backends/tmux.sh
index dee5813d64b..9b51f910848 100644
--- a/bin/backends/tmux.sh
+++ b/bin/backends/tmux.sh
@@ -117,10 +117,9 @@ fm_backend_tmux_send_literal() {  # <target> <text>
   tmux send-keys -t "$1" -l "$2"
 }
 
-# fm_backend_tmux_kill: remove the task's window, best-effort. Mirrors
-# fm-teardown.sh's `tmux kill-window -t "$T" 2>/dev/null || true`.
+# fm_backend_tmux_kill: remove the task's window.
 fm_backend_tmux_kill() {  # <target>
-  tmux kill-window -t "$1" 2>/dev/null || true
+  tmux kill-window -t "$1" 2>/dev/null || [ "${FM_BACKEND_KILL_STRICT:-0}" != 1 ]
 }
 
 # fm_backend_tmux_current_command: <target>'s live foreground process name -
diff --git a/bin/backends/zellij.sh b/bin/backends/zellij.sh
index 162ea5477b6..0e052b86f52 100644
--- a/bin/backends/zellij.sh
+++ b/bin/backends/zellij.sh
@@ -270,8 +270,10 @@ fm_backend_zellij_pane_for_tab() {  # <session> <tab_id>
 # target string; the tab id is looked up fresh rather than trusted stale,
 # mirroring herdr's label-based, never-trust-a-stored-id recovery posture).
 fm_backend_zellij_tab_for_pane() {  # <session> <pane_id>
-  local session=$1 pane_id=$2
-  fm_backend_zellij_cli "$session" action list-panes --json 2>/dev/null \
+  local session=$1 pane_id=$2 panes
+  panes=$(fm_backend_zellij_cli "$session" action list-panes --json 2>/dev/null) || return 1
+  printf '%s' "$panes" | jq -e 'type == "array"' >/dev/null 2>&1 || return 1
+  printf '%s' "$panes" \
     | jq -r --argjson p "$pane_id" '.[]? | select(.id == $p and .is_plugin == false) | .tab_id' 2>/dev/null | head -1
 }
 
@@ -299,7 +301,8 @@ fm_backend_zellij_pane_exists() {  # <session> <pane_id>
 fm_backend_zellij_tab_matches_label() {  # <session> <tab_id> <label>
   local session=$1 tab_id=$2 label=$3 scoped tabs count
   scoped=$(fm_backend_zellij_scoped_title "$label")
-  tabs=$(fm_backend_zellij_cli "$session" action list-tabs --json 2>/dev/null)
+  tabs=$(fm_backend_zellij_cli "$session" action list-tabs --json 2>/dev/null) || return 2
+  printf '%s' "$tabs" | jq -e 'type == "array"' >/dev/null 2>&1 || return 2
   printf '%s' "$tabs" | jq -e --argjson t "$tab_id" --arg want "$scoped" \
     '[.[]? | select(.tab_id == $t and .name == $want)] | length > 0' >/dev/null 2>&1 && return 0
   printf '%s' "$tabs" | jq -e --argjson t "$tab_id" --arg want "$label" \
@@ -308,6 +311,22 @@ fm_backend_zellij_tab_matches_label() {  # <session> <tab_id> <label>
   [ "$count" = "1" ]
 }
 
+fm_backend_zellij_tab_absent() {  # <session> <tab_id>
+  local session=$1 tab_id=$2 tabs
+  tabs=$(fm_backend_zellij_cli "$session" action list-tabs --json 2>/dev/null) || return 1
+  printf '%s' "$tabs" | jq -e 'type == "array"' >/dev/null 2>&1 || return 1
+  printf '%s' "$tabs" | jq -e --argjson t "$tab_id" \
+    '[.[]? | select(.tab_id == $t)] | length == 0' >/dev/null 2>&1
+}
+
+fm_backend_zellij_pane_absent() {  # <session> <pane_id>
+  local session=$1 pane_id=$2 panes
+  panes=$(fm_backend_zellij_cli "$session" action list-panes --json 2>/dev/null) || return 1
+  printf '%s' "$panes" | jq -e 'type == "array"' >/dev/null 2>&1 || return 1
+  printf '%s' "$panes" | jq -e --argjson p "$pane_id" \
+    '[.[]? | select(.id == $p)] | length == 0' >/dev/null 2>&1
+}
+
 # fm_backend_zellij_create_task: create the task's tab (one terminal pane) in
 # <session>, refusing an existing <label>. Zellij does NOT enforce tab-name
 # uniqueness itself (verified: two tabs can share a name), so the duplicate
@@ -521,8 +540,7 @@ fm_backend_zellij_send_text_submit() {  # <target> <text> <retries> <enter-sleep
   done
 }
 
-# fm_backend_zellij_kill: remove the task's tab, best-effort (mirrors
-# tmux-kill-window's/herdr-pane-close's `|| true` contract). Verified: unlike
+# fm_backend_zellij_kill: remove the task's tab. Verified: unlike
 # herdr, closing a zellij tab's only PANE does NOT close the tab itself (an
 # empty tab survives in list-tabs); `close-tab-by-id` on a live tab DOES
 # cleanly remove both the pane and the tab in one call, verified to need no
@@ -531,27 +549,67 @@ fm_backend_zellij_send_text_submit() {  # <target> <text> <retries> <enter-sleep
 # passes the recorded tab id and expected tab label for already-empty ghost
 # tabs. Any tab id is verified against the expected label when one is provided.
 fm_backend_zellij_kill() {  # <target> [tab_id] [expected_label]
-  fm_backend_zellij_parse_target "$1" || return 0
-  fm_backend_zellij_session_exists "$FM_BACKEND_ZELLIJ_SESSION" || return 0
-  local tab_id fallback_tab_id=${2:-} expected_label=${3:-}
-  tab_id=$(fm_backend_zellij_tab_for_pane "$FM_BACKEND_ZELLIJ_SESSION" "$FM_BACKEND_ZELLIJ_PANE" 2>/dev/null)
-  if [ -n "$tab_id" ] && [ -n "$expected_label" ] && ! fm_backend_zellij_tab_matches_label "$FM_BACKEND_ZELLIJ_SESSION" "$tab_id" "$expected_label"; then
-    tab_id=
+  if ! fm_backend_zellij_parse_target "$1"; then
+    [ "${FM_BACKEND_KILL_STRICT:-0}" != 1 ] && return 0
+    return 1
+  fi
+  if ! fm_backend_zellij_session_exists "$FM_BACKEND_ZELLIJ_SESSION"; then
+    [ "${FM_BACKEND_KILL_STRICT:-0}" != 1 ] && return 0
+    return 1
+  fi
+  local tab_id query_status label_status fallback_tab_id=${2:-} expected_label=${3:-}
+  if tab_id=$(fm_backend_zellij_tab_for_pane "$FM_BACKEND_ZELLIJ_SESSION" "$FM_BACKEND_ZELLIJ_PANE" 2>/dev/null); then
+    query_status=0
+  else
+    query_status=$?
+  fi
+  if [ "$query_status" -ne 0 ] && [ "${FM_BACKEND_KILL_STRICT:-0}" = 1 ]; then
+    return 1
+  fi
+  if [ -n "$tab_id" ] && [ -n "$expected_label" ]; then
+    if fm_backend_zellij_tab_matches_label "$FM_BACKEND_ZELLIJ_SESSION" "$tab_id" "$expected_label"; then
+      label_status=0
+    else
+      label_status=$?
+    fi
+    if [ "$label_status" -ne 0 ]; then
+      if [ "$label_status" -eq 2 ] && [ "${FM_BACKEND_KILL_STRICT:-0}" = 1 ]; then
+        return 1
+      fi
+      tab_id=
+    fi
   fi
   case "$fallback_tab_id" in
     ''|*[!0-9]*) ;;
     *)
       if [ -z "$tab_id" ]; then
-        if [ -z "$expected_label" ] || fm_backend_zellij_tab_matches_label "$FM_BACKEND_ZELLIJ_SESSION" "$fallback_tab_id" "$expected_label"; then
+        if [ -z "$expected_label" ]; then
           tab_id=$fallback_tab_id
+        else
+          if fm_backend_zellij_tab_matches_label "$FM_BACKEND_ZELLIJ_SESSION" "$fallback_tab_id" "$expected_label"; then
+            label_status=0
+          else
+            label_status=$?
+          fi
+          if [ "$label_status" -eq 0 ]; then
+            tab_id=$fallback_tab_id
+          elif [ "$label_status" -eq 2 ] && [ "${FM_BACKEND_KILL_STRICT:-0}" = 1 ]; then
+            return 1
+          fi
         fi
       fi
       ;;
   esac
   if [ -n "$tab_id" ]; then
-    fm_backend_zellij_cli "$FM_BACKEND_ZELLIJ_SESSION" action close-tab-by-id "$tab_id" >/dev/null 2>&1 || true
+    fm_backend_zellij_cli "$FM_BACKEND_ZELLIJ_SESSION" action close-tab-by-id "$tab_id" >/dev/null 2>&1 || [ "${FM_BACKEND_KILL_STRICT:-0}" != 1 ]
+    if [ "${FM_BACKEND_KILL_STRICT:-0}" = 1 ]; then
+      fm_backend_zellij_tab_absent "$FM_BACKEND_ZELLIJ_SESSION" "$tab_id" || return 1
+    fi
   elif [ -z "$expected_label" ]; then
-    fm_backend_zellij_cli "$FM_BACKEND_ZELLIJ_SESSION" action close-pane --pane-id "$FM_BACKEND_ZELLIJ_PANE" >/dev/null 2>&1 || true
+    fm_backend_zellij_cli "$FM_BACKEND_ZELLIJ_SESSION" action close-pane --pane-id "$FM_BACKEND_ZELLIJ_PANE" >/dev/null 2>&1 || [ "${FM_BACKEND_KILL_STRICT:-0}" != 1 ]
+    if [ "${FM_BACKEND_KILL_STRICT:-0}" = 1 ]; then
+      fm_backend_zellij_pane_absent "$FM_BACKEND_ZELLIJ_SESSION" "$FM_BACKEND_ZELLIJ_PANE" || return 1
+    fi
   fi
 }
 
diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh
index d38bd9f06ef..e41fe321f80 100644
--- a/bin/fm-backend.sh
+++ b/bin/fm-backend.sh
@@ -564,9 +564,8 @@ fm_backend_send_text_submit() {  # <backend> <target> <text> <retries> <enter-sl
   esac
 }
 
-# fm_backend_kill: remove the task's session endpoint (best-effort; a
-# nonexistent/already-gone target is not an error - callers already swallow
-# failures here exactly as the inline `tmux kill-window ... || true` did).
+# fm_backend_kill: remove the task's session endpoint (best-effort by default).
+# Set FM_BACKEND_KILL_STRICT=1 when an allocation failure must be recorded if a backend close fails.
 fm_backend_kill() {  # <backend> <target>
   local backend=$1
   shift
@@ -694,6 +693,85 @@ fm_backend_target_exists() {  # <backend> <target> [expected-label]
   esac
 }
 
+fm_backend_target_absent() {  # <backend> <target> [expected-label] -> 0 absent, 1 live, 2 unknown
+  local backend=$1 target=$2 expected_label=${3:-} out status state session pane wsid title
+  case "$backend" in
+    tmux)
+      out=$(tmux display-message -p -t "$target" '#{pane_id}' 2>&1)
+      status=$?
+      [ "$status" -eq 0 ] && return 1
+      case "$out" in
+        "can't find "*|"no server running on "*) return 0 ;;
+        *) return 2 ;;
+      esac
+      ;;
+    herdr)
+      fm_backend_source herdr || return 2
+      session=${target%%:*}
+      pane=${target#*:}
+      [ -n "$session" ] && [ -n "$pane" ] && [ "$pane" != "$target" ] || return 2
+      state=$(fm_backend_herdr_pane_agent_state "$session" "$pane")
+      case "$state" in
+        dead) return 0 ;;
+        live|no-agent) return 1 ;;
+        *) return 2 ;;
+      esac
+      ;;
+    zellij)
+      fm_backend_source zellij || return 2
+      fm_backend_zellij_parse_target "$target" || return 2
+      out=$(zellij list-sessions --short --no-formatting 2>/dev/null) || return 2
+      if ! printf '%s\n' "$out" | grep -qxF "$FM_BACKEND_ZELLIJ_SESSION"; then
+        return 0
+      fi
+      out=$(fm_backend_zellij_cli "$FM_BACKEND_ZELLIJ_SESSION" action list-panes --json 2>/dev/null) || return 2
+      printf '%s' "$out" | jq -e 'type == "array"' >/dev/null 2>&1 || return 2
+      if printf '%s' "$out" | jq -e --argjson p "$FM_BACKEND_ZELLIJ_PANE" \
+        '[.[]? | select(.id == $p and .is_plugin == false)] | length == 0' >/dev/null 2>&1; then
+        return 0
+      fi
+      return 1
+      ;;
+    cmux)
+      fm_backend_source cmux || return 2
+      fm_backend_cmux_parse_target "$target" || return 2
+      wsid=$FM_BACKEND_CMUX_WORKSPACE
+      out=$(fm_backend_cmux_cli workspace list --json --id-format uuids 2>/dev/null) || return 2
+      printf '%s' "$out" | jq -e '(.workspaces | type) == "array"' >/dev/null 2>&1 || return 2
+      if [ -n "$expected_label" ]; then
+        title=$(fm_backend_cmux_scoped_title "$expected_label")
+        if printf '%s' "$out" | jq -e --arg id "$wsid" --arg title "$title" \
+          '[.workspaces[]? | select(.id == $id or .title == $title)] | length == 0' >/dev/null 2>&1; then
+          return 0
+        fi
+      elif printf '%s' "$out" | jq -e --arg id "$wsid" \
+        '[.workspaces[]? | select(.id == $id)] | length == 0' >/dev/null 2>&1; then
+        return 0
+      fi
+      return 1
+      ;;
+    orca)
+      fm_backend_source orca || return 2
+      out=$(orca terminal read --terminal "$target" --limit 1 --json 2>&1)
+      status=$?
+      printf '%s' "$out" | node -e '
+const fs = require("fs");
+let data;
+try { data = JSON.parse(fs.readFileSync(0, "utf8")); } catch { process.exit(2); }
+if (data.ok === false) {
+  const code = String((data.error && data.error.code) || "").toLowerCase();
+  process.exit(code === "terminal_not_found" || code === "not_found" ? 0 : 2);
+}
+process.exit(process.argv[1] === "0" ? 1 : 2);
+' "$status"
+      return $?
+      ;;
+    *)
+      return 2
+      ;;
+  esac
+}
+
 # fm_backend_agent_alive: CONFIDENT liveness of a live harness-agent PROCESS
 # under <target>, distinct from fm_backend_target_exists's pane-PRESENCE-only
 # check above. A secondmate agent that has exited leaves its backend endpoint
diff --git a/bin/fm-codex-home.py b/bin/fm-codex-home.py
new file mode 100644
index 00000000000..fd7a5bbfe73
--- /dev/null
+++ b/bin/fm-codex-home.py
@@ -0,0 +1,449 @@
+#!/usr/bin/env python3
+"""Manage a firstmate-owned private Codex home for one ship or scout task.
+
+fm-spawn.sh is the sole caller.
+It creates a mode-0700 directory below data/codex-crewmate.
+It copies only the captain's auth.json and models_cache.json.
+It writes a no-plugin and no-MCP configuration.
+It launches Codex through an open directory descriptor.
+It removes only a validated managed home during abort cleanup or teardown.
+Secondmate Codex launches do not use this helper.
+"""
+
+import argparse
+import os
+import secrets
+import signal
+import stat
+import sys
+
+
+def die(message):
+    print(f"error: {message}", file=sys.stderr)
+    raise SystemExit(1)
+
+
+def open_directory(name, directory_fd=None):
+    flags = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW
+    return os.open(name, flags, dir_fd=directory_fd)
+
+
+def require_directory(fd, label):
+    if not stat.S_ISDIR(os.fstat(fd).st_mode):
+        die(f"{label} must be a directory")
+
+
+def directory_path(fd, fallback):
+    try:
+        import fcntl
+
+        getpath = getattr(fcntl, "F_GETPATH", None)
+        if getpath is not None:
+            path = fcntl.fcntl(fd, getpath, bytes(1024)).split(b"\0", 1)[0]
+            if path:
+                return os.fsdecode(path)
+    except (AttributeError, OSError):
+        pass
+    for directory in ("/proc/self/fd", "/dev/fd"):
+        try:
+            path = os.readlink(os.path.join(directory, str(fd)))
+            if os.path.isabs(path):
+                return path
+        except OSError:
+            pass
+    return fallback
+
+
+def write_all(fd, content):
+    while content:
+        written = os.write(fd, content)
+        content = content[written:]
+
+
+def write_file(directory_fd, name, content):
+    fd = os.open(name, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600, dir_fd=directory_fd)
+    try:
+        write_all(fd, content)
+        os.fchmod(fd, 0o600)
+    finally:
+        os.close(fd)
+
+
+def copy_regular_file(source, directory_fd, name):
+    try:
+        source_fd = os.open(os.path.join(source, name), os.O_RDONLY | os.O_NOFOLLOW)
+    except FileNotFoundError:
+        return
+    try:
+        if not stat.S_ISREG(os.fstat(source_fd).st_mode):
+            die(f"Codex source file is not regular: {os.path.join(source, name)}")
+        target_fd = os.open(name, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600, dir_fd=directory_fd)
+        try:
+            while True:
+                chunk = os.read(source_fd, 1024 * 1024)
+                if not chunk:
+                    break
+                write_all(target_fd, chunk)
+            os.fchmod(target_fd, 0o600)
+        finally:
+            os.close(target_fd)
+    finally:
+        os.close(source_fd)
+
+
+def remove_tree(directory_fd, name):
+    try:
+        child_fd = open_directory(name, directory_fd)
+    except FileNotFoundError:
+        return
+    try:
+        opened_stat = os.fstat(child_fd)
+        for child in os.listdir(child_fd):
+            child_stat = os.stat(child, dir_fd=child_fd, follow_symlinks=False)
+            if stat.S_ISDIR(child_stat.st_mode):
+                remove_tree(child_fd, child)
+            else:
+                os.unlink(child, dir_fd=child_fd)
+    finally:
+        os.close(child_fd)
+    current_stat = os.stat(name, dir_fd=directory_fd, follow_symlinks=False)
+    if (current_stat.st_dev, current_stat.st_ino) != (opened_stat.st_dev, opened_stat.st_ino):
+        raise OSError("managed Codex home changed during removal")
+    os.rmdir(name, dir_fd=directory_fd)
+
+
+def toml_basic_string(value):
+    if any(ord(char) < 0x20 or ord(char) == 0x7F for char in value):
+        die("Codex worktree path contains a TOML control character")
+    return value.replace("\\", "\\\\").replace('"', '\\"')
+
+
+def parse_args():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--data")
+    parser.add_argument("--source")
+    parser.add_argument("--profile")
+    parser.add_argument("--worktree")
+    parser.add_argument("--new-home-name", action="store_true")
+    parser.add_argument("--new-result-token", action="store_true")
+    parser.add_argument("--create-activate", action="store_true")
+    parser.add_argument("--remove", action="store_true")
+    parser.add_argument("--read-activation-result", action="store_true")
+    parser.add_argument("--remove-activation-result", action="store_true")
+    parser.add_argument("--home")
+    parser.add_argument("--result-token")
+    parser.add_argument("command", nargs=argparse.REMAINDER)
+    return parser.parse_args()
+
+
+def managed_home_name(home):
+    name = os.path.basename(home or "")
+    if not name.startswith(".fm-codex-home.") or len(name) <= len(".fm-codex-home."):
+        die("isolated Codex home name is unsafe")
+    return name
+
+
+def launch_command(args):
+    command = args.command[1:] if args.command[:1] == ["--"] else args.command
+    if not command:
+        die("Codex home activation requires a command")
+    return command
+
+
+def result_token(args):
+    token = args.result_token or ""
+    if len(token) != 64 or any(char not in "0123456789abcdef" for char in token):
+        die("isolated Codex home activation token is unsafe")
+    return token.encode()
+
+
+def activation_result_name(args):
+    return ".fm-codex-activation." + managed_home_name(args.home)
+
+
+def activation_result_fd(args, base_fd):
+    try:
+        fd = os.open(
+            activation_result_name(args),
+            os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW,
+            0o600,
+            dir_fd=base_fd,
+        )
+        os.fchmod(fd, 0o600)
+        return fd
+    except OSError as error:
+        die(f"could not record isolated Codex home activation: {error.strerror}")
+
+
+def finish_activation_result_with_token(fd, result, token):
+    try:
+        write_all(fd, result + b" " + token + b"\n")
+    finally:
+        os.close(fd)
+
+
+def read_activation_result(args):
+    token = result_token(args)
+    try:
+        data_fd = open_directory(os.path.abspath(args.data))
+        try:
+            require_directory(data_fd, "firstmate data")
+            base_fd = open_directory("codex-crewmate", data_fd)
+        finally:
+            os.close(data_fd)
+        try:
+            require_directory(base_fd, "isolated Codex home")
+            try:
+                fd = os.open(activation_result_name(args), os.O_RDONLY | os.O_NOFOLLOW, dir_fd=base_fd)
+            except FileNotFoundError:
+                print("pending")
+                return 3
+        finally:
+            os.close(base_fd)
+    except FileNotFoundError:
+        print("pending")
+        return 3
+    except OSError as error:
+        die(f"isolated Codex home activation result is unsafe: {error.strerror}")
+    try:
+        file_stat = os.fstat(fd)
+        if (
+            not stat.S_ISREG(file_stat.st_mode)
+            or file_stat.st_uid != os.geteuid()
+            or file_stat.st_nlink != 1
+            or stat.S_IMODE(file_stat.st_mode) != 0o600
+        ):
+            die("isolated Codex home activation result is unsafe")
+        content = os.read(fd, 256)
+        if os.read(fd, 1):
+            die("isolated Codex home activation result is unsafe")
+    finally:
+        os.close(fd)
+    for state in (b"ready", b"failed"):
+        if content == state + b" " + token + b"\n":
+            print(state.decode())
+            return 0
+    die("isolated Codex home activation result is unsafe")
+
+
+def remove_activation_result(args):
+    try:
+        data_fd = open_directory(os.path.abspath(args.data))
+        try:
+            require_directory(data_fd, "firstmate data")
+            base_fd = open_directory("codex-crewmate", data_fd)
+        finally:
+            os.close(data_fd)
+        try:
+            require_directory(base_fd, "isolated Codex home")
+            try:
+                os.unlink(activation_result_name(args), dir_fd=base_fd)
+            except FileNotFoundError:
+                pass
+        finally:
+            os.close(base_fd)
+    except FileNotFoundError:
+        pass
+    except OSError as error:
+        die(f"could not remove isolated Codex home activation result: {error.strerror}")
+
+
+class ActivationExecError(Exception):
+    pass
+
+
+def activate_command(args, home_fd, command, result_fd, token):
+    read_fd, write_fd = os.pipe()
+    os.set_inheritable(read_fd, False)
+    os.set_inheritable(write_fd, False)
+    pid = os.fork()
+    if pid == 0:
+        os.close(read_fd)
+        try:
+            os.set_inheritable(home_fd, True)
+            environment = os.environ.copy()
+            environment["CODEX_HOME"] = f"/dev/fd/{home_fd}"
+            os.execvpe(command[0], command, environment)
+        except BaseException:
+            try:
+                write_all(write_fd, b"failed\n")
+            finally:
+                os._exit(1)
+    os.close(write_fd)
+    try:
+        outcome = os.read(read_fd, 64)
+    finally:
+        os.close(read_fd)
+    if outcome:
+        _, status = os.waitpid(pid, 0)
+        finish_activation_result_with_token(result_fd, b"failed", token)
+        raise ActivationExecError("could not execute isolated Codex launch")
+    try:
+        finish_activation_result_with_token(result_fd, b"ready", token)
+    except BaseException:
+        os.kill(pid, signal.SIGTERM)
+        os.waitpid(pid, 0)
+        raise
+    _, status = os.waitpid(pid, 0)
+    return os.waitstatus_to_exitcode(status)
+
+
+def validate_data_root(data):
+    if not data:
+        die("isolated Codex home requires --data")
+    data_fd = open_directory(os.path.abspath(data))
+    try:
+        require_directory(data_fd, "firstmate data")
+        try:
+            base_fd = open_directory("codex-crewmate", data_fd)
+        except FileNotFoundError:
+            return
+        try:
+            require_directory(base_fd, "isolated Codex home")
+        finally:
+            os.close(base_fd)
+    finally:
+        os.close(data_fd)
+
+
+def remove_home(args):
+    if args.create_activate or not args.home:
+        die("Codex home removal requires --home")
+    if not args.data:
+        die("Codex home removal requires --data")
+    data_fd = open_directory(os.path.abspath(args.data))
+    try:
+        require_directory(data_fd, "firstmate data")
+        try:
+            base_fd = open_directory("codex-crewmate", data_fd)
+        except FileNotFoundError:
+            return
+    finally:
+        os.close(data_fd)
+    try:
+        require_directory(base_fd, "isolated Codex home")
+        remove_tree(base_fd, managed_home_name(args.home))
+    except FileNotFoundError:
+        pass
+    finally:
+        os.close(base_fd)
+
+
+def create_home(args, command=None):
+    if not args.source or not args.profile or args.worktree is None:
+        die("Codex home creation requires --source, --profile, and --worktree")
+    if not args.data:
+        die("Codex home creation requires --data")
+    if not args.profile or any(char not in "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-" for char in args.profile):
+        die("isolated Codex profile name is unsafe")
+    worktree = toml_basic_string(args.worktree)
+    try:
+        data = os.path.abspath(args.data)
+        data_fd = open_directory(data)
+        require_directory(data_fd, "firstmate data")
+        data = directory_path(data_fd, data)
+        try:
+            try:
+                os.mkdir("codex-crewmate", 0o700, dir_fd=data_fd)
+            except FileExistsError:
+                pass
+            base_fd = open_directory("codex-crewmate", data_fd)
+            require_directory(base_fd, "isolated Codex home")
+            os.fchmod(base_fd, 0o700)
+            try:
+                activation_fd = None
+                activation_token = None
+                home_created = False
+                if command:
+                    activation_fd = activation_result_fd(args, base_fd)
+                    activation_token = result_token(args)
+                while True:
+                    name = managed_home_name(args.home) if args.home else ".fm-codex-home." + secrets.token_hex(16)
+                    try:
+                        os.mkdir(name, 0o700, dir_fd=base_fd)
+                        home_created = True
+                        break
+                    except FileExistsError:
+                        if args.home:
+                            die("isolated Codex home already exists")
+                        continue
+                home_fd = open_directory(name, base_fd)
+                try:
+                    require_directory(home_fd, "isolated Codex home")
+                    os.fchmod(home_fd, 0o700)
+                    base_config = "# Firstmate Codex crewmate home.\n[features]\nplugins = false\n[projects.\"%s\"]\ntrust_level = \"untrusted\"\n" % worktree
+                    write_file(home_fd, "config.toml", base_config.encode())
+                    copy_regular_file(args.source, home_fd, "auth.json")
+                    copy_regular_file(args.source, home_fd, "models_cache.json")
+                    profile = "# Firstmate Codex crewmate profile.\n[projects.\"%s\"]\ntrust_level = \"untrusted\"\n" % worktree
+                    write_file(home_fd, args.profile + ".config.toml", profile.encode())
+                    if command:
+                        return activate_command(args, home_fd, command, activation_fd, activation_token)
+                finally:
+                    os.close(home_fd)
+                print(os.path.join(data, "codex-crewmate", name))
+            except BaseException:
+                if activation_fd is not None:
+                    try:
+                        finish_activation_result_with_token(activation_fd, b"failed", activation_token)
+                    except OSError:
+                        pass
+                if home_created:
+                    try:
+                        remove_tree(base_fd, name)
+                    except OSError:
+                        pass
+                raise
+            finally:
+                os.close(base_fd)
+        finally:
+            os.close(data_fd)
+    except OSError as error:
+        die(f"could not prepare isolated Codex home: {error.strerror}")
+
+
+def main():
+    args = parse_args()
+    if args.new_result_token:
+        if args.new_home_name or args.remove or args.create_activate or args.read_activation_result or args.remove_activation_result or args.home or args.result_token or args.command:
+            die("isolated Codex home result token generation accepts no other action")
+        print(secrets.token_hex(32))
+        return
+    if args.new_home_name:
+        if args.remove or args.create_activate or args.read_activation_result or args.remove_activation_result or args.home or args.result_token or args.command:
+            die("isolated Codex home name generation accepts no other action")
+        try:
+            validate_data_root(args.data)
+        except OSError as error:
+            die(f"could not prepare isolated Codex home: {error.strerror}")
+        print(".fm-codex-home." + secrets.token_hex(16))
+        return
+    if args.read_activation_result:
+        if args.remove or args.create_activate or args.remove_activation_result or not args.home or not args.data or args.source or args.profile or args.worktree is not None or args.command:
+            die("isolated Codex home activation result read requires data, home, and result arguments")
+        raise SystemExit(read_activation_result(args))
+    if args.remove_activation_result:
+        if args.remove or args.create_activate or args.read_activation_result or not args.home or not args.data or args.source or args.profile or args.worktree is not None or args.command:
+            die("isolated Codex home activation result removal requires data and home")
+        remove_activation_result(args)
+        return
+    if args.remove:
+        remove_home(args)
+        return
+    if args.create_activate:
+        if not args.home:
+            die("Codex home activation requires --home")
+        if not args.data:
+            die("Codex home activation requires --data")
+        result_token(args)
+        try:
+            exit_code = create_home(args, launch_command(args))
+        except BaseException:
+            raise
+        raise SystemExit(exit_code)
+        return
+    create_home(args)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/bin/fm-review-diff.sh b/bin/fm-review-diff.sh
index 4b97b000135..7692b145f94 100755
--- a/bin/fm-review-diff.sh
+++ b/bin/fm-review-diff.sh
@@ -128,12 +128,12 @@ git -C "$WT" rev-parse --verify --quiet "$BASE^{commit}" >/dev/null || { echo "e
 git -C "$WT" rev-parse --verify --quiet "$COMPARE_REF^{commit}" >/dev/null || { echo "error: compare ref $COMPARE_REF does not resolve in $WT" >&2; exit 1; }
 
 echo "diff base: $BASE"
-if git -C "$WT" diff --quiet "$BASE...$COMPARE_REF" --; then
+if git -C "$WT" diff --no-ext-diff --quiet "$BASE...$COMPARE_REF" --; then
   echo "no changes vs $BASE"
   exit 0
 fi
 
-git -C "$WT" diff --stat "$BASE...$COMPARE_REF" --
+git -C "$WT" diff --no-ext-diff --stat "$BASE...$COMPARE_REF" --
 if ! "$STAT_ONLY"; then
   echo
   git -C "$WT" diff --no-ext-diff "$BASE...$COMPARE_REF" --
diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
index bdf2ecf24a1..0f2326ef00e 100755
--- a/bin/fm-spawn.sh
+++ b/bin/fm-spawn.sh
@@ -73,6 +73,11 @@
 #                  written by this script; outside the worktree to avoid pi's trust gate)
 #     __PITURNEND__ absolute path to .pi/extensions/fm-primary-turnend-guard.ts in a pi secondmate home
 #     __PIWATCH__   absolute path to .pi/extensions/fm-primary-pi-watch.ts in a pi secondmate home
+# Codex ship and scout launches receive a firstmate-managed CODEX_HOME under
+# data/codex-crewmate, each in a fresh private directory with only copied
+# auth/model catalog files and a config.toml with no MCP servers, disabled plugins, and a per-task
+# profile that excludes project-local Codex configuration.
+# Codex secondmate launches retain their existing home and are not changed here.
 # Per-harness turn-end hooks are installed automatically; some live outside the worktree.
 # grok uses a firstmate-owned global hook under ${GROK_HOME:-$HOME/.grok}/hooks
 # plus a gitignored .fm-grok-turnend worktree pointer and a state token.
@@ -190,6 +195,14 @@ fi
 ORCA_ABORT_CLEANUP=0
 ORCA_WORKTREE_ID=
 ORCA_TERMINAL=
+ORCA_WORKTREE_CLEANUP_COMPLETE=0
+ORCA_ABORT_CLEANUP_FAILED=0
+FAILED_ENDPOINT_CLEANUP=0
+TREEHOUSE_ABORT_CLEANUP=0
+TASK_TMP=
+CODEX_CREWMATE_HOME=
+CODEX_ACTIVATION_TOKEN=
+SPAWN_META_WRITTEN=0
 
 parse_orca_worktree_result() {
   local raw=$1 rest
@@ -208,38 +221,134 @@ parse_orca_worktree_result() {
   fi
 }
 
+write_failed_treehouse_spawn_meta() {
+  mkdir -p "$STATE" 2>/dev/null || return 0
+  {
+    if [ "$BACKEND" = orca ]; then
+      echo "window=$W"
+    else
+      echo "window=${T:-}"
+    fi
+    echo "worktree=$WT"
+    echo "project=$PROJ_ABS"
+    echo "harness=$HARNESS"
+    echo "kind=$KIND"
+    echo "mode=${MODE:-no-mistakes}"
+    echo "yolo=${YOLO:-off}"
+    echo "tasktmp=${TASK_TMP:-}"
+    echo "failed_spawn=1"
+    [ "$FAILED_ENDPOINT_CLEANUP" != 1 ] || echo "endpoint_cleanup_pending=1"
+    [ -z "${CODEX_CREWMATE_HOME:-}" ] || echo "codex_crewmate_home=$CODEX_CREWMATE_HOME"
+    echo "model=${MODEL:-default}"
+    echo "effort=${EFFORT:-default}"
+    [ "$BACKEND" = tmux ] || echo "backend=$BACKEND"
+    if [ "$BACKEND" = herdr ]; then
+      echo "herdr_session=${HERDR_SES:-}"
+      echo "herdr_workspace_id=${HERDR_WORKSPACE_ID:-}"
+      echo "herdr_tab_id=${HERDR_TAB_ID:-}"
+      echo "herdr_pane_id=${HERDR_PANE_ID:-}"
+    fi
+    if [ "$BACKEND" = zellij ]; then
+      echo "zellij_session=${ZELLIJ_SES:-}"
+      echo "zellij_tab_id=${ZELLIJ_TAB_ID:-}"
+      echo "zellij_pane_id=${ZELLIJ_PANE_ID:-}"
+    fi
+    if [ "$BACKEND" = cmux ]; then
+      echo "cmux_workspace_id=${CMUX_WORKSPACE_ID:-}"
+      echo "cmux_surface_id=${CMUX_SURFACE_ID:-}"
+    fi
+    if [ "$BACKEND" = orca ]; then
+      echo "orca_worktree_id=${ORCA_WORKTREE_ID:-}"
+      [ "${ORCA_WORKTREE_CLEANUP_COMPLETE:-0}" != 1 ] || echo "orca_worktree_cleanup_complete=1"
+      [ -z "${ORCA_TERMINAL:-}" ] || echo "terminal=$ORCA_TERMINAL"
+    fi
+  } > "$STATE/$ID.meta" 2>/dev/null || true
+}
+
+remove_codex_crewmate_home() {
+  local home=${CODEX_CREWMATE_HOME:-}
+  [ -n "$home" ] || return 0
+  python3 "$FM_ROOT/bin/fm-codex-home.py" --remove --data "$DATA" --home "$home"
+}
+
+remove_codex_home_activation_result() {
+  local home=${CODEX_CREWMATE_HOME:-}
+  [ -n "$home" ] || return 0
+  python3 "$FM_ROOT/bin/fm-codex-home.py" --remove-activation-result --data "$DATA" --home "$home"
+}
+
 orca_spawn_abort_cleanup() {
-  local status=$?
-  [ "$ORCA_ABORT_CLEANUP" = 1 ] || return "$status"
+  local cleanup_failed=0
+  [ "$ORCA_ABORT_CLEANUP" = 1 ] || return 0
   ORCA_ABORT_CLEANUP=0
   if [ -n "${ORCA_TERMINAL:-}" ]; then
-    fm_backend_kill orca "$ORCA_TERMINAL" 2>/dev/null || true
+    if FM_BACKEND_KILL_STRICT=1 fm_backend_kill orca "$ORCA_TERMINAL" 2>/dev/null; then
+      if fm_backend_target_absent orca "$ORCA_TERMINAL"; then
+        ORCA_TERMINAL=
+        T=
+      else
+        cleanup_failed=1
+        FAILED_ENDPOINT_CLEANUP=1
+      fi
+    else
+      cleanup_failed=1
+      FAILED_ENDPOINT_CLEANUP=1
+    fi
   fi
   if [ -n "${ORCA_WORKTREE_ID:-}" ]; then
-    if ! fm_backend_remove_worktree orca "$ORCA_WORKTREE_ID" 2>/dev/null; then
-      mkdir -p "$STATE" 2>/dev/null || true
-      if [ -d "$STATE" ]; then
-        {
-          echo "window=$W"
-          echo "worktree=${WT:-}"
-          echo "project=$PROJ_ABS"
-          echo "harness=$HARNESS"
-          echo "kind=$KIND"
-          echo "mode=${MODE:-no-mistakes}"
-          echo "yolo=${YOLO:-off}"
-          echo "tasktmp=${TASK_TMP:-}"
-          echo "model=${MODEL:-default}"
-          echo "effort=${EFFORT:-default}"
-          echo "backend=orca"
-          echo "orca_worktree_id=$ORCA_WORKTREE_ID"
-          [ -z "${ORCA_TERMINAL:-}" ] || echo "terminal=$ORCA_TERMINAL"
-        } > "$STATE/$ID.meta" 2>/dev/null || true
+    if fm_backend_remove_worktree orca "$ORCA_WORKTREE_ID" 2>/dev/null; then
+      ORCA_WORKTREE_ID=
+      ORCA_WORKTREE_CLEANUP_COMPLETE=1
+      WT=
+    else
+      cleanup_failed=1
+    fi
+  fi
+  ORCA_ABORT_CLEANUP_FAILED=$cleanup_failed
+  return 0
+}
+
+spawn_abort_cleanup() {
+  local status=$? preserve_codex_home=0 clean_codex_home=0 orca_cleanup_failed=0
+  if [ "$TREEHOUSE_ABORT_CLEANUP" = 1 ]; then
+    TREEHOUSE_ABORT_CLEANUP=0
+    clean_codex_home=1
+    if ( cd "$PROJ_ABS" && treehouse return --force "$WT" ) 2>/dev/null; then
+      if ! FM_BACKEND_KILL_STRICT=1 fm_backend_kill "$BACKEND" "$T" "${ZELLIJ_TAB_ID:-}" "fm-$ID" 2>/dev/null; then
+        FAILED_ENDPOINT_CLEANUP=1
+        write_failed_treehouse_spawn_meta
+        preserve_codex_home=1
+      elif ! fm_backend_target_absent "$BACKEND" "$T" "fm-$ID"; then
+        FAILED_ENDPOINT_CLEANUP=1
+        write_failed_treehouse_spawn_meta
+        preserve_codex_home=1
       fi
+    else
+      FAILED_ENDPOINT_CLEANUP=1
+      write_failed_treehouse_spawn_meta
+      preserve_codex_home=1
     fi
   fi
+  if [ "$ORCA_ABORT_CLEANUP" = 1 ]; then
+    clean_codex_home=1
+    orca_spawn_abort_cleanup
+    orca_cleanup_failed=$ORCA_ABORT_CLEANUP_FAILED
+  fi
+  if [ "$clean_codex_home" -eq 1 ] && [ "$preserve_codex_home" -eq 0 ] && ! remove_codex_crewmate_home; then
+    echo "error: could not remove isolated Codex crewmate home" >&2
+    write_failed_treehouse_spawn_meta
+  elif [ "$clean_codex_home" -eq 1 ] && [ "$preserve_codex_home" -eq 0 ]; then
+    CODEX_CREWMATE_HOME=
+  fi
+  [ "$orca_cleanup_failed" -eq 0 ] || write_failed_treehouse_spawn_meta
+  [ -z "$CODEX_ACTIVATION_TOKEN" ] || remove_codex_home_activation_result 2>/dev/null || true
+  [ -z "$TASK_TMP" ] || rm -rf -- "$TASK_TMP"
+  if [ "$status" -ne 0 ] && [ "$SPAWN_META_WRITTEN" = 1 ] && [ "$FAILED_ENDPOINT_CLEANUP" != 1 ] && [ "$preserve_codex_home" -eq 0 ] && [ "$orca_cleanup_failed" -eq 0 ] && [ -z "$CODEX_CREWMATE_HOME" ]; then
+    rm -f "$STATE/$ID.meta"
+  fi
   return "$status"
 }
-trap orca_spawn_abort_cleanup EXIT
+trap spawn_abort_cleanup EXIT
 
 # Batch dispatch (see header): when the first positional is an `id=repo` pair, treat every
 # positional as one and spawn each by re-execing this script in single-task mode. We use
@@ -326,7 +435,7 @@ launch_template() {
       if [ "$kind" = secondmate ]; then
         printf '%s' 'codex __MODELFLAG____EFFORTFLAG__--dangerously-bypass-approvals-and-sandbox "$(cat __BRIEF__)"'
       else
-        printf '%s' 'codex __MODELFLAG____EFFORTFLAG__--dangerously-bypass-approvals-and-sandbox -c "notify=[\"bash\",\"-c\",\"touch __TURNEND__\"]" "$(cat __BRIEF__)"'
+        printf '%s' 'codex --profile __CODEXPROFILE__ --disable plugins __MODELFLAG____EFFORTFLAG__--dangerously-bypass-approvals-and-sandbox -c "notify=[\"bash\",\"-c\",\"touch __TURNEND__\"]" "$(cat __BRIEF__)"'
       fi
       ;;
     opencode) printf '%s' 'OPENCODE_CONFIG_CONTENT='\''{"permission":{"*":"allow"}}'\'' opencode __MODELFLAG__--prompt "$(cat __BRIEF__)"' ;;
@@ -349,13 +458,443 @@ launch_template() {
   esac
 }
 
+raw_launch_word_is() {
+  local word=$1 expected=$2 base lowered
+  base=${word##*/}
+  lowered=$(printf '%s' "$base" | tr '[:upper:]' '[:lower:]') || return 1
+  [ "$lowered" = "$expected" ]
+}
+
+raw_launch_word_is_codex() {
+  raw_launch_word_is "$1" codex
+}
+
+raw_launch_word_is_dynamic_dispatcher() {
+  local word=$1
+  raw_launch_word_is "$word" find || raw_launch_word_is "$word" xargs || raw_launch_word_is "$word" parallel
+}
+
+raw_launch_word_is_indirect_dispatcher() {
+  local word=$1
+  raw_launch_word_is "$word" eval || raw_launch_word_is "$word" python || raw_launch_word_is "$word" python3 || raw_launch_word_is "$word" pypy || raw_launch_word_is "$word" perl || raw_launch_word_is "$word" ruby || raw_launch_word_is "$word" node || raw_launch_word_is "$word" nodejs || raw_launch_word_is "$word" php || raw_launch_word_is "$word" lua
+}
+
+raw_launch_word_is_script_dispatcher() {
+  local word=$1 base
+  raw_launch_word_is "$word" source || [ "$word" = . ] && return 0
+  base=${word##*/}
+  case "$base" in
+    *.sh|*.bash|*.zsh|*.command) return 0 ;;
+  esac
+  case "$word" in
+    ./*|../*) return 0 ;;
+  esac
+  return 1
+}
+
+raw_launch_mentions_codex() {
+  local raw=$1 status
+  while [ -n "$raw" ]; do
+    raw_launch_read_word "$raw"
+    status=$?
+    [ "$status" -eq 0 ] || return "$status"
+    raw_launch_word_is_codex "$RAW_LAUNCH_WORD" && return 0
+    raw=$RAW_LAUNCH_REST
+  done
+  return 1
+}
+
+raw_launch_has_codex_dispatch_argument() {
+  local raw=$1 previous='' status
+  while [ -n "$raw" ]; do
+    raw_launch_read_word "$raw"
+    status=$?
+    [ "$status" -eq 0 ] || return "$status"
+    if raw_launch_word_is_codex "$RAW_LAUNCH_WORD" && [[ "$previous" != -* ]]; then
+      return 0
+    fi
+    previous=$RAW_LAUNCH_WORD
+    raw=$RAW_LAUNCH_REST
+  done
+  return 1
+}
+
+raw_launch_has_dynamic_execution() {
+  local raw=$1 len=${#1} i=0 char next quote=''
+  while [ "$i" -lt "$len" ]; do
+    char=${raw:i:1}
+    next=${raw:i+1:1}
+    case "$quote" in
+      "'")
+        [ "$char" = "'" ] && quote=
+        ;;
+      '"')
+        case "$char" in
+          '"') quote= ;;
+          \\) i=$((i + 1)) ;;
+          '$') [ "$next" = '(' ] && return 0 ;;
+          '`') return 0 ;;
+        esac
+        ;;
+      '')
+        case "$char" in
+          "'") quote="'" ;;
+          '"') quote='"' ;;
+          \\) i=$((i + 1)) ;;
+          '$') [ "$next" = '(' ] && return 0 ;;
+          '`') return 0 ;;
+          ';'|'&'|'|'|'('|')'|$'\n'|$'\r') return 0 ;;
+          '<'|'>') [ "$next" = '(' ] && return 0 ;;
+        esac
+        ;;
+    esac
+    i=$((i + 1))
+  done
+  return 1
+}
+
+raw_launch_wrapped_command_status() {
+  raw_launch_starts_codex "$1"
+  local status=$?
+  [ "$status" -ne 0 ] || return 2
+  return "$status"
+}
+
+raw_launch_read_word() {
+  local raw=$1 len=${#1} i=0 char quote='' word=
+  while [ "$i" -lt "$len" ]; do
+    char=${raw:i:1}
+    case "$char" in
+      ' '|$'\t'|$'\n'|$'\r') i=$((i + 1)) ;;
+      *) break ;;
+    esac
+  done
+  [ "$i" -lt "$len" ] || return 1
+  while [ "$i" -lt "$len" ]; do
+    char=${raw:i:1}
+    case "$quote" in
+      "'")
+        if [ "$char" = "'" ]; then quote=; else word+=$char; fi
+        ;;
+      '"')
+        case "$char" in
+          '"') quote= ;;
+          \\)
+            i=$((i + 1))
+            [ "$i" -lt "$len" ] || return 2
+            word+=${raw:i:1}
+            ;;
+          '$'|'`') return 2 ;;
+          *) word+=$char ;;
+        esac
+        ;;
+      '')
+        case "$char" in
+          ' '|$'\t'|$'\n'|$'\r') break ;;
+          "'") quote="'" ;;
+          '"') quote='"' ;;
+          \\)
+            i=$((i + 1))
+            [ "$i" -lt "$len" ] || return 2
+            word+=${raw:i:1}
+            ;;
+          '$'|'`'|';'|'&'|'|'|'('|')'|'<'|'>'|'*'|'?'|'['|']'|'{'|'}'|'!'|'~') return 2 ;;
+          *) word+=$char ;;
+        esac
+        ;;
+    esac
+    i=$((i + 1))
+  done
+  [ -z "$quote" ] || return 2
+  RAW_LAUNCH_WORD=$word
+  RAW_LAUNCH_REST=${raw:i}
+}
+
+raw_launch_starts_codex() {
+  local raw=$1 word status state=prefix nested
+  while :; do
+    raw_launch_read_word "$raw"
+    status=$?
+    [ "$status" -eq 0 ] || return "$status"
+    word=$RAW_LAUNCH_WORD
+    raw=$RAW_LAUNCH_REST
+    case "$state" in
+      prefix)
+        case "$word" in
+          [A-Za-z_][A-Za-z0-9_]*=*) ;;
+          *)
+            if raw_launch_word_is "$word" env; then
+              state='env'
+            elif raw_launch_word_is "$word" command; then
+              state='command'
+            elif raw_launch_word_is "$word" exec; then
+              state='command'
+            elif raw_launch_word_is "$word" builtin; then
+              state='builtin'
+            elif raw_launch_word_is "$word" sh || raw_launch_word_is "$word" bash || raw_launch_word_is "$word" zsh || raw_launch_word_is "$word" dash || raw_launch_word_is "$word" ksh; then
+              state=shell
+            elif raw_launch_word_is "$word" nice; then
+              state='nice'
+            elif raw_launch_word_is "$word" timeout; then
+              state=timeout
+            elif raw_launch_word_is "$word" sudo; then
+              state=sudo
+            elif raw_launch_word_is_script_dispatcher "$word"; then
+              return 2
+            elif raw_launch_word_is_dynamic_dispatcher "$word"; then
+              return 2
+            elif raw_launch_word_is_indirect_dispatcher "$word"; then
+              return 2
+            elif raw_launch_word_is "$word" nohup || raw_launch_word_is "$word" time || raw_launch_word_is "$word" stdbuf || raw_launch_word_is "$word" setsid || raw_launch_word_is "$word" chrt || raw_launch_word_is "$word" ionice || raw_launch_word_is "$word" taskset || raw_launch_word_is "$word" script; then
+              state=wrapper
+            else
+              raw_launch_word_is_codex "$word"
+              return $?
+            fi
+            ;;
+        esac
+        ;;
+      env)
+        case "$word" in
+          [A-Za-z_][A-Za-z0-9_]*=*) ;;
+          -i|--ignore-environment|--null) ;;
+          -u|--unset|-C|--chdir)
+            raw_launch_read_word "$raw" || return 2
+            raw=$RAW_LAUNCH_REST
+            ;;
+          -S|--split-string)
+            raw_launch_read_word "$raw" || return 2
+            nested=$RAW_LAUNCH_WORD
+            if raw_launch_starts_codex "$nested"; then return 0; else return $?; fi
+            ;;
+          --unset=*|--chdir=*) ;;
+          --split-string=*)
+            nested=${word#*=}
+            if raw_launch_starts_codex "$nested"; then return 0; else return $?; fi
+            ;;
+          --) state=env-command ;;
+          -*) return 2 ;;
+          *)
+            if raw_launch_starts_codex "$word$raw"; then return 0; else return $?; fi
+            ;;
+        esac
+        ;;
+      command)
+        case "$word" in
+          --) state=command-command ;;
+          -*) ;;
+          *)
+            if raw_launch_starts_codex "$word$raw"; then return 0; else return $?; fi
+            ;;
+        esac
+        ;;
+      env-command|command-command)
+        if raw_launch_starts_codex "$word$raw"; then return 0; else return $?; fi
+        ;;
+      builtin)
+        case "$word" in
+          -p|--) ;;
+          eval|source|.) return 2 ;;
+          command|exec)
+            raw_launch_wrapped_command_status "$word$raw"
+            return $?
+            ;;
+          *) return 1 ;;
+        esac
+        ;;
+      nice)
+        case "$word" in
+          -n|--adjustment)
+            raw_launch_read_word "$raw" || return 2
+            raw=$RAW_LAUNCH_REST
+            ;;
+          --adjustment=*) ;;
+          --) state=prefix ;;
+          -*) ;;
+          *)
+            raw_launch_wrapped_command_status "$word$raw"
+            return $?
+            ;;
+        esac
+        ;;
+      timeout)
+        case "$word" in
+          -k|--kill-after|-s|--signal)
+            raw_launch_read_word "$raw" || return 2
+            raw=$RAW_LAUNCH_REST
+            ;;
+          --kill-after=*|--signal=*|-k*|-s*) ;;
+          --) state='timeout-duration' ;;
+          -*) ;;
+          *)
+            raw_launch_read_word "$raw" || return 2
+            raw_launch_wrapped_command_status "$RAW_LAUNCH_WORD$RAW_LAUNCH_REST"
+            return $?
+            ;;
+        esac
+        ;;
+      timeout-duration)
+        raw_launch_read_word "$raw" || return 2
+        raw_launch_wrapped_command_status "$RAW_LAUNCH_WORD$RAW_LAUNCH_REST"
+        return $?
+        ;;
+      sudo)
+        case "$word" in
+          -C|-D|-g|-h|-p|-r|-t|-T|-u|--close-from|--chdir|--group|--host|--prompt|--role|--type|--command-timeout|--user)
+            raw_launch_read_word "$raw" || return 2
+            raw=$RAW_LAUNCH_REST
+            ;;
+          --close-from=*|--chdir=*|--group=*|--host=*|--prompt=*|--role=*|--type=*|--command-timeout=*|--user=*) ;;
+          --) state=sudo-command ;;
+          -*)
+            raw_launch_mentions_codex "$word$raw"
+            status=$?
+            [ "$status" -ne 0 ] || return 2
+            return "$status"
+            ;;
+          *)
+            raw_launch_wrapped_command_status "$word$raw"
+            return $?
+            ;;
+        esac
+        ;;
+      sudo-command)
+        raw_launch_wrapped_command_status "$word$raw"
+        return $?
+        ;;
+      wrapper)
+        raw_launch_mentions_codex "$word$raw"
+        status=$?
+        [ "$status" -ne 0 ] || return 2
+        return "$status"
+        ;;
+      shell)
+        case "$word" in
+          -c)
+            raw_launch_read_word "$raw"
+            status=$?
+            [ "$status" -eq 0 ] || return 2
+            nested=$RAW_LAUNCH_WORD
+            raw_launch_is_simple "$nested" || return 2
+            raw_launch_starts_codex "$nested"
+            status=$?
+            [ "$status" -eq 1 ] || return 2
+            raw_launch_read_word "$nested" || return 2
+            case "$RAW_LAUNCH_WORD" in
+              ./*|../*|*.sh|*.bash|*.zsh|*.command) return 2 ;;
+            esac
+            return 1
+            ;;
+          *) return 2 ;;
+        esac
+        ;;
+    esac
+  done
+}
+
+raw_launch_is_simple() {
+  local raw=$1
+  case "$raw" in
+    *[\'\"\\\`\$\;\&\|\(\)\<\>\*\?\[\]\{\}\!\~$'\n'$'\r']*) return 1 ;;
+  esac
+}
+
+normalize_raw_codex_launch() {
+  raw_launch_is_simple "$1" || return 1
+  raw_launch_starts_codex "$1"
+}
+
+raw_codex_launch_is_normalizable() {
+  local raw=$1 seen_codex=0
+  while [ -n "$raw" ]; do
+    raw_launch_read_word "$raw" || return 1
+    raw=$RAW_LAUNCH_REST
+    if raw_launch_word_is_codex "$RAW_LAUNCH_WORD"; then
+      [ "$seen_codex" -eq 0 ] || return 1
+      seen_codex=1
+    elif [ "$seen_codex" -eq 0 ] && { raw_launch_word_is "$RAW_LAUNCH_WORD" env || raw_launch_word_is "$RAW_LAUNCH_WORD" command || raw_launch_word_is "$RAW_LAUNCH_WORD" exec; }; then
+      :
+    elif case "$RAW_LAUNCH_WORD" in CODEX_HOME=*) true ;; *) false ;; esac; then
+      :
+    else
+      return 1
+    fi
+  done
+  [ "$seen_codex" -eq 1 ]
+}
+
+refresh_codex_crewmate_home() {
+  local name
+  name=$(python3 "$FM_ROOT/bin/fm-codex-home.py" --data "$DATA" --new-home-name) || return 1
+  CODEX_CREWMATE_HOME="$DATA/codex-crewmate/$name"
+}
+
+wait_for_codex_home_activation() {
+  local home=$1 token=$2 deadline status read_status
+  deadline=$(( $(date +%s) + 10 ))
+  while [ "$(date +%s)" -le "$deadline" ]; do
+    set +e
+    status=$(python3 "$FM_ROOT/bin/fm-codex-home.py" --data "$DATA" --read-activation-result --home "$home" --result-token "$token" 2>&1)
+    read_status=$?
+    set -e
+    if [ "$read_status" -eq 0 ]; then
+      remove_codex_home_activation_result 2>/dev/null || true
+      [ "$status" = ready ] && return 0
+      echo "error: isolated Codex home activation failed" >&2
+      return 1
+    fi
+    if [ "$read_status" -ne 3 ]; then
+      remove_codex_home_activation_result 2>/dev/null || true
+      echo "error: isolated Codex home activation result is unsafe" >&2
+      return 1
+    fi
+    sleep 0.1
+  done
+  remove_codex_home_activation_result 2>/dev/null || true
+  echo "error: isolated Codex home activation did not report ready within 10s" >&2
+  return 1
+}
+
 case "$ARG3" in
   *' '*)  # raw launch command (unverified-adapter escape hatch)
-    LAUNCH=$ARG3
-    HARNESS=""
-    for word in $LAUNCH; do
-      case "$word" in [A-Za-z_]*=*) continue ;; *) HARNESS=$(basename "$word"); break ;; esac
-    done
+    set +e
+    raw_launch_starts_codex "$ARG3"
+    raw_codex_status=$?
+    if [ "$raw_codex_status" -eq 1 ]; then
+      raw_launch_has_codex_dispatch_argument "$ARG3"
+      raw_codex_mentions=$?
+      [ "$raw_codex_mentions" -ne 0 ] || raw_codex_status=2
+      if [ "$raw_codex_status" -eq 1 ] && raw_launch_has_dynamic_execution "$ARG3"; then
+        raw_codex_status=2
+      fi
+    fi
+    set -e
+    if [ "$KIND" != secondmate ] && [ "$raw_codex_status" -eq 2 ]; then
+      echo "error: unsafe raw launch command at executable position; use --harness codex for Codex" >&2
+      exit 1
+    fi
+    if [ "$KIND" != secondmate ] && [ "$raw_codex_status" -eq 0 ]; then
+      raw_launch_is_simple "$ARG3" || {
+        echo "error: unsafe raw launch command; quote, escape, and shell syntax are not supported - use --harness codex for Codex" >&2
+        exit 1
+      }
+      normalize_raw_codex_launch "$ARG3" || {
+        echo "error: unsafe raw Codex launch command; use --harness codex for Codex options" >&2
+        exit 1
+      }
+      raw_codex_launch_is_normalizable "$ARG3" || {
+        echo "error: raw Codex launch options are not supported; use --harness codex with --model/--effort" >&2
+        exit 1
+      }
+      HARNESS=codex
+      LAUNCH=$(launch_template "$HARNESS" "$KIND")
+    else
+      LAUNCH=$ARG3
+      HARNESS=""
+      for word in $LAUNCH; do
+        case "$word" in [A-Za-z_]*=*) continue ;; *) HARNESS=$(basename "$word"); break ;; esac
+      done
+    fi
     ;;
   '')
     # No explicit harness: resolve from config. A secondmate AGENT launches on the
@@ -641,10 +1180,22 @@ if [ "$KIND" = secondmate ]; then
 else
   PROJ_ABS="$(cd "$(resolve_project_dir_arg "$PROJ")" && pwd)"
   WT=""
+  WT_REAL=""
   BRIEF="$DATA/$ID/brief.md"
 fi
 [ -f "$BRIEF" ] || { echo "error: no brief at $BRIEF" >&2; exit 1; }
 
+CODEX_CREWMATE_PROFILE=
+if [ "$HARNESS" = codex ] && [ "$KIND" != secondmate ]; then
+  case "$ID" in
+    ''|*[!A-Za-z0-9_-]*)
+      echo "error: Codex crewmate task id must contain only letters, digits, hyphens, or underscores" >&2
+      exit 1
+      ;;
+  esac
+  CODEX_CREWMATE_PROFILE="fm-crewmate-$ID"
+fi
+
 # PROJ_ABS can still carry a symlinked path component (e.g. macOS's /tmp ->
 # /private/tmp) when it came from the ship/scout branch's logical `pwd` above.
 # Every backend's own current-path read (tmux's pane_current_path, herdr's
@@ -690,6 +1241,7 @@ validate_spawn_worktree() {  # <source> <inspect-target>
     echo "error: $source did not yield an isolated worktree (resolved '$WT'; worktree root '${wt_top:-none}'; primary '$PROJ_ABS'); refusing to launch to avoid tangling the primary checkout. Inspect target $inspect_target" >&2
     exit 1
   fi
+  WT_REAL=$wt_real
 }
 
 W="fm-$ID"
@@ -859,15 +1411,35 @@ if [ "$KIND" != secondmate ] && [ "$BACKEND" != orca ]; then
   fi
 
   validate_spawn_worktree "treehouse get" "$T"
+  TREEHOUSE_ABORT_CLEANUP=1
+fi
+
+if [ "$HARNESS" = codex ] && [ "$KIND" != secondmate ]; then
+  refresh_codex_crewmate_home || {
+    echo "error: could not prepare isolated Codex crewmate home" >&2
+    exit 1
+  }
+  if [ -f "$WT_REAL/.codex/config.toml" ]; then
+    echo "warning: Codex crewmate ignores project config $WT_REAL/.codex/config.toml to keep MCPs and plugins disabled" >&2
+  fi
 fi
 
-# Per-task temp root: /tmp/fm-<id>/ with Go's build temp nested at gotmp/. Go won't
+# Per-task temp root is atomically created with Go's build temp nested at gotmp/. Go won't
 # create GOTMPDIR, so mkdir before it is used; fm-teardown removes the whole root.
-# Nested (not a bare /tmp/fm-<id>/gotmp) so other per-task temp can live alongside
-# later, and teardown cleans one deterministic path. GOTMPDIR (not TMPDIR) is the
+# Nested (not a bare /tmp/fm-<id>.<random>/gotmp) so other per-task temp can live alongside
+# later, and teardown cleans the recorded path. GOTMPDIR (not TMPDIR) is the
 # targeted knob: TMPDIR is too broad (affects every program's temp, not just Go's).
-TASK_TMP="/tmp/fm-$ID"
-mkdir -p "$TASK_TMP/gotmp"
+TASK_TMP=$(mktemp -d "/tmp/fm-$ID.XXXXXXXX") || {
+  echo "error: could not create private task temporary directory" >&2
+  exit 1
+}
+mkdir "$TASK_TMP/gotmp" || exit 1
+if [ -n "$CODEX_CREWMATE_HOME" ]; then
+  CODEX_ACTIVATION_TOKEN=$(python3 "$FM_ROOT/bin/fm-codex-home.py" --new-result-token) || {
+    echo "error: could not create isolated Codex home activation token" >&2
+    exit 1
+  }
+fi
 
 # Per-harness turn-end hook: a file that touches state/<id>.turn-ended when the
 # agent finishes a turn. Worktree-resident hooks are kept out of git's view so
@@ -972,7 +1544,7 @@ EOF
   esac
 fi
 
-# Per-project delivery mode + yolo flag (bin/fm-project-mode.sh; AGENTS.md project management and task lifecycle).
+# Per-project delivery mode + yolo flag (bin/fm-project-mode.sh; the project-management skill and AGENTS.md task lifecycle).
 # Recorded in meta so fm-teardown's safety check and the validate/merge stages can
 # branch on them. Mode governs ship tasks; a scout's deliverable is a report, not a
 # merge, so scout teardown ignores mode.
@@ -999,6 +1571,7 @@ META_WINDOW=$T
   echo "mode=$MODE"
   echo "yolo=$YOLO"
   echo "tasktmp=$TASK_TMP"
+  [ -z "$CODEX_CREWMATE_HOME" ] || echo "codex_crewmate_home=$CODEX_CREWMATE_HOME"
   echo "model=${MODEL:-default}"
   echo "effort=${EFFORT:-default}"
   # backend= is written only for a non-default (non-tmux) backend, so the
@@ -1029,7 +1602,7 @@ META_WINDOW=$T
     echo "projects=$SECONDMATE_PROJECTS"
   fi
 } > "$STATE/$ID.meta"
-[ "$BACKEND" = orca ] && ORCA_ABORT_CLEANUP=0
+SPAWN_META_WRITTEN=1
 
 sq_brief=$(shell_quote "$BRIEF")
 sq_turnend=$(shell_quote "$TURNEND")
@@ -1045,6 +1618,17 @@ LAUNCH=${LAUNCH//__TURNEND__/$sq_turnend}
 LAUNCH=${LAUNCH//__PIEXT__/$sq_piext}
 LAUNCH=${LAUNCH//__PITURNEND__/$sq_piturnend}
 LAUNCH=${LAUNCH//__PIWATCH__/$sq_piwatch}
+if [ -n "$CODEX_CREWMATE_HOME" ]; then
+  sq_codex_crewmate_home=$(shell_quote "$CODEX_CREWMATE_HOME")
+  sq_codex_crewmate_profile=$(shell_quote "$CODEX_CREWMATE_PROFILE")
+  LAUNCH=${LAUNCH//__CODEXPROFILE__/$sq_codex_crewmate_profile}
+  sq_codex_home_helper=$(shell_quote "$FM_ROOT/bin/fm-codex-home.py")
+  sq_codex_data=$(shell_quote "$DATA")
+  sq_codex_source=$(shell_quote "${CODEX_HOME:-$HOME/.codex}")
+  sq_codex_worktree=$(shell_quote "$WT_REAL")
+  sq_codex_activation_token=$(shell_quote "$CODEX_ACTIVATION_TOKEN")
+  LAUNCH="exec python3 $sq_codex_home_helper --create-activate --data $sq_codex_data --source $sq_codex_source --profile $sq_codex_crewmate_profile --worktree $sq_codex_worktree --home $sq_codex_crewmate_home --result-token $sq_codex_activation_token -- $LAUNCH"
+fi
 if [ "$KIND" = secondmate ]; then
   sq_home=$(shell_quote "$PROJ_ABS")
   LAUNCH="FM_ROOT_OVERRIDE= FM_STATE_OVERRIDE= FM_DATA_OVERRIDE= FM_PROJECTS_OVERRIDE= FM_CONFIG_OVERRIDE= FM_HOME=$sq_home $LAUNCH"
@@ -1057,5 +1641,11 @@ sleep 0.3
 spawn_send_literal "$T" "$LAUNCH"
 sleep 0.3
 spawn_send_key "$T" Enter
+if [ -n "$CODEX_ACTIVATION_TOKEN" ]; then
+  wait_for_codex_home_activation "$CODEX_CREWMATE_HOME" "$CODEX_ACTIVATION_TOKEN" || exit 1
+  CODEX_ACTIVATION_TOKEN=
+fi
+TREEHOUSE_ABORT_CLEANUP=0
+[ "$BACKEND" = orca ] && ORCA_ABORT_CLEANUP=0
 
 echo "spawned $ID harness=$HARNESS kind=$KIND mode=$MODE yolo=$YOLO window=$META_WINDOW worktree=$WT"
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 83b66cc2a3a..c162e58ae46 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -27,7 +27,17 @@
 # for the common case where there is no remote at all.
 # Scout tasks (kind=scout in meta) carve out of that check: their worktree is
 # declared scratch and the report at data/<task-id>/report.md is the work
-# product - teardown proceeds once the report exists, and refuses without it.
+# product. Teardown proceeds only once the report exists and the shared
+# unresolved-decision completion gate verifies its captain-held inventory.
+# Before destructive cleanup, teardown validates task check artifacts and any
+# matching quarantine entries as ordinary single-link files on the state
+# device. It refuses and preserves task state when that proof fails; otherwise
+# it removes the task's check, trust record, PR sidecar, publication record, and
+# quarantine entries with the rest of the volatile state.
+# Codex ship and scout tasks record a firstmate-managed private home under
+# data/codex-crewmate in codex_crewmate_home= metadata.
+# Teardown removes that home only after endpoint cleanup succeeds.
+# When failed-spawn cleanup cannot confirm the endpoint absent, it preserves the metadata and private home for a later safe recovery attempt.
 # Orca tasks use the same safety checks, then close the recorded terminal and
 # remove the recorded worktree through `orca worktree rm`; teardown never guesses
 # an Orca target from ambient CLI state.
@@ -110,10 +120,13 @@ if [ "$BACKEND" = orca ]; then
 fi
 HOME_PATH=$(grep '^home=' "$META" | cut -d= -f2- || true)
 PR_URL=$(grep '^pr=' "$META" | tail -1 | cut -d= -f2- || true)
-# tasktmp is recorded by fm-spawn for tasks that set up a per-task temp root
-# (/tmp/fm-<id>/); absent for tasks spawned before that change, so tolerate empty.
+# tasktmp is recorded by fm-spawn for tasks that set up a per-task temp root;
+# absent for tasks spawned before that change, so tolerate empty.
 TASK_TMP=$(grep '^tasktmp=' "$META" | cut -d= -f2- || true)
+CODEX_CREWMATE_HOME=$(grep '^codex_crewmate_home=' "$META" | cut -d= -f2- || true)
+ENDPOINT_CLEANUP_PENDING=$(grep '^endpoint_cleanup_pending=' "$META" | tail -1 | cut -d= -f2- || true)
 ORCA_WORKTREE_ID=$(fm_meta_get "$META" orca_worktree_id)
+ORCA_WORKTREE_CLEANUP_COMPLETE=$(fm_meta_get "$META" orca_worktree_cleanup_complete)
 ORCA_PATH_MATCH_VERIFIED=0
 
 KIND=$(grep '^kind=' "$META" | cut -d= -f2- || true)
@@ -163,7 +176,9 @@ require_orca_terminal() {
 }
 
 if [ "$BACKEND" = orca ] && [ "$KIND" != secondmate ]; then
-  ORCA_WORKTREE_ID=$(require_orca_worktree_id "$META") || exit 1
+  if [ "$ORCA_WORKTREE_CLEANUP_COMPLETE" != 1 ]; then
+    ORCA_WORKTREE_ID=$(require_orca_worktree_id "$META") || exit 1
+  fi
   T_ORCA=$(meta_value "$META" terminal)
   [ -z "$T_ORCA" ] || T=$T_ORCA
 fi
@@ -777,6 +792,62 @@ safe_rm_rf_child_worktree() {
   rm -rf -- "$target"
 }
 
+validate_task_temp_for_removal() {
+  local target=$1 prefix suffix
+  [ -n "$target" ] || return 0
+  prefix="/tmp/fm-$ID."
+  case "$target" in
+    "$prefix"*) suffix=${target#"$prefix"} ;;
+    *)
+      echo "REFUSED: unsafe task temporary directory $target does not match task $ID" >&2
+      return 1
+      ;;
+  esac
+  case "$suffix" in
+    ''|*[![:alnum:]]*)
+      echo "REFUSED: unsafe task temporary directory $target does not match task $ID" >&2
+      return 1
+      ;;
+  esac
+  [ ! -e "$target" ] && [ ! -L "$target" ] && return 0
+  if [ ! -d "$target" ] || [ -L "$target" ]; then
+    echo "REFUSED: unsafe task temporary directory $target is not a private directory" >&2
+    return 1
+  fi
+}
+
+remove_codex_crewmate_home() {
+  local home=$1
+  [ -n "$home" ] || return 0
+  python3 "$FM_ROOT/bin/fm-codex-home.py" --remove --data "$DATA" --home "$home"
+}
+
+close_recorded_endpoint() {
+  local tab_id absence_status
+  tab_id=$(meta_value "$META" zellij_tab_id)
+  if [ "$ENDPOINT_CLEANUP_PENDING" = 1 ]; then
+    if ! FM_BACKEND_KILL_STRICT=1 fm_backend_kill "$BACKEND" "$T" "$tab_id" "fm-$ID" 2>/dev/null; then
+      echo "error: failed-spawn endpoint $T could not be confirmed closed; preserving recovery metadata" >&2
+      return 1
+    fi
+    if fm_backend_target_absent "$BACKEND" "$T" "fm-$ID"; then
+      absence_status=0
+    else
+      absence_status=$?
+    fi
+    if [ "$absence_status" -ne 0 ]; then
+      if [ "$absence_status" -eq 1 ]; then
+        echo "error: failed-spawn endpoint $T remains live after cleanup; preserving recovery metadata" >&2
+      else
+        echo "error: failed-spawn endpoint $T could not be confirmed absent after cleanup; preserving recovery metadata" >&2
+      fi
+      return 1
+    fi
+  else
+    fm_backend_kill "$BACKEND" "$T" "$tab_id" "fm-$ID" 2>/dev/null || true
+  fi
+}
+
 validate_firstmate_home_for_removal() {
   local home=$1 label=$2 expected_id=${3:-} abs_home_path marker_id conflict child_id child_home
   [ -n "$home" ] || return 0
@@ -941,6 +1012,8 @@ if [ "$KIND" = secondmate ]; then
   fi
 fi
 
+validate_task_temp_for_removal "$TASK_TMP" || exit 1
+
 if [ "$KIND" = secondmate ] && [ "$FORCE" != "--force" ]; then
   SUB_STATE="$HOME_PATH/state"
   if [ -d "$SUB_STATE" ]; then
@@ -966,7 +1039,7 @@ if [ "$KIND" = scout ] && [ "$FORCE" != "--force" ]; then
   fi
 fi
 
-if [ "$BACKEND" = orca ] && [ "$KIND" != scout ] && [ "$KIND" != secondmate ] && [ "$FORCE" != "--force" ]; then
+if [ "$BACKEND" = orca ] && [ -n "$ORCA_WORKTREE_ID" ] && [ "$KIND" != scout ] && [ "$KIND" != secondmate ] && [ "$FORCE" != "--force" ]; then
   if ! inspectable_git_worktree "$WT"; then
     echo "REFUSED: Orca ship task $ID has no inspectable git worktree at ${WT:-<missing>}." >&2
     echo "Cannot verify dirty or unlanded work; restore the worktree path or get explicit OK to discard, then --force." >&2
@@ -992,11 +1065,11 @@ fi
 
 # Best-effort: drop the local task branch so the shared repo does not accumulate refs.
 if [ "$BACKEND" = orca ] && [ "$KIND" != secondmate ]; then
-  if [ "$ORCA_PATH_MATCH_VERIFIED" != 1 ]; then
+  if [ -n "$ORCA_WORKTREE_ID" ] && [ "$ORCA_PATH_MATCH_VERIFIED" != 1 ]; then
     require_orca_worktree_path_match_if_present "$ORCA_WORKTREE_ID" "$WT" || exit 1
     ORCA_PATH_MATCH_VERIFIED=1
   fi
-  if [ -d "$WT" ]; then
+  if [ -n "$ORCA_WORKTREE_ID" ] && [ -d "$WT" ]; then
     branch=$(git -C "$WT" rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)
     if [ "$branch" != "HEAD" ]; then
       if git -C "$WT" checkout --detach -q 2>/dev/null; then
@@ -1005,8 +1078,8 @@ if [ "$BACKEND" = orca ] && [ "$KIND" != secondmate ]; then
     fi
     rm -f "$WT/.claude/settings.local.json" "$WT/.opencode/plugins/fm-turn-end.js" "$WT/.fm-grok-turnend"
   fi
-  [ -z "$T_ORCA" ] || fm_backend_kill "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID" 2>/dev/null || true
-  fm_backend_remove_worktree "$BACKEND" "$ORCA_WORKTREE_ID"
+  [ -z "$T_ORCA" ] || close_recorded_endpoint || exit 1
+  [ -z "$ORCA_WORKTREE_ID" ] || fm_backend_remove_worktree "$BACKEND" "$ORCA_WORKTREE_ID"
 elif [ -d "$WT" ] && [ "$KIND" != secondmate ]; then
   branch=$(git -C "$WT" rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)
   if [ "$branch" != "HEAD" ]; then
@@ -1031,8 +1104,9 @@ elif [ -d "$WT" ] && [ "$KIND" != secondmate ]; then
 fi
 
 if [ "$BACKEND" != orca ]; then
-  fm_backend_kill "$BACKEND" "$T" "$(meta_value "$META" zellij_tab_id)" "fm-$ID" 2>/dev/null || true
+  close_recorded_endpoint || exit 1
 fi
+remove_codex_crewmate_home "$CODEX_CREWMATE_HOME" || exit 1
 if [ "$KIND" = secondmate ]; then
   [ -n "$HOME_PATH" ] || HOME_PATH=$WT
   remove_firstmate_home "$HOME_PATH" "secondmate home" "$ID"
@@ -1040,9 +1114,9 @@ if [ "$KIND" = secondmate ]; then
 fi
 remove_grok_turnend_auth "$STATE" "$ID"
 fm_backend_clear_transition "$BACKEND" "$STATE" "$T" || true
-# Remove the per-task temp root (/tmp/fm-<id>/, incl. its gotmp/) recorded by spawn.
+# Remove the per-task temp root, including its gotmp/, recorded by spawn.
 # Read before the state-file rm below; empty (pre-fix tasks without tasktmp=) is a no-op.
-[ -n "$TASK_TMP" ] && rm -rf "$TASK_TMP"
+[ -z "$TASK_TMP" ] || rm -rf -- "$TASK_TMP"
 rm -f "$STATE/$ID.status" "$STATE/$ID.turn-ended" "$STATE/$ID.check.sh" "$STATE/$ID.meta" "$STATE/$ID.pi-ext.ts" "$STATE/$ID.grok-turnend-token"
 if [ "$KIND" != scout ] && [ "$KIND" != secondmate ] && [ "$MODE" != local-only ]; then
   "$FM_ROOT/bin/fm-fleet-sync.sh" "$PROJ" || true
diff --git a/docs/architecture.md b/docs/architecture.md
index 81ac184d6ed..49ee7882462 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -62,6 +62,8 @@ Stalled escalation delivery writes `state/.subsuper-inject-wedged` and attempts
 The runtime backend is the session-provider layer below firstmate's scripts.
 It owns task endpoint creation, bounded capture, text/key sends, current-path reads for spawn-time worktree discovery when the backend does not create the worktree itself, live-window fallback lookup, agent-process liveness probes where verified, and endpoint teardown.
 `bin/fm-backend.sh` centralizes backend selection, `state/<id>.meta` helpers, selector resolution, and operation dispatch; `bin/backends/tmux.sh` is the verified reference adapter ([`docs/tmux-backend.md`](tmux-backend.md)), and `bin/backends/herdr.sh` (P2), `bin/backends/zellij.sh` (P3), `bin/backends/orca.sh` (P4), and `bin/backends/cmux.sh` (P5) are experimental task-spawn adapters.
+Routine endpoint teardown is best-effort, but cleanup following a failed allocation is strict: firstmate must confirm the recorded endpoint is absent before discarding recovery metadata or task-private credentials.
+When that proof is unavailable, `fm-teardown.sh` preserves the task's metadata and resources for a later recovery instead of assuming cleanup succeeded.
 New spawns select a backend from `--backend`, then `FM_BACKEND`, then local `config/backend`, then runtime auto-detection from `$TMUX`, `HERDR_ENV=1`, or cmux runtime signals, then default `tmux`.
 Runtime auto-detection is innermost-first: `$TMUX` wins over `HERDR_ENV=1`, which wins over cmux's primary `CMUX_WORKSPACE_ID` marker and documented fallback signals; auto-detected herdr or cmux prints a one-time opt-out notice, auto-detected tmux stays silent, and zellij and orca are never auto-detected (only explicit selection).
 Unknown backend names fail loudly.
@@ -83,6 +85,10 @@ Codex App support is recorded in `docs/codex-app-backend.md`; it is not selectab
 
 Crewmates never intentionally touch your project clone; [treehouse](https://github.com/kunchenguid/treehouse) pools clean worktrees for tmux, herdr, zellij, and cmux tasks, while Orca creates its own worktrees for `backend=orca`.
 For ship and scout work, `fm-spawn.sh` refuses to launch unless the resolved task path is a real git worktree root that is distinct from the project primary checkout.
+Codex ship and scout workers additionally run with a firstmate-managed, task-private `CODEX_HOME` under `data/codex-crewmate/`.
+That home copies only the captain's Codex authentication and model catalog, disables plugins, carries no MCP configuration, and excludes the project-local Codex configuration.
+It is recorded as `codex_crewmate_home=` in task metadata and removed only after endpoint cleanup succeeds; the full configuration contract is in [configuration.md](configuration.md#harness-support).
+Codex secondmate launches are intentionally outside this isolation rule and retain their existing home behavior.
 
 The firstmate repo has one extra exposure because it can dispatch crewmates to work on itself.
 Its operating checkout (`FM_ROOT`) and the disposable crewmate worktrees are all linked git worktrees of the same repository, so the valid discriminator is branch state, not whether the checkout is linked.
diff --git a/docs/cmux-backend.md b/docs/cmux-backend.md
index 5859e7f2d34..ab94184e95f 100644
--- a/docs/cmux-backend.md
+++ b/docs/cmux-backend.md
@@ -180,7 +180,7 @@ No session field is needed - unlike herdr/zellij there is no session layer to re
 | Bounded capture | `cmux read-screen --workspace <id> --surface <id> --scrollback --lines <N> --json`, trimmed locally with `tail` | No herdr-style small-N empty-result bug: N=1..10 all verified to return correctly-clamped, non-empty content on an already-interacted-with surface. A single call is still bounded by the surface's actual current viewport height regardless of the requested `--lines` value (verified: capped at 16 rows in a headless/no-attached-window test run), so "fetch generous, trim locally" is kept for consistency even though the specific herdr bug does not reproduce. |
 | Worktree-path discovery | marked active cwd probe + capture-scrape (`fm_backend_cmux_current_path`), NOT `current_directory` | `current_directory` DOES reflect a `cd` run directly in the surface's own top-level shell, but stays FROZEN at wherever that shell was when it launched a foreground subshell (exactly what `treehouse get` does) - zellij-shape, not herdr-shape. See "Worktree-path discovery: current_directory does not track a subshell" below. |
 | Busy state | *(no native primitive)* | cmux has agent-awareness elsewhere (Claude Code hooks integration, session-resume tokens) but exposes nothing over the socket API for generic busy/idle classification; `surface.health`/`surface-health` is render health, not agent status. `fm_backend_busy_state`'s dispatcher (`bin/fm-backend.sh`) falls through to `unknown` for cmux via its wildcard case, exactly like tmux/zellij/Orca - the watcher's existing pane-hash + regex path is the only busy-state source for this backend. |
-| Kill | `cmux close-workspace --workspace <id>`, preceded by a throwaway `new-workspace --window <win> --focus false --id-format uuids` when the target is the only workspace in its window | See "Closing the last workspace in a window" below. The backend owns the whole task workspace; kill closes it best-effort (`\|\| true`), but cmux silently refuses to close the LAST workspace in a window, so kill first detects that case (`fm_backend_cmux_window_of_workspace`) and adds a throwaway sibling before closing, matching every other backend's `kill` contract. |
+| Kill | `cmux close-workspace --workspace <id>`, preceded by a throwaway `new-workspace --window <win> --focus false --id-format uuids` when the target is the only workspace in its window | Routine kill is best-effort, but it first adds a throwaway sibling when cmux would refuse to close a last workspace; failed-allocation recovery requests a strict close and retains metadata until target absence is confirmed as defined in [architecture.md](architecture.md#runtime-session-backends). |
 | Recovery / list-live | `cmux workspace list --json --id-format uuids`, filter titles starting with this home's `fm-<home-label>-`, then `list-panes` per match for the surface id | Title-based, never trusts a stored workspace uuid blindly - ids do NOT survive an app relaunch (see "Workspace ids do not survive a relaunch" below), so this is the only safe recovery posture. The adapter prints the plain `fm-<id>` label back to callers after stripping the readable home tag and `FM_ROOT` hash. |
 
 ## Socket control modes: the full matrix (default `cmuxOnly` rejects external CLIs)
diff --git a/docs/configuration.md b/docs/configuration.md
index d4da2abb06a..d0d76ff7c93 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -160,6 +160,12 @@ The primary propagates `config/crew-dispatch.json`, `config/crew-harness`, and `
 `config/secondmate-harness` is not inherited because secondmates do not launch secondmates.
 For grok, `fm-spawn.sh` installs one firstmate-owned global turn-end hook under `$GROK_HOME/hooks/`, or `~/.grok/hooks/` when `GROK_HOME` is unset, and drops a per-task `.fm-grok-turnend` pointer in the worktree, with teardown removing the task token and pointer.
 For Pi secondmate launches, `fm-spawn.sh` starts Pi with `-e` pointed at the secondmate home's own tracked `.pi/extensions/fm-primary-pi-watch.ts` and `.pi/extensions/fm-primary-turnend-guard.ts`, both already present from the secondmate home's git worktree.
+For Codex ship and scout launches, `fm-spawn.sh` creates one private task home under `data/codex-crewmate/` and runs the process with that directory as `CODEX_HOME`.
+The helper copies only `auth.json` and `models_cache.json` from the captain's current `CODEX_HOME`, or `~/.codex` when it is unset, then writes an isolated configuration that disables plugins, contains no MCP configuration, and keeps the task worktree untrusted.
+Project-local `.codex/config.toml` is deliberately excluded from those launches, so it cannot re-enable MCP servers or plugins.
+The captain's Codex home is never modified, and Codex secondmate launches intentionally keep their existing home behavior.
+The task metadata records `codex_crewmate_home=`, and normal teardown removes that managed home after endpoint cleanup succeeds.
+If a spawn or teardown cannot confirm endpoint cleanup, firstmate preserves the metadata and managed home for a later safe recovery attempt.
 
 ## Crew dispatch profiles (config/crew-dispatch.json)
 
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 0a0c15f7691..877a9352720 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -187,7 +187,7 @@ Herdr tasks additionally record:
 | Bounded capture | `herdr pane read <pane> --source recent --lines N` | See "Verified bug" below - N is never passed through directly. |
 | ANSI capture | `herdr pane read <pane> --source recent --lines N --format ansi` | Herdr 0.7.3 preserves composer de-emphasis styling, letting the shared `fm_composer_strip_ghost` extractor treat dim/faint and dark-TRUECOLOR ghost/placeholder text as empty while retaining real typed input. The same small-`--lines` workaround applies. |
 | Busy state | `herdr agent get <pane>` -> `.result.agent.agent_status` | Verified live against an interactive `claude` session: reports `working` while generating, `done` once idle. Mapped: `working` -> busy; `idle`/`done` -> idle; `blocked` -> idle (surfaced like a stale pane, not suppressed as busy - a blocked agent is stuck waiting on the human, not grinding); anything else -> unknown (the cue for the shared tail-regex fallback). |
-| Kill | `herdr pane close <pane>` | Closing a tab's only (root) pane also closes the tab - no separate tab-close call needed for this adapter's one-pane-per-tab shape. Best-effort: closing an already-closed pane exits non-zero, matching tmux's `kill-window \|\| true` contract. Teardown itself only ever closes the task's own pane/tab, never the workspace - but closing a workspace's LAST tab (verified real-herdr behavior) deletes the workspace as a side effect, so a home's own workspace persists only while at least one task tab remains; see "Workspace lifecycle" above. |
+| Kill | `herdr pane close <pane>` | Closing a tab's only (root) pane also closes the tab, so no separate tab-close call is needed for this adapter's one-pane-per-tab shape; routine calls are best-effort, while failed-allocation recovery requests a strict close and retains metadata until target absence is confirmed as defined in [architecture.md](architecture.md#runtime-session-backends). |
 | Default-tab prune (create_task, first task in a fresh workspace only) | `herdr workspace create`'s own response (`.result.tab.tab_id`) identifies the seeded tab; `herdr tab list` + `herdr agent get <pane>` re-verify it; `herdr pane close <pane>` closes exactly that tab id | `herdr workspace create` seeds the new workspace with one auto-created default tab (label `1`, id captured straight from the create response) firstmate never uses. `fm_backend_herdr_create_task` closes EXACTLY that captured tab id right after creating the first real task tab in a freshly created workspace - never right after `workspace create` itself (see Kill row), and never re-derived from a tab's label or the workspace's tab count at create_task time (see "Default-tab prune" above for the created-vs-adopted safety gate and the 2026-07-02 incident it fixes). Best-effort; an ADOPTED workspace (not freshly created by this same call) is never a prune candidate at all. |
 | Recovery / list-live | `herdr tab list --workspace <id>`, filter labels starting with `fm-` | Label-based, never trusts a stored id blindly - see "ID stability" below. `<id>` is always THIS home's own workspace (`fm_backend_herdr_workspace_find`), so recovery never sees a sibling home's tabs. |
 | Workspace create / tab create (focus) | `herdr workspace create --no-focus`, `herdr tab create --no-focus` | Verified: neither focuses by default once a workspace already exists in the session, matching pre-P3 (flagless) behavior; `--no-focus` is passed anyway for defense in depth, since the very first workspace ever created in a brand-new session focuses regardless of the flag. `--focus` was separately verified to reliably focus, confirming the flag has real effect. |
diff --git a/docs/scripts.md b/docs/scripts.md
index a7d3030f90d..3533442e438 100644
--- a/docs/scripts.md
+++ b/docs/scripts.md
@@ -26,6 +26,7 @@ The shared no-mistakes gate refusal used by `fm-spawn.sh`, `fm-send.sh`, and `fm
 | `fm-supervision-instructions.sh` | Render the session-start primary-harness supervision block or the one-line repair instruction |
 | `fm-home-seed.sh`        | Transactionally provision a secondmate home and maintain `data/secondmates.md`       |
 | `fm-spawn.sh`            | Spawn crewmates, scouts, `id=repo` batches, and secondmates on the resolved harness and runtime backend |
+| `fm-codex-home.py`       | Create, activate, validate, and remove task-private no-MCP Codex crew homes |
 | `fm-dispatch-select.sh`  | Resolve a matched crew-dispatch rule to one concrete profile, owning `quota-balanced` selection |
 | `fm-backend.sh`          | Runtime-backend selection, meta helpers, selector resolution, and operation dispatch |
 | `fm-backend-hometag-lib.sh` | Shared per-installation home-tag derivation for zellij tab and cmux workspace titles |
diff --git a/docs/zellij-backend.md b/docs/zellij-backend.md
index c83daecab3b..eabd407c257 100644
--- a/docs/zellij-backend.md
+++ b/docs/zellij-backend.md
@@ -104,7 +104,7 @@ Zellij tasks additionally record:
 | Bounded capture | `zellij action dump-screen --pane-id <id>` for 40 lines or fewer; `zellij action dump-screen --pane-id <id> --full` above that threshold | Works for a background session with NO attached client (resolves report gap #1). No `--lines`-style bound flag exists at all (unlike herdr's buggy small-N `--lines`, there is simply no flag). Routine watcher-sized reads use zellij's viewport-only dump to avoid unbounded scrollback reads; larger explicit peeks request `--full` and trim to the caller's requested line count locally with `tail`. The tradeoff: on a very short terminal viewport, a 40-line routine read can see fewer than 40 lines and miss content above the visible screen. |
 | Busy state | *(no native primitive)* | D5 (`herdr-addendum.md`): zellij has no agent-state API. `fm_backend_busy_state`'s dispatcher (`bin/fm-backend.sh`) falls through to `unknown` for zellij via its wildcard case, exactly like tmux - the watcher's existing pane-hash + regex path is the only busy-state source for this backend. |
 | Agent liveness | *(no verified primitive)* | `fm_backend_agent_alive` reports `unknown` for zellij, so `bin/fm-bootstrap.sh`'s session-start secondmate liveness sweep never auto-respawns a zellij secondmate endpoint, conservatively avoiding a false-dead reading that would create a duplicate secondmate supervisor in one home. |
-| Kill | `zellij action close-tab-by-id <id>` (tab id resolved fresh from the pane id when possible; teardown can pass recorded `zellij_tab_id` plus the expected caller-facing `fm-<id>` label when the pane is already gone) | Unlike herdr (where closing a tab's only pane also closes the tab), closing a zellij pane with `close-pane` does NOT close the now-empty tab - it survives as an empty "ghost" entry in `list-tabs`. `close-tab-by-id` on a LIVE tab (with its pane still running) verified to cleanly remove both pane and tab in one call. Kill resolves the owning tab and closes by tab id; if teardown supplies an expected label, the tab id must still match it through the home-scoped-title or unambiguous legacy-title check before it is closed, including the recorded `zellij_tab_id` ghost-tab fallback. Best-effort (`\|\| true`), matching tmux's `kill-window` and herdr's `pane close` contract. |
+| Kill | `zellij action close-tab-by-id <id>` (tab id resolved fresh from the pane id when possible; teardown can pass recorded `zellij_tab_id` plus the expected caller-facing `fm-<id>` label when the pane is already gone) | Kill resolves the owning tab and checks an expected label through the home-scoped title or unambiguous legacy-title match before closing it, including the recorded ghost-tab fallback; routine calls are best-effort, while failed-allocation recovery requests a strict close and retains metadata until target absence is confirmed as defined in [architecture.md](architecture.md#runtime-session-backends). |
 | Recovery / list-live | `zellij action list-tabs --json`, filter names starting with this home's own `fm-<home-label>-` prefix | Name-based, never trusts a stored pane id blindly - the same posture herdr's `list_live` takes. Scoped to this installation's own home-scoped prefix (see "Home-scoped tab titles" above), so it never lists another firstmate home's tabs; the adapter strips the tag back off and reports the plain `fm-<id>` label. Does not attempt the legacy untagged-title fallback (that fallback is for a single already-known tab, not a bulk sweep). |
 | Session cleanup (test-only) | `zellij delete-session <name> --force` | The single-call kill-and-delete form, gated behind `tests/zellij-test-safety.sh`'s guard (refuses an empty name, the literal `"firstmate"` default name, or a name not currently listed). Never `kill-all-sessions`/`delete-all-sessions` - see "Session safety" below. |
 
diff --git a/tests/fm-backend-cmux.test.sh b/tests/fm-backend-cmux.test.sh
index 79c16b13abc..9f544533b8e 100755
--- a/tests/fm-backend-cmux.test.sh
+++ b/tests/fm-backend-cmux.test.sh
@@ -541,6 +541,27 @@ test_target_ready_rejects_label_mismatch() {
   pass "fm_backend_cmux_target_ready: rejects a workspace id reused under a different title"
 }
 
+test_dispatch_target_absent_requires_confirmed_workspace_list() {
+  local dir fb out title target
+  target="aaaaaaaa-0000-0000-0000-000000000000:bbbbbbbb-1111-1111-1111-111111111111"
+  title=$(cmux_expected_scoped_title fm-label)
+
+  dir="$TMP_ROOT/target-absent-confirmed"; mkdir -p "$dir/responses"
+  cmux_workspace_list_response "$dir" 1
+  fb=$(make_cmux_fakebin "$dir")
+  out=$( PATH="$fb:$PATH" FM_CMUX_LOG="$dir/log" FM_CMUX_RESPONSES="$dir/responses" \
+    bash -c '. "$0/bin/fm-backend.sh"; fm_backend_target_absent cmux "$1" fm-label; printf "%s" "$?"' "$ROOT" "$target" )
+  [ "$out" = 0 ] || fail "target absence should be confirmed only when the workspace list succeeds and contains neither target nor label, got $out"
+
+  dir="$TMP_ROOT/target-absent-unqueryable"; mkdir -p "$dir/responses"
+  printf '1\n' > "$dir/responses/1.exit"
+  fb=$(make_cmux_fakebin "$dir")
+  out=$( PATH="$fb:$PATH" FM_CMUX_LOG="$dir/log" FM_CMUX_RESPONSES="$dir/responses" \
+    bash -c '. "$0/bin/fm-backend.sh"; fm_backend_target_absent cmux "$1" fm-label; printf "%s" "$?"' "$ROOT" "$target" )
+  [ "$out" = 2 ] || fail "an unqueryable workspace list must not be treated as absent, got $out"
+  pass "fm_backend_target_absent: cmux requires a readable workspace list"
+}
+
 test_capture_trims_locally() {
   local dir fb out
   dir="$TMP_ROOT/capture"; mkdir -p "$dir/responses"
@@ -941,6 +962,36 @@ test_kill_is_best_effort_when_close_workspace_fails() {
   pass "fm_backend_cmux_kill: never fails even when close-workspace fails"
 }
 
+test_kill_is_strict_when_target_readiness_is_unqueryable() {
+  local dir fb status
+  dir="$TMP_ROOT/kill-strict-unqueryable"; mkdir -p "$dir/responses"
+  cmux_panes_empty_response "$dir" 1
+  fb=$(make_cmux_fakebin "$dir")
+  PATH="$fb:$PATH" FM_CMUX_LOG="$dir/log" FM_CMUX_RESPONSES="$dir/responses" \
+    FM_BACKEND_KILL_STRICT=1 \
+    bash -c '. "$0/bin/backends/cmux.sh"; fm_backend_cmux_kill "aaaaaaaa-0000-0000-0000-000000000000:bbbbbbbb-1111-1111-1111-111111111111"' "$ROOT"
+  status=$?
+  [ "$status" -ne 0 ] || fail "strict kill must fail when the cmux target cannot be queried"
+  assert_not_contains "$(cat "$dir/log")" $'\x1f''close-workspace' \
+    "strict kill must not claim to close an unqueryable cmux target"
+  pass "fm_backend_cmux_kill: strict cleanup propagates readiness failures"
+}
+
+test_kill_is_noop_when_reused_workspace_label_mismatches() {
+  local dir fb status title
+  dir="$TMP_ROOT/kill-reused-label"; mkdir -p "$dir/responses"
+  title=$(cmux_expected_scoped_title fm-other)
+  cmux_workspace_list_response "$dir" 1 "aaaaaaaa-0000-0000-0000-000000000000" "$title"
+  fb=$(make_cmux_fakebin "$dir")
+  PATH="$fb:$PATH" FM_CMUX_LOG="$dir/log" FM_CMUX_RESPONSES="$dir/responses" \
+    bash -c '. "$0/bin/backends/cmux.sh"; fm_backend_cmux_kill "aaaaaaaa-0000-0000-0000-000000000000:bbbbbbbb-1111-1111-1111-111111111111" "" "fm-label"' "$ROOT"
+  status=$?
+  expect_code 0 "$status" "non-strict kill should no-op when the workspace label no longer matches"
+  assert_not_contains "$(cat "$dir/log")" $'\x1f''close-workspace' \
+    "non-strict kill must not close a workspace whose id was reused under another label"
+  pass "fm_backend_cmux_kill: non-strict cleanup no-ops on a reused workspace label mismatch"
+}
+
 test_kill_recovers_stale_target_by_label() {
   local dir fb title
   dir="$TMP_ROOT/kill-stale-target"; mkdir -p "$dir/responses"
@@ -1036,6 +1087,7 @@ test_create_task_creates_and_parses_ids
 test_target_ready_fails_when_target_absent
 test_target_ready_checks_expected_label
 test_target_ready_rejects_label_mismatch
+test_dispatch_target_absent_requires_confirmed_workspace_list
 test_capture_trims_locally
 test_capture_fails_when_read_screen_fails_empty
 test_capture_fails_when_target_not_ready
@@ -1058,6 +1110,8 @@ test_window_of_workspace_empty_when_not_found
 test_kill_closes_workspace_directly_when_not_last
 test_kill_adds_sibling_when_last_in_window
 test_kill_is_best_effort_when_close_workspace_fails
+test_kill_is_strict_when_target_readiness_is_unqueryable
+test_kill_is_noop_when_reused_workspace_label_mismatches
 test_kill_recovers_stale_target_by_label
 test_list_live_filters_by_title_prefix
 test_secondmate_spawn_refuses_cmux_backend
diff --git a/tests/fm-backend-herdr.test.sh b/tests/fm-backend-herdr.test.sh
index eab75fd382a..678607655a3 100755
--- a/tests/fm-backend-herdr.test.sh
+++ b/tests/fm-backend-herdr.test.sh
@@ -752,6 +752,32 @@ test_kill_is_best_effort() {
   pass "fm_backend_herdr_kill: calls pane close and stays best-effort on failure"
 }
 
+test_kill_is_noop_when_target_is_malformed() {
+  local dir log resp fb
+  dir="$TMP_ROOT/kill-malformed-target"; mkdir -p "$dir/responses"; log="$dir/log"; resp="$dir/responses"; : > "$log"
+  fb=$(make_herdr_fakebin "$dir")
+  PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" \
+    bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_kill malformed-target' "$ROOT"
+  expect_code 0 $? "non-strict kill must no-op when the Herdr target cannot be parsed"
+  assert_not_contains "$(cat "$log")" $'\x1f''pane'$'\x1f''close' \
+    "non-strict kill must not close a malformed Herdr target"
+  pass "fm_backend_herdr_kill: non-strict cleanup skips malformed targets"
+}
+
+test_kill_is_strict_when_target_readiness_is_unqueryable() {
+  local dir log resp fb status
+  dir="$TMP_ROOT/kill-strict-unqueryable"; mkdir -p "$dir/responses"; log="$dir/log"; resp="$dir/responses"; : > "$log"
+  printf '1\n' > "$resp/1.exit"
+  fb=$(make_herdr_fakebin "$dir")
+  PATH="$fb:$PATH" FM_HERDR_LOG="$log" FM_HERDR_RESPONSES="$resp" FM_HERDR_SCRIPT_STATUS=1 \
+    FM_BACKEND_KILL_STRICT=1 bash -c '. "$0/bin/backends/herdr.sh"; fm_backend_herdr_kill default:w1:p2' "$ROOT"
+  status=$?
+  [ "$status" -ne 0 ] || fail "strict kill must fail when Herdr target readiness cannot be queried"
+  assert_not_contains "$(cat "$log")" $'\x1f''pane'$'\x1f''close' \
+    "strict kill must not claim to close an unqueryable Herdr target"
+  pass "fm_backend_herdr_kill: strict cleanup propagates readiness failures"
+}
+
 test_current_path_reads_cwd() {
   local dir log resp fb out
   dir="$TMP_ROOT/cwd"; mkdir -p "$dir/responses"; log="$dir/log"; resp="$dir/responses"; : > "$log"
@@ -2010,6 +2036,8 @@ test_capture_works_around_small_lines_bug
 test_capture_preserves_pane_read_failure
 test_send_key_normalizes_and_targets_pane
 test_kill_is_best_effort
+test_kill_is_noop_when_target_is_malformed
+test_kill_is_strict_when_target_readiness_is_unqueryable
 test_current_path_reads_cwd
 test_busy_state_working_maps_to_busy
 test_busy_state_done_and_blocked_map_to_idle
diff --git a/tests/fm-backend-orca.test.sh b/tests/fm-backend-orca.test.sh
index 38fd4a9c51a..9fce069f32d 100755
--- a/tests/fm-backend-orca.test.sh
+++ b/tests/fm-backend-orca.test.sh
@@ -56,6 +56,7 @@ neutral_fm_root() {  # <dir> -> echoes a minimal root with a quiet guard
 exit 0
 SH
   chmod +x "$root/bin/fm-guard.sh"
+  ln -s "$ROOT/bin/fm-codex-home.py" "$root/bin/fm-codex-home.py"
   printf '%s\n' "$root"
 }
 
@@ -326,6 +327,31 @@ test_kill_is_best_effort_close() {
   pass "fm_backend_orca_kill: calls terminal close and stays best-effort"
 }
 
+test_kill_fails_on_close_error_in_strict_mode() {
+  local out status
+  orca_case kill-strict
+  printf '1\n' > "$RESP/1.exit"
+  out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" FM_BACKEND_KILL_STRICT=1 \
+    bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_kill term-123' "$ROOT" 2>&1 )
+  status=$?
+  [ "$status" -ne 0 ] || fail "strict Orca kill must fail when terminal close fails"
+  assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''close'$'\x1f''--terminal'$'\x1f''term-123'$'\x1f''--json' \
+    "strict kill did not attempt terminal close"
+  pass "fm_backend_orca_kill: strict mode propagates close failures"
+}
+
+test_kill_fails_on_close_error_json_in_strict_mode() {
+  local out status
+  orca_case kill-strict-error-json
+  printf '{"ok":false,"error":{"code":"terminal_close_failed","message":"terminal close failed"}}\n' > "$RESP/1.out"
+  out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" FM_BACKEND_KILL_STRICT=1 \
+    bash -c '. "$0/bin/backends/orca.sh"; fm_backend_orca_kill term-123' "$ROOT" 2>&1 )
+  status=$?
+  [ "$status" -ne 0 ] || fail "strict Orca kill must fail when terminal close returns ok:false"
+  assert_contains "$out" "terminal close failed" "strict kill did not surface the close error"
+  pass "fm_backend_orca_kill: strict mode rejects close error JSON"
+}
+
 test_remove_worktree_refuses_empty_id() {
   local out status
   orca_case remove-empty
@@ -500,11 +526,11 @@ test_spawn_writes_orca_metadata_and_launches_harness() {
   assert_grep "worktree=$wt" "$state/$id.meta" "meta missing Orca worktree path"
   assert_not_contains "$(cat "$log")" $'orca\x1f''terminal'$'\x1f''create' \
     "spawn should reuse the implicit terminal returned by Orca worktree creation"
-  assert_contains "$(cat "$log")" $'orca\x1f''terminal'$'\x1f''send'$'\x1f''--terminal'$'\x1f''term-spawn'$'\x1f''--text'$'\x1f''export GOTMPDIR=/tmp/fm-orcaspawnz1/gotmp'$'\x1f''--enter'$'\x1f''--json' \
-    "spawn did not export GOTMPDIR through the Orca terminal"
+  grep -Eq $'orca\x1fterminal\x1fsend\x1f--terminal\x1fterm-spawn\x1f--text\x1fexport GOTMPDIR=/tmp/fm-orcaspawnz1\\.[A-Za-z0-9]+/gotmp\x1f--enter\x1f--json' "$log" \
+    || fail "spawn did not export GOTMPDIR through the Orca terminal"
   assert_contains "$(cat "$log")" "CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false claude --dangerously-skip-permissions" \
     "spawn did not send the selected harness launch command through Orca"
-  rm -rf "/tmp/fm-$id"
+  rm -rf "/tmp/fm-$id".*
   pass "fm-spawn.sh --backend orca: reuses implicit terminal, records metadata, launches harness"
 }
 
@@ -579,6 +605,7 @@ test_spawn_refuses_orca_nonisolated_worktree() {
   printf '1\n' > "$RESP/1.exit"
   printf '{"ok":true,"result":{"repo":{"id":"repo-bad"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-bad","path":"%s"},"terminal":{"handle":"term-bad"}}}\n' "$proj" > "$RESP/3.out"
+  printf '{"ok":false,"error":{"code":"terminal_not_found","message":"terminal not found"}}\n' > "$RESP/5.out"
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
@@ -597,6 +624,36 @@ test_spawn_refuses_orca_nonisolated_worktree() {
   pass "fm-spawn.sh --backend orca: refuses non-isolated worktrees and closes implicit terminals"
 }
 
+test_spawn_preserves_orca_metadata_when_terminal_close_is_unconfirmed() {
+  local proj data state config id out status
+  id="orcacloseunconfirmedz5"
+  proj="$TMP_ROOT/close-unconfirmed-project"
+  data="$TMP_ROOT/close-unconfirmed-data"
+  state="$TMP_ROOT/close-unconfirmed-state"
+  config="$TMP_ROOT/close-unconfirmed-config"
+  fm_git_init_commit "$proj"
+  mkdir -p "$data/$id" "$state" "$config"
+  printf 'brief\n' > "$data/$id/brief.md"
+  touch "$state/.last-watcher-beat"
+  orca_case close-unconfirmed
+  printf '1\n' > "$RESP/1.exit"
+  printf '{"ok":true,"result":{"repo":{"id":"repo-close-unconfirmed"}}}\n' > "$RESP/2.out"
+  printf '{"ok":true,"result":{"worktree":{"id":"wt-close-unconfirmed","path":"%s"},"terminal":{"handle":"term-still-live"}}}\n' "$proj" > "$RESP/3.out"
+  printf '{"ok":true,"result":{"terminal":{"tail":["still live"]}}}\n' > "$RESP/5.out"
+  out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
+    FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
+    FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
+    "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude --backend orca 2>&1 )
+  status=$?
+  expect_code 1 "$status" "Orca spawn should abort after rejecting a primary checkout worktree"
+  assert_present "$state/$id.meta" "an unconfirmed Orca close must preserve failed-spawn metadata"
+  assert_grep "terminal=term-still-live" "$state/$id.meta" "preserved metadata missing the still-live Orca terminal"
+  assert_grep "endpoint_cleanup_pending=1" "$state/$id.meta" "preserved metadata must mark pending endpoint cleanup"
+  assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''read'$'\x1f''--terminal'$'\x1f''term-still-live'$'\x1f''--limit'$'\x1f''1'$'\x1f''--json' \
+    "Orca spawn must query the terminal after a successful strict close"
+  pass "fm-spawn.sh --backend orca: preserves metadata when strict close is unconfirmed"
+}
+
 test_spawn_removes_orca_worktree_when_terminal_create_fails() {
   local proj wt data state config id out status
   id="orcatermfailz8"
@@ -664,6 +721,38 @@ test_spawn_preserves_orca_metadata_when_abort_cleanup_fails() {
   pass "fm-spawn.sh --backend orca: preserves metadata when abort cleanup fails"
 }
 
+test_orca_spawn_uses_strict_terminal_cleanup() {
+  assert_grep "FM_BACKEND_KILL_STRICT=1 fm_backend_kill orca \"\$ORCA_TERMINAL\"" "$ROOT/bin/fm-spawn.sh" \
+    "Orca spawn abort cleanup must request strict terminal close failures"
+  assert_grep "fm_backend_target_absent orca \"\$ORCA_TERMINAL\"" "$ROOT/bin/fm-spawn.sh" \
+    "Orca spawn abort cleanup must confirm the terminal is absent after close"
+  pass "fm-spawn.sh --backend orca: confirms strict terminal cleanup"
+}
+
+test_orca_partial_cleanup_metadata_reaches_codex_home() {
+  local data state config home id out status neutral
+  id="orcacodexcleanupleakz1"
+  data="$TMP_ROOT/codex-cleanup-fail-data"
+  state="$TMP_ROOT/codex-cleanup-fail-state"
+  config="$TMP_ROOT/codex-cleanup-fail-config"
+  home="$data/codex-crewmate/.fm-codex-home.partial"
+  mkdir -p "$home" "$state" "$config"
+  touch "$state/.last-watcher-beat"
+  fm_write_meta "$state/$id.meta" \
+    "window=fm-$id" "worktree=" "project=" "harness=codex" "kind=ship" \
+    "mode=no-mistakes" "yolo=off" "backend=orca" "orca_worktree_id=" \
+    "orca_worktree_cleanup_complete=1" \
+    "codex_crewmate_home=$home"
+  neutral=$(neutral_fm_root "$TMP_ROOT/codex-partial-neutral")
+  out=$( FM_ROOT_OVERRIDE="$neutral" FM_STATE_OVERRIDE="$state" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
+    "$ROOT/bin/fm-teardown.sh" "$id" --force 2>&1 )
+  status=$?
+  expect_code 0 "$status" "Orca partial cleanup metadata should reach Codex-home removal"$'\n'"$out"
+  [ ! -e "$home" ] || fail "Orca partial cleanup teardown left the Codex home behind"
+  assert_absent "$state/$id.meta" "Orca partial cleanup teardown should remove metadata"
+  pass "fm-teardown.sh backend=orca: partial cleanup metadata reaches Codex-home removal"
+}
+
 test_spawn_releases_orca_resources_when_metadata_write_fails() {
   local proj wt data state_file config id out status
   id="orcametafailz9"
@@ -681,6 +770,7 @@ test_spawn_releases_orca_resources_when_metadata_write_fails() {
   printf '{"ok":true,"result":{"repo":{"id":"repo-meta-fail"}}}\n' > "$RESP/2.out"
   printf '{"ok":true,"result":{"worktree":{"id":"wt-meta-fail","path":"%s"}}}\n' "$wt" > "$RESP/3.out"
   printf '{"ok":true,"result":{"terminal":{"handle":"term-meta-fail"}}}\n' > "$RESP/4.out"
+  printf '{"ok":false,"error":{"code":"terminal_not_found","message":"terminal not found"}}\n' > "$RESP/6.out"
   out=$( PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
     FM_ROOT_OVERRIDE="$ROOT" FM_STATE_OVERRIDE="$state_file" FM_DATA_OVERRIDE="$data" FM_CONFIG_OVERRIDE="$config" \
     FM_PROJECTS_OVERRIDE="$TMP_ROOT/unused-projects" FM_SPAWN_NO_GUARD=1 \
@@ -773,6 +863,21 @@ test_target_exists_rejects_orca_error_json() {
   pass "fm_backend_target_exists: Orca ok:false read JSON is not live"
 }
 
+test_target_absent_confirms_orca_not_found() {
+  local status
+  orca_case target-absent-not-found
+  printf '{"ok":false,"error":{"code":"terminal_not_found","message":"terminal not found"}}\n' > "$RESP/1.out"
+  set +e
+  PATH="$FB:$PATH" FM_ORCA_LOG="$LOG" FM_ORCA_RESPONSES="$RESP" \
+    bash -c '. "$0/bin/fm-backend.sh"; fm_backend_target_absent orca term-gone fm-task' "$ROOT"
+  status=$?
+  set -e
+  expect_code 0 "$status" "fm_backend_target_absent should confirm Orca terminal_not_found"
+  assert_contains "$(cat "$LOG")" $'orca\x1f''terminal'$'\x1f''read'$'\x1f''--terminal'$'\x1f''term-gone'$'\x1f''--limit'$'\x1f''1'$'\x1f''--json' \
+    "fm_backend_target_absent should query the terminal after a strict close"
+  pass "fm_backend_target_absent: confirms an Orca terminal is absent"
+}
+
 test_scout_teardown_removes_orca_worktree_via_helper() {
   local proj wt data state config id out rc neutral
   id="orcateardownz3"
@@ -1290,6 +1395,8 @@ test_send_key_enter_and_interrupt
 test_send_key_refuses_unknown_key
 test_send_key_refuses_escape_until_supported
 test_kill_is_best_effort_close
+test_kill_fails_on_close_error_in_strict_mode
+test_kill_fails_on_close_error_json_in_strict_mode
 test_remove_worktree_refuses_empty_id
 test_remove_worktree_rejects_orca_error_json
 test_worktree_path_resolves_id
@@ -1302,12 +1409,16 @@ test_spawn_writes_orca_metadata_and_launches_harness
 test_spawn_refuses_orca_secondmate_before_home_mutation
 test_spawn_refuses_orca_when_runtime_not_ready
 test_spawn_refuses_orca_nonisolated_worktree
+test_spawn_preserves_orca_metadata_when_terminal_close_is_unconfirmed
 test_spawn_removes_orca_worktree_when_terminal_create_fails
 test_spawn_preserves_orca_metadata_when_abort_cleanup_fails
+test_orca_spawn_uses_strict_terminal_cleanup
+test_orca_partial_cleanup_metadata_reaches_codex_home
 test_spawn_releases_orca_resources_when_metadata_write_fails
 test_peek_send_and_crew_state_route_through_orca_meta
 test_peek_and_crew_state_fail_closed_on_orca_error_json
 test_target_exists_rejects_orca_error_json
+test_target_absent_confirms_orca_not_found
 test_scout_teardown_removes_orca_worktree_via_helper
 test_scout_teardown_refuses_orca_id_path_mismatch
 test_teardown_removes_orca_worktree_when_path_missing
diff --git a/tests/fm-backend-zellij.test.sh b/tests/fm-backend-zellij.test.sh
index acfaacca9ef..df3a8902ad9 100755
--- a/tests/fm-backend-zellij.test.sh
+++ b/tests/fm-backend-zellij.test.sh
@@ -789,6 +789,118 @@ test_kill_is_noop_when_session_absent() {
   pass "fm_backend_zellij_kill: never fails when the target session no longer exists"
 }
 
+test_kill_is_noop_when_target_is_malformed() {
+  local dir fb
+  dir="$TMP_ROOT/kill-malformed-target"; mkdir -p "$dir/responses"; : > "$dir/log"
+  fb=$(make_zellij_fakebin "$dir")
+  PATH="$fb:$PATH" FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" \
+    FM_ZELLIJ_SESSION_LIST="firstmate" \
+    bash -c '. "$0/bin/backends/zellij.sh"; fm_backend_zellij_kill malformed-target' "$ROOT"
+  expect_code 0 $? "non-strict kill must no-op when the Zellij target cannot be parsed"
+  assert_not_contains "$(cat "$dir/log")" $'\x1f''close-tab-by-id' \
+    "non-strict kill must not close a tab after target parsing fails"
+  assert_not_contains "$(cat "$dir/log")" $'\x1f''close-pane' \
+    "non-strict kill must not close a pane after target parsing fails"
+  pass "fm_backend_zellij_kill: non-strict cleanup skips malformed targets"
+}
+
+test_kill_is_strict_when_session_is_unqueryable() {
+  local dir fb status
+  dir="$TMP_ROOT/kill-strict-no-session"; mkdir -p "$dir/responses"
+  fb=$(make_zellij_fakebin "$dir")
+  PATH="$fb:$PATH" FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" \
+    FM_ZELLIJ_SESSION_LIST="" FM_BACKEND_KILL_STRICT=1 \
+    bash -c '. "$0/bin/backends/zellij.sh"; fm_backend_zellij_kill firstmate:7' "$ROOT"
+  status=$?
+  [ "$status" -ne 0 ] || fail "strict kill must fail when the Zellij session cannot be queried"
+  pass "fm_backend_zellij_kill: strict cleanup propagates session readiness failures"
+}
+
+test_kill_is_strict_when_target_query_is_unqueryable() {
+  local dir fb status
+  dir="$TMP_ROOT/kill-strict-target-query"; mkdir -p "$dir/responses"
+  printf 'temporary failure\n' > "$dir/responses/1.out"
+  printf '1\n' > "$dir/responses/1.exit"
+  fb=$(make_zellij_fakebin "$dir")
+  PATH="$fb:$PATH" FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" \
+    FM_ZELLIJ_SESSION_LIST="firstmate" FM_BACKEND_KILL_STRICT=1 \
+    bash -c '. "$0/bin/backends/zellij.sh"; fm_backend_zellij_kill firstmate:7' "$ROOT"
+  status=$?
+  [ "$status" -ne 0 ] || fail "strict kill must fail when the Zellij target cannot be queried"
+  assert_not_contains "$(cat "$dir/log")" $'\x1f''close-tab-by-id' \
+    "strict kill must not close a target after its pane query fails"
+  assert_not_contains "$(cat "$dir/log")" $'\x1f''close-pane' \
+    "strict kill must not close a target after its pane query fails"
+  pass "fm_backend_zellij_kill: strict cleanup propagates target query failures"
+}
+
+test_kill_is_strict_when_label_query_is_unqueryable() {
+  local dir fb status
+  dir="$TMP_ROOT/kill-strict-label-query"; mkdir -p "$dir/responses"
+  zellij_pane_response "$dir" 1 7 3
+  printf 'temporary failure\n' > "$dir/responses/2.out"
+  printf '1\n' > "$dir/responses/2.exit"
+  fb=$(make_zellij_fakebin "$dir")
+  PATH="$fb:$PATH" FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" \
+    FM_ZELLIJ_SESSION_LIST="firstmate" FM_BACKEND_KILL_STRICT=1 \
+    bash -c '. "$0/bin/backends/zellij.sh"; fm_backend_zellij_kill firstmate:7 "" fm-task' "$ROOT"
+  status=$?
+  [ "$status" -ne 0 ] || fail "strict kill must fail when the Zellij label cannot be queried"
+  assert_not_contains "$(cat "$dir/log")" $'\x1f''close-tab-by-id' \
+    "strict kill must not close a target after its label query fails"
+  assert_not_contains "$(cat "$dir/log")" $'\x1f''close-pane' \
+    "strict kill must not close a target after its label query fails"
+  pass "fm_backend_zellij_kill: strict cleanup propagates label query failures"
+}
+
+test_kill_is_strict_when_tab_remains_after_close() {
+  local dir fb status
+  dir="$TMP_ROOT/kill-strict-tab-remains"; mkdir -p "$dir/responses"
+  zellij_pane_response "$dir" 1 7 3
+  zellij_tab_response "$dir" 3 3 fm-task
+  fb=$(make_zellij_fakebin "$dir")
+  PATH="$fb:$PATH" FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" \
+    FM_ZELLIJ_SESSION_LIST="firstmate" FM_BACKEND_KILL_STRICT=1 \
+    bash -c '. "$0/bin/backends/zellij.sh"; fm_backend_zellij_kill firstmate:7' "$ROOT"
+  status=$?
+  [ "$status" -ne 0 ] || fail "strict kill must fail when close-tab-by-id leaves the task tab live"
+  zellij_assert_call_order "$dir/log" $'\x1f''close-tab-by-id' $'\x1f''list-tabs'$'\x1f''--json' \
+    "strict kill did not verify the tab was absent after close-tab-by-id"
+  pass "fm_backend_zellij_kill: strict cleanup rejects an unconfirmed tab close"
+}
+
+test_kill_strict_confirms_tab_absent_after_close() {
+  local dir fb status
+  dir="$TMP_ROOT/kill-strict-tab-absent"; mkdir -p "$dir/responses"
+  zellij_pane_response "$dir" 1 7 3
+  printf '[]\n' > "$dir/responses/3.out"
+  fb=$(make_zellij_fakebin "$dir")
+  PATH="$fb:$PATH" FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" \
+    FM_ZELLIJ_SESSION_LIST="firstmate" FM_BACKEND_KILL_STRICT=1 \
+    bash -c '. "$0/bin/backends/zellij.sh"; fm_backend_zellij_kill firstmate:7' "$ROOT"
+  status=$?
+  expect_code 0 "$status" "strict kill should succeed only after the task tab is confirmed absent"
+  pass "fm_backend_zellij_kill: strict cleanup confirms a tab close"
+}
+
+test_kill_is_strict_when_pane_remains_after_close() {
+  local dir fb status close_line postcheck_line
+  dir="$TMP_ROOT/kill-strict-pane-remains"; mkdir -p "$dir/responses"
+  printf '[]\n' > "$dir/responses/1.out"
+  zellij_pane_response "$dir" 3 7 3
+  fb=$(make_zellij_fakebin "$dir")
+  PATH="$fb:$PATH" FM_ZELLIJ_LOG="$dir/log" FM_ZELLIJ_RESPONSES="$dir/responses" \
+    FM_ZELLIJ_SESSION_LIST="firstmate" FM_BACKEND_KILL_STRICT=1 \
+    bash -c '. "$0/bin/backends/zellij.sh"; fm_backend_zellij_kill firstmate:7' "$ROOT"
+  status=$?
+  [ "$status" -ne 0 ] || fail "strict kill must fail when close-pane leaves the task pane live"
+  close_line=$(grep -anF -- $'\x1f''close-pane' "$dir/log" | head -1 | cut -d: -f1)
+  postcheck_line=$(grep -anF -- $'\x1f''list-panes'$'\x1f''--json' "$dir/log" | tail -1 | cut -d: -f1)
+  [ -n "$close_line" ] && [ -n "$postcheck_line" ] && [ "$close_line" -lt "$postcheck_line" ] \
+    || fail "strict kill did not verify the pane was absent after close-pane"
+  pass "fm_backend_zellij_kill: strict cleanup rejects an unconfirmed pane close"
+}
+
 test_teardown_passes_recorded_tab_id_to_zellij_kill() {
   local dir state data config project fb out status
   dir="$TMP_ROOT/teardown-zellij-ghost"; state="$dir/state"; data="$dir/data"; config="$dir/config"; project="$dir/project"
@@ -1053,6 +1165,13 @@ test_kill_falls_back_to_close_pane_when_tab_lookup_empty
 test_kill_closes_recorded_tab_when_pane_already_gone
 test_kill_skips_recorded_tab_when_label_mismatches
 test_kill_is_noop_when_session_absent
+test_kill_is_noop_when_target_is_malformed
+test_kill_is_strict_when_session_is_unqueryable
+test_kill_is_strict_when_target_query_is_unqueryable
+test_kill_is_strict_when_label_query_is_unqueryable
+test_kill_is_strict_when_tab_remains_after_close
+test_kill_strict_confirms_tab_absent_after_close
+test_kill_is_strict_when_pane_remains_after_close
 test_teardown_passes_recorded_tab_id_to_zellij_kill
 test_forced_secondmate_teardown_kills_zellij_children_with_child_home_tag
 test_send_text_submit_detects_landed_send
diff --git a/tests/fm-gate-refuse.test.sh b/tests/fm-gate-refuse.test.sh
index 5f13039c1ae..6bb3ada5708 100755
--- a/tests/fm-gate-refuse.test.sh
+++ b/tests/fm-gate-refuse.test.sh
@@ -167,7 +167,7 @@ run_spawn() {
       "FM_PROJECTS_OVERRIDE=$home/projects" "FM_CONFIG_OVERRIDE=$home/config" \
       "FM_SPAWN_NO_GUARD=1" "FM_FAKE_PANE_PATH=$pane" "TMUX=fake,1,0" \
       "PATH=$fakebin:$PATH" "$@" \
-      "$SPAWN" "$id" "$proj" codex ) 2>&1
+      "$SPAWN" "$id" "$proj" claude ) 2>&1
 }
 
 test_spawn_refuses_and_admits() {
diff --git a/tests/fm-gotmp.test.sh b/tests/fm-gotmp.test.sh
index 6b6fd8aa1ea..b95247024e2 100755
--- a/tests/fm-gotmp.test.sh
+++ b/tests/fm-gotmp.test.sh
@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # Behavior tests for per-task GOTMPDIR support (fm-gotmp).
 #
-# fm-spawn gives each task a temp root /tmp/fm-<id>/ with Go's build temp nested at
-# gotmp/, exports GOTMPDIR into the crewmate pane, and records tasktmp= in the task's
+# fm-spawn gives each task an atomically created temp root with Go's build temp nested
+# at gotmp/, exports GOTMPDIR into the crewmate pane, and records tasktmp= in the task's
 # meta. fm-teardown reads tasktmp= and removes the whole root on cleanup.
 #
 # These tests exercise behavior directly: fm-teardown is run as a subprocess against a
@@ -96,26 +96,30 @@ META
 
 # --- fm-spawn side ---
 
-test_spawn_contract_and_mkdir_pattern() {
-  # Structural: fm-spawn must create the gotmp dir, record tasktmp in meta, and export
+test_spawn_contract_and_private_temp_pattern() {
+  # Structural: fm-spawn must create a private temp root and its gotmp dir, record tasktmp in meta, and export
   # GOTMPDIR into the pane. Assert the contract lines are present in the source.
   # shellcheck disable=SC2016  # single quotes are deliberate: these are literal source strings
-  grep -F 'mkdir -p "$TASK_TMP/gotmp"' "$SPAWN" >/dev/null \
+  grep -F 'TASK_TMP=$(mktemp -d "/tmp/fm-$ID.XXXXXXXX")' "$SPAWN" >/dev/null \
+    || fail "fm-spawn missing: private task temporary root"
+  # shellcheck disable=SC2016  # single quotes are deliberate: these are literal source strings
+  grep -F 'mkdir "$TASK_TMP/gotmp"' "$SPAWN" >/dev/null \
     || fail "fm-spawn missing: mkdir of gotmp under TASK_TMP"
   # shellcheck disable=SC2016  # single quotes are deliberate: literal source string
   grep -F 'echo "tasktmp=$TASK_TMP"' "$SPAWN" >/dev/null \
     || fail "fm-spawn missing: tasktmp= line in meta write"
   grep -F 'export GOTMPDIR=' "$SPAWN" >/dev/null \
     || fail "fm-spawn missing: GOTMPDIR export into pane"
-  # Behavioral: the mkdir + meta-write pattern spawn uses must produce a gotmp dir and
+  # Behavioral: the private-root + mkdir + meta-write pattern spawn uses must produce a gotmp dir and
   # a meta line whose value the teardown grep (tasktmp=, cut -d= -f2-) reads back whole.
   local id=spawn-sim-z1
   local sim_root="$TMP_ROOT/$id-root"
-  local task_tmp="$sim_root/tmp/fm-$id"
-  mkdir -p "$sim_root/state"
-  # Replicate spawn's exact mkdir + meta-write lines.
-  TASK_TMP="$task_tmp"
-  mkdir -p "$TASK_TMP/gotmp"
+  local task_tmp
+  mkdir -p "$sim_root/state" "$sim_root/tmp"
+  # Replicate spawn's exact private-root + mkdir + meta-write lines.
+  TASK_TMP=$(mktemp -d "$sim_root/tmp/fm-$id.XXXXXXXX")
+  task_tmp=$TASK_TMP
+  mkdir "$TASK_TMP/gotmp"
   {
     echo "tasktmp=$TASK_TMP"
   } > "$sim_root/state/$id.meta"
@@ -132,7 +136,8 @@ test_spawn_contract_and_mkdir_pattern() {
 
 test_teardown_removes_tasktmp_dir() {
   local id=td-rm-z2
-  local task_tmp="$TMP_ROOT/fm-$id"
+  local task_tmp
+  task_tmp=$(mktemp -d "/tmp/fm-$id.XXXXXXXX")
   mkdir -p "$task_tmp/gotmp"
   printf 'leftover\n' > "$task_tmp/gotmp/build-artifact"
   local fake
@@ -192,7 +197,7 @@ META
 test_teardown_skips_gracefully_when_dir_missing() {
   # tasktmp= points to a path that does not exist. Teardown must not error.
   local id=td-missing-z4
-  local task_tmp="$TMP_ROOT/never-created-fm-$id"
+  local task_tmp="/tmp/fm-$id.missing"
   # Intentionally do NOT create $task_tmp.
   [ ! -e "$task_tmp" ] || fail "precondition: task_tmp should not exist yet"
   local fake
@@ -203,7 +208,7 @@ test_teardown_skips_gracefully_when_dir_missing() {
   pass "fm-teardown skips gracefully when tasktmp= points to a nonexistent dir"
 }
 
-test_spawn_contract_and_mkdir_pattern
+test_spawn_contract_and_private_temp_pattern
 test_teardown_removes_tasktmp_dir
 test_teardown_skips_gracefully_without_tasktmp
 test_teardown_skips_gracefully_when_dir_missing
diff --git a/tests/fm-spawn-dispatch-profile.test.sh b/tests/fm-spawn-dispatch-profile.test.sh
index 477e8b95414..218b5639a11 100755
--- a/tests/fm-spawn-dispatch-profile.test.sh
+++ b/tests/fm-spawn-dispatch-profile.test.sh
@@ -11,6 +11,7 @@ set -u
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 SPAWN="$ROOT/bin/fm-spawn.sh"
+TEARDOWN="$ROOT/bin/fm-teardown.sh"
 TMP_ROOT=$(fm_test_tmproot fm-spawn-dispatch-profile)
 
 make_spawn_fakebin() {
@@ -21,28 +22,78 @@ make_spawn_fakebin() {
 set -u
 case "$*" in
   *"#{pane_current_path}"*) printf '%s\n' "${FM_FAKE_PANE_PATH:-}"; exit 0 ;;
+  *"#{pane_id}"*)
+    [ "${FM_FAKE_TARGET_QUERY_STATUS:-0}" -eq 0 ] || exit "${FM_FAKE_TARGET_QUERY_STATUS}"
+    if [ "$(cat "${FM_FAKE_TARGET_STATE:?}" 2>/dev/null)" != live ]; then
+      printf '%s\n' "can't find window: ${3:-unknown}" >&2
+      exit 1
+    fi
+    printf '%s\n' '@1'
+    exit 0
+    ;;
 esac
 case "${1:-}" in
   display-message) printf 'firstmate\n'; exit 0 ;;
   list-windows) exit 0 ;;
-  has-session|new-session|new-window|kill-window) exit 0 ;;
+  kill-window)
+    [ -z "${FM_FAKE_BACKEND_LOG:-}" ] || printf '%s\n' "$*" >> "$FM_FAKE_BACKEND_LOG"
+    status=${FM_FAKE_BACKEND_KILL_STATUS:-0}
+    [ "$status" -ne 0 ] || [ "${FM_FAKE_BACKEND_CLOSE_EFFECT:-gone}" != gone ] || printf '%s\n' gone > "${FM_FAKE_TARGET_STATE:?}"
+    exit "$status"
+    ;;
+  has-session|new-session|new-window)
+    [ -z "${FM_FAKE_BACKEND_LOG:-}" ] || printf '%s\n' "$*" >> "$FM_FAKE_BACKEND_LOG"
+    exit 0
+    ;;
   send-keys)
+    literal=
     if [ -n "${FM_FAKE_LAUNCH_LOG:-}" ]; then
       prev=
       for a in "$@"; do
         if [ "$prev" = "-l" ]; then
           printf '%s\n' "$a" >> "$FM_FAKE_LAUNCH_LOG"
+          literal=$a
         fi
         prev=$a
       done
     fi
+    case "$literal" in
+      *'--create-activate '*)
+        data=$(printf '%s\n' "$literal" | sed -n "s/.*--data '\\([^']*\\)'.*/\\1/p")
+        home=$(printf '%s\n' "$literal" | sed -n "s/.*--home '\\([^']*\\)'.*/\\1/p")
+        token=$(printf '%s\n' "$literal" | sed -n "s/.*--result-token '\\([0-9a-f]*\\)'.*/\\1/p")
+        if [ -n "$data" ] && [ -n "$home" ]; then
+          result="$data/codex-crewmate/.fm-codex-activation.${home##*/}"
+          mkdir -p "$data/codex-crewmate"
+          umask 077
+          printf '%s %s\n' "${FM_FAKE_ACTIVATION_RESULT:-ready}" "$token" > "$result"
+          chmod 600 "$result"
+        fi
+        ;;
+    esac
     exit 0
     ;;
 esac
 exit 0
 SH
   chmod +x "$fakebin/tmux"
-  fm_fake_exit0 "$fakebin" treehouse
+cat > "$fakebin/treehouse" <<'SH'
+#!/usr/bin/env bash
+set -u
+[ -z "${FM_FAKE_BACKEND_LOG:-}" ] || printf 'treehouse %s\n' "$*" >> "$FM_FAKE_BACKEND_LOG"
+case "$*" in
+  "return --force"*) exit "${FM_FAKE_TREEHOUSE_RETURN_STATUS:-0}" ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/treehouse"
+  cat > "$fakebin/mktemp" <<'SH'
+#!/usr/bin/env bash
+set -u
+[ -z "${FM_FAKE_MKTEMP_LOG:-}" ] || printf '%s\n' "$*" >> "$FM_FAKE_MKTEMP_LOG"
+exec /usr/bin/mktemp "$@"
+SH
+  chmod +x "$fakebin/mktemp"
   printf '%s\n' "$fakebin"
 }
 
@@ -81,14 +132,24 @@ make_seeded_secondmate_home() {
 }
 
 run_spawn() {
-  local home=$1 wt=$2 fakebin=$3 launchlog=$4
+  local home=$1 wt=$2 fakebin=$3 launchlog=$4 target_state
   shift 4
+  target_state="$(dirname "$launchlog")/target-state"
   : > "$launchlog"
+  printf '%s\n' live > "$target_state"
   FM_ROOT_OVERRIDE='' FM_HOME="$home" \
     FM_STATE_OVERRIDE="$home/state" FM_DATA_OVERRIDE="$home/data" \
     FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
     FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$wt" TMUX="fake,1,0" \
-    FM_FAKE_LAUNCH_LOG="$launchlog" GROK_HOME="$home/grok-home" PATH="$fakebin:$PATH" \
+    FM_FAKE_LAUNCH_LOG="$launchlog" FM_FAKE_BACKEND_LOG="$(dirname "$launchlog")/backend.log" \
+    FM_FAKE_TREEHOUSE_RETURN_STATUS="${FM_FAKE_TREEHOUSE_RETURN_STATUS:-0}" \
+    FM_FAKE_BACKEND_KILL_STATUS="${FM_FAKE_BACKEND_KILL_STATUS:-0}" \
+    FM_FAKE_BACKEND_CLOSE_EFFECT="${FM_FAKE_BACKEND_CLOSE_EFFECT:-gone}" \
+    FM_FAKE_TARGET_QUERY_STATUS="${FM_FAKE_TARGET_QUERY_STATUS:-0}" \
+    FM_FAKE_TARGET_STATE="$target_state" \
+    FM_FAKE_ACTIVATION_RESULT="${FM_FAKE_ACTIVATION_RESULT:-ready}" \
+    GROK_HOME="$home/grok-home" PATH="$fakebin:$PATH" \
+    HOME="$CASE_DIR/user" \
     "$SPAWN" "$@" 2>&1
 }
 
@@ -98,6 +159,37 @@ $1
 EOF
 }
 
+codex_home_from_launch() {
+  printf '%s\n' "$1" | sed -n "s/.*--home '\\([^']*\\)'.*/\\1/p"
+}
+
+codex_source_from_launch() {
+  printf '%s\n' "$1" | sed -n "s/.*--source '\\([^']*\\)'.*/\\1/p"
+}
+
+codex_activation_result_from_launch() {
+  local home
+  home=$(codex_home_from_launch "$1")
+  [ -z "$home" ] || printf '%s/.fm-codex-activation.%s\n' "$(dirname "$home")" "${home##*/}"
+}
+
+assert_private_activation_result() {  # <task-id> <result-path> <message>
+  local id=$1 result=$2 message=$3 base
+  base=${result%/*}
+  case "$result" in
+    */data/codex-crewmate/.fm-codex-activation..fm-codex-home.*) : ;;
+    *) fail "$message: $result" ;;
+  esac
+  [ -d "$base" ] && [ ! -L "$base" ] || fail "$message: unsafe parent $base"
+}
+
+materialize_codex_home() {  # <home> <data> <source> <profile> <worktree>
+  python3 "$ROOT/bin/fm-codex-home.py" --create-activate --data "$2" --source "$3" \
+    --profile "$4" --worktree "$5" --home "$1" \
+    --result-token 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef -- /usr/bin/env >/dev/null
+  python3 "$ROOT/bin/fm-codex-home.py" --remove-activation-result --data "$2" --home "$1"
+}
+
 assert_meta_profile() {
   local meta=$1 harness=$2 model=$3 effort=$4
   assert_grep "harness=$harness" "$meta" "meta missing harness=$harness"
@@ -169,7 +261,7 @@ test_active_dispatch_profile_allows_explicit_harness() {
   assert_contains "$out" "spawned $id harness=codex" "spawn did not report explicit codex harness"
   assert_meta_profile "$HOME_DIR/state/$id.meta" codex gpt-5 high
   launch=$(cat "$LAUNCH_LOG")
-  assert_contains "$launch" "codex --model 'gpt-5' -c 'model_reasoning_effort=\"high\"' --dangerously-bypass-approvals-and-sandbox" \
+  assert_contains "$launch" "--model 'gpt-5' -c 'model_reasoning_effort=\"high\"' --dangerously-bypass-approvals-and-sandbox" \
     "explicit harness launch did not thread model and effort"
   pass "active crew-dispatch profile allows an explicit resolved harness"
 }
@@ -235,11 +327,866 @@ test_codex_threads_model_and_effort() {
   expect_code 0 "$status" "codex spawn with profile flags should succeed"
   assert_meta_profile "$HOME_DIR/state/$id.meta" codex gpt-5 high
   launch=$(cat "$LAUNCH_LOG")
-  assert_contains "$launch" "codex --model 'gpt-5' -c 'model_reasoning_effort=\"high\"' --dangerously-bypass-approvals-and-sandbox" \
+  assert_contains "$launch" "--model 'gpt-5' -c 'model_reasoning_effort=\"high\"' --dangerously-bypass-approvals-and-sandbox" \
     "codex launch did not thread model and reasoning effort config"
   pass "codex receives --model and model_reasoning_effort profile flags"
 }
 
+test_codex_crewmate_home_excludes_mcp_and_plugins() {
+  local rec ship scout out status launch crew_home source_home activation_result worktree_link worktree_real
+  ship=profile-codex-home-ship-z17
+  scout=profile-codex-home-scout-z18
+  rec=$(make_spawn_case profile-codex-home codex "$ship" "$scout")
+  read_case_record "$rec"
+  worktree_link="$CASE_DIR/worktree-link"
+  ln -s "$WT_DIR" "$worktree_link"
+  worktree_real=$(cd "$worktree_link" && pwd -P)
+  source_home="$CASE_DIR/user/.codex"
+  mkdir -p "$source_home/plugins"
+  printf '%s\n' '{"auth_mode":"chatgpt"}' > "$source_home/auth.json"
+  printf '%s\n' '{"models":[]}' > "$source_home/models_cache.json"
+  cat > "$source_home/config.toml" <<'EOF'
+[mcp_servers.shared_memory]
+command = "broken-memory-server"
+[plugins."computer-use@openai-bundled"]
+enabled = true
+EOF
+  mkdir -p "$WT_DIR/.codex"
+  cat > "$WT_DIR/.codex/config.toml" <<'EOF'
+[mcp_servers.project_memory]
+command = "still-broken-memory-server"
+[plugins."project-plugin@local"]
+enabled = true
+EOF
+
+  out=$(run_spawn "$HOME_DIR" "$worktree_link" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$ship" "$PROJ_DIR")
+  status=$?
+  expect_code 0 "$status" "Codex ship spawn should succeed with an isolated home"
+  launch=$(cat "$LAUNCH_LOG")
+  crew_home=$(codex_home_from_launch "$launch")
+  activation_result=$(codex_activation_result_from_launch "$launch")
+  [ -n "$crew_home" ] || fail "Codex ship launch did not expose an isolated CODEX_HOME"
+  assert_private_activation_result "$ship" "$activation_result" "Codex ship launch did not use a private activation result"
+  assert_contains "$launch" "--home '$crew_home' --result-token '" \
+    "Codex ship launch did not authenticate the isolated-home activation"
+  assert_contains "$launch" "-- codex --profile 'fm-crewmate-$ship' --disable plugins" \
+    "Codex ship launch did not activate the isolated CODEX_HOME"
+  assert_contains "$launch" "--worktree '$worktree_real'" \
+    "Codex ship launch did not use the physical worktree for its trust profile"
+  assert_not_contains "$launch" "--worktree '$worktree_link'" \
+    "Codex ship launch used the logical worktree for its trust profile"
+  materialize_codex_home "$crew_home" "$HOME_DIR/data" "$source_home" "fm-crewmate-$ship" "$worktree_real"
+  assert_contains "$out" "warning: Codex crewmate ignores project config" \
+    "Codex ship launch did not warn that project Codex config was ignored"
+  assert_contains "$out" "$worktree_real/.codex/config.toml to keep MCPs and plugins disabled" \
+    "Codex ship launch did not warn that project Codex config was ignored"
+  assert_present "$crew_home/config.toml" "isolated Codex config was not created"
+  assert_grep "codex_crewmate_home=$crew_home" "$HOME_DIR/state/$ship.meta" \
+    "Codex ship metadata did not retain its isolated home for cleanup"
+  assert_no_grep 'mcp_servers' "$crew_home/config.toml" \
+    "isolated Codex config retained MCP server entries"
+  assert_grep 'plugins = false' "$crew_home/config.toml" \
+    "isolated Codex config did not disable plugins"
+  assert_no_grep '[plugins.' "$crew_home/config.toml" \
+    "isolated Codex config retained plugin registrations"
+  assert_grep "trust_level = \"untrusted\"" "$crew_home/config.toml" \
+    "isolated Codex base config did not persist project trust"
+  assert_grep "$worktree_real" "$crew_home/config.toml" \
+    "isolated Codex base config did not scope untrusted trust to the worktree"
+  assert_grep "trust_level = \"untrusted\"" "$crew_home/fm-crewmate-$ship.config.toml" \
+    "isolated Codex profile did not disable project config trust"
+  assert_grep '[projects.' "$crew_home/fm-crewmate-$ship.config.toml" \
+    "isolated Codex profile did not scope untrusted trust to the project"
+  assert_grep "$worktree_real" "$crew_home/fm-crewmate-$ship.config.toml" \
+    "isolated Codex profile did not scope untrusted trust to the worktree"
+  assert_no_grep "$PROJ_DIR" "$crew_home/fm-crewmate-$ship.config.toml" \
+    "isolated Codex profile must not scope untrusted trust to the primary project"
+  [ ! -e "$crew_home/plugins" ] || fail "isolated Codex home retained a plugins directory"
+  cmp -s "$source_home/auth.json" "$crew_home/auth.json" \
+    || fail "isolated Codex home did not refresh authentication"
+  cmp -s "$source_home/models_cache.json" "$crew_home/models_cache.json" \
+    || fail "isolated Codex home did not refresh the model catalog"
+  [ ! -L "$crew_home/auth.json" ] || fail "isolated Codex auth must not point into the captain home"
+
+  mkdir -p "$HOME_DIR/data/codex-crewmate/fm-crewmate-$scout/plugins/stale-plugin"
+  out=$(run_spawn "$HOME_DIR" "$worktree_link" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$scout" "$PROJ_DIR" --scout)
+  status=$?
+  expect_code 0 "$status" "Codex scout spawn should use the isolated home"
+  launch=$(cat "$LAUNCH_LOG")
+  crew_home=$(codex_home_from_launch "$launch")
+  activation_result=$(codex_activation_result_from_launch "$launch")
+  [ -n "$crew_home" ] || fail "Codex scout launch did not expose an isolated CODEX_HOME"
+  assert_private_activation_result "$scout" "$activation_result" "Codex scout launch did not use a private activation result"
+  assert_contains "$launch" "--home '$crew_home' --result-token '" \
+    "Codex scout launch did not authenticate the isolated-home activation"
+  assert_contains "$launch" "-- codex --profile 'fm-crewmate-$scout' --disable plugins" \
+    "Codex scout launch did not activate the isolated CODEX_HOME"
+  materialize_codex_home "$crew_home" "$HOME_DIR/data" "$source_home" "fm-crewmate-$scout" "$worktree_real"
+  assert_no_grep 'mcp_servers' "$crew_home/config.toml" \
+    "Codex scout refresh reintroduced MCP server entries"
+  assert_grep 'plugins = false' "$crew_home/config.toml" \
+    "Codex scout refresh did not disable plugins"
+  assert_no_grep '[plugins.' "$crew_home/config.toml" \
+    "Codex scout refresh reintroduced plugin registrations"
+  [ ! -e "$crew_home/plugins" ] || fail "Codex scout home retained plugins"
+  pass "Codex ship and scout launches use fresh MCP-free homes"
+}
+
+test_codex_crewmate_home_honors_codex_home_override() {
+  local rec id out status launch source_home
+  id=profile-codex-home-override-z69
+  rec=$(make_spawn_case profile-codex-home-override codex "$id")
+  read_case_record "$rec"
+  source_home="$CASE_DIR/explicit-codex-home"
+  mkdir -p "$source_home"
+
+  out=$(CODEX_HOME="$source_home" run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 0 "$status" "Codex spawn should honor an explicit CODEX_HOME"
+  launch=$(cat "$LAUNCH_LOG")
+  [ "$(codex_source_from_launch "$launch")" = "$source_home" ] \
+    || fail "Codex launch did not source its isolated home from explicit CODEX_HOME"
+  pass "Codex isolated home honors an explicit CODEX_HOME source"
+}
+
+test_codex_crewmate_home_uses_fresh_private_directory() {
+  local rec id out status source_home legacy_home crew_home launch home_base home_parent
+  id=profile-codex-home-fresh-z19
+  rec=$(make_spawn_case profile-codex-home-fresh codex "$id")
+  read_case_record "$rec"
+  source_home="$CASE_DIR/user/.codex"
+  legacy_home="$HOME_DIR/data/codex-crewmate/fm-crewmate-$id"
+  mkdir -p "$source_home" "$legacy_home/plugins/stale-plugin" "$legacy_home/config.toml"
+  printf '%s\n' 'legacy-config' > "$legacy_home/auth.json"
+
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 0 "$status" "Codex spawn should not reuse a legacy isolated home"
+  launch=$(cat "$LAUNCH_LOG")
+  crew_home=$(codex_home_from_launch "$launch")
+  [ -n "$crew_home" ] || fail "Codex launch did not expose a fresh isolated CODEX_HOME"
+  [ "$crew_home" != "$legacy_home" ] || fail "Codex launch reused the legacy isolated home"
+  home_base=$(cd "$HOME_DIR/data/codex-crewmate" && pwd -P)
+  home_parent=$(cd "$(dirname "$crew_home")" && pwd -P)
+  case "${crew_home##*/}" in .fm-codex-home.*) : ;; *) fail "Codex launch did not use a private per-task home: $crew_home" ;; esac
+  [ "$home_parent" = "$home_base" ] || fail "Codex launch did not use a private per-task home: $crew_home"
+  materialize_codex_home "$crew_home" "$HOME_DIR/data" "$source_home" "fm-crewmate-$id" "$WT_DIR"
+  [ ! -e "$crew_home/plugins" ] || fail "fresh Codex home inherited legacy plugins"
+  assert_not_contains "$(cat "$crew_home/auth.json" 2>/dev/null || true)" "legacy-config" \
+    "fresh Codex home inherited legacy authentication"
+  pass "Codex spawn uses a fresh private isolated home"
+}
+
+test_codex_crewmate_home_is_removed_at_teardown() {
+  local rec id out status launch crew_home target_state
+  id=profile-codex-home-teardown-z30
+  rec=$(make_spawn_case profile-codex-home-teardown codex "$id")
+  read_case_record "$rec"
+
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 0 "$status" "Codex spawn should prepare a private home before teardown"
+  launch=$(cat "$LAUNCH_LOG")
+  crew_home=$(codex_home_from_launch "$launch")
+  materialize_codex_home "$crew_home" "$HOME_DIR/data" "$CASE_DIR/user/.codex" "fm-crewmate-$id" "$WT_DIR"
+  [ -d "$crew_home" ] || fail "Codex spawn did not create the private home to be torn down"
+  target_state="$CASE_DIR/target-state"
+
+  out=$(FM_ROOT_OVERRIDE='' FM_HOME="$HOME_DIR" FM_STATE_OVERRIDE="$HOME_DIR/state" \
+    FM_DATA_OVERRIDE="$HOME_DIR/data" FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" \
+    FM_CONFIG_OVERRIDE="$HOME_DIR/config" FM_FAKE_TARGET_STATE="$target_state" \
+    FM_FAKE_BACKEND_LOG="$CASE_DIR/backend.log" PATH="$FAKEBIN_DIR:$PATH" \
+    "$TEARDOWN" "$id" --force 2>&1)
+  status=$?
+  expect_code 0 "$status" "teardown should remove a recorded Codex private home"
+  [ ! -e "$crew_home" ] || fail "teardown left the credential-bearing Codex private home behind"
+  assert_absent "$HOME_DIR/state/$id.meta" "teardown should remove metadata only after private-home cleanup"
+  pass "teardown removes the recorded private Codex home"
+}
+
+test_codex_crewmate_home_refuses_symlink_escape() {
+  local rec id out status source_home crew_root
+  id=profile-codex-home-symlink-z21
+  rec=$(make_spawn_case profile-codex-home-symlink codex "$id")
+  read_case_record "$rec"
+  source_home="$CASE_DIR/user/.codex"
+  crew_root="$HOME_DIR/data/codex-crewmate"
+  mkdir -p "$source_home/plugins"
+  printf '%s\n' 'captain-config' > "$source_home/config.toml"
+  ln -s "$source_home" "$crew_root"
+
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 1 "$status" "Codex spawn must reject a symlinked isolated home"
+  assert_contains "$out" "could not prepare isolated Codex crewmate home" \
+    "Codex spawn did not report the symlink escape"
+  assert_grep 'captain-config' "$source_home/config.toml" \
+    "symlink rejection must not overwrite the captain Codex config"
+  [ -d "$source_home/plugins" ] || fail "symlink rejection must not remove captain plugins"
+  assert_absent "$HOME_DIR/state/$id.meta" "symlink rejection must not create task metadata"
+  assert_grep "treehouse return --force $WT_DIR" "$CASE_DIR/backend.log" \
+    "symlink rejection did not return its worktree"
+  assert_grep "kill-window -t firstmate:fm-$id" "$CASE_DIR/backend.log" \
+    "symlink rejection did not remove its task endpoint"
+  [ ! -s "$LAUNCH_LOG" ] || fail "symlink rejection must not launch Codex"
+  pass "Codex spawn refuses isolated-home symlink escapes"
+}
+
+test_codex_crewmate_home_refuses_symlinked_data_root() {
+  local rec id out status data_root real_data
+  id=profile-codex-data-root-symlink-z36
+  rec=$(make_spawn_case profile-codex-data-root-symlink codex "$id")
+  read_case_record "$rec"
+  data_root="$HOME_DIR/data"
+  real_data="$CASE_DIR/real-data"
+  mv "$data_root" "$real_data"
+  ln -s "$real_data" "$data_root"
+
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 1 "$status" "Codex spawn must reject a symlinked data root"
+  assert_contains "$out" "could not prepare isolated Codex crewmate home" \
+    "Codex spawn did not report the data-root symlink escape"
+  assert_absent "$real_data/codex-crewmate" "data-root symlink rejection must not create a Codex home"
+  assert_grep "treehouse return --force $WT_DIR" "$CASE_DIR/backend.log" \
+    "data-root symlink rejection did not return its worktree"
+  assert_grep "kill-window -t firstmate:fm-$id" "$CASE_DIR/backend.log" \
+    "data-root symlink rejection did not remove its task endpoint"
+  [ ! -s "$LAUNCH_LOG" ] || fail "data-root symlink rejection must not launch Codex"
+  pass "Codex spawn refuses a symlinked data root"
+}
+
+test_codex_crewmate_profile_rejects_toml_control_characters() {
+  local data source out status worktree
+  data="$CASE_DIR/control-data"
+  source="$CASE_DIR/control-source"
+  worktree=$'safe\n[mcp_servers.injected]'
+  mkdir -p "$data" "$source"
+
+  out=$(python3 "$ROOT/bin/fm-codex-home.py" --data "$data" --source "$source" \
+    --profile fm-crewmate-control-z37 --worktree "$worktree" 2>&1)
+  status=$?
+  expect_code 1 "$status" "Codex home creation must reject TOML control characters"
+  assert_contains "$out" "TOML control character" \
+    "Codex home creation did not explain the unsafe TOML path"
+  assert_absent "$data/codex-crewmate" "unsafe TOML path must not create a Codex home"
+  pass "Codex profile rejects TOML control characters"
+}
+
+test_codex_crewmate_home_fails_when_private_home_creation_fails() {
+  local rec id out status
+  id=profile-codex-home-create-z23
+  rec=$(make_spawn_case profile-codex-home-create codex "$id")
+  read_case_record "$rec"
+  cat > "$FAKEBIN_DIR/python3" <<'SH'
+#!/usr/bin/env bash
+exit 74
+SH
+  chmod +x "$FAKEBIN_DIR/python3"
+
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 1 "$status" "Codex spawn must fail when its private home cannot be created"
+  assert_contains "$out" "could not prepare isolated Codex crewmate home" \
+    "Codex spawn did not report private-home preparation failure"
+  assert_absent "$HOME_DIR/state/$id.meta" "private-home preparation failure must not create task metadata"
+  assert_grep "treehouse return --force $WT_DIR" "$CASE_DIR/backend.log" \
+    "private-home preparation failure did not return its worktree"
+  assert_grep "kill-window -t firstmate:fm-$id" "$CASE_DIR/backend.log" \
+    "private-home preparation failure did not remove its task endpoint"
+  [ ! -s "$LAUNCH_LOG" ] || fail "private-home preparation failure must not launch Codex"
+  pass "Codex spawn cleans up a failed private-home allocation"
+}
+
+test_raw_codex_launch_is_normalized() {
+  local command case_name rec id out status launch crew_home activation_result n=0
+  for case_name in mixed-case absolute-mixed-case env-wrapper absolute-env-wrapper command-wrapper nested-wrapper exec-wrapper; do
+    n=$((n + 1))
+    id="profile-raw-codex-$n-z24"
+    rec=$(make_spawn_case "profile-raw-codex-$n" codex "$id")
+    read_case_record "$rec"
+    case "$case_name" in
+      mixed-case) command='CODEX_HOME=/unsafe Codex' ;;
+      absolute-mixed-case) command='CODEX_HOME=/unsafe /opt/firstmate/Codex' ;;
+      env-wrapper) command='env CODEX_HOME=/unsafe codex' ;;
+      absolute-env-wrapper) command='CODEX_HOME=/unsafe /usr/bin/env codex' ;;
+      command-wrapper) command='command codex CODEX_HOME=/unsafe' ;;
+      nested-wrapper) command='command env CODEX_HOME=/unsafe codex' ;;
+      exec-wrapper) command='exec codex CODEX_HOME=/unsafe' ;;
+    esac
+
+    out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" \
+      "$id" "$PROJ_DIR" "$command")
+    status=$?
+    expect_code 0 "$status" "$case_name raw Codex launch should be normalized"
+    assert_contains "$out" "spawned $id harness=codex" "$case_name raw Codex launch did not report Codex"
+    launch=$(cat "$LAUNCH_LOG")
+    crew_home=$(codex_home_from_launch "$launch")
+    activation_result=$(codex_activation_result_from_launch "$launch")
+    [ -n "$crew_home" ] || fail "$case_name raw Codex launch did not expose an isolated CODEX_HOME"
+    assert_private_activation_result "$id" "$activation_result" "$case_name raw Codex launch did not use a private activation result"
+    assert_contains "$launch" "--home '$crew_home' --result-token '" \
+      "$case_name raw Codex launch did not authenticate the isolated-home activation"
+    assert_contains "$launch" "-- codex --profile 'fm-crewmate-$id' --disable plugins" \
+      "$case_name raw Codex launch did not enforce the isolated profile"
+    assert_not_contains "$launch" '/unsafe' "$case_name raw CODEX_HOME assignment survived normalization"
+  done
+  pass "raw Codex launch is normalized to the isolated profile"
+}
+
+test_raw_codex_execution_wrappers_fail_closed() {
+  local command case_name rec id out status n=0
+  for case_name in nice nice-option shell shell-multicommand shell-script sourced-script script-path sudo-user timeout-duration script find xargs unknown-wrapper eval builtin-eval interpreter; do
+    n=$((n + 1))
+    id="profile-raw-codex-wrapper-$n-z31"
+    rec=$(make_spawn_case "profile-raw-codex-wrapper-$n" codex "$id")
+    read_case_record "$rec"
+    case "$case_name" in
+      nice) command='nice codex' ;;
+      nice-option) command='nice -n 1 env CODEX_HOME=/unsafe codex' ;;
+      shell) command='sh -c codex' ;;
+      shell-multicommand) command="sh -c 'true; CODEX_HOME=/unsafe codex'" ;;
+      shell-script) command='sh -c ./launch-worker' ;;
+      sourced-script) command='source ./launch-worker' ;;
+      script-path) command='./launch-worker.sh --background' ;;
+      sudo-user) command='sudo -u crew CODEX_HOME=/unsafe codex' ;;
+      timeout-duration) command='timeout 5 CODEX_HOME=/unsafe codex' ;;
+      script) command='script -q /dev/null codex' ;;
+      find) command='find . -exec codex {} \;' ;;
+      xargs) command='xargs -a jobs codex' ;;
+      unknown-wrapper) command='custom-wrapper codex' ;;
+      eval) command="eval \"\$COMMAND\"" ;;
+      builtin-eval) command="builtin eval \"\$COMMAND\"" ;;
+      interpreter) command="python3 -c 'os.execvp(\"codex\", [\"codex\"])'" ;;
+    esac
+
+    out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" \
+      "$id" "$PROJ_DIR" "$command")
+    status=$?
+    expect_code 1 "$status" "$case_name raw Codex wrapper must fail closed"
+    assert_contains "$out" "unsafe raw launch command" \
+      "$case_name raw Codex wrapper did not explain the refusal"
+    assert_absent "$HOME_DIR/state/$id.meta" "$case_name raw Codex wrapper must fail before task allocation"
+    if [ -e "$CASE_DIR/backend.log" ]; then
+      assert_no_grep "new-window -t firstmate" "$CASE_DIR/backend.log" \
+        "$case_name raw Codex wrapper must not allocate an endpoint"
+    fi
+    [ ! -s "$LAUNCH_LOG" ] || fail "$case_name raw Codex wrapper must not launch Codex"
+  done
+  pass "raw Codex execution wrappers fail closed"
+}
+
+test_raw_codex_late_home_assignment_is_normalized() {
+  local rec id out status launch crew_home
+  id=profile-raw-codex-unsafe-z25
+  rec=$(make_spawn_case profile-raw-codex-unsafe codex "$id")
+  read_case_record "$rec"
+
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" \
+    "$id" "$PROJ_DIR" "codex CODEX_HOME=/unsafe")
+  status=$?
+  expect_code 0 "$status" "raw Codex launch with a late CODEX_HOME assignment should normalize"
+  launch=$(cat "$LAUNCH_LOG")
+  crew_home=$(codex_home_from_launch "$launch")
+  [ -n "$crew_home" ] || fail "late CODEX_HOME assignment bypassed the isolated home"
+  assert_not_contains "$launch" '/unsafe' "late raw CODEX_HOME assignment survived normalization"
+  pass "late raw CODEX_HOME assignments cannot bypass the isolated home"
+}
+
+test_raw_codex_options_fail_closed() {
+  local rec id out status
+  id=profile-raw-codex-options-z46
+  rec=$(make_spawn_case profile-raw-codex-options codex "$id")
+  read_case_record "$rec"
+
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" \
+    "$id" "$PROJ_DIR" "codex --model gpt-5")
+  status=$?
+  expect_code 1 "$status" "raw Codex options must fail closed rather than being dropped"
+  assert_contains "$out" "raw Codex launch options are not supported" \
+    "raw Codex options did not explain the refusal"
+  assert_absent "$HOME_DIR/state/$id.meta" "raw Codex option refusal must happen before task allocation"
+  [ ! -s "$LAUNCH_LOG" ] || fail "raw Codex options must not launch a default Codex command"
+  pass "raw Codex options fail closed instead of being dropped"
+}
+
+test_quoted_or_escaped_raw_codex_launch_fails_closed() {
+  local command case_name rec id out status n=0
+  for case_name in quoted escaped; do
+    n=$((n + 1))
+    id="profile-raw-codex-shell-$n-z27"
+    rec=$(make_spawn_case "profile-raw-codex-shell-$n" codex "$id")
+    read_case_record "$rec"
+    case "$case_name" in
+      quoted) command="CODEX_HOME=/unsafe 'codex'" ;;
+      escaped) command='CODEX_HOME=/unsafe co\de\x' ;;
+    esac
+
+    out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" \
+      "$id" "$PROJ_DIR" "$command")
+    status=$?
+    expect_code 1 "$status" "$case_name raw Codex launch must fail closed"
+    assert_contains "$out" "unsafe raw launch command" \
+      "$case_name raw Codex launch did not explain the refusal"
+    assert_absent "$HOME_DIR/state/$id.meta" "$case_name raw Codex launch must fail before task allocation"
+    if [ -e "$CASE_DIR/backend.log" ]; then
+      assert_no_grep "new-window -t firstmate" "$CASE_DIR/backend.log" \
+        "$case_name raw Codex launch must fail before endpoint allocation"
+    fi
+    [ ! -s "$LAUNCH_LOG" ] || fail "$case_name raw Codex launch must not launch Codex"
+  done
+  pass "quoted and escaped raw Codex launches fail closed"
+}
+
+test_quoted_raw_custom_launch_remains_supported() {
+  local command case_name rec id out status launch n=0
+  for case_name in quoted shell-variable env-option env-s shell-command builtin codex-model; do
+    n=$((n + 1))
+    id="profile-raw-custom-$n-z29"
+    rec=$(make_spawn_case "profile-raw-custom-$n" claude "$id")
+    read_case_record "$rec"
+    case "$case_name" in
+      quoted) command="custom-agent --prompt 'review this'" ;;
+      shell-variable) command="custom-agent --prompt \"\$PROMPT\"" ;;
+      env-option) command='env -i custom-agent --prompt review' ;;
+      env-s) command="env -S 'custom-agent --prompt review'" ;;
+      shell-command) command="sh -c 'custom-agent --prompt review'" ;;
+      builtin) command='builtin printf review' ;;
+      codex-model) command='custom-agent --model codex' ;;
+    esac
+    out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" \
+      "$id" "$PROJ_DIR" "$command" )
+    status=$?
+    expect_code 0 "$status" "$case_name raw custom launch should remain supported"
+    launch=$(cat "$LAUNCH_LOG")
+    assert_contains "$launch" "$command" \
+      "$case_name raw custom launch was not preserved"
+    assert_not_contains "$launch" "CODEX_HOME=" \
+      "$case_name raw custom launch was incorrectly normalized as Codex"
+  done
+  pass "quoted raw custom launches retain their existing behavior"
+}
+
+test_raw_custom_dynamic_execution_fails_closed() {
+  local command case_name rec id out status n=0
+  for case_name in command-substitution backticks process-substitution; do
+    n=$((n + 1))
+    id="profile-raw-custom-dynamic-$n-z59"
+    rec=$(make_spawn_case "profile-raw-custom-dynamic-$n" claude "$id")
+    read_case_record "$rec"
+    case "$case_name" in
+      command-substitution) command="custom-agent \"\$(CODEX_HOME=/unsafe codex)\"" ;;
+      backticks) command="custom-agent \"\`CODEX_HOME=/unsafe codex\`\"" ;;
+      process-substitution) command='custom-agent <(CODEX_HOME=/unsafe codex)' ;;
+    esac
+    out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" \
+      "$id" "$PROJ_DIR" "$command")
+    status=$?
+    expect_code 1 "$status" "$case_name raw custom launch must fail closed"
+    assert_contains "$out" "unsafe raw launch command" \
+      "$case_name raw custom launch did not explain the refusal"
+    assert_absent "$HOME_DIR/state/$id.meta" "$case_name raw custom launch must fail before task allocation"
+    [ ! -s "$LAUNCH_LOG" ] || fail "$case_name raw custom launch must not run Codex"
+  done
+  pass "raw custom dynamic execution fails closed"
+}
+
+test_raw_script_dispatches_fail_closed() {
+  local command case_name rec id out status n=0
+  for case_name in shell-multicommand relative-extensionless; do
+    n=$((n + 1))
+    id="profile-raw-script-$n-z75"
+    rec=$(make_spawn_case "profile-raw-script-$n" claude "$id")
+    read_case_record "$rec"
+    case "$case_name" in
+      shell-multicommand) command="sh -c 'true; CODEX_HOME=/unsafe codex'" ;;
+      relative-extensionless) command='./launch-worker --run' ;;
+    esac
+
+    out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" \
+      "$id" "$PROJ_DIR" "$command")
+    status=$?
+    expect_code 1 "$status" "$case_name raw script dispatch must fail closed"
+    assert_contains "$out" "unsafe raw launch command" \
+      "$case_name raw script dispatch did not explain the refusal"
+    assert_absent "$HOME_DIR/state/$id.meta" "$case_name raw script dispatch must fail before task allocation"
+    [ ! -s "$LAUNCH_LOG" ] || fail "$case_name raw script dispatch must not launch"
+  done
+  pass "raw script dispatches fail closed"
+}
+
+test_codex_crewmate_home_uses_private_directory() {
+  local rec id out status crew_home launch staging
+  id=profile-codex-home-staging-z28
+  rec=$(make_spawn_case profile-codex-home-staging codex "$id")
+  read_case_record "$rec"
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 0 "$status" "Codex spawn should create an isolated private home"
+  assert_grep 'O_NOFOLLOW' "$ROOT/bin/fm-codex-home.py" \
+    "Codex home construction must use no-follow file descriptors"
+  launch=$(cat "$LAUNCH_LOG")
+  crew_home=$(codex_home_from_launch "$launch")
+  [ -n "$crew_home" ] || fail "Codex launch did not expose its private home"
+  assert_contains "$launch" "exec python3 '$ROOT/bin/fm-codex-home.py' --create-activate" \
+    "Codex launch must activate its home through the descriptor-safe helper"
+  assert_not_contains "$launch" "CODEX_HOME=" \
+    "Codex launch must not pass a mutable CODEX_HOME pathname"
+  staging=
+  if [ -d "$HOME_DIR/data/codex-crewmate" ]; then
+    staging=$(find "$HOME_DIR/data/codex-crewmate" -maxdepth 1 -type d -name '.fm-codex-stage.*' -print -quit)
+  fi
+  [ -z "$staging" ] || fail "Codex home refresh left stale staging behind: $staging"
+  pass "Codex home refresh uses a private per-task directory"
+}
+
+test_codex_home_activation_uses_open_descriptor() {
+  local data source home result token out
+  data="$TMP_ROOT/codex-activation-data"
+  source="$TMP_ROOT/codex-activation-source"
+  mkdir -p "$data" "$source"
+  home="$data/codex-crewmate/$(python3 "$ROOT/bin/fm-codex-home.py" --data "$data" --new-home-name)"
+  result="$data/codex-crewmate/.fm-codex-activation.${home##*/}"
+  token=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+  out=$(python3 "$ROOT/bin/fm-codex-home.py" --create-activate --data "$data" --source "$source" \
+    --profile fm-crewmate-activation-z42 --worktree /tmp/fm-codex-activation --home "$home" --result-token "$token" -- /usr/bin/env)
+  assert_contains "$out" "CODEX_HOME=/dev/fd/" \
+    "Codex activation must retain an opened home descriptor"
+  assert_contains "$(cat "$result")" ready "Codex activation must report readiness before launch"
+  python3 "$ROOT/bin/fm-codex-home.py" --remove-activation-result --data "$data" --home "$home"
+  python3 "$ROOT/bin/fm-codex-home.py" --remove --data "$data" --home "$home"
+  assert_absent "$home" "descriptor-activated Codex home must remain removable"
+  pass "Codex activation passes a descriptor-backed home"
+}
+
+test_codex_home_activation_reports_exec_failure() {
+  local data source home result token out status
+  data="$TMP_ROOT/codex-activation-exec-failure-data"
+  source="$TMP_ROOT/codex-activation-exec-failure-source"
+  mkdir -p "$data" "$source"
+  home="$data/codex-crewmate/$(python3 "$ROOT/bin/fm-codex-home.py" --data "$data" --new-home-name)"
+  result="$data/codex-crewmate/.fm-codex-activation.${home##*/}"
+  token=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+  out=$(python3 "$ROOT/bin/fm-codex-home.py" --create-activate --data "$data" --source "$source" \
+    --profile fm-crewmate-exec-failure-z44 --worktree /tmp/fm-codex-exec-failure --home "$home" --result-token "$token" -- /definitely/missing/codex 2>&1)
+  status=$?
+  expect_code 1 "$status" "Codex activation must fail when its launch command cannot exec"
+  assert_contains "$(cat "$result")" failed "Codex activation must report exec failures as failed"
+  assert_absent "$home" "Codex activation must remove a home after an exec failure"
+  pass "Codex activation reports exec failures before ready"
+}
+
+test_codex_home_activation_refuses_replaced_path() {
+  local data source name home result token out status
+  data="$TMP_ROOT/codex-activation-race-data"
+  source="$TMP_ROOT/codex-activation-race-source"
+  mkdir -p "$data" "$source"
+  name=$(python3 "$ROOT/bin/fm-codex-home.py" --data "$data" --new-home-name)
+  home="$data/codex-crewmate/$name"
+  result="$data/codex-crewmate/.fm-codex-activation.${home##*/}"
+  token=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+  mkdir -p "$home"
+  out=$(python3 "$ROOT/bin/fm-codex-home.py" --create-activate --data "$data" --source "$source" \
+    --profile fm-crewmate-race-z43 --worktree /tmp/fm-codex-race --home "$home" --result-token "$token" -- /usr/bin/env 2>&1)
+  status=$?
+  expect_code 1 "$status" "Codex activation must reject a replaced planned home"
+  assert_contains "$out" "already exists" "Codex activation did not reject the replaced planned home"
+  assert_contains "$(cat "$result")" failed "Codex activation failure must report failure"
+  pass "Codex activation rejects replaced planned homes"
+}
+
+test_codex_home_activation_result_refuses_symlink() {
+  local data home result target token out status
+  data=$(mktemp -d "$TMP_ROOT/codex-activation-result.XXXXXXXX")
+  home="$data/codex-crewmate/.fm-codex-home.0123456789abcdef0123456789abcdef"
+  result="$data/codex-crewmate/.fm-codex-activation.${home##*/}"
+  target="$data/codex-crewmate/target"
+  mkdir -p "$data/codex-crewmate"
+  token=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+  printf 'ready %s\n' "$token" > "$target"
+  chmod 600 "$target"
+  ln -s target "$result"
+  out=$(python3 "$ROOT/bin/fm-codex-home.py" --read-activation-result --data "$data" --home "$home" --result-token "$token" 2>&1)
+  status=$?
+  expect_code 1 "$status" "Codex activation must reject a symlinked result"
+  assert_contains "$out" "result is unsafe" "Codex activation result reader accepted a symlink"
+  pass "Codex activation result reader rejects symlinks"
+}
+
+test_codex_home_activation_refuses_existing_result() {
+  local data source home result token out status
+  data=$(mktemp -d "$TMP_ROOT/codex-activation-existing-result.XXXXXXXX")
+  source="$TMP_ROOT/codex-activation-existing-result-source"
+  mkdir -p "$data/codex-crewmate" "$source"
+  home="$data/codex-crewmate/.fm-codex-home.0123456789abcdef0123456789abcdef"
+  result="$data/codex-crewmate/.fm-codex-activation.${home##*/}"
+  token=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+  printf 'ready %s\n' "$token" > "$result"
+  chmod 600 "$result"
+  out=$(python3 "$ROOT/bin/fm-codex-home.py" --create-activate --data "$data" --source "$source" \
+    --profile fm-crewmate-existing-result-z68 --worktree /tmp/fm-codex-existing-result --home "$home" --result-token "$token" -- /usr/bin/env 2>&1)
+  status=$?
+  expect_code 1 "$status" "Codex activation must refuse an existing result"
+  assert_contains "$out" "could not record isolated Codex home activation" \
+    "Codex activation did not report an existing result safely"
+  assert_absent "$home" "existing activation result must not create a Codex home"
+  pass "Codex activation refuses an existing managed result"
+}
+
+test_codex_home_activation_failure_aborts_spawn() {
+  local rec id out status task_tmp
+  id=profile-codex-home-activation-z45
+  rec=$(make_spawn_case profile-codex-home-activation codex "$id")
+  read_case_record "$rec"
+
+  out=$(FM_FAKE_ACTIVATION_RESULT=failed run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 1 "$status" "Codex spawn must fail when terminal activation fails"
+  assert_contains "$out" "isolated Codex home activation failed" \
+    "Codex spawn did not report terminal activation failure"
+  assert_absent "$HOME_DIR/state/$id.meta" "terminal activation failure must not retain task metadata"
+  assert_grep "treehouse return --force $WT_DIR" "$CASE_DIR/backend.log" \
+    "terminal activation failure did not return its worktree"
+  assert_grep "kill-window -t firstmate:fm-$id" "$CASE_DIR/backend.log" \
+    "terminal activation failure did not remove its task endpoint"
+  for task_tmp in "/tmp/fm-$id".*; do
+    [ ! -e "$task_tmp" ] || fail "terminal activation failure left task temporary root: $task_tmp"
+  done
+  pass "Codex spawn synchronizes terminal activation failures"
+}
+
+test_codex_activation_uses_managed_data_root() {
+  local rec id out status target legacy_path launch activation_result
+  id=profile-codex-activation-parent-z67
+  rec=$(make_spawn_case profile-codex-activation-parent codex "$id")
+  read_case_record "$rec"
+  target="$CASE_DIR/activation-target"
+  legacy_path="/tmp/fm-$id"
+  mkdir -p "$target"
+  rm -f "$legacy_path"
+  ln -s "$target" "$legacy_path" || fail "could not create predictable task-temp symlink"
+
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  rm -f "$legacy_path"
+  expect_code 0 "$status" "Codex spawn must not follow a predictable task-temp symlink"
+  launch=$(cat "$LAUNCH_LOG")
+  activation_result=$(codex_activation_result_from_launch "$launch")
+  assert_private_activation_result "$id" "$activation_result" "Codex activation did not use the managed data root"
+  assert_not_contains "$launch" "--result-file" \
+    "Codex activation must not pass a mutable task-temporary result path"
+  [ ! -e "$target/result" ] || fail "Codex activation followed the predictable task-temp symlink"
+  pass "Codex activation uses the descriptor-validated managed data root"
+}
+
+test_codex_teardown_preserves_failed_endpoint_metadata() {
+  local rec id out status launch crew_home target_state
+  id=profile-codex-failed-endpoint-z40
+  rec=$(make_spawn_case profile-codex-failed-endpoint codex "$id")
+  read_case_record "$rec"
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 0 "$status" "Codex spawn should prepare a failed-endpoint recovery case"
+  launch=$(cat "$LAUNCH_LOG")
+  crew_home=$(codex_home_from_launch "$launch")
+  materialize_codex_home "$crew_home" "$HOME_DIR/data" "$CASE_DIR/user/.codex" "fm-crewmate-$id" "$WT_DIR"
+  printf 'failed_spawn=1\nendpoint_cleanup_pending=1\n' >> "$HOME_DIR/state/$id.meta"
+  target_state="$CASE_DIR/target-state"
+  printf 'live\n' > "$target_state"
+
+  out=$(FM_ROOT_OVERRIDE='' FM_HOME="$HOME_DIR" FM_STATE_OVERRIDE="$HOME_DIR/state" \
+    FM_DATA_OVERRIDE="$HOME_DIR/data" FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" \
+    FM_CONFIG_OVERRIDE="$HOME_DIR/config" FM_FAKE_TARGET_STATE="$target_state" \
+    FM_FAKE_BACKEND_LOG="$CASE_DIR/backend.log" FM_FAKE_BACKEND_KILL_STATUS=75 PATH="$FAKEBIN_DIR:$PATH" \
+    "$TEARDOWN" "$id" --force 2>&1)
+  status=$?
+  expect_code 1 "$status" "teardown must retain failed-spawn metadata when endpoint close fails"
+  assert_contains "$out" "preserving recovery metadata" \
+    "teardown did not explain the retained failed-spawn recovery state"
+  [ -f "$HOME_DIR/state/$id.meta" ] || fail "failed endpoint teardown discarded recovery metadata"
+  [ -d "$crew_home" ] || fail "failed endpoint teardown removed the credential home before close confirmation"
+  pass "failed endpoint teardown retains recovery metadata until close succeeds"
+}
+
+test_codex_teardown_preserves_metadata_when_successful_close_leaves_endpoint_live() {
+  local rec id out status launch crew_home target_state
+  id=profile-codex-unconfirmed-endpoint-z68
+  rec=$(make_spawn_case profile-codex-unconfirmed-endpoint codex "$id")
+  read_case_record "$rec"
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 0 "$status" "Codex spawn should prepare an unconfirmed-endpoint recovery case"
+  launch=$(cat "$LAUNCH_LOG")
+  crew_home=$(codex_home_from_launch "$launch")
+  materialize_codex_home "$crew_home" "$HOME_DIR/data" "$CASE_DIR/user/.codex" "fm-crewmate-$id" "$WT_DIR"
+  printf 'failed_spawn=1\nendpoint_cleanup_pending=1\n' >> "$HOME_DIR/state/$id.meta"
+  target_state="$CASE_DIR/target-state"
+  printf 'live\n' > "$target_state"
+
+  out=$(FM_ROOT_OVERRIDE='' FM_HOME="$HOME_DIR" FM_STATE_OVERRIDE="$HOME_DIR/state" \
+    FM_DATA_OVERRIDE="$HOME_DIR/data" FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" \
+    FM_CONFIG_OVERRIDE="$HOME_DIR/config" FM_FAKE_TARGET_STATE="$target_state" \
+    FM_FAKE_BACKEND_LOG="$CASE_DIR/backend.log" FM_FAKE_BACKEND_CLOSE_EFFECT=none PATH="$FAKEBIN_DIR:$PATH" \
+    "$TEARDOWN" "$id" --force 2>&1)
+  status=$?
+  expect_code 1 "$status" "teardown must retain failed-spawn metadata when close reports success but endpoint remains live"
+  assert_contains "$out" "remains live after cleanup" \
+    "teardown did not explain the unconfirmed endpoint cleanup"
+  [ -f "$HOME_DIR/state/$id.meta" ] || fail "unconfirmed endpoint teardown discarded recovery metadata"
+  [ -d "$crew_home" ] || fail "unconfirmed endpoint teardown removed the credential home"
+  pass "failed endpoint teardown verifies successful cleanup removed the endpoint"
+}
+
+test_codex_teardown_preserves_metadata_when_endpoint_query_is_unavailable() {
+  local rec id out status launch crew_home target_state
+  id=profile-codex-unqueryable-endpoint-z76
+  rec=$(make_spawn_case profile-codex-unqueryable-endpoint codex "$id")
+  read_case_record "$rec"
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 0 "$status" "Codex spawn should prepare an unqueryable-endpoint recovery case"
+  launch=$(cat "$LAUNCH_LOG")
+  crew_home=$(codex_home_from_launch "$launch")
+  materialize_codex_home "$crew_home" "$HOME_DIR/data" "$CASE_DIR/user/.codex" "fm-crewmate-$id" "$WT_DIR"
+  printf 'failed_spawn=1\nendpoint_cleanup_pending=1\n' >> "$HOME_DIR/state/$id.meta"
+  target_state="$CASE_DIR/target-state"
+  printf 'live\n' > "$target_state"
+
+  out=$(FM_ROOT_OVERRIDE='' FM_HOME="$HOME_DIR" FM_STATE_OVERRIDE="$HOME_DIR/state" \
+    FM_DATA_OVERRIDE="$HOME_DIR/data" FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" \
+    FM_CONFIG_OVERRIDE="$HOME_DIR/config" FM_FAKE_TARGET_STATE="$target_state" \
+    FM_FAKE_TARGET_QUERY_STATUS=75 FM_FAKE_BACKEND_LOG="$CASE_DIR/backend.log" PATH="$FAKEBIN_DIR:$PATH" \
+    "$TEARDOWN" "$id" --force 2>&1)
+  status=$?
+  expect_code 1 "$status" "teardown must retain failed-spawn metadata when endpoint absence is unqueryable"
+  assert_contains "$out" "could not be confirmed absent" \
+    "teardown did not explain the unqueryable endpoint state"
+  [ -f "$HOME_DIR/state/$id.meta" ] || fail "unqueryable endpoint teardown discarded recovery metadata"
+  [ -d "$crew_home" ] || fail "unqueryable endpoint teardown removed the credential home"
+  pass "failed endpoint teardown requires confirmed absence"
+}
+
+test_codex_teardown_refuses_malformed_task_temp_metadata() {
+  local rec id out status launch crew_home unsafe_task_tmp meta
+  id=profile-codex-unsafe-tasktmp-z69
+  rec=$(make_spawn_case profile-codex-unsafe-tasktmp codex "$id")
+  read_case_record "$rec"
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 0 "$status" "Codex spawn should prepare a task-temp metadata case"
+  launch=$(cat "$LAUNCH_LOG")
+  crew_home=$(codex_home_from_launch "$launch")
+  materialize_codex_home "$crew_home" "$HOME_DIR/data" "$CASE_DIR/user/.codex" "fm-crewmate-$id" "$WT_DIR"
+  unsafe_task_tmp="$CASE_DIR/not-a-task-temp"
+  mkdir -p "$unsafe_task_tmp"
+  printf 'keep\n' > "$unsafe_task_tmp/sentinel"
+  meta="$HOME_DIR/state/$id.meta"
+  sed "s|^tasktmp=.*|tasktmp=$unsafe_task_tmp|" "$meta" > "$meta.next" && mv "$meta.next" "$meta"
+
+  out=$(FM_ROOT_OVERRIDE='' FM_HOME="$HOME_DIR" FM_STATE_OVERRIDE="$HOME_DIR/state" \
+    FM_DATA_OVERRIDE="$HOME_DIR/data" FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" \
+    FM_CONFIG_OVERRIDE="$HOME_DIR/config" FM_FAKE_TARGET_STATE="$CASE_DIR/target-state" \
+    FM_FAKE_BACKEND_LOG="$CASE_DIR/backend.log" PATH="$FAKEBIN_DIR:$PATH" \
+    "$TEARDOWN" "$id" --force 2>&1)
+  status=$?
+  expect_code 1 "$status" "teardown must refuse malformed task temporary metadata"
+  assert_contains "$out" "unsafe task temporary directory" \
+    "teardown did not explain the malformed task temporary metadata"
+  [ -f "$unsafe_task_tmp/sentinel" ] || fail "teardown removed a path supplied by task metadata"
+  [ -f "$meta" ] || fail "teardown discarded metadata after refusing an unsafe task temporary path"
+  [ -d "$crew_home" ] || fail "teardown performed cleanup after refusing unsafe task temporary metadata"
+  pass "teardown refuses malformed task temporary metadata"
+}
+
+test_codex_teardown_refuses_symlinked_data_root() {
+  local rec id out status launch crew_home data_root real_data target_state
+  id=profile-codex-teardown-data-symlink-z41
+  rec=$(make_spawn_case profile-codex-teardown-data-symlink codex "$id")
+  read_case_record "$rec"
+  out=$(run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 0 "$status" "Codex spawn should prepare a teardown data-root case"
+  launch=$(cat "$LAUNCH_LOG")
+  crew_home=$(codex_home_from_launch "$launch")
+  materialize_codex_home "$crew_home" "$HOME_DIR/data" "$CASE_DIR/user/.codex" "fm-crewmate-$id" "$WT_DIR"
+  data_root="$HOME_DIR/data"
+  real_data="$CASE_DIR/real-data"
+  mv "$data_root" "$real_data"
+  ln -s "$real_data" "$data_root"
+  target_state="$CASE_DIR/target-state"
+  printf 'gone\n' > "$target_state"
+
+  out=$(FM_ROOT_OVERRIDE='' FM_HOME="$HOME_DIR" FM_STATE_OVERRIDE="$HOME_DIR/state" \
+    FM_DATA_OVERRIDE="$data_root" FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" \
+    FM_CONFIG_OVERRIDE="$HOME_DIR/config" FM_FAKE_TARGET_STATE="$target_state" \
+    FM_FAKE_BACKEND_LOG="$CASE_DIR/backend.log" PATH="$FAKEBIN_DIR:$PATH" \
+    "$TEARDOWN" "$id" --force 2>&1)
+  status=$?
+  expect_code 1 "$status" "teardown must reject a symlinked data root"
+  [ -d "$crew_home" ] || fail "symlinked data-root cleanup deleted the managed home"
+  [ -f "$HOME_DIR/state/$id.meta" ] || fail "symlinked data-root cleanup discarded metadata"
+  pass "Codex teardown rejects symlinked data roots"
+}
+
+test_codex_crewmate_home_records_failed_worktree_return() {
+  local rec id out status project
+  id=profile-codex-home-return-z22
+  rec=$(make_spawn_case profile-codex-home-return codex "$id")
+  read_case_record "$rec"
+  project=$(cd "$PROJ_DIR" && pwd)
+  cat > "$FAKEBIN_DIR/python3" <<'SH'
+#!/usr/bin/env bash
+exit 73
+SH
+  chmod +x "$FAKEBIN_DIR/python3"
+
+  out=$(FM_FAKE_TREEHOUSE_RETURN_STATUS=75 \
+    run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 1 "$status" "Codex spawn must fail when private-home creation and return fail"
+  assert_grep "treehouse return --force $WT_DIR" "$CASE_DIR/backend.log" \
+    "failed isolated-home cleanup did not attempt to return its worktree"
+  assert_no_grep "kill-window -t firstmate:fm-$id" "$CASE_DIR/backend.log" \
+    "failed worktree return must leave the endpoint for normal teardown"
+  assert_grep "window=firstmate:fm-$id" "$HOME_DIR/state/$id.meta" \
+    "failed worktree return did not record the task endpoint"
+  assert_grep "worktree=$WT_DIR" "$HOME_DIR/state/$id.meta" \
+    "failed worktree return did not record the worktree"
+  assert_grep "project=$project" "$HOME_DIR/state/$id.meta" \
+    "failed worktree return did not record the project"
+  pass "Codex spawn records failed worktree returns for normal teardown"
+}
+
+test_codex_crewmate_home_records_failed_endpoint_removal() {
+  local rec id out status project
+  id=profile-codex-home-kill-z26
+  rec=$(make_spawn_case profile-codex-home-kill codex "$id")
+  read_case_record "$rec"
+  project=$(cd "$PROJ_DIR" && pwd)
+  cat > "$FAKEBIN_DIR/python3" <<'SH'
+#!/usr/bin/env bash
+exit 73
+SH
+  chmod +x "$FAKEBIN_DIR/python3"
+
+  out=$(FM_FAKE_TREEHOUSE_RETURN_STATUS=0 FM_FAKE_BACKEND_KILL_STATUS=76 FM_FAKE_TARGET_QUERY_STATUS=77 \
+    run_spawn "$HOME_DIR" "$WT_DIR" "$FAKEBIN_DIR" "$LAUNCH_LOG" "$id" "$PROJ_DIR")
+  status=$?
+  expect_code 1 "$status" "Codex spawn must fail when private-home creation and endpoint removal fail"
+  assert_grep "treehouse return --force $WT_DIR" "$CASE_DIR/backend.log" \
+    "failed isolated-home cleanup did not return its worktree"
+  assert_grep "kill-window -t firstmate:fm-$id" "$CASE_DIR/backend.log" \
+    "failed endpoint removal was not attempted"
+  assert_grep "window=firstmate:fm-$id" "$HOME_DIR/state/$id.meta" \
+    "failed endpoint removal did not record the task endpoint"
+  assert_grep "worktree=$WT_DIR" "$HOME_DIR/state/$id.meta" \
+    "failed endpoint removal did not record the worktree"
+  assert_grep "project=$project" "$HOME_DIR/state/$id.meta" \
+    "failed endpoint removal did not record the project"
+  [ ! -s "$LAUNCH_LOG" ] || fail "failed endpoint removal must not launch Codex"
+  pass "Codex spawn records failed endpoint removals for normal teardown"
+}
+
 test_codex_omits_invalid_max_effort() {
   local rec id out status launch
   id=profile-codex-max-z4
@@ -251,7 +1198,7 @@ test_codex_omits_invalid_max_effort() {
   expect_code 0 "$status" "codex spawn with unsupported max effort should omit the effort flag"
   assert_meta_profile "$HOME_DIR/state/$id.meta" codex gpt-5 max
   launch=$(cat "$LAUNCH_LOG")
-  assert_contains "$launch" "codex --model 'gpt-5' --dangerously-bypass-approvals-and-sandbox" \
+  assert_contains "$launch" "--model 'gpt-5' --dangerously-bypass-approvals-and-sandbox" \
     "codex launch did not preserve the model flag when max effort was omitted"
   assert_not_contains "$launch" "model_reasoning_effort" "codex launch must omit unsupported max reasoning effort"
   pass "codex omits unsupported max effort instead of passing a bad config value"
@@ -380,6 +1327,8 @@ test_active_dispatch_profile_does_not_block_secondmate_launch() {
   assert_contains "$out" "spawned $id harness=codex kind=secondmate" "secondmate launch did not use secondmate harness resolution"
   assert_grep "kind=secondmate" "$HOME_DIR/state/$id.meta" "secondmate meta missing kind=secondmate"
   assert_meta_profile "$HOME_DIR/state/$id.meta" codex default default
+  assert_not_contains "$(cat "$LAUNCH_LOG")" "CODEX_HOME=" \
+    "secondmate Codex launch must keep its existing CODEX_HOME behavior"
   pass "active crew-dispatch profile does not block secondmate launches"
 }
 
@@ -391,6 +1340,37 @@ test_active_dispatch_profile_allows_positional_harness
 test_active_dispatch_profile_allows_raw_launch_command
 test_claude_threads_model_and_effort
 test_codex_threads_model_and_effort
+test_codex_crewmate_home_excludes_mcp_and_plugins
+test_codex_crewmate_home_honors_codex_home_override
+test_codex_crewmate_home_uses_fresh_private_directory
+test_codex_crewmate_home_is_removed_at_teardown
+test_codex_crewmate_home_refuses_symlink_escape
+test_codex_crewmate_home_refuses_symlinked_data_root
+test_codex_crewmate_profile_rejects_toml_control_characters
+test_codex_crewmate_home_fails_when_private_home_creation_fails
+test_raw_codex_launch_is_normalized
+test_raw_codex_late_home_assignment_is_normalized
+test_raw_codex_options_fail_closed
+test_raw_codex_execution_wrappers_fail_closed
+test_quoted_or_escaped_raw_codex_launch_fails_closed
+test_quoted_raw_custom_launch_remains_supported
+test_raw_custom_dynamic_execution_fails_closed
+test_raw_script_dispatches_fail_closed
+test_codex_crewmate_home_uses_private_directory
+test_codex_home_activation_uses_open_descriptor
+test_codex_home_activation_reports_exec_failure
+test_codex_home_activation_refuses_replaced_path
+test_codex_home_activation_result_refuses_symlink
+test_codex_home_activation_refuses_existing_result
+test_codex_home_activation_failure_aborts_spawn
+test_codex_activation_uses_managed_data_root
+test_codex_teardown_preserves_failed_endpoint_metadata
+test_codex_teardown_preserves_metadata_when_successful_close_leaves_endpoint_live
+test_codex_teardown_preserves_metadata_when_endpoint_query_is_unavailable
+test_codex_teardown_refuses_malformed_task_temp_metadata
+test_codex_teardown_refuses_symlinked_data_root
+test_codex_crewmate_home_records_failed_worktree_return
+test_codex_crewmate_home_records_failed_endpoint_removal
 test_codex_omits_invalid_max_effort
 test_grok_threads_model_and_reasoning_effort
 test_grok_omits_invalid_max_reasoning_effort
diff --git a/tests/fm-tangle-guard.test.sh b/tests/fm-tangle-guard.test.sh
index a6f24eaa593..caea36f9658 100755
--- a/tests/fm-tangle-guard.test.sh
+++ b/tests/fm-tangle-guard.test.sh
@@ -182,7 +182,7 @@ run_spawn() {
     FM_PROJECTS_OVERRIDE="$home/projects" FM_CONFIG_OVERRIDE="$home/config" \
     FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$pane" TMUX="fake,1,0" \
     PATH="$fakebin:$PATH" \
-    "$ROOT/bin/fm-spawn.sh" "$id" "$proj" codex 2>&1
+    "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude 2>&1
 }
 
 test_spawn_isolation_abort() {
@@ -262,7 +262,7 @@ run_spawn_record() {
     FM_SPAWN_NO_GUARD=1 FM_FAKE_PANE_PATH="$pane" TMUX="fake,1,0" \
     FM_TMUX_REC="$rec" \
     PATH="$fakebin:$PATH" \
-    "$ROOT/bin/fm-spawn.sh" "$id" "$proj" codex 2>&1
+    "$ROOT/bin/fm-spawn.sh" "$id" "$proj" claude 2>&1
 }
 
 test_spawn_tmux_window_construction() {