Normal lifecycle commands now run Codex inside each test agent’s own unprivileged container. Sends use an author-bound messenger control endpoint; receiver receipts prevent automatic resubmission after ambiguous queue acceptance. A bounded listener readiness check prevents cold-start TUI connection failures.
Stacked on accepted tests PR #6. The linked tests PR follows this product branch. Nix runtime/configuration is a separate paired stack in notplants-nix. This is PLAN M7; branch sequence m9 does not mean backlog phase M9.
Validation on b1: both final-code real-model Git and Space gates passed exchange/marks, stopped-recipient failure/refusal, recovery and full restart without reinjection. 259 Python tests, 2 helper + 14 CLI + 1 SAP spike Go tests, all Go builds and five Nix/live checks passed with no skips. See docs/CONTAINER-INTEGRATION.md for pins, commands, evidence and failed-run corrections.
Limits: shared kernel/trusted host, explicitly authorized shared read-only test model login, and manual reconciliation of unresolved acceptance receipts. 131.441 MiB is settled single-backend post-turn RSS, not peak capacity. Old resume characterization remains parked/unclassified. Independent review is required; do not merge this fork automatically.
Paired tests: #8. Runtime stack: Nix product #60 → tests #61.