diff --git a/.changeset/codex-launch-defaults.md b/.changeset/codex-launch-defaults.md
deleted file mode 100644
index 66f61efd..00000000
--- a/.changeset/codex-launch-defaults.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'aicodeman': minor
----
-
-Add synced Codex default model and reasoning effort controls to App Settings. Apply defaults to new local sessions (including WSL) while preserving explicit launch settings, custom endpoints, Docker and remote commands, and Codex configuration when defaults are empty.
diff --git a/docs/wiki/Agent-CLIs.md b/docs/wiki/Agent-CLIs.md
index 09f0dee0..ea8bdeca 100644
--- a/docs/wiki/Agent-CLIs.md
+++ b/docs/wiki/Agent-CLIs.md
@@ -133,7 +133,8 @@ Integration detail: [`docs/opencode-integration.md`](https://github.com/Ark0N/Co
 App Settings has synced **Default Codex model** and **Default Codex reasoning effort**
 controls. Enter a model ID supported by your Codex provider; available reasoning levels
 depend on the model and CLI version. Empty defaults use Codex's own configuration.
-The defaults apply when creating local sessions (including WSL), including HTTP API launches.
+The defaults apply to local Codex sessions started from the Run menu, from Resume, and through
+`POST /api/sessions` or `/api/quick-start`; scheduled (cron) jobs do not use them.
 Explicit `codexConfig.model` / `codexConfig.reasoningEffort` values take precedence.
 Custom model endpoints, Docker containers and remote host command overrides keep their own settings.
 Changing a default affects new sessions and does not edit Codex configuration files.
diff --git a/docs/wiki/Settings-Reference.md b/docs/wiki/Settings-Reference.md
index 4c899732..20b65e45 100644
--- a/docs/wiki/Settings-Reference.md
+++ b/docs/wiki/Settings-Reference.md
@@ -133,7 +133,9 @@ instead of its native cloud backend. See [Custom Model Endpoints](Custom-Model-E
 | Codeman Agent Skill              | Injects the agent skill into new Claude sessions per case. Off by default. See [Driving Codeman From An Agent](Driving-Codeman-From-An-Agent). |
 | Remote auto-reconnect            | Reattaches dropped remote SSH sessions. On by default.                                         |
 | Nice priority / value            | Runs agent processes at a lower CPU priority.                                                  |
-| Bypass approvals and sandbox     | Pi's project trust. Read [Agent CLIs](Agent-CLIs) before enabling.                             |
+| Default Codex model              | Model for new local Codex sessions; empty uses Codex's own config. Letters, digits, `.` `_` `-` `/` only. |
+| Default Codex reasoning effort   | Reasoning level for new local Codex sessions; empty uses Codex's own config.                   |
+| Bypass approvals and sandbox     | Starts new Codex sessions with `--dangerously-bypass-approvals-and-sandbox`. Read [Agent CLIs](Agent-CLIs) before enabling. |
 | Animated status effects          | Cosmetic.                                                                                      |
 | MCP server sync                  | Copies the MCP servers each installed, enabled CLI (Claude, Codex, Gemini, OpenCode, Antigravity) has into the others' own config files. Synced, off by default, admin only in multi-user mode. Turn it on and save, then **Preview** shows what would change and **Sync now** applies it. It only adds missing servers, keeps the previous file as `.codeman-bak`, and leaves a file that receives env values or headers readable by you only. A config dir moved by `CODEX_HOME`, `CLAUDE_CONFIG_DIR`, `XDG_CONFIG_HOME` or `GEMINI_CLI_HOME` in Codeman's own environment is followed. |
 
diff --git a/src/web/codex-launch-defaults.ts b/src/web/codex-launch-defaults.ts
index 24f25b40..43a059e9 100644
--- a/src/web/codex-launch-defaults.ts
+++ b/src/web/codex-launch-defaults.ts
@@ -1,3 +1,16 @@
+/**
+ * @fileoverview Launch-time defaults for Codex sessions.
+ *
+ * Resolves the synced App Settings `codexModel` / `codexReasoningEffort` into the
+ * `codexConfig` a launch uses, filling ONLY the fields the caller left unset.
+ * Persisted values are re-validated with `SettingsUpdateSchema`, so a hand-edited
+ * settings.json can never smuggle an unchecked value onto the codex command line.
+ *
+ * Scope is the caller's decision: the create and quick-start routes apply it to
+ * local launches only, never to remote, Docker or custom-endpoint launches.
+ * Nothing here writes Codex's own config files.
+ */
+
 import type { CodexConfig } from '../types.js';
 import { SettingsUpdateSchema } from './schemas.js';
 import { readJsonConfig, SETTINGS_PATH } from './route-helpers.js';
diff --git a/src/web/public/i18n.js b/src/web/public/i18n.js
index 1e0dd92a..9f791263 100644
--- a/src/web/public/i18n.js
+++ b/src/web/public/i18n.js
@@ -52,6 +52,8 @@
       '新本地 Codex 会话（包括 WSL）使用的模型 ID。留空时使用 Codex 配置。',
     'Applies to new local sessions; supported levels depend on the model and Codex version. Custom endpoints, Docker and remote sessions keep their own settings.':
       '应用于新本地会话；可用强度取决于模型和 Codex 版本。自定义端点、Docker 和远程会话保留自己的设置。',
+    'Default Codex model may only contain letters, digits, ".", "_", "-" and "/"':
+      'Codex 默认模型只能包含字母、数字、"."、"_"、"-" 和 "/"',
     'Skip to terminal': '跳转到终端',
     'Go to main page': '返回主页',
     'Session tabs': '会话标签页',
diff --git a/src/web/public/index.html b/src/web/public/index.html
index c5ba68fb..f199eba2 100644
--- a/src/web/public/index.html
+++ b/src/web/public/index.html
@@ -2586,14 +2586,14 @@
               <div class="set-group" id="appSettingsCodexGroup">
                 <div class="set-group-head"><h4>Codex</h4><span class="set-scope">synced</span></div>
                 <div class="set-group-body">
-                  <div class="set-row" data-search="codex default model">
+                  <div class="set-row has-field" data-search="codex default model">
                     <div class="set-row-text">
                       <span class="set-row-label">Default Codex model</span>
                       <span class="set-row-desc">Model ID for new local Codex sessions, including WSL. Leave empty to use Codex configuration.</span>
                     </div>
                     <input id="appSettingsCodexModel" class="set-input" type="text" maxlength="100" aria-label="Default Codex model" placeholder="Use Codex configuration" autocomplete="off" spellcheck="false">
                   </div>
-                  <div class="set-row" data-search="codex default reasoning effort thinking">
+                  <div class="set-row has-field" data-search="codex default reasoning effort thinking">
                     <div class="set-row-text">
                       <span class="set-row-label">Default Codex reasoning effort</span>
                       <span class="set-row-desc">Applies to new local sessions; supported levels depend on the model and Codex version. Custom endpoints, Docker and remote sessions keep their own settings.</span>
diff --git a/src/web/public/settings-ui.js b/src/web/public/settings-ui.js
index bafe75b4..0edbd4fd 100644
--- a/src/web/public/settings-ui.js
+++ b/src/web/public/settings-ui.js
@@ -2607,6 +2607,15 @@ Object.assign(CodemanApp.prototype, {
       },
     };
 
+    // SettingsUpdateSchema is .strict() and checks codexModel with this same
+    // pattern, so one bad character 400s the WHOLE settings PUT while the toast
+    // still says "Settings saved". Refuse it here, before anything is persisted.
+    if (!/^[A-Za-z0-9._\/-]*$/.test(settings.codexModel)) {
+      this.showToast('Default Codex model may only contain letters, digits, ".", "_", "-" and "/"', 'error');
+      document.getElementById('appSettingsCodexModel')?.focus();
+      return;
+    }
+
     // The "Token Count" / "Show Cost ($)" header toggles were removed from the
     // UI, but their features still read settings.showTokenCount / settings.showCost
     // (applyHeaderVisibilitySettings, the header cost render). saveAppSettings