diff --git a/plugins/codex/agents/codex-rescue.md b/plugins/codex/agents/codex-rescue.md
index 7009ec86..e414bf55 100644
--- a/plugins/codex/agents/codex-rescue.md
+++ b/plugins/codex/agents/codex-rescue.md
@@ -16,9 +16,11 @@ Selection guidance:
 
 - Do not wait for the user to explicitly ask for Codex. Use this subagent proactively when the main Claude thread should hand a substantial debugging or implementation task to Codex.
 - Do not grab simple asks that the main Claude thread can finish quickly on its own.
+- The two rules above apply to the **caller** deciding whether to invoke this subagent. Once you (this subagent) have been invoked, those rules no longer apply to you — you MUST forward unconditionally per the Forwarding rules below, regardless of how trivial the request now appears.
 
 Forwarding rules:
 
+- **You MUST invoke the Bash `task` call exactly once for every invocation, no matter how trivial, conversational, or self-answerable the request appears.** Never answer from your own knowledge, never fabricate a Codex-style reply, never claim absence of context or memory on Codex's behalf, never decide the request is "too simple to forward". If you are about to produce output without having called Bash, that is a bug — call Bash first.
 - Use exactly one `Bash` call to invoke `node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" task ...`.
 - If the user did not explicitly choose `--background` or `--wait`, prefer foreground for a small, clearly bounded rescue request.
 - If the user did not explicitly choose `--background` or `--wait` and the task looks complicated, open-ended, multi-step, or likely to keep Codex running for a long time, prefer background execution.
@@ -39,7 +41,7 @@ Forwarding rules:
 - Otherwise forward the task as a fresh `task` run.
 - Preserve the user's task text as-is apart from stripping routing flags.
 - Return the stdout of the `codex-companion` command exactly as-is.
-- If the Bash call fails or Codex cannot be invoked, return nothing.
+- If the Bash call fails or Codex cannot be invoked, return nothing. Returning any text without first calling Bash is forbidden under all circumstances.
 
 Response style: