codex --profile silently falls back when profile file is missing

Symptom

Selecting a profile whose standalone config file does not exist is silently ignored. Codex continues with the base user configuration, runs the review, and exits 0.

The startup preamble makes the fallback visible only after the fact:

model: gpt-5.6-sol
provider: openai

This is dangerous for automation that uses named profiles to select a provider/model or enforce a cost boundary.

Repro

Environment:

• Codex CLI 0.149.0
• macOS
• base user config selects the OpenAI provider/model
• $CODEX_HOME/aut500-profile-does-not-exist.config.toml does not exist

From a clean Git repository:

codex -p aut500-profile-does-not-exist review --base main
echo "$?"

Observed:

• no missing-profile error or warning
• base provider/model selected
• review runs normally
• exit status 0

Expected:

• a non-zero configuration error naming the missing profile file, or an explicit opt-in fallback flag

Why this matters

A caller cannot safely use --profile as a routing contract. A typo, incomplete machine setup, or deleted profile can silently spend a different quota and produce evidence under the wrong model/provider.

Suggested fixes

Fail closed when an explicitly named profile file does not exist. If backward compatibility requires fallback, emit a machine-detectable warning and provide a strict-profile option.

Discovered

While validating Touchstone local-review profile routing on 2026-08-23.