diff --git a/tests/restart-chaos/README.md b/tests/restart-chaos/README.md
index 393d5fe9848..14207e23782 100644
--- a/tests/restart-chaos/README.md
+++ b/tests/restart-chaos/README.md
@@ -31,7 +31,7 @@ are wired (see the TODO in `seed.ts`).
 | File | Role |
 | --- | --- |
 | `supervisor.ts` | Owns the server. Reuses `tests/runner-e2e` process code (config, ports, env isolation, wrapper-owned Postgres, process-tree stopper, `replaceController`). Faults: K1 SIGKILL + immediate restart, K2 SIGTERM + restart, K4 SIGKILL + 2–5 min hold. The controller runtime cache is kept (discarding it is K11). |
-| `seed.ts` | Chaos Lab company, encrypted provider secrets, native Codex / ACPX Claude / OpenCode agents from the runner-e2e catalog, and the `chaos-sandbox` project (git repo: python CLI, one failing test, `bench.sh` ≈ 4 min) with isolated git-worktree workspaces. |
+| `seed.ts` | Chaos Lab company, encrypted provider secrets, native Codex / ACPX Claude / OpenCode agents from the runner-e2e catalog, and the `chaos-sandbox` project (git repo: python CLI, one failing test, `bench.sh` ≈ 4 min) with isolated git-worktree workspaces. It first turns on the instance `enableIsolatedWorkspaces` setting; without it the server ignores the project policy and every repo task shares the primary checkout. |
 | `scheduler.ts` | Seeded plan: workload × adapter × fault cells and a random fire time per task. Saved to `results/<wave>/plan.json`. `--replay` reruns one task alone with the same choices and fires the recorded sequence of faults that crossed it (other tasks' faults included) at the same offsets from launch. |
 | `observer.ts` | Polls each issue and its runs. When a task rests needing Retry it calls `POST /api/issues/:id/retry` once, with the body `useTaskRetry.ts` sends. Collects T-oracle artifacts and the R6 sweep. |
 | `grader.ts` | Pure R1–R6 grading over the samples. |
diff --git a/tests/restart-chaos/seed.test.ts b/tests/restart-chaos/seed.test.ts
new file mode 100644
index 00000000000..25e4c348844
--- /dev/null
+++ b/tests/restart-chaos/seed.test.ts
@@ -0,0 +1,68 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { ChaosApi } from "./api.js";
+import { seedChaosLab } from "./seed.js";
+import { Timeline } from "./timeline.js";
+
+type Call = { method: string; route: string; body?: unknown };
+
+/** Records the seed's board API calls; answers like a fresh local_trusted instance. */
+function fakeApi(experimentalResponse: (body: Record<string, unknown>) => Record<string, unknown>) {
+  const calls: Call[] = [];
+  let ids = 0;
+  const api = {
+    get: async (route: string) => {
+      calls.push({ method: "GET", route });
+      if (route.includes("/environments")) return [{ id: "environment-1", driver: "local" }];
+      throw new Error(`unexpected GET ${route}`);
+    },
+    post: async (route: string, body?: unknown) => {
+      calls.push({ method: "POST", route, body });
+      return { id: `id-${++ids}`, name: "x" };
+    },
+    patch: async (route: string, body?: unknown) => {
+      calls.push({ method: "PATCH", route, body });
+      if (route === "/api/instance/settings/experimental") return experimentalResponse(body as Record<string, unknown>);
+      throw new Error(`unexpected PATCH ${route}`);
+    },
+  };
+  return { api: api as unknown as ChaosApi, calls };
+}
+
+describe("seedChaosLab workspace isolation", () => {
+  let fixtureRoot: string;
+  beforeEach(async () => {
+    fixtureRoot = await mkdtemp(path.join(os.tmpdir(), "rc21-seed-"));
+    vi.stubEnv("OPENAI_API_KEY", "test-only-not-a-key");
+  });
+  afterEach(async () => {
+    vi.unstubAllEnvs();
+    await rm(fixtureRoot, { recursive: true, force: true });
+  });
+
+  const seed = (api: ChaosApi) => seedChaosLab({ api, env: "local", adapters: ["codex"], concurrency: 2,
+    budgetCents: 3_000, fixtureRoot, waveId: "w-test", timeline: new Timeline(null) });
+
+  // RC-21: the project's git_worktree policy is gated behind the instance's
+  // isolated-workspaces setting. Without it every repo task ran in the shared
+  // primary checkout, so concurrent tasks wrote into one tree.
+  it("enables isolated workspaces before creating the git_worktree project", async () => {
+    const { api, calls } = fakeApi(body => ({ ...body }));
+    await seed(api);
+    const enable = calls.findIndex(call => call.method === "PATCH" && call.route === "/api/instance/settings/experimental"
+      && (call.body as Record<string, unknown>).enableIsolatedWorkspaces === true);
+    const project = calls.findIndex(call => call.method === "POST" && call.route.endsWith("/projects"));
+    expect(enable).toBeGreaterThanOrEqual(0);
+    expect(project).toBeGreaterThan(enable);
+    expect((calls[project]!.body as { executionWorkspacePolicy: unknown }).executionWorkspacePolicy)
+      .toMatchObject({ enabled: true, defaultMode: "isolated_workspace", workspaceStrategy: { type: "git_worktree" } });
+  });
+
+  it("refuses to seed when the instance does not confirm isolated workspaces", async () => {
+    const { api, calls } = fakeApi(() => ({ enableIsolatedWorkspaces: false }));
+    await expect(seed(api)).rejects.toThrow(/isolated workspaces/i);
+    expect(calls.some(call => call.method === "POST" && call.route.endsWith("/projects"))).toBe(false);
+  });
+});
diff --git a/tests/restart-chaos/seed.ts b/tests/restart-chaos/seed.ts
index b9ee5f26c93..2799fb2384f 100644
--- a/tests/restart-chaos/seed.ts
+++ b/tests/restart-chaos/seed.ts
@@ -102,6 +102,16 @@ export async function seedChaosLab(input: {
     timeline.add("seed_agent", { adapter, agentId: created.id, profile: profile.id, model: profile.model });
   }
 
+  // The project's git_worktree policy only takes effect when the instance has
+  // isolated workspaces enabled (the Experimental setting users turn on, as in
+  // runner-e2e). Without it every repo task shares the primary checkout (RC-21).
+  const experimental = await api.patch<{ enableIsolatedWorkspaces?: boolean }>(
+    "/api/instance/settings/experimental", { enableIsolatedWorkspaces: true });
+  if (experimental?.enableIsolatedWorkspaces !== true) {
+    throw new Error("Isolated instance did not enable isolated workspaces; repo tasks would share one checkout");
+  }
+  timeline.add("seed_isolated_workspaces", { enableIsolatedWorkspaces: true });
+
   const project = await api.post<{ id: string }>(`/api/companies/${company.id}/projects`, {
     name: "chaos-sandbox",
     description: "Fixture repository for restart chaos workloads",