diff --git a/Cargo.lock b/Cargo.lock
index 66984c6b..303cabe6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -285,6 +285,7 @@ dependencies = [
  "crossterm",
  "globset",
  "ignore",
+ "landlock",
  "libc",
  "regex",
  "reqwest",
@@ -388,6 +389,26 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c34f04666d835ff5d62e058c3995147c06f42fe86ff053337632bca83e42702d"
 
+[[package]]
+name = "enumflags2"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
+dependencies = [
+ "enumflags2_derive",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -810,7 +831,7 @@ version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "82cb6a9f675da968c63b6208c641b9dca58fc0133ae53375736b1767b0cab8bd"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -836,6 +857,17 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "landlock"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cca98e95f35b29d469dade6724c6f96cec9236640f745a0e99b0334ec320ab1"
+dependencies = [
+ "enumflags2",
+ "libc",
+ "thiserror",
+]
+
 [[package]]
 name = "libc"
 version = "0.2.186"
diff --git a/Cargo.toml b/Cargo.toml
index d4266b9d..f946b36b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -60,3 +60,6 @@ required-features = ["gui"]
 name = "gui_server"
 path = "tests/gui_server.rs"
 required-features = ["gui"]
+
+[target.'cfg(target_os = "linux")'.dependencies]
+landlock = "0.4"
diff --git a/SECURITY.md b/SECURITY.md
index b113ede1..d3faa07c 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -77,10 +77,15 @@ before the shell starts.
     an inode outside the workspace can still be written through. Seatbelt decides
     by path, so it allows writing the workspace path even though the inode lives
     outside; the sandbox only denies *creating* a new hardlink to an outside
-    inode.
+    inode. On Linux that creation needs Landlock ABI2 (kernel 5.19); on an older
+    kernel the link is not closed and is named in the `bash_sandbox_status`
+    reason.
 - Backend availability is probed once at run start. On macOS the backend is
   Seatbelt through `sandbox-exec`; under a nested sandbox it reports `rc=71` and
-  is unavailable. Other platforms have no backend in this stage.
+  is unavailable. On Linux the backend is Landlock; it requires ABI1 (kernel
+  5.13) and is unavailable below that, when Landlock is disabled, or when a
+  seccomp filter denies the ruleset syscalls. Other platforms have no backend in
+  this stage.
 - `auto` continues with lexical checks only when the backend is unavailable,
   warns once at startup, and records `bash_sandbox_status` with `applied=false`
   and a reason. `required` instead fails Bash and verifier commands with
@@ -88,8 +93,9 @@ before the shell starts.
   reports "sandboxed" when the sandbox was not applied.
 - The dependency caches (cargo registry/git/package-cache, npm, pip, Playwright
   browsers) stay writable so builds and tests work; they remain a contamination
-  path outside the workspace. pnpm and yarn stores are not allowed in this
-  stage.
+  path outside the workspace. On macOS they live under `~/Library/Caches` and
+  `~/.cargo`; on Linux under `~/.cargo`, `~/.npm`, and `~/.cache`. pnpm and yarn
+  stores are not allowed in this stage.
 
 macOS `mktemp` ignores `TMPDIR` and targets the per-user temp directory, which
 the sandbox denies. A `mktemp` inside the run temp directory (`mktemp -p
diff --git a/docs/guide/README.md b/docs/guide/README.md
index 3107b3a5..76940754 100644
--- a/docs/guide/README.md
+++ b/docs/guide/README.md
@@ -25,7 +25,7 @@ Recommended route / 推奨順路:
   Trial, Gate 1, and separate status, history, and result pages
 - [Extensions](en/extensions.md) — four layers, boundaries, registration, and
   the supply lifecycle
-- [CLI reference](en/cli-reference.md) — all 66 public flags, defaults, and
+- [CLI reference](en/cli-reference.md) — all 67 public flags, defaults, and
   conflicts
 - [Plan YAML editing](en/plan-yaml.md) — commented templates, offline
   validation, next commands, and recovery diffs
@@ -53,7 +53,7 @@ walkthrough. Read the [security model](../../SECURITY.md) before enabling
 - [GUI 入門](../user/getting-started-gui.md) — 前提確認、サンプル Trial、Gate 1、
   分離された実行状況・履歴・結果ページ
 - [拡張](ja/extensions.md) — 4 レイヤー、境界、登録導線、供給ライフサイクル
-- [CLI リファレンス](ja/cli-reference.md) — 公開されている全 66 フラグ、既定値、排他関係
+- [CLI リファレンス](ja/cli-reference.md) — 公開されている全 67 フラグ、既定値、排他関係
 - [Plan YAML の編集](ja/plan-yaml.md) — コメント付き template、offline 検証、次コマンド、
   recovery 差分
 - [スラッシュコマンド](ja/slash-commands.md) — 一般レジストリで受け付ける全 24 コマンド名と
diff --git a/docs/guide/en/cli-reference.md b/docs/guide/en/cli-reference.md
index 83d14b1a..ca1cb51f 100644
--- a/docs/guide/en/cli-reference.md
+++ b/docs/guide/en/cli-reference.md
@@ -23,7 +23,7 @@ before parsing finishes or in the resolved configuration after parsing; see
 [Conflicts and combinations](#conflicts-and-combinations).
 
 Clap also generates `-h`/`--help` and `-V`/`--version`. They are not part of the
-66 application flags below. The hidden `--completion-contract-json <PATH>` is an
+67 application flags below. The hidden `--completion-contract-json <PATH>` is an
 internal integration surface and is intentionally not a public user flag.
 
 ## Flag reference
@@ -79,6 +79,7 @@ internal integration surface and is intentionally not a public user flag.
 | `--style` | `<STYLE>` | `default` | Pass the plan presentation/generation style. | [Inline flags](slash-commands.md#inline-flags) |
 | `--resume` | `<RESUME>` | none | Load the named saved minimal-loop session for a direct `--prompt` run. | [Session options](#conflicts-and-combinations) |
 | `--offline` | none | off | Block runtime dependency setup and Bash commands containing npm/pnpm/yarn/cargo install, curl, or wget. Provider/API requests and other network-capable commands are unaffected. | [Providers](providers.md) |
+| `--sandbox` | `<auto\|required\|off>` | `auto` | Select the OS write sandbox for Bash and verifier commands. `auto` applies it when the backend is available and otherwise continues with lexical checks only; `required` fails those commands when the backend is unavailable; `off` keeps the previous behavior. | [OS write sandbox](#os-write-sandbox) |
 | `--quiet` | none | off (`narration = "normal"`) | Suppress presentation narration. | [Top-level keys](configuration.md#top-level-keys) |
 | `--summary-json` | none | off | Append one machine-readable terminal run summary as the final stdout line. Omitting it preserves existing stdout bytes. | [Headless execution](../../user/headless.md) |
 | `--trace` | none | off | Opt in to scrubbed provider request and response traces under the active run directory. | [Troubleshooting](troubleshooting.md) |
@@ -99,7 +100,7 @@ internal integration surface and is intentionally not a public user flag.
 
 ## OS write sandbox
 
-The hidden `--sandbox auto|required|off` flag (default `auto`) controls an
+The `--sandbox auto|required|off` flag (default `auto`) controls an
 OS-level write sandbox for the model Bash tool and for verification/acceptance
 commands. The lexical checks still run first; the sandbox adds confinement for
 writes the lexical guard cannot see.
@@ -117,9 +118,10 @@ writes the lexical guard cannot see.
 - **Modes:** `auto` uses the backend when available and otherwise warns once and
   records `bash_sandbox_status` with `applied=false` and a reason, continuing
   with lexical checks only; `required` fails Bash and verifier commands with
-  `bash_sandbox_unavailable`; `off` keeps the previous behavior. The backend is
-  unavailable under a nested sandbox (`rc=71`) and on a platform without one
-  (macOS only in this stage).
+  `bash_sandbox_unavailable`; `off` keeps the previous behavior. On macOS the
+  backend is Seatbelt and is unavailable under a nested sandbox (`rc=71`); on
+  Linux it is Landlock and is unavailable below ABI1 (kernel 5.13), when
+  disabled, or when a seccomp filter denies it.
 - Dependency caches (cargo, npm, pip, Playwright browsers) stay writable so
   builds and tests work; they remain a contamination path outside the workspace.
 
diff --git a/docs/guide/ja/cli-reference.md b/docs/guide/ja/cli-reference.md
index dc61a153..5abe8588 100644
--- a/docs/guide/ja/cli-reference.md
+++ b/docs/guide/ja/cli-reference.md
@@ -22,7 +22,7 @@
 [排他関係と組み合わせ](#排他関係と組み合わせ)を参照してください。
 
 Clap が生成する `-h`/`--help` と `-V`/`--version` は、以下のアプリケーション固有の
-66 フラグには含めません。非表示の `--completion-contract-json <PATH>` は内部連携用であり、
+67 フラグには含めません。非表示の `--completion-contract-json <PATH>` は内部連携用であり、
 公開ユーザーフラグではありません。
 
 ## フラグ一覧
@@ -78,6 +78,7 @@ Clap が生成する `-h`/`--help` と `-V`/`--version` は、以下のアプリ
 | `--style` | `<STYLE>` | `default` | plan の表示／生成スタイルを渡します。 | [インラインフラグ](slash-commands.md#インラインフラグ) |
 | `--resume` | `<RESUME>` | なし | 直接 `--prompt` 実行で、指定した保存済み minimal-loop セッションを読み込みます。 | [セッションオプション](#排他関係と組み合わせ) |
 | `--offline` | なし | オフ | runtime の依存関係セットアップと、npm/pnpm/yarn/cargo install、curl、wget を含む Bash コマンドを禁止します。provider/API 要求とその他のネットワーク可能なコマンドには影響しません。 | [プロバイダ](providers.md) |
+| `--sandbox` | `<auto\|required\|off>` | `auto` | モデルの Bash ツールと検証・受け入れコマンドに対する OS レベルの書き込みサンドボックスを選びます。`auto` は backend が使えれば適用し、使えなければ字句検査だけで続けます。`required` は backend が使えないときに対象コマンドを失敗させます。`off` は今までの挙動を保ちます。 | [OS 書き込みサンドボックス](#os-書き込みサンドボックス) |
 | `--quiet` | なし | オフ（`narration = "normal"`） | プレゼンテーションのナレーションを抑制します。 | [トップレベルキー](configuration.md#トップレベルキー) |
 | `--summary-json` | なし | オフ | stdout 最終行へ機械可読な終端runサマリを1件追加します。省略時は既存stdout bytesを維持します。 | [Headless execution](../../user/headless.md) |
 | `--trace` | なし | オフ | active run の `trace/` directory に scrub 済み provider exchange を opt-in 保存します。 | [トラブルシューティング](troubleshooting.md) |
@@ -98,11 +99,11 @@ Clap が生成する `-h`/`--help` と `-V`/`--version` は、以下のアプリ
 
 ## OS 書き込みサンドボックス
 
-隠しフラグ `--sandbox auto|required|off`（既定 `auto`）は、モデルの Bash ツールと検証・受け入れコマンドに対する OS レベルの書き込みサンドボックスを制御します。字句検査は先に働き、サンドボックスは字句検査から見えない書き込みを閉じ込めます。
+フラグ `--sandbox auto|required|off`（既定 `auto`）は、モデルの Bash ツールと検証・受け入れコマンドに対する OS レベルの書き込みサンドボックスを制御します。字句検査は先に働き、サンドボックスは字句検査から見えない書き込みを閉じ込めます。
 
 - **OS が閉じるもの（backend が使えるとき）：** コマンドやスクリプトの中の書き込み — `sh -c 'cp ...'`、`eval`、`xargs`、`find -exec`、インタープリタの `open(..., 'w')`、`dd of=`、`sed -i` — と、workspace の外の inode への hardlink です。書き込めるのは、workspace・run の一時ディレクトリ・既知の依存キャッシュ・`/dev/null` などのデバイスだけです。
 - **字句検査だけのもの：** 読み取り、ネットワーク、backend が使えないときの全コマンドです。`--yes`・`--allow bash:verify`・`--offline` は、それ自体では間接的な書き込みを閉じません。適用されたサンドボックスだけが閉じます。`--allow bash:verify` はコマンドを分類で通すだけなので、そのコマンドが呼ぶスクリプトの中身を制限するのはサンドボックスだけです。
-- **モード：** `auto` は backend が使えれば適用し、使えなければ起動時に一度警告し、`applied=false` と理由つきの `bash_sandbox_status` を記録して字句検査だけで続けます。`required` は Bash と検証コマンドを `bash_sandbox_unavailable` で失敗させます。`off` は今までの挙動を保ちます。入れ子の sandbox（`rc=71`）と backend の無いプラットフォーム（この段階は macOS のみ）では未適用です。
+- **モード：** `auto` は backend が使えれば適用し、使えなければ起動時に一度警告し、`applied=false` と理由つきの `bash_sandbox_status` を記録して字句検査だけで続けます。`required` は Bash と検証コマンドを `bash_sandbox_unavailable` で失敗させます。`off` は今までの挙動を保ちます。macOS は Seatbelt で、入れ子の sandbox（`rc=71`）では未適用です。Linux は Landlock で、ABI1（kernel 5.13）未満・無効化・seccomp による拒否では未適用です。
 - 依存キャッシュ（cargo・npm・pip・Playwright のブラウザ）はビルドとテストのために書き込み可能なままにします。workspace の外の汚染経路として残ります。
 
 macOS の `mktemp` は `TMPDIR` を見ません。`mktemp -p "$TMPDIR"` か `$TMPDIR` 配下のテンプレートを使ってください。適用の試験の記録は `tests/corpus/apps/issue502-indirect-write/fixtures/macos-probe-results.md` にあります。
diff --git a/src/bin/gui_server/delegate.rs b/src/bin/gui_server/delegate.rs
index f0b5a151..ffe216f7 100644
--- a/src/bin/gui_server/delegate.rs
+++ b/src/bin/gui_server/delegate.rs
@@ -35,6 +35,22 @@ const DELEGATION_WORKSPACE_CHANGED: &str = "Gate 1 workspace changed before CLI
 const CONTINUATION_WORKSPACE_CHANGED: &str = "Gate 1 workspace changed before CLI continuation";
 const RECOVERY_WORKSPACE_CHANGED: &str = "Gate 1 workspace changed before Recovery Run";
 pub(super) const DELEGATE_PERMISSION_POLICY: &str = "read,write,bash:verify";
+/// Fixed flags every delegated CLI invocation starts with. `--sandbox required`
+/// (issue #656, decision 4) makes a delegated run fail honestly with
+/// `bash_sandbox_unavailable` when the OS write sandbox cannot be applied, for
+/// example inside a nested sandbox, instead of silently continuing with lexical
+/// checks only.
+const DELEGATE_FIXED_ARGS: &[&str] = &[
+    "--allow",
+    DELEGATE_PERMISSION_POLICY,
+    "--sandbox",
+    "required",
+    "--quiet",
+    "--footer",
+    "off",
+    "--stream",
+    "off",
+];
 const PACK_DIRECTORY_ENV: &str = "COMMANDAGENT_PACK_DIRECTORY";
 const PACK_ID_ENV: &str = "COMMANDAGENT_PACK_ID";
 const PACK_VERSION_ENV: &str = "COMMANDAGENT_PACK_VERSION";
@@ -295,15 +311,7 @@ fn delegated_cli_command(
     command
         .current_dir(&execution_workspace)
         .env("COMMANDAGENT_EVAL_EVENTS", paths.events_path())
-        .args([
-            "--allow",
-            DELEGATE_PERMISSION_POLICY,
-            "--quiet",
-            "--footer",
-            "off",
-            "--stream",
-            "off",
-        ])
+        .args(DELEGATE_FIXED_ARGS)
         .arg("--cwd")
         .arg(&execution_workspace)
         .arg("--state-dir")
@@ -385,3 +393,21 @@ fn apply_confirmed_pack(
         .env(PACK_HASH_ENV, hash);
     Ok(true)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Issue #656 decision 4: the delegated CLI must be started with
+    /// `--sandbox required` so a GUI run fails honestly when the OS write
+    /// sandbox cannot be applied instead of silently dropping it.
+    #[test]
+    fn delegated_cli_requires_the_os_write_sandbox() {
+        assert!(
+            DELEGATE_FIXED_ARGS
+                .windows(2)
+                .any(|pair| pair == ["--sandbox", "required"]),
+            "{DELEGATE_FIXED_ARGS:?}"
+        );
+    }
+}
diff --git a/src/cli.rs b/src/cli.rs
index f5ad4699..7a73013f 100644
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -512,7 +512,6 @@ pub struct Cli {
     pub offline: bool,
     #[arg(
         long,
-        hide = true,
         value_enum,
         value_name = "auto|required|off",
         default_value = "auto",
@@ -1114,6 +1113,12 @@ mod tests {
         assert!(help.contains("--quiet"));
     }
 
+    #[test]
+    fn help_includes_sandbox() {
+        let help = Cli::command().render_long_help().to_string();
+        assert!(help.contains("--sandbox"));
+    }
+
     #[test]
     fn help_hides_completion_contract_json() {
         let help = Cli::command().render_long_help().to_string();
diff --git a/src/tools/os_sandbox.rs b/src/tools/os_sandbox.rs
index 71a2d98b..305c139a 100644
--- a/src/tools/os_sandbox.rs
+++ b/src/tools/os_sandbox.rs
@@ -16,7 +16,7 @@
 //!   [`UNAVAILABLE_KIND`]; `off` keeps the previous behavior.
 //! - The lexical guard is not weakened or replaced: it still runs first and can
 //!   refuse a command before the sandbox is consulted.
-//! - macOS only in this stage; Linux (landlock) is a separate issue. On any
+//! - macOS uses Seatbelt (stage 1a); Linux uses Landlock (stage 1b). On any
 //!   other platform the backend is reported as unavailable rather than silently
 //!   pretending isolation.
 
@@ -26,11 +26,15 @@ use std::sync::Mutex;
 
 use clap::ValueEnum;
 
+#[cfg(target_os = "linux")]
+pub mod landlock;
 #[cfg(target_os = "macos")]
 pub mod seatbelt;
 
 /// The macOS backend name used in `bash_sandbox_status`.
 pub const BACKEND_SEATBELT: &str = "seatbelt";
+/// The Linux backend name used in `bash_sandbox_status`.
+pub const BACKEND_LANDLOCK: &str = "landlock";
 /// The backend name on platforms without a write backend in this stage.
 pub const BACKEND_NONE: &str = "none";
 
@@ -44,10 +48,9 @@ const RUN_FINISHED_REASON: &str = "run finished; the OS write sandbox is no long
 /// The refusal reason for a `required` run whose backend is available but whose
 /// policy is gone (for example after [`cleanup`]).
 const MISSING_POLICY_REASON: &str = "the OS write sandbox has no policy to apply";
-/// The reason recorded on platforms with no write-isolation backend in 1a.
-#[cfg(not(target_os = "macos"))]
-const NO_PLATFORM_BACKEND: &str =
-    "no OS write-isolation backend is available on this platform (macOS only in stage 1a)";
+/// The reason recorded on platforms with no write-isolation backend in 1a/1b.
+#[cfg(not(any(target_os = "macos", target_os = "linux")))]
+const NO_PLATFORM_BACKEND: &str = "no OS write-isolation backend is available on this platform (macOS Seatbelt and Linux Landlock are supported)";
 
 /// `--sandbox auto|required|off`. `auto` is the default.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
@@ -124,12 +127,18 @@ pub struct SandboxStatus {
 }
 
 impl SandboxStatus {
-    fn from_parts(mode: SandboxMode, availability: &SandboxAvailability) -> Self {
+    fn from_parts(
+        mode: SandboxMode,
+        availability: &SandboxAvailability,
+        note: Option<String>,
+    ) -> Self {
         let applied = mode.uses_backend() && matches!(availability, SandboxAvailability::Available);
         let reason = if mode.uses_backend() {
             match availability {
                 SandboxAvailability::Unavailable(reason) => Some(reason.clone()),
-                SandboxAvailability::Available => None,
+                // When the backend is applied, an empty reason means fully confined;
+                // a backend note names the best-effort operations it cannot close.
+                SandboxAvailability::Available => note,
             }
         } else {
             None
@@ -167,19 +176,41 @@ static INSTALLED: Mutex<Option<Installed>> = Mutex::new(None);
 fn backend_name() -> &'static str {
     if cfg!(target_os = "macos") {
         BACKEND_SEATBELT
+    } else if cfg!(target_os = "linux") {
+        BACKEND_LANDLOCK
     } else {
         BACKEND_NONE
     }
 }
 
+/// The best-effort limitation of the applied backend, recorded in the
+/// `bash_sandbox_status` reason even while the sandbox is applied. The Linux
+/// Landlock backend names the operations an older ABI cannot close; other
+/// backends have none.
+fn backend_note() -> Option<String> {
+    #[cfg(target_os = "linux")]
+    {
+        landlock::limitation_note()
+    }
+    #[cfg(not(target_os = "linux"))]
+    {
+        None
+    }
+}
+
 /// Probe the backend once. On macOS this starts `sandbox-exec` with a do-nothing
 /// profile; a nested sandbox fails with rc=71, which is reported as unavailable.
+/// On Linux this queries the Landlock ABI and confirms a child can enforce it.
 pub fn probe() -> SandboxAvailability {
     #[cfg(target_os = "macos")]
     {
         seatbelt::probe()
     }
-    #[cfg(not(target_os = "macos"))]
+    #[cfg(target_os = "linux")]
+    {
+        landlock::probe()
+    }
+    #[cfg(not(any(target_os = "macos", target_os = "linux")))]
     {
         SandboxAvailability::Unavailable(NO_PLATFORM_BACKEND.to_string())
     }
@@ -286,15 +317,23 @@ fn reconcile_workspace_impl(workspace_root: &Path) -> Option<SandboxStatus> {
         )
     };
     if !mismatched || !mode.uses_backend() {
-        return Some(SandboxStatus::from_parts(mode, &availability));
+        return Some(SandboxStatus::from_parts(
+            mode,
+            &availability,
+            backend_note(),
+        ));
     }
     if !matches!(availability, SandboxAvailability::Available) {
         // The backend is already unavailable; keep the reason the run started
         // with instead of overwriting it.
-        return Some(SandboxStatus::from_parts(mode, &availability));
+        return Some(SandboxStatus::from_parts(
+            mode,
+            &availability,
+            backend_note(),
+        ));
     }
     let availability = SandboxAvailability::Unavailable(DIFFERENT_WORKSPACE_REASON.to_string());
-    let status = SandboxStatus::from_parts(mode, &availability);
+    let status = SandboxStatus::from_parts(mode, &availability, None);
     *installed = Some(Installed {
         policy,
         mode,
@@ -308,7 +347,7 @@ fn store(
     policy: Option<SandboxPolicy>,
     availability: SandboxAvailability,
 ) -> SandboxStatus {
-    let status = SandboxStatus::from_parts(mode, &availability);
+    let status = SandboxStatus::from_parts(mode, &availability, backend_note());
     let mut installed = INSTALLED.lock().expect("sandbox state");
     *installed = Some(Installed {
         policy,
@@ -318,6 +357,23 @@ fn store(
     status
 }
 
+/// Record that the installed backend is no longer applied, for example when a
+/// per-command ruleset could not be built even though the run-start probe said
+/// the backend was available. Mirrors [`reconcile_workspace`]: the availability
+/// becomes [`SandboxAvailability::Unavailable`] with the reason, so
+/// [`is_applied`] turns false and later `required` commands refuse. The event
+/// name and schema are unchanged and no field is added.
+#[cfg(target_os = "linux")]
+fn mark_backend_unavailable(reason: String) {
+    let mut installed = INSTALLED.lock().expect("sandbox state");
+    let Some(state) = installed.as_mut() else {
+        return;
+    };
+    if matches!(state.availability, SandboxAvailability::Available) {
+        state.availability = SandboxAvailability::Unavailable(reason);
+    }
+}
+
 /// Clear the process-wide state. Tests only.
 pub fn reset_for_test() {
     let mut installed = INSTALLED.lock().expect("sandbox state");
@@ -365,9 +421,9 @@ pub fn cleanup_guard() -> SandboxCleanupGuard {
 /// The status recorded at run start, if any.
 pub fn status() -> Option<SandboxStatus> {
     let installed = INSTALLED.lock().expect("sandbox state");
-    installed
-        .as_ref()
-        .map(|installed| SandboxStatus::from_parts(installed.mode, &installed.availability))
+    installed.as_ref().map(|installed| {
+        SandboxStatus::from_parts(installed.mode, &installed.availability, backend_note())
+    })
 }
 
 /// Whether the backend is currently applied for this run.
@@ -420,7 +476,7 @@ pub fn wrap_command(command: Command) -> Result<Command, SandboxRefusal> {
                     .and_then(|installed| installed.policy.clone())
             };
             match policy {
-                Some(policy) => Ok(apply_backend(command, &policy)),
+                Some(policy) => apply_backend(command, &policy, mode),
                 None => {
                     // The state says the backend is available but no policy is
                     // installed (for example once the run's sandbox is torn
@@ -439,15 +495,39 @@ pub fn wrap_command(command: Command) -> Result<Command, SandboxRefusal> {
     }
 }
 
-fn apply_backend(command: Command, policy: &SandboxPolicy) -> Command {
+fn apply_backend(
+    command: Command,
+    policy: &SandboxPolicy,
+    mode: SandboxMode,
+) -> Result<Command, SandboxRefusal> {
+    #[cfg(target_os = "linux")]
+    {
+        let mut command = command;
+        match landlock::wrap(&mut command, policy) {
+            Ok(()) => Ok(command),
+            // The ruleset could not be built even though the backend probed as
+            // available. Record the run as no longer applied, so `is_applied()`
+            // turns false and later commands do not claim isolation; `required`
+            // refuses, `auto` continues with lexical checks only.
+            Err(reason) => {
+                mark_backend_unavailable(reason.clone());
+                if mode == SandboxMode::Required {
+                    Err(SandboxRefusal { reason })
+                } else {
+                    Ok(command)
+                }
+            }
+        }
+    }
     #[cfg(target_os = "macos")]
     {
-        seatbelt::wrap(command, policy)
+        let _ = mode;
+        Ok(seatbelt::wrap(command, policy))
     }
-    #[cfg(not(target_os = "macos"))]
+    #[cfg(not(any(target_os = "macos", target_os = "linux")))]
     {
-        let _ = policy;
-        command
+        let _ = (policy, mode);
+        Ok(command)
     }
 }
 
@@ -585,6 +665,100 @@ mod tests {
         assert!(wrap_command(Command::new("sh")).is_ok());
     }
 
+    /// Stage 1b: a substituted Landlock decision that is unavailable (for example
+    /// ABI 0) makes `auto` continue with `applied=false` and `required` refuse
+    /// with the honest kind. The reason comes from the real pure decision.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn unavailable_landlock_decision_continues_auto_and_refuses_required() {
+        let _serial = SANDBOX_TEST_LOCK
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        let _guard = TestStateGuard;
+        let SandboxAvailability::Unavailable(reason) =
+            landlock::decide_availability("5.4.0-generic", Ok(0), Ok(()))
+        else {
+            panic!("ABI 0 must be unavailable");
+        };
+        assert!(
+            reason.contains("5.4.0-generic") && reason.contains("ABI"),
+            "{reason}"
+        );
+
+        install_for_test(
+            SandboxMode::Auto,
+            policy(),
+            SandboxAvailability::Unavailable(reason.clone()),
+        );
+        let status = status().unwrap();
+        assert!(!status.applied, "{status:?}");
+        assert_eq!(status.reason.as_deref(), Some(reason.as_str()));
+        assert!(wrap_command(Command::new("sh")).is_ok(), "auto continues");
+
+        install_for_test(
+            SandboxMode::Required,
+            policy(),
+            SandboxAvailability::Unavailable(reason.clone()),
+        );
+        let error = wrap_command(Command::new("sh")).expect_err("required must refuse");
+        assert_eq!(error.summary(), format!("{UNAVAILABLE_KIND}: {reason}"));
+    }
+
+    /// Stage 1b: when the probe was available but `landlock::wrap` fails at run
+    /// time, `auto` continues with lexical checks only and the installed sandbox
+    /// stops claiming to be applied; `required` refuses.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn auto_downgrades_when_the_backend_wrap_fails() {
+        let _serial = SANDBOX_TEST_LOCK
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        let _guard = TestStateGuard;
+        let _hook = WrapFailureHookGuard;
+        landlock::test_hooks::force_wrap_failure(true);
+
+        install_for_test(SandboxMode::Auto, policy(), SandboxAvailability::Available);
+        assert!(is_applied());
+
+        assert!(
+            wrap_command(Command::new("sh")).is_ok(),
+            "auto must continue after a failed wrap"
+        );
+        assert!(!is_applied(), "a failed wrap must clear the applied claim");
+        let status = status().unwrap();
+        assert!(!status.applied, "{status:?}");
+        assert!(
+            status
+                .reason
+                .as_deref()
+                .is_some_and(|reason| reason.contains("could not be built")),
+            "{status:?}"
+        );
+
+        install_for_test(
+            SandboxMode::Required,
+            policy(),
+            SandboxAvailability::Available,
+        );
+        let error = wrap_command(Command::new("sh")).expect_err("required must refuse");
+        assert!(
+            error.summary().contains(UNAVAILABLE_KIND),
+            "{}",
+            error.summary()
+        );
+    }
+
+    /// Resets the Landlock wrap-failure hook on drop.
+    #[cfg(target_os = "linux")]
+    struct WrapFailureHookGuard;
+
+    #[cfg(target_os = "linux")]
+    impl Drop for WrapFailureHookGuard {
+        fn drop(&mut self) {
+            landlock::test_hooks::force_wrap_failure(false);
+        }
+    }
+
     struct TestStateGuard;
 
     impl Drop for TestStateGuard {
diff --git a/src/tools/os_sandbox/landlock.rs b/src/tools/os_sandbox/landlock.rs
new file mode 100644
index 00000000..578d523b
--- /dev/null
+++ b/src/tools/os_sandbox/landlock.rs
@@ -0,0 +1,445 @@
+//! Linux Landlock backend (Issue #656, stage 1b).
+//!
+//! Confines the writes of model Bash and verifier commands with Landlock. The
+//! ruleset and every allowed-location file descriptor are opened in the parent;
+//! the forked child's `pre_exec` runs only `prctl(PR_SET_NO_NEW_PRIVS)` and
+//! `landlock_restrict_self`, so no work that could allocate, lock, or log
+//! happens between `fork` and `exec`.
+//!
+//! Design (issue #656, decisions from #502):
+//! - ABI1 (kernel 5.13) is required. ABI2 (`refer`, link/rename across
+//!   directories) and ABI3 (`truncate`) are used best-effort; when they are
+//!   missing the still-open operations are named in the `bash_sandbox_status`
+//!   reason.
+//! - Reads and network are not handled, so they stay unchanged, matching 1a.
+//! - Availability is probed once at run start from the Landlock ABI query and a
+//!   child `restrict_self`, so a seccomp filter that denies either syscall is an
+//!   honest "unavailable" instead of a silent pass.
+
+use std::os::fd::{AsRawFd, OwnedFd};
+use std::os::unix::process::CommandExt;
+use std::path::PathBuf;
+use std::process::{Command, Stdio};
+use std::sync::OnceLock;
+use std::time::Duration;
+
+use landlock::{
+    ABI, AccessFs, CompatLevel, Compatible, Ruleset, RulesetAttr, RulesetCreatedAttr,
+    path_beneath_rules,
+};
+
+use super::{SandboxAvailability, SandboxPolicy};
+
+/// The `flags` value that asks `landlock_create_ruleset` for the ABI version.
+const LANDLOCK_CREATE_RULESET_VERSION: libc::c_uint = 1;
+
+/// Bound on the child that proves `landlock_restrict_self` can be enforced.
+const PROBE_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// Device files that either read-only tools or an attached terminal expect to
+/// write. Only the ones that exist are allowed.
+const DEVICE_PATHS: &[&str] = &[
+    "/dev/null",
+    "/dev/zero",
+    "/dev/full",
+    "/dev/random",
+    "/dev/urandom",
+    "/dev/tty",
+    "/dev/ptmx",
+    "/dev/pts",
+];
+
+/// The Landlock ABI detected for the running kernel, or the reason it cannot be
+/// used. Computed once per process.
+#[derive(Debug)]
+enum Detected {
+    Available { abi: u32 },
+    Unavailable(String),
+}
+
+static DETECTED: OnceLock<Detected> = OnceLock::new();
+
+fn detect() -> &'static Detected {
+    DETECTED.get_or_init(detect_uncached)
+}
+
+fn detect_uncached() -> Detected {
+    let release = kernel_release();
+    let abi_query = query_abi();
+    let enforcement = match abi_query {
+        Ok(abi) if abi >= 1 => probe_restrict_self(abi),
+        // `decide` ignores `enforcement` unless the ABI query is supported.
+        _ => Ok(()),
+    };
+    decide(&release, abi_query, enforcement)
+}
+
+/// The pure availability decision: the ABI query result and the child
+/// enforcement result, with no syscall.
+///
+/// `abi_query` is the `landlock_create_ruleset(... VERSION)` result — `Ok(0)` is
+/// an unsupported or disabled kernel, `Ok(n)` with `n >= 1` is ABI `n`, and
+/// `Err(errno)` is a failed query (including a seccomp denial). `enforcement` is
+/// the `restrict_self` result and is consulted only for a supported ABI.
+fn decide(kernel: &str, abi_query: Result<u32, i32>, enforcement: Result<(), String>) -> Detected {
+    match abi_query {
+        Ok(0) => Detected::Unavailable(format!(
+            "landlock ABI 0 is not supported by this kernel (kernel {kernel})"
+        )),
+        Ok(abi) => match enforcement {
+            Ok(()) => Detected::Available { abi },
+            Err(reason) => {
+                Detected::Unavailable(format!("{reason} (kernel {kernel}, landlock ABI {abi})"))
+            }
+        },
+        Err(errno) => Detected::Unavailable(format!(
+            "landlock ABI query failed (kernel {kernel}, ABI query errno {errno})"
+        )),
+    }
+}
+
+/// The pure decision as a [`SandboxAvailability`], so the stage-1b tests can
+/// substitute the backend judgement through `install_for_test` with the real
+/// reason and no syscall.
+#[cfg(test)]
+pub(crate) fn decide_availability(
+    kernel: &str,
+    abi_query: Result<u32, i32>,
+    enforcement: Result<(), String>,
+) -> SandboxAvailability {
+    match decide(kernel, abi_query, enforcement) {
+        Detected::Available { .. } => SandboxAvailability::Available,
+        Detected::Unavailable(reason) => SandboxAvailability::Unavailable(reason),
+    }
+}
+
+/// Ask the kernel for its Landlock ABI version. A negative return is the kernel
+/// reporting an unsupported or disabled Landlock (`ENOSYS`/`EOPNOTSUPP`) or a
+/// seccomp filter denying the syscall; the `Err` carries the raw `errno`.
+fn query_abi() -> Result<u32, i32> {
+    let ret = unsafe {
+        libc::syscall(
+            libc::SYS_landlock_create_ruleset,
+            std::ptr::null::<libc::c_void>(),
+            0usize,
+            LANDLOCK_CREATE_RULESET_VERSION,
+        )
+    };
+    if ret < 0 {
+        Err(errno())
+    } else {
+        Ok(ret as u32)
+    }
+}
+
+/// Build a ruleset for the detected ABI and confirm a child can enforce it.
+///
+/// This exercises both syscalls the backend depends on: creating the ruleset
+/// (already done here) and `landlock_restrict_self` in a short-lived child, so a
+/// seccomp profile that allows creation but denies enforcement is still
+/// reported as unavailable.
+fn probe_restrict_self(abi: u32) -> Result<(), String> {
+    let fd = create_ruleset(abi, std::iter::empty::<PathBuf>())?;
+    let raw = fd.as_raw_fd();
+    let mut command = probe_command();
+    // SAFETY: `pre_exec` runs after fork. The closure performs only the two
+    // syscalls in `apply_restriction` and allocates, locks, and logs nothing.
+    unsafe {
+        command.pre_exec(move || apply_restriction(raw));
+    }
+    let output = crate::bounded_process::run_with_timeout(&mut command, PROBE_TIMEOUT)
+        .map_err(|err| format!("landlock probe could not start: {err}"))?;
+    if output.success() {
+        Ok(())
+    } else {
+        Err(format!(
+            "landlock probe exited with {}",
+            output
+                .status
+                .map(|status| status.to_string())
+                .unwrap_or_else(|| "no status".to_string())
+        ))
+    }
+}
+
+fn probe_command() -> Command {
+    for candidate in ["/bin/true", "/usr/bin/true"] {
+        if std::path::Path::new(candidate).exists() {
+            let mut command = Command::new(candidate);
+            command
+                .stdin(Stdio::null())
+                .stdout(Stdio::null())
+                .stderr(Stdio::null());
+            return command;
+        }
+    }
+    let mut command = Command::new("true");
+    command
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null());
+    command
+}
+
+/// Create a ruleset that denies the ABI's write accesses outside `allowed`,
+/// returning its file descriptor for the child to enforce.
+fn create_ruleset(abi: u32, allowed: impl IntoIterator<Item = PathBuf>) -> Result<OwnedFd, String> {
+    let access = AccessFs::from_write(ABI::from(abi as i32));
+    let created = Ruleset::default()
+        // ABI1 must be enforceable; otherwise the backend is unavailable.
+        .set_compatibility(CompatLevel::HardRequirement)
+        .handle_access(access)
+        .map_err(|err| format!("landlock ruleset setup failed: {err}"))?
+        // Rules are best-effort so a file location silently drops directory-only
+        // accesses instead of failing the whole ruleset.
+        .set_compatibility(CompatLevel::BestEffort)
+        .create()
+        .map_err(|err| format!("landlock ruleset creation failed: {err}"))?;
+    let created = created
+        .add_rules(path_beneath_rules(allowed, access))
+        .map_err(|err| format!("landlock rule failed: {err}"))?;
+    Option::<OwnedFd>::from(created)
+        .ok_or_else(|| "landlock ruleset is not enforceable on this kernel".to_string())
+}
+
+/// Probe the backend once. Returns [`SandboxAvailability::Unavailable`] with an
+/// honest reason when Landlock is unsupported, disabled, or denied.
+pub fn probe() -> SandboxAvailability {
+    match detect() {
+        Detected::Available { .. } => SandboxAvailability::Available,
+        Detected::Unavailable(reason) => SandboxAvailability::Unavailable(reason.clone()),
+    }
+}
+
+/// The best-effort limitation of the detected ABI, recorded in
+/// `bash_sandbox_status` while the sandbox is applied, or `None` when every
+/// supported operation is closed.
+pub fn limitation_note() -> Option<String> {
+    match detect() {
+        Detected::Available { abi } => limitation_for(&kernel_release(), *abi),
+        Detected::Unavailable(_) => None,
+    }
+}
+
+/// The pure ABI limitation: ABI1 cannot close cross-directory link/rename
+/// (ABI2), and ABI1/ABI2 cannot close `truncate` (ABI3). ABI3 and later close
+/// both, so there is no note.
+fn limitation_for(kernel: &str, abi: u32) -> Option<String> {
+    let mut open = Vec::new();
+    if abi < 2 {
+        open.push("linking or renaming a file across directories (ABI2)");
+    }
+    if abi < 3 {
+        open.push("truncating a file (ABI3)");
+    }
+    if open.is_empty() {
+        None
+    } else {
+        Some(format!(
+            "landlock ABI {abi} (kernel {kernel}) applied; not closed: {}",
+            open.join(", ")
+        ))
+    }
+}
+
+/// The detected Landlock ABI, or 0 when the backend is unavailable. Test record.
+pub fn detected_abi() -> u32 {
+    match detect() {
+        Detected::Available { abi } => *abi,
+        Detected::Unavailable(_) => 0,
+    }
+}
+
+/// The running kernel release string, for the availability record. Test record.
+pub fn kernel_release_label() -> String {
+    kernel_release()
+}
+
+/// Wrap `command` so its child is confined to the policy's allowed locations.
+///
+/// The ruleset is created and every location descriptor opened here in the
+/// parent. Returns `Err` (with the reason) when the ruleset cannot be built, so
+/// a `required` run fails honestly instead of spawning an unconfined command.
+pub fn wrap(command: &mut Command, policy: &SandboxPolicy) -> Result<(), String> {
+    #[cfg(test)]
+    if test_hooks::wrap_should_fail() {
+        return Err("landlock ruleset could not be built (test hook)".to_string());
+    }
+    let fd = create_ruleset(detected_abi(), allowed_paths(policy))?;
+    // Point tools at the run temp directory, which the ruleset allows.
+    command.env("TMPDIR", &policy.run_tmp_dir);
+    let raw = fd.as_raw_fd();
+    // SAFETY: `pre_exec` runs after fork. The closure keeps the ruleset
+    // descriptor open across the fork and calls only the two syscalls in
+    // `apply_restriction`; it does not allocate, lock, or log.
+    unsafe {
+        command.pre_exec(move || {
+            let _ruleset_descriptor = &fd;
+            apply_restriction(raw)
+        });
+    }
+    Ok(())
+}
+
+/// The locations the sandbox leaves writable: the workspace, the run temp
+/// directory, the known dependency caches, and the device files that exist.
+fn allowed_paths(policy: &SandboxPolicy) -> Vec<PathBuf> {
+    let mut paths = vec![policy.workspace_root.clone(), policy.run_tmp_dir.clone()];
+    paths.extend(existing(policy.caches.cargo_registry.clone()));
+    paths.extend(existing(policy.caches.cargo_git.clone()));
+    paths.extend(existing(policy.caches.cargo_package_cache.clone()));
+    paths.extend(existing(policy.caches.npm.clone()));
+    paths.extend(existing(policy.caches.pip.clone()));
+    paths.extend(existing(policy.caches.playwright.clone()));
+    if let Some(home) = std::env::var_os("HOME").map(PathBuf::from) {
+        paths.extend(cache_paths(&home));
+    }
+    for device in DEVICE_PATHS {
+        let path = PathBuf::from(device);
+        if path.exists() {
+            paths.push(path);
+        }
+    }
+    paths
+}
+
+/// The Linux dependency caches allowed for writing (decision 2). Only those that
+/// exist are returned.
+fn cache_paths(home: &std::path::Path) -> Vec<PathBuf> {
+    [
+        home.join(".cargo/registry"),
+        home.join(".cargo/git"),
+        home.join(".cargo/.package-cache"),
+        home.join(".npm"),
+        home.join(".cache/pip"),
+        home.join(".cache/ms-playwright"),
+    ]
+    .into_iter()
+    .filter(|path| path.exists())
+    .collect()
+}
+
+fn existing(path: Option<PathBuf>) -> Option<PathBuf> {
+    path.filter(|path| path.exists())
+}
+
+/// Apply the prepared ruleset in the freshly forked child.
+///
+/// # pre_exec contract
+///
+/// This runs between `fork` and `exec`, so it must not allocate, take a lock, or
+/// log. It performs exactly two syscalls: `prctl(PR_SET_NO_NEW_PRIVS)` and
+/// `landlock_restrict_self`. Error values are built with
+/// [`std::io::Error::from_raw_os_error`], which does not allocate.
+fn apply_restriction(ruleset_fd: libc::c_int) -> std::io::Result<()> {
+    if unsafe { libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) } != 0 {
+        return Err(std::io::Error::from_raw_os_error(errno()));
+    }
+    let rc = unsafe {
+        libc::syscall(
+            libc::SYS_landlock_restrict_self,
+            ruleset_fd as libc::c_long,
+            0 as libc::c_long,
+        )
+    };
+    if rc != 0 {
+        return Err(std::io::Error::from_raw_os_error(errno()));
+    }
+    Ok(())
+}
+
+/// Read `errno` without allocating.
+fn errno() -> libc::c_int {
+    unsafe { *libc::__errno_location() }
+}
+
+/// The running kernel release from `/proc`, or `unknown` when it cannot be read.
+fn kernel_release() -> String {
+    std::fs::read_to_string("/proc/sys/kernel/osrelease")
+        .map(|release| release.trim().to_string())
+        .unwrap_or_else(|_| "unknown".to_string())
+}
+
+/// Test-only switch that forces [`wrap`] to fail so the `auto` degradation path
+/// (the probe said available but the ruleset could not be built) can be
+/// exercised on a kernel that supports Landlock.
+#[cfg(test)]
+pub(crate) mod test_hooks {
+    use std::sync::atomic::{AtomicBool, Ordering};
+
+    static FORCE_WRAP_FAILURE: AtomicBool = AtomicBool::new(false);
+
+    pub(crate) fn force_wrap_failure(force: bool) {
+        FORCE_WRAP_FAILURE.store(force, Ordering::SeqCst);
+    }
+
+    pub(crate) fn wrap_should_fail() -> bool {
+        FORCE_WRAP_FAILURE.load(Ordering::SeqCst)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn abi_zero_is_unavailable_and_names_the_kernel_and_abi() {
+        let Detected::Unavailable(reason) = decide("6.1.0-generic", Ok(0), Ok(())) else {
+            panic!("ABI 0 must be unavailable");
+        };
+        assert!(reason.contains("6.1.0-generic"), "{reason}");
+        assert!(reason.contains("ABI"), "{reason}");
+    }
+
+    #[test]
+    fn a_failed_abi_query_is_unavailable_and_names_the_kernel() {
+        let Detected::Unavailable(reason) = decide("6.1.0-generic", Err(38), Ok(())) else {
+            panic!("a failed query must be unavailable");
+        };
+        assert!(reason.contains("6.1.0-generic"), "{reason}");
+        assert!(reason.contains("ABI"), "{reason}");
+        assert!(reason.contains("38"), "{reason}");
+    }
+
+    #[test]
+    fn a_supported_abi_is_available() {
+        for abi in [1u32, 2, 3, 4, 9] {
+            assert!(
+                matches!(
+                    decide("6.1.0", Ok(abi), Ok(())),
+                    Detected::Available { abi: found } if found == abi
+                ),
+                "ABI {abi} must be available"
+            );
+        }
+    }
+
+    #[test]
+    fn an_enforcement_failure_is_unavailable_and_names_the_kernel_and_abi() {
+        let Detected::Unavailable(reason) = decide(
+            "6.1.0",
+            Ok(2),
+            Err("probe exited with exit status: 1".to_string()),
+        ) else {
+            panic!("an enforcement failure must be unavailable");
+        };
+        assert!(reason.contains("6.1.0"), "{reason}");
+        assert!(reason.contains("landlock ABI 2"), "{reason}");
+    }
+
+    #[test]
+    fn limitation_note_reports_the_abi2_and_abi3_gaps() {
+        let abi1 = limitation_for("6.1.0", 1).expect("ABI 1 has gaps");
+        assert!(abi1.contains("ABI2") && abi1.contains("ABI3"), "{abi1}");
+        assert!(
+            abi1.contains("landlock ABI 1") && abi1.contains("6.1.0"),
+            "{abi1}"
+        );
+
+        let abi2 = limitation_for("6.1.0", 2).expect("ABI 2 still has a gap");
+        assert!(abi2.contains("ABI3") && !abi2.contains("ABI2"), "{abi2}");
+
+        assert!(limitation_for("6.1.0", 3).is_none());
+        assert!(limitation_for("6.1.0", 9).is_none());
+    }
+}
diff --git a/tests/issue502_os_sandbox_write.rs b/tests/issue502_os_sandbox_write.rs
index 85be68b2..c00594ec 100644
--- a/tests/issue502_os_sandbox_write.rs
+++ b/tests/issue502_os_sandbox_write.rs
@@ -8,19 +8,20 @@
 //! the two launch points use, so an escape fails and the outside fixture does
 //! not change.
 //!
-//! The applied cases are `#[cfg(target_os = "macos")]` and no-op when the
-//! backend is unavailable (a nested sandbox reports rc=71); on Linux CI only the
-//! `off` and unavailable paths run, matching the issue's acceptance note. The
-//! outside fixtures live inside one test tempdir and are never written outside
-//! it.
+//! The macOS applied cases are `#[cfg(target_os = "macos")]` and no-op when the
+//! backend is unavailable (a nested sandbox reports rc=71). The Linux applied
+//! cases are `#[cfg(target_os = "linux")]`; they fail under CI when Landlock is
+//! unavailable, so the runner cannot silently lose the backend. Both platforms
+//! share the `off` and unavailable paths. The outside fixtures live inside one
+//! test tempdir and are never written outside it.
 
 use std::path::{Path, PathBuf};
-#[cfg(target_os = "macos")]
+#[cfg(unix)]
 use std::process::{Command, Stdio};
 use std::sync::{Mutex, MutexGuard};
 use std::time::Duration;
 
-#[cfg(target_os = "macos")]
+#[cfg(unix)]
 use commandagent::bounded_process::{self, BoundedProcessOutput};
 use commandagent::minimal_loop::verifier_env;
 use commandagent::planner::verify::{NormalizedVerifyCommand, normalize_verify_command};
@@ -46,7 +47,7 @@ fn sandbox_lock() -> MutexGuard<'static, ()> {
 struct Fixture {
     _dir: tempfile::TempDir,
     root: PathBuf,
-    #[cfg(target_os = "macos")]
+    #[cfg(unix)]
     outside_secret: PathBuf,
 }
 
@@ -66,12 +67,12 @@ fn fixture() -> Fixture {
     Fixture {
         _dir: dir,
         root,
-        #[cfg(target_os = "macos")]
+        #[cfg(unix)]
         outside_secret: outside.join("secret.txt"),
     }
 }
 
-#[cfg(target_os = "macos")]
+#[cfg(unix)]
 fn read_secret(path: &Path) -> String {
     std::fs::read_to_string(path).unwrap_or_else(|_| "<missing>".to_string())
 }
@@ -87,7 +88,7 @@ fn backend_available() -> bool {
 
 /// Install an available sandbox whose write-allow list is `workspace` and create
 /// its run temp dir.
-#[cfg(target_os = "macos")]
+#[cfg(unix)]
 fn install_available_for(workspace: &Path, run_tmp: &Path) {
     std::fs::create_dir_all(run_tmp).unwrap();
     os_sandbox::install_for_test(
@@ -98,7 +99,7 @@ fn install_available_for(workspace: &Path, run_tmp: &Path) {
 }
 
 /// Install an available sandbox for the fixture and create its run temp dir.
-#[cfg(target_os = "macos")]
+#[cfg(unix)]
 fn install_available(fixture: &Fixture) {
     install_available_for(&fixture.root, &run_tmp_path(fixture));
 }
@@ -120,7 +121,7 @@ fn run_via_bash(root: &Path, command: &str) -> BashOutcome {
 
 /// Build `sh -c <command>` and apply the installed sandbox directly, bypassing
 /// the lexical guard, so the OS layer is measured on its own.
-#[cfg(target_os = "macos")]
+#[cfg(unix)]
 fn run_wrapped(root: &Path, command: &str) -> BoundedProcessOutput {
     let mut process = Command::new("sh");
     process.arg("-c").arg(command).current_dir(root);
@@ -129,7 +130,7 @@ fn run_wrapped(root: &Path, command: &str) -> BoundedProcessOutput {
     bounded_process::run_with_timeout(&mut process, TIMEOUT).expect("spawn wrapped command")
 }
 
-#[cfg(target_os = "macos")]
+#[cfg(unix)]
 fn run_wrapped_success(root: &Path, command: &str) -> (bool, String) {
     let output = run_wrapped(root, command);
     (
@@ -141,12 +142,12 @@ fn run_wrapped_success(root: &Path, command: &str) -> (bool, String) {
 #[derive(Deserialize)]
 struct IndirectCase {
     command: String,
-    #[cfg(target_os = "macos")]
+    #[cfg(unix)]
     id: String,
-    #[cfg(target_os = "macos")]
+    #[cfg(unix)]
     #[serde(rename = "lexicalR")]
     lexical_r: bool,
-    #[cfg(target_os = "macos")]
+    #[cfg(unix)]
     #[serde(rename = "exitNonzero")]
     exit_nonzero: bool,
 }
@@ -358,6 +359,447 @@ fn applied_cargo_build_succeeds() {
     os_sandbox::reset_for_test();
 }
 
+// ---------------------------------------------------------------------------
+// Linux (Issue #656, stage 1b): the Landlock backend drives the same two launch
+// points. These cases skip only when Landlock is genuinely unavailable, and fail
+// under CI when it is, so a GitHub Actions Linux runner cannot silently lose the
+// backend. The kernel release and Landlock ABI are printed for the record.
+// ---------------------------------------------------------------------------
+
+/// The indirect rows the Linux backend measures. The hardlink row is covered by
+/// its own ABI2-gated test, so a kernel without ABI2 does not fail here.
+#[cfg(target_os = "linux")]
+const LINUX_EXCLUDED_INDIRECT_IDS: &[&str] = &["hardlink-outside"];
+
+/// Ask the kernel for its Landlock ABI without going through the backend, so a
+/// mutated `landlock::detected_abi()` cannot make these tests agree with
+/// themselves. A negative return (unsupported, disabled, or seccomp-denied) is
+/// reported as ABI 0.
+#[cfg(target_os = "linux")]
+fn kernel_landlock_abi() -> u32 {
+    const LANDLOCK_CREATE_RULESET_VERSION: libc::c_uint = 1;
+    let ret = unsafe {
+        libc::syscall(
+            libc::SYS_landlock_create_ruleset,
+            std::ptr::null::<libc::c_void>(),
+            0usize,
+            LANDLOCK_CREATE_RULESET_VERSION,
+        )
+    };
+    if ret < 0 { 0 } else { ret as u32 }
+}
+
+/// The running kernel release, read through the backend's public accessor (which
+/// reads `/proc/sys/kernel/osrelease`).
+#[cfg(target_os = "linux")]
+fn landlock_kernel_release() -> String {
+    commandagent::tools::os_sandbox::landlock::kernel_release_label()
+}
+
+/// The ABI-gated outcome for an ABI-dependent Linux test.
+#[cfg(target_os = "linux")]
+#[derive(Debug, PartialEq, Eq)]
+enum AbiGate {
+    /// The kernel ABI is new enough.
+    Continue,
+    /// The ABI is too old and this is a local run; record and skip.
+    Skip(String),
+    /// The ABI is too old and this is CI; the runner must provide it.
+    Fail(String),
+}
+
+/// Decide whether an ABI-dependent test continues, skips, or fails. Pure: it
+/// takes the CI flag, the queried ABI, and the ABI it needs, so it is testable
+/// without touching the environment. The skip/fail reasons name the kernel and
+/// the ABI.
+#[cfg(target_os = "linux")]
+fn abi_gate(ci: bool, abi: u32, required_abi: u32, kernel: &str) -> AbiGate {
+    if abi >= required_abi {
+        AbiGate::Continue
+    } else if ci {
+        AbiGate::Fail(format!(
+            "CI: Landlock ABI {abi} (kernel {kernel}) is below the required ABI{required_abi}"
+        ))
+    } else {
+        AbiGate::Skip(format!(
+            "SKIP: Landlock ABI {abi} (kernel {kernel}) < {required_abi}"
+        ))
+    }
+}
+
+/// Apply [`abi_gate`] with the process `CI`, returning whether the test should
+/// continue. A too-old ABI fails under CI and skips otherwise.
+#[cfg(target_os = "linux")]
+fn require_abi_or_ci_fail(abi: u32, required_abi: u32) -> bool {
+    match abi_gate(
+        std::env::var_os("CI").is_some(),
+        abi,
+        required_abi,
+        &landlock_kernel_release(),
+    ) {
+        AbiGate::Continue => true,
+        AbiGate::Skip(reason) => {
+            eprintln!("{reason}");
+            false
+        }
+        AbiGate::Fail(reason) => panic!("{reason}"),
+    }
+}
+
+/// Append the kernel release and Landlock ABI to `$GITHUB_STEP_SUMMARY` once per
+/// process, when that variable is set. Best effort: a write failure never fails
+/// the test, and only the kernel version and ABI number are written.
+#[cfg(target_os = "linux")]
+fn record_kernel_and_abi_in_step_summary() {
+    use std::sync::Once;
+
+    static ONCE: Once = Once::new();
+    ONCE.call_once(|| {
+        let Some(path) = std::env::var_os("GITHUB_STEP_SUMMARY") else {
+            return;
+        };
+        let line = format!(
+            "issue502/656 landlock: kernel={} abi={}\n",
+            landlock_kernel_release(),
+            kernel_landlock_abi()
+        );
+        let _ = std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(path)
+            .and_then(|mut file| std::io::Write::write_all(&mut file, line.as_bytes()));
+    });
+}
+
+/// Print the running kernel release and Landlock ABI, and refuse a silent skip
+/// under CI: a GitHub Actions Linux runner must have an applied Landlock
+/// backend. Returns whether the backend is available for this test run.
+///
+/// It also pins `landlock::detected_abi()` to the independently queried kernel
+/// ABI, so a backend that reports the wrong ABI fails here instead of silently
+/// building a weaker ruleset.
+#[cfg(target_os = "linux")]
+fn require_landlock_backend() -> bool {
+    use commandagent::tools::os_sandbox::landlock;
+    record_kernel_and_abi_in_step_summary();
+    let abi = kernel_landlock_abi();
+    let kernel = landlock::kernel_release_label();
+    let available = matches!(os_sandbox::probe(), SandboxAvailability::Available);
+    let reported = landlock::detected_abi();
+    eprintln!("issue502/656 landlock: kernel={kernel} abi={abi} detected_abi={reported}");
+    if available {
+        // A backend that reports the wrong ABI would build a weaker ruleset
+        // than the kernel supports; pin it to the independent query.
+        assert_eq!(
+            reported, abi,
+            "detected_abi() must equal the kernel ABI queried independently"
+        );
+    }
+    if std::env::var_os("CI").is_some() {
+        assert!(
+            available,
+            "CI: the Landlock backend must be available (kernel {kernel}, abi {abi})"
+        );
+    }
+    available
+}
+
+/// The acceptance write set under Landlock: each indirect form fails (or
+/// performs no outside write) and the outside fixture is unchanged.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_applied_indirect_writes_are_denied_and_the_outside_fixture_is_unchanged() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+
+    for case in indirect_cases() {
+        if LINUX_EXCLUDED_INDIRECT_IDS.contains(&case.id.as_str()) {
+            continue;
+        }
+        assert_eq!(
+            path_confinement_rejection(&case.command, &fixture.root).is_some(),
+            case.lexical_r,
+            "{}: the lexical decision must be unchanged",
+            case.id
+        );
+        let output = run_wrapped(&fixture.root, &case.command);
+        assert_eq!(
+            !output.success(),
+            case.exit_nonzero,
+            "{}: sandbox exit code; stderr={}",
+            case.id,
+            String::from_utf8_lossy(&output.stderr)
+        );
+        assert_eq!(
+            read_secret(&fixture.outside_secret),
+            SECRET,
+            "{}: the outside fixture must not change",
+            case.id
+        );
+        if !case.lexical_r {
+            let outcome = run_via_bash(&fixture.root, &case.command);
+            assert_eq!(
+                !outcome.is_success(),
+                case.exit_nonzero,
+                "{}: the bash launch point; {outcome:?}",
+                case.id
+            );
+            assert_eq!(read_secret(&fixture.outside_secret), SECRET, "{}", case.id);
+        }
+    }
+    os_sandbox::reset_for_test();
+}
+
+/// The ABI gate: a too-old ABI fails under CI, skips on a local run, and a new
+/// enough ABI continues. The kernel and the queried ABI appear in the reason.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_abi_gate_fails_under_ci_and_skips_otherwise() {
+    let kernel = "6.1.0-generic";
+    assert!(
+        matches!(
+            abi_gate(true, 1, 2, kernel),
+            AbiGate::Fail(reason) if reason.contains(kernel) && reason.contains('1')
+        ),
+        "{:?}",
+        abi_gate(true, 1, 2, kernel)
+    );
+    assert!(matches!(abi_gate(false, 1, 2, kernel), AbiGate::Skip(_)));
+    assert_eq!(abi_gate(false, 3, 3, kernel), AbiGate::Continue);
+    assert_eq!(abi_gate(true, 3, 3, kernel), AbiGate::Continue);
+    assert_eq!(abi_gate(false, 8, 2, kernel), AbiGate::Continue);
+}
+
+/// A hardlink to an outside inode is refused by Landlock. ABI2 (kernel 5.19)
+/// introduced the `refer` right that closes this. A too-old ABI skips on a local
+/// run and fails under CI, so a CI runner cannot silently lose the closure.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_applied_hardlink_to_an_outside_inode_is_denied() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let abi = kernel_landlock_abi();
+    if !require_abi_or_ci_fail(abi, 2) {
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+    let hardlink = fixture.root.join("hard.txt");
+    let outside = fixture
+        .outside_secret
+        .parent()
+        .expect("outside secret has a parent");
+
+    let command = format!("ln '{}' hard.txt", outside.join("secret.txt").display());
+    let output = run_wrapped(&fixture.root, &command);
+    assert!(
+        !output.success(),
+        "hardlink must be denied: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert!(!hardlink.exists(), "the hardlink must not be created");
+    assert_eq!(read_secret(&fixture.outside_secret), SECRET);
+    os_sandbox::reset_for_test();
+}
+
+/// `truncate(2)` does not `open` the file, so an outside inode needs ABI3
+/// (kernel 6.2) to be closed. ABI3 and later must deny it; a too-old ABI skips
+/// on a local run and fails under CI.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_applied_truncate_of_an_outside_inode_is_denied() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let abi = kernel_landlock_abi();
+    if !require_abi_or_ci_fail(abi, 3) {
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+    let command = format!(
+        "python3 -c \"import os; os.truncate('{}', 0)\"",
+        fixture.outside_secret.display()
+    );
+
+    let output = run_wrapped(&fixture.root, &command);
+    assert!(
+        !output.success(),
+        "truncate(2) of an outside inode must be denied: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert_eq!(read_secret(&fixture.outside_secret), SECRET);
+    os_sandbox::reset_for_test();
+}
+
+/// The public run-start status reports the Linux backend and its ABI
+/// limitations: `backend == "landlock"`, `applied == true`, no reason once ABI3
+/// closes every supported operation, and the unclosed operations named on an
+/// older ABI.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_installed_status_reports_the_backend_and_its_limitations() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let abi = kernel_landlock_abi();
+    let fixture = fixture();
+    let state_dir = fixture._dir.path().join("state");
+
+    let status = os_sandbox::install(SandboxMode::Auto, &fixture.root, &state_dir);
+    assert_eq!(status.backend, "landlock", "{status:?}");
+    assert!(status.applied, "{status:?}");
+    assert_eq!(status.mode.as_str(), "auto");
+    if abi >= 3 {
+        assert_eq!(
+            status.reason, None,
+            "ABI3+ closes truncate and cross-directory link/rename: {status:?}"
+        );
+    } else {
+        let reason = status.reason.as_deref().unwrap_or("");
+        assert!(
+            reason.contains("ABI2") || reason.contains("ABI3"),
+            "an older ABI must name the unclosed operations: {status:?}"
+        );
+    }
+    assert_eq!(
+        os_sandbox::status().map(|status| status.backend),
+        Some("landlock")
+    );
+
+    os_sandbox::cleanup();
+    os_sandbox::reset_for_test();
+}
+
+/// A direct write to the system temp directory (not the run temp directory) is
+/// denied, and the probe path is never created.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_applied_system_temp_write_is_denied() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+    let system_tmp = std::env::temp_dir()
+        .canonicalize()
+        .unwrap_or_else(|_| std::env::temp_dir());
+    let target = system_tmp.join(format!("commandagent-502b-{}.txt", std::process::id()));
+
+    let command = format!("echo written > '{}'", target.display());
+    let output = run_wrapped(&fixture.root, &command);
+    assert!(
+        !output.success(),
+        "a write to the system temp directory must be denied: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert!(!target.exists(), "the system temp probe must not exist");
+    let _ = std::fs::remove_file(&target);
+    os_sandbox::reset_for_test();
+}
+
+/// The verifier/acceptance launch point is wired to the same Landlock sandbox.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_applied_verifier_commands_cannot_write_outside() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+    let command: NormalizedVerifyCommand =
+        normalize_verify_command("sh -c 'cp a.txt escape/secret.txt'").expect("normalize");
+    assert!(
+        path_confinement_rejection(command.as_str(), &fixture.root).is_none(),
+        "the lexical guard must pass this form so the sandbox is what blocks it"
+    );
+
+    let outcome =
+        verifier_env::run_structured_for_verify_with_profile(&command, &fixture.root, None, false)
+            .expect("verifier launch");
+    assert!(!outcome.is_success(), "{outcome:?}");
+    assert_eq!(read_secret(&fixture.outside_secret), SECRET);
+    os_sandbox::reset_for_test();
+}
+
+/// Required tools that only read or use the run temp directory succeed inside
+/// Landlock (`TMPDIR` points at the allowed run temp directory).
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_applied_required_tools_succeed_inside_the_sandbox() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+    std::process::Command::new("git")
+        .args(["init", "-q"])
+        .current_dir(&fixture.root)
+        .status()
+        .expect("git init");
+
+    for command in [
+        "mktemp -p \"$TMPDIR\" probe.XXXXXX",
+        "mktemp \"$TMPDIR/probe.XXXXXX\"",
+        "git status --porcelain",
+        "cargo --version",
+        "node -e 'process.stdout.write(\"ok\")'",
+        "python3 -c 'print(\"ok\")'",
+        "echo inside > inside.txt",
+    ] {
+        let (ok, stderr) = run_wrapped_success(&fixture.root, command);
+        assert!(ok, "expected success: {command}; stderr={stderr}");
+    }
+    assert!(fixture.root.join("inside.txt").is_file());
+    os_sandbox::reset_for_test();
+}
+
+/// A dependency-less `cargo build` succeeds inside Landlock when the cargo
+/// caches are allowed. Ignored by default: run explicitly to record the applied
+/// result.
+#[cfg(target_os = "linux")]
+#[test]
+#[ignore = "heavy: run explicitly to record the applied result"]
+fn linux_applied_cargo_build_succeeds() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+    let src = fixture.root.join("src");
+    std::fs::create_dir_all(&src).unwrap();
+    std::fs::write(
+        fixture.root.join("Cargo.toml"),
+        "[package]\nname = \"issue502-probe\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n[workspace]\n",
+    )
+    .unwrap();
+    std::fs::write(src.join("main.rs"), "fn main() {}\n").unwrap();
+
+    let (ok, stderr) = run_wrapped_success(&fixture.root, "cargo build");
+    assert!(ok, "cargo build failed: {stderr}");
+    assert!(fixture.root.join("target/debug/issue502-probe").is_file());
+    os_sandbox::reset_for_test();
+}
+
 /// The probe agrees with a direct `/usr/bin/sandbox-exec` run: `rc=0` is
 /// available and any non-zero rc (for example 71 under a nested sandbox) is
 /// unavailable. This stays honest whether or not the test process is already