Summary

• Add one shared bash sandbox unavailable message that explains why bash = "enforce" refuses execution when no OS sandbox backend is present.
• Surface the recovery path in the bash tool error, startup warning, doctor, CLI /sandbox, generated config comments, desktop settings copy, and docs.
• Correct the public docs that still described non-macOS hosts as falling back to unconfined shell execution.

Root cause

Reasonix 1.16 intentionally fails closed when bash = "enforce" cannot wrap commands in an OS sandbox. Earlier versions could run unconfined on hosts without the backend, so users saw a sudden full bash refusal after upgrading.

Cache review

Cache-impact: low - touches cache-sensitive files, but does not change the stable system prompt, provider request serialization, tool schema bytes/order, MCP registration, compaction, or memory injection; only stderr/tool-error diagnostics and documentation/settings copy change.
Cache-guard: reviewed against references/cache-first.md; focused tests cover the changed packages and scripts/check-cache-impact.sh passes with these notes.
System-prompt-review: reviewed internal/boot/boot.go; the change only reuses the shared sandbox-unavailable stderr warning before tool registration and does not alter sysPrompt construction or provider-visible prefix ordering.

Validation

• go test ./internal/sandbox ./internal/tool/builtin ./internal/doctor ./internal/boot
• go test ./internal/config
• go test ./internal/cli
• pnpm --dir desktop/frontend typecheck