diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-23-linux-all-unix-sockets-exposed/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-23-linux-all-unix-sockets-exposed/report.md
index 70028a516..df1ce8274 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-23-linux-all-unix-sockets-exposed/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-23-linux-all-unix-sockets-exposed/report.md
@@ -44,6 +44,7 @@ command -v podman → /usr/bin/podman
 ~/.claude/settings.local.json hooks:
   SessionStart → /home/alice/.claude/scripts/container-gateway-hook.sh start
   SessionEnd → /home/alice/.claude/scripts/container-gateway-hook.sh stop
+  PreToolUse (matcher Bash) → /home/alice/.claude/scripts/container-gateway-hook.sh ensure
 test -x /home/alice/.claude/scripts/container-gateway-hook.sh → exists, executable
 
 cat /home/alice/tracker/.claude/settings.local.json:
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/expected.json
index d8f68c00e..71ada7055 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/expected.json
@@ -44,7 +44,7 @@
     {
       "n": 9,
       "status": "✓",
-      "evidence": "only vetted-op-read in allow, vetted-op in ask; Edit+Write denied on catalogue and policy"
+      "evidence": "only vetted-op-read in allow, vetted-op in ask; Edit denied on the catalogue, ~/.claude/magpie/**, and the policy in .apache-magpie-overrides and every personal layer"
     },
     {
       "n": 10,
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/report.md
index 58d5acaf0..15f899345 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/report.md
@@ -66,7 +66,8 @@ Live probe: read .git/HEAD OK; write .magpie-verify-probe.tmp OK (removed).
 ## Check 9 — vetted-ops split and exclusion
 
 permissions.allow contains vetted-op-read only; vetted-op is in ask.
-permissions.deny has Edit on ~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/**, ~/.claude/magpie/** and .apache-magpie-overrides/tools/vetted-ops/**.
+permissions.deny has Edit on ~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/**, ~/.claude/magpie/**, .apache-magpie-overrides/tools/vetted-ops/**,
+//**/.git/**/apache-magpie/tools/vetted-ops/**, //**/.svn/apache-magpie/tools/vetted-ops/** and //**/.apache-magpie-local/tools/vetted-ops/**.
 
 ## Check 10 — Hardware-key touch overlay and the signing key
 
@@ -78,6 +79,8 @@ Key type (the user ran `cut -d' ' -f1 ~/.ssh/id_ed25519_sk.pub` from their own t
 10a — wiring and scripts:
   PreToolUse Bash → ~/.claude/scripts/gpg-touch-overlay.sh arm
   PostToolUse Bash → ~/.claude/scripts/gpg-touch-overlay.sh disarm
+  PermissionDenied Bash → ~/.claude/scripts/gpg-touch-overlay.sh disarm
+  PostToolUseFailure Bash → ~/.claude/scripts/gpg-touch-overlay.sh disarm
   ~/.claude/scripts/gpg-touch-overlay.sh: -rwxr-xr-x, identical to tools/agent-isolation/gpg-touch-overlay.sh
   ~/.claude/scripts/gpg-touch-overlay-window-macos.py: -rwxr-xr-x, identical to tools/agent-isolation/gpg-touch-overlay-window-macos.py