diff --git a/docs/setup/sandbox-troubleshooting.md b/docs/setup/sandbox-troubleshooting.md
index 57f8a3626..bfb55994c 100644
--- a/docs/setup/sandbox-troubleshooting.md
+++ b/docs/setup/sandbox-troubleshooting.md
@@ -66,6 +66,14 @@
     - [Root cause](#root-cause-11)
     - [Fix](#fix-11)
     - [Notes](#notes-10)
+  - [Every Bash call fails with `bwrap: Can't create file … Read-only file system`](#every-bash-call-fails-with-bwrap-cant-create-file--read-only-file-system)
+    - [Symptom](#symptom-12)
+    - [Root cause](#root-cause-12)
+    - [Fix](#fix-12)
+  - [`git status` shows files you never created, such as `.mcp.json` or `.bash_profile`](#git-status-shows-files-you-never-created-such-as-mcpjson-or-bash_profile)
+    - [Symptom](#symptom-13)
+    - [Root cause](#root-cause-13)
+    - [Fix](#fix-13)
   - [Adding a new entry](#adding-a-new-entry)
 
 <!-- END doctoc generated TOC please keep comment here to allow auto update -->
@@ -198,6 +206,12 @@ fails with `No agent running`, and `gpg-connect-agent` cannot start one
 (`exit status 2`). Where that filter is active, an agent-dependent
 command — a signed `git commit`, `git tag -s`, `ssh-add -l` — must run
 with a per-call sandbox bypass, or outside the agent session entirely.
+The one setting that lifts the filter is
+`sandbox.network.allowAllUnixSockets: true` (`allowUnixSockets` is
+macOS-only, so it cannot name the agent socket here). It opens every
+socket the sandbox can see, not just the agent's, so set it only
+together with the `denyRead` entries in
+[Linux needs `allowAllUnixSockets`](secure-agent-setup.md#linux-needs-allowallunixsockets).
 The allowlist entries below remain correct and still matter (gpg reads
 the keyring through them); they simply do not restore the agent channel
 on their own.
@@ -673,7 +687,7 @@ dial unix ./.apache-magpie-local/run/podman.sock: connect: operation not permitt
 The first three lines are the CLI reaching straight for the real daemon socket or the podman machine's ssh identity, both denied by design.
 The last two are the CLI reaching the container gateway's own socket instead.
 `no such file or directory` means the gateway is not running for this project.
-`operation not permitted` means its socket is not in `sandbox.network.allowUnixSockets`.
+`operation not permitted` means its socket is not in `sandbox.network.allowUnixSockets` (macOS), or that `sandbox.network.allowAllUnixSockets` is not `true` (Linux).
 
 Inside the sandbox, `podman machine list` prints an empty table even when the machine is running, because the machine directory under `~/.local/share/containers/podman/machine/` is unreadable.
 An empty list from inside the sandbox is therefore not evidence that no machine exists.
@@ -705,7 +719,7 @@ See [Container gateway](secure-agent-setup.md#container-gateway) in the setup gu
 | `failed to read identity "…/machine/machine": operation not permitted` | `CONTAINER_HOST` / `DOCKER_HOST` are unset, so the CLI fell back to its default connection instead of the gateway | Add the reference `env` block below to `.claude/settings.local.json` |
 | `dial unix /.//.apache-magpie-local/run/podman.sock` — note the leading `/.//` | `CONTAINER_HOST` / `DOCKER_HOST` use a project-relative `unix://./…` value, which the CLIs do **not** resolve against the cwd | Use the absolute `unix:///<project>/…` spelling in the `env` block below |
 | `dial unix /<run-dir>/podman.sock: connect: no such file or directory` | The gateway is not running for this project. It exits after its idle timeout (4 h), when another session on the project ends, or when it crashes; the `PreToolUse` `ensure` hook restarts it before the next container command, so this error means that hook is not wired or could not start it | Wire the `ensure` hook per [Container gateway](secure-agent-setup.md#container-gateway), run `~/.claude/scripts/container-gateway-hook.sh start </dev/null` from a terminal in the project root (the hook reads its payload from stdin; with none it uses the current directory), or check `<run-dir>/container-gateway.log` for why it did not start |
-| `dial unix /<run-dir>/podman.sock: connect: operation not permitted` | The gateway is running but its socket is missing from `sandbox.network.allowUnixSockets` | Add both gateway sockets as absolute paths, per [Container gateway](secure-agent-setup.md#container-gateway) |
+| `dial unix /<run-dir>/podman.sock: connect: operation not permitted` | The gateway is running but its socket is missing from `sandbox.network.allowUnixSockets` (macOS), or `allowAllUnixSockets` is off (Linux, where the seccomp filter blocks every `AF_UNIX` socket) | Add both gateway sockets as absolute paths, per [Container gateway](secure-agent-setup.md#container-gateway); on Linux set `allowAllUnixSockets` with its `denyRead` entries, per [Linux needs `allowAllUnixSockets`](secure-agent-setup.md#linux-needs-allowallunixsockets) |
 | `no podman or docker backend found; nothing to serve` in the gateway log, while `podman` works by hand | On macOS the gateway asked `podman machine inspect` for the socket path, and that command renders it from the **caller's** `TMPDIR` | Update the framework: discovery now also probes `getconf DARWIN_USER_TEMP_DIR`/`podman/`, so a hook whose `TMPDIR` differs from the machine's still finds the socket |
 
 ```jsonc
@@ -1280,6 +1294,89 @@ Rationale:
   user-scope `~/.claude/settings.json` synced across machines: both paths
   name this host's home directory and uid.
 
+---
+
+## Every Bash call fails with `bwrap: Can't create file … Read-only file system`
+
+### Symptom
+
+Every Bash tool call fails before the command runs, whatever the command,
+with:
+
+```text
+bwrap: Can't create file at <project>/.claude/settings.json: Read-only file system
+```
+
+The path named is one of the files the sandbox protects from writes
+(`.claude/settings.json`, `.mcp.json`, a shell rc), inside a directory that
+`sandbox.filesystem.allowWrite` lists.
+
+### Root cause
+
+Linux only. A `sandbox.filesystem.allowRead` entry that is a parent of an
+`allowWrite` path — `allowRead: ["/home/<you>/repos"]` next to
+`allowWrite: ["/home/<you>/repos/<project>"]`, under the reference
+`denyRead: ["~/"]` — makes bubblewrap mount the parent read-only on top of
+the writable child. The write path ends up read-only, and bubblewrap's
+first step, creating a placeholder for each write-protected file that does
+not exist yet, fails, so the whole command fails. The mount order is
+Claude Code's; the trap is in the settings shape.
+
+### Fix
+
+Never list a parent of an `allowWrite` path in `allowRead`. List the
+specific directories you need read instead:
+
+```jsonc
+{
+  "sandbox": {
+    "filesystem": {
+      "allowRead": [
+        // not "/home/<you>/repos"
+        "/home/<you>/repos/<project>",
+        "/home/<you>/repos/<other-project>"
+      ],
+      "allowWrite": ["/home/<you>/repos/<project>"]
+    }
+  }
+}
+```
+
+A parent that is itself in `allowWrite` is fine. `sandbox-lint` rejects an
+`allowRead` entry that is a strict parent of an `allowWrite` entry and not
+writable itself.
+
+---
+
+## `git status` shows files you never created, such as `.mcp.json` or `.bash_profile`
+
+### Symptom
+
+Inside the sandbox, `git status` lists untracked files that are not there
+when you look from your own terminal — typically `.claude/settings.json`,
+`.mcp.json`, or `.bash_profile`. `stat` shows they are not regular files:
+
+```console
+$ stat -c '%F %t,%T' .mcp.json
+character special file 1,3
+```
+
+### Root cause
+
+Device `1,3` is `/dev/null`. On Linux the sandbox protects a
+write-denied path that does not exist on the host — the agent settings
+files, `.mcp.json`, shell rc files — by bind-mounting `/dev/null` over a
+placeholder at that path, so a sandboxed command cannot create it. Git
+inside the sandbox sees the placeholder as a new file. An absent
+`denyRead` path gets no placeholder: there is nothing to hide, so nothing
+is mounted.
+
+### Fix
+
+None needed: it is not a real file on the host. Do not commit it and do not
+delete it. Check from outside the sandbox (your own terminal) whether a real
+file is there before acting on it.
+
 ## Adding a new entry
 
 When you hit a sandbox-shaped failure not in this list:
diff --git a/docs/setup/secure-agent-setup.md b/docs/setup/secure-agent-setup.md
index c98c5b646..89af72c8a 100644
--- a/docs/setup/secure-agent-setup.md
+++ b/docs/setup/secure-agent-setup.md
@@ -56,6 +56,7 @@
   - [Container gateway](#container-gateway)
     - [Why install it](#why-install-it-1)
     - [Install (user-scope)](#install-user-scope-4)
+    - [Linux needs `allowAllUnixSockets`](#linux-needs-allowallunixsockets)
     - [Egress](#egress)
     - [Verify](#verify-4)
     - [Trade-offs](#trade-offs-3)
@@ -561,6 +562,9 @@ The full block below is the two merged, annotated.
       ]
     },
     "network": {
+      // Linux ignores allowUnixSockets and blocks every AF_UNIX socket; the gateway and
+      // ssh-agent signing need a per-machine `allowAllUnixSockets: true` there, never
+      // without the host-socket denyRead entries in "Linux needs allowAllUnixSockets" below.
       "allowUnixSockets": [        // macOS only (ignored on Linux): sockets a sandboxed Bash may connect(2) to. A read entry alone lets it stat the file, not talk to it.
         "/Users/<you>/.gnupg/S.gpg-agent.ssh"   // gpg-agent's ssh socket — needed for signed commits and pushes over ssh; absolute path (see "SSH agent / Yubikey appears unreachable" in sandbox-troubleshooting.md)
         // Per project, local settings (`.claude/settings.local.json`,
@@ -2950,6 +2954,58 @@ The CLIs do not resolve it against the cwd: a `unix://` URL's authority is parse
 
 Never add the real daemon socket to `allowUnixSockets` under any name: the framework's `sandbox-lint` tool rejects an entry whose basename is `docker.sock`, `podman.sock`, or ends in `-api.sock`, unless its parent directory is the gateway's run directory, `<project>/.apache-magpie-local/run` or `<git-common-dir>/apache-magpie/run/<worktree-id>`.
 
+### Linux needs `allowAllUnixSockets`
+
+The `allowUnixSockets` entries above are macOS-only: Claude Code ignores them on Linux, where its seccomp filter rejects `socket(AF_UNIX, …)` before any path is consulted ([SSH agent / Yubikey appears unreachable](sandbox-troubleshooting.md#ssh-agent--yubikey-appears-unreachable-from-inside-the-sandbox)).
+On Linux the sandboxed `podman` / `docker` CLI reaches the gateway, and a sandboxed `git` reaches the ssh agent to sign, only with `sandbox.network.allowAllUnixSockets: true`, which skips that filter.
+Keep the `allowUnixSockets` entries anyway: they are inert on Linux and keep the block valid on a Mac.
+
+`allowAllUnixSockets` lets a sandboxed command connect to **every** Unix socket whose path it can see, and the reference `denyRead: ["~/"]` hides nothing outside your home.
+Pair it with `sandbox.filesystem.denyRead` entries, as absolute paths, for the host's daemon and IPC sockets.
+Each one is a way out of the sandbox:
+
+| Path | What a sandboxed command could do through it |
+|---|---|
+| `/run/docker.sock`, `/var/run/docker.sock` | Drive the Docker daemon: root-equivalent when you are in the `docker` group |
+| `/run/docker-cli.sock` | The same, through Docker Desktop's CLI socket |
+| `/run/podman` | Drive rootful Podman's daemon (`podman.sock`) |
+| `/run/user/<uid>` | Run commands outside the sandbox through the systemd user manager, over the user D-Bus (`bus`) or its own `systemd/private` socket (`systemd-run --user`); drive rootless Podman (`podman/podman.sock`); reach editor askpass sockets (`vscode-git-*.sock`) and systemd's ssh agent |
+| `/run/dbus` | Talk to the system D-Bus |
+| `/tmp/.X11-unix` | Inject keystrokes into your X11 session |
+| `/run/WSL` (WSL only) | Launch Windows executables outside the sandbox through the interop sockets |
+| `/mnt/wslg` (WSL only) | Reach the WSLg display and audio sockets |
+
+Deny `/run/user/<uid>` whole: the user manager answers on `systemd/private` even with the bus denied, so denying single sockets in it leaves a way out.
+One channel stays open whatever `denyRead` says: on Linux the flag also unblocks `AF_VSOCK` sockets (per Claude Code's settings schema), which have no path to deny. On WSL2 that is a channel to the Windows host. Treat it as residual risk.
+
+```jsonc
+// per machine: ~/.claude/settings.local.json, or the project's .claude/settings.local.json
+{
+  "sandbox": {
+    "network": { "allowAllUnixSockets": true },
+    "filesystem": {
+      "denyRead": [
+        "/run/docker.sock", "/var/run/docker.sock", "/run/docker-cli.sock", "/run/podman",
+        "/run/user/<uid>", "/run/dbus", "/tmp/.X11-unix",
+        "/run/WSL", "/mnt/wslg"   // WSL only
+      ]
+    }
+  }
+}
+```
+
+Replace `<uid>` with the output of `id -u` (for example `/run/user/1000`). Pasted as-is, the entry names a path that does not exist and hides nothing; sandbox-lint and check 12e both flag it.
+
+The gateway's sockets are unaffected: its run directory is inside the project tree or the git directory (`<project>/.apache-magpie-local/run/` or `<git-common-dir>/apache-magpie/run/<worktree-id>/`), never under `/run/user`.
+The ssh agent may not be: run `echo "$SSH_AUTH_SOCK"` in your own terminal.
+An agent socket under `/tmp` (the classic `ssh-agent`) needs nothing.
+When it is under `/run/user/<uid>/`, add the socket path itself to `allowRead`, or the agent's own subdirectory for gpg-agent (`gnupg/`) and gnome-keyring (`keyring/`) — never `/run/user/<uid>/` itself, where systemd's agent socket sits directly and an entry would re-open the whole directory.
+`allowRead` takes precedence inside a `denyRead` the same way `~/.gnupg/` does under `~/`; a single-file `allowRead` inside a denied directory has not been verified on Linux, so test signing after adding it.
+
+Keep both halves in one per-machine file. `allowAllUnixSockets` lifts socket blocking on macOS too, so a user-scope `~/.claude/settings.json` [synced across machines](#syncing-user-scope-config-across-machines) would carry it to a Mac without the Linux denials.
+Inside the sandbox each denied path that exists is replaced by an empty directory or a `/dev/null` device, so `test -S /run/docker.sock` reports no socket there.
+`sandbox-lint` rejects `allowAllUnixSockets: true` in the project's settings layers without `denyRead` cover for every path in the table (it does not read user-scope files), and `setup-isolated-setup-verify` check 12e flags each one that exists on the host and is not denied, in any scope.
+
 ### Egress
 
 At start, the gateway resolves the egress gateway's address for each backend and probes it once.
@@ -2971,7 +3027,7 @@ podman run --rm -v "$HOME/.ssh:/x" alpine true # expected: 403 container-gateway
 ```
 
 `status` prints a JSON object (`running`, `pid`, `sockets`, `serving`) and exits 0 when the gateway is up for this project, 3 otherwise.
-The `podman info` call should succeed from inside the sandbox once the hook has started the gateway and the two `allowUnixSockets` entries are in place.
+The `podman info` call should succeed from inside the sandbox once the hook has started the gateway and the two `allowUnixSockets` entries (macOS) or `allowAllUnixSockets` with its `denyRead` entries (Linux) are in place.
 The `podman run` call is expected to fail: a bind mount outside the project root (and any `--extra-bind-root`) is exactly what the policy refuses, and the `403` message is the gateway working as intended.
 
 ### Trade-offs
@@ -3653,7 +3709,9 @@ below and report ✓ done / ✗ missing / ⚠ partial, with the evidence
     - The project `.claude/settings.json` or
       `.claude/settings.local.json` has `env.CONTAINER_HOST` and
       `env.DOCKER_HOST`, and both gateway sockets appear in
-      `sandbox.network.allowUnixSockets`.
+      `sandbox.network.allowUnixSockets`. On Linux, which ignores
+      `allowUnixSockets`, the socket half is instead
+      `sandbox.network.allowAllUnixSockets: true` in any scope.
     - No scope (project, project-local, or user) lists a raw
       daemon socket in `allowUnixSockets` — an entry whose
       basename is `docker.sock`, `podman.sock`, or ends in
@@ -3664,6 +3722,16 @@ below and report ✓ done / ✗ missing / ⚠ partial, with the evidence
     On any ✗, point at
     [`docs/setup/sandbox-troubleshooting.md` → Docker / Podman command fails with a socket error](sandbox-troubleshooting.md#docker--podman-command-fails-with-a-socket-error)
     rather than re-explaining the fix.
+    Separately, and even when the rest of this check is n/a (the flag
+    may be set only for ssh-agent signing): on Linux, when any scope
+    sets `sandbox.network.allowAllUnixSockets: true`, each of
+    `/run/docker.sock`, `/var/run/docker.sock`, `/run/docker-cli.sock`,
+    `/run/podman`, `/run/user/<uid>`, `/run/dbus`, `/tmp/.X11-unix`,
+    `/run/WSL` and `/mnt/wslg` that exists on this host must be
+    covered by a `sandbox.filesystem.denyRead` entry (the path or a
+    directory above it) in some scope; each one that is not is ✗,
+    naming the path (see
+    [Linux needs `allowAllUnixSockets`](#linux-needs-allowallunixsockets)).
 13. **Eval-harness exclusion**, if installed (optional — report
     n/a when neither the exclusion nor the script is present;
     not running eval suites is a normal posture). When either is:
diff --git a/plugins/magpie-setup/skills/isolated-setup-install/optional-steps.md b/plugins/magpie-setup/skills/isolated-setup-install/optional-steps.md
index 119d22118..47bd26cbd 100644
--- a/plugins/magpie-setup/skills/isolated-setup-install/optional-steps.md
+++ b/plugins/magpie-setup/skills/isolated-setup-install/optional-steps.md
@@ -226,6 +226,12 @@ project-relative `unix://./…` value against the cwd — the URL
 authority is read as a host component, so `unix://./x` dials
 `/.//x` — and `allowUnixSockets` has no relative form either.
 Nothing gateway-related is committed to `.claude/settings.json`.
+On Linux, which ignores `allowUnixSockets`, the same diff also proposes
+`sandbox.network.allowAllUnixSockets: true` together with
+`sandbox.filesystem.denyRead` entries for each host daemon and IPC
+socket path that exists on the machine, never the flag alone; the path
+list and the `/run/user/<uid>` caveat are in
+[docs/setup/secure-agent-setup.md → Linux needs `allowAllUnixSockets`](../../../../docs/setup/secure-agent-setup.md#linux-needs-allowallunixsockets).
 Never propose the real
 daemon socket under any name; `tools/sandbox-lint` rejects an
 `allowUnixSockets` entry named `docker.sock` / `podman.sock` /
diff --git a/plugins/magpie-setup/skills/isolated-setup-verify/SKILL.md b/plugins/magpie-setup/skills/isolated-setup-verify/SKILL.md
index 5c7f3b856..c4757e544 100644
--- a/plugins/magpie-setup/skills/isolated-setup-verify/SKILL.md
+++ b/plugins/magpie-setup/skills/isolated-setup-verify/SKILL.md
@@ -18,7 +18,7 @@ when_to_use: >-
 capability: capability:platform
 surface_hash: sha256:ce33cb9437d44992
 license: Apache-2.0
-measured_tokens: 7351
+measured_tokens: 7494
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -172,8 +172,9 @@ Walk each in order:
     The catalog entry [`gh` fails with TLS `OSStatus -26276` or `HTTP 401` inside the sandbox](../../../../docs/setup/sandbox-troubleshooting.md#gh-fails-with-tls-osstatus--26276-or-http-401-inside-the-sandbox) has the measured shape table and the optional `gh tofile` alias that moves a redirection inside `gh`.
     If the operator has that alias installed, say so; it is a convenience, not a requirement.
 
-12. **Container gateway wired.** Only when `podman` or `docker` is on `PATH`; neither installed → **n/a** for the whole check.
-    Four sub-checks:
+12. **Container gateway wired.** 12a–12d only when `podman` or `docker` is on `PATH`; neither installed → **n/a** for those four.
+    12e (Linux host sockets hidden when `allowAllUnixSockets` is true) runs independently of that gate, so with no container runtime check 12 reports 12e alone.
+    Five sub-checks:
     [`conditional-checks.md`](conditional-checks.md#check-12--container-gateway-wired).
 
 13. **Eval-harness exclusion, if installed.** Optional (step M of `setup-isolated-setup-install`).
@@ -281,8 +282,9 @@ If anything is ✗ or ⚠, suggest the matching follow-up skill without invoking
   ✗ on 10d (wrapper named but unreadable in the sandbox) → the two-file `allowRead` widening in [`docs/setup/sandbox-troubleshooting.md` → Signed commit fails with "cannot exec" of the touch-overlay wrapper](../../../../docs/setup/sandbox-troubleshooting.md#signed-commit-fails-with-cannot-exec-of-the-touch-overlay-wrapper), applied by the user, then re-verify.
 - ✗ on check 11 (`"gh *"` missing from `sandbox.excludedCommands`, or a catch-all `Bash(gh *)` in `permissions.ask`) → the operator edits settings themselves (settings.json changes are never applied from a skill): add the exclusion (in the framework checkout, by reconciling the local settings as in check 18), or replace the catch-all with the explicit write-subcommand list from the reference `.claude/settings.json`; then re-run `setup-isolated-setup-verify`.
 - ✗ on check 12a / 12b (hooks or the hook script missing) → `setup-isolated-setup-install` Step L.
-- ✗ on check 12c (project `env` or `allowUnixSockets` half missing) → `setup-isolated-setup-install` Step L, to propose the missing block as a settings diff for the operator to approve.
+- ✗ on check 12c (project `env` or socket half missing: `allowUnixSockets`, or `allowAllUnixSockets` on Linux) → `setup-isolated-setup-install` Step L, to propose the missing block as a settings diff for the operator to approve.
 - ✗ on check 12d (a raw daemon socket in `allowUnixSockets`) → the operator removes that entry themselves (settings.json changes are never applied from a skill) and, if they need the daemon reachable, follows Step L instead; then re-run `setup-isolated-setup-verify`.
+- ✗ on check 12e (Linux, `allowAllUnixSockets` with a host socket not in `denyRead`) → the operator adds the named paths to `sandbox.filesystem.denyRead` themselves, per [Linux needs `allowAllUnixSockets`](../../../../docs/setup/secure-agent-setup.md#linux-needs-allowallunixsockets); then re-run `setup-isolated-setup-verify`.
 - ⚠ on check 17a, 17b or 17c, or ✗ on 17b, 17c, 17d or 17e → the operator edits settings themselves (settings.json changes are never applied from a skill): copy the rules from step B of `setup-isolated-setup-install`, remove every `roborev` `allow`, and for 17c remove any `allowWrite` on `~/.roborev/`, then on macOS finish step B.2 (the `unix://` `server_addr` and its `allowUnixSockets` entry) or remove its `allowRead`, and on Linux remove the `allowRead` and run `roborev review` explicitly instead; then re-run `setup-isolated-setup-verify`. ⚠ on 17f → show the operator `.roborev.toml` and its history and leave the decision to them. ✗ on 17f (roborev's hook in a shared whole-user hooks directory) → name the hook; the operator restores the Step P dispatcher there (`setup-isolated-setup-install` Step P) and moves roborev's hook into the repository's own `$(git rev-parse --git-common-dir)/hooks/post-commit`, never with `--force`; then re-run `setup-isolated-setup-verify`. ⚠ on 17g → name the hook or MCP entry and what it bypasses; removing it is the operator's call.
 - ✗ on check 19 → `setup-isolated-setup-install` Step U, which stages the `~/.config/uv/uv.toml` change and proposes the settings edits; the operator applies them and runs the reinstall commands from a terminal, then re-run `setup-isolated-setup-verify`.
 - ⚠ or ✗ on check 18 → `setup upgrade`, whose local-settings reconciliation stages the merged `.claude/settings.local.json` for the operator to copy; a ✗ override is the operator's to remove.
diff --git a/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md b/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
index 468888024..799c7f124 100644
--- a/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
+++ b/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
@@ -254,9 +254,10 @@ reading this file; read the section for a check whose condition holds.
 
 ## Check 12 — container gateway wired
 
-12. **Container gateway wired.** Only meaningful when `podman` or
-    `docker` is on `PATH`; if neither is installed, report **n/a**
-    for the whole check. Four sub-checks:
+12. **Container gateway wired.** 12a–12d are only meaningful when
+    `podman` or `docker` is on `PATH`; if neither is installed, report
+    them **n/a**. 12e has its own condition, so with no container
+    runtime check 12 reports 12e alone. Five sub-checks:
 
     - **12a — hooks wired.** User-scope `~/.claude/settings.json`
       or `~/.claude/settings.local.json` has a `SessionStart` hook
@@ -283,8 +284,12 @@ reading this file; read the section for a check whose condition holds.
     - **12c — project wiring.** The gitignored
       `.claude/settings.local.json` has `env.CONTAINER_HOST` and
       `env.DOCKER_HOST`, and both gateway sockets appear in
-      `sandbox.network.allowUnixSockets`. Either half missing
-      (the `env` pair or the socket allow-list pair) is ✗; report
+      `sandbox.network.allowUnixSockets`. On Linux, which ignores
+      `allowUnixSockets`, the socket half is instead
+      `sandbox.network.allowAllUnixSockets: true` in any scope;
+      `allowUnixSockets` entries there are inert and neither satisfy
+      nor fail it. Either half missing
+      (the `env` pair or the socket half) is ✗; report
       which half. All four values must be **absolute** paths: the
       CLIs read a `unix://` URL's authority as a host component, so
       a project-relative `unix://./…` value dials a path that does
@@ -309,6 +314,23 @@ reading this file; read the section for a check whose condition holds.
       > or <git-common-dir>/apache-magpie/run/<worktree-id>/*.sock when the
       > project has not adopted Magpie) instead`
 
+    - **12e — Linux host sockets hidden.** Runs whenever any scope
+      sets `sandbox.network.allowAllUnixSockets: true`, even when
+      12a–12d are n/a (no container runtime: the flag may be there only
+      for ssh-agent signing); with the flag absent or not on Linux it
+      is n/a. The flag makes every Unix socket the sandbox can see
+      connectable, so for each of `/run/docker.sock`,
+      `/var/run/docker.sock`, `/run/docker-cli.sock`, `/run/podman`,
+      `/run/user/<uid>` (`<uid>` from `id -u`), `/run/dbus`,
+      `/tmp/.X11-unix`, `/run/WSL` and `/mnt/wslg` that exists on the
+      host, some scope's `sandbox.filesystem.denyRead` must hold the
+      path or a directory above it. Denying single sockets inside
+      `/run/user/<uid>` (`bus`, `podman`) does not count: the systemd
+      user manager also listens on `systemd/private`. Each one that
+      exists and is not covered is ✗, naming the path; a path the host
+      does not have needs no entry. Point at
+      [Linux needs `allowAllUnixSockets`](../../../../docs/setup/secure-agent-setup.md#linux-needs-allowallunixsockets).
+
     Install detail:
     [`docs/setup/secure-agent-setup.md` → Container gateway](../../../../docs/setup/secure-agent-setup.md#container-gateway).
     On any ✗, point at
diff --git a/plugins/magpie-setup/skills/setup/setup_preflight/isolated_fingerprint.py b/plugins/magpie-setup/skills/setup/setup_preflight/isolated_fingerprint.py
index 7696428ad..ead06b949 100644
--- a/plugins/magpie-setup/skills/setup/setup_preflight/isolated_fingerprint.py
+++ b/plugins/magpie-setup/skills/setup/setup_preflight/isolated_fingerprint.py
@@ -21,4 +21,4 @@
 for installs that do not carry the framework source (see `isolated.py`).
 """
 
-FRAMEWORK_FINGERPRINT = "sha256:ac374d2df3fa4f09"
+FRAMEWORK_FINGERPRINT = "sha256:520552c9c1bc08b8"
diff --git a/tools/agent-isolation/sandbox-error-hint.sh b/tools/agent-isolation/sandbox-error-hint.sh
index 5934f6bfb..6e6149546 100755
--- a/tools/agent-isolation/sandbox-error-hint.sh
+++ b/tools/agent-isolation/sandbox-error-hint.sh
@@ -112,6 +112,8 @@ elif match 'Could not open a connection to your authentication agent|agent refus
   hint="SSH agent / Yubikey appears unreachable from inside the sandbox. See ${doc_path}#ssh-agent--yubikey-appears-unreachable-from-inside-the-sandbox"
 elif match "cannot exec '[^']*gpg-touch-(wrap-[^']*|overlay\.sh wrap [^']*)': Operation not permitted|bash: [^ ]*gpg-touch-(wrap-[^ :]*|overlay\.sh): Operation not permitted"; then
   hint="git cannot start the touch-overlay wrapper from inside the sandbox (~/.claude/scripts/ is read-denied). See ${doc_path}#signed-commit-fails-with-cannot-exec-of-the-touch-overlay-wrapper"
+elif match "bwrap: Can't create file (at )?.*: Read-only file system"; then
+  hint="An allowRead entry that is a parent of an allowWrite path makes bubblewrap mount that path read-only. See ${doc_path}#every-bash-call-fails-with-bwrap-cant-create-file--read-only-file-system"
 elif match 'Cannot connect to the Docker daemon|open /var/run/docker\.sock: operation not permitted|Cannot connect to Podman|connect: permission denied.*podman\.sock'; then
   hint="Docker / Podman runtime socket denied by the sandbox. See ${doc_path}#docker--podman-command-fails-with-a-socket-error"
 elif match '127\.0\.0\.1.*[Pp]ermission denied|[Oo]peration not permitted.*bind|Errno 49.*assign requested address|HTTP.*Connection refused.*127\.0\.0\.1'; then
diff --git a/tools/agent-isolation/tests/test_sandbox_error_hint.py b/tools/agent-isolation/tests/test_sandbox_error_hint.py
index 112874f98..f85b001ad 100644
--- a/tools/agent-isolation/tests/test_sandbox_error_hint.py
+++ b/tools/agent-isolation/tests/test_sandbox_error_hint.py
@@ -142,6 +142,22 @@ def test_tmp_signature(self) -> None:
         assert result.returncode == 1
         assert f"{DOC}#temp-files-fail-with-read-only-file-system-under-tmp" in result.stderr
 
+    def test_bwrap_read_only_placeholder_beats_the_tmp_branch(self) -> None:
+        # A project under /tmp would otherwise match the /tmp branch.
+        result = _run(
+            _bash(stderr="bwrap: Can't create file at /tmp/proj/.claude/settings.json: Read-only file system")
+        )
+        assert result.returncode == 1
+        assert f"{DOC}#every-bash-call-fails-with-bwrap-cant-create-file--read-only-file-system" in result.stderr
+        assert "temp-files-fail" not in result.stderr
+
+    def test_bwrap_read_only_placeholder_with_a_space_in_the_path(self) -> None:
+        result = _run(
+            _bash(stderr="bwrap: Can't create file at /home/u/My Repos/p/.mcp.json: Read-only file system")
+        )
+        assert result.returncode == 1
+        assert f"{DOC}#every-bash-call-fails-with-bwrap-cant-create-file--read-only-file-system" in result.stderr
+
     def test_string_shaped_tool_response(self) -> None:
         payload = json.dumps(
             {"tool_name": "Bash", "tool_response": "Cannot connect to the Docker daemon"}
diff --git a/tools/sandbox-lint/README.md b/tools/sandbox-lint/README.md
index 89dc78643..408fd3c78 100644
--- a/tools/sandbox-lint/README.md
+++ b/tools/sandbox-lint/README.md
@@ -157,6 +157,21 @@ uv run --project tools/sandbox-lint sandbox-lint --any-harness /path/to/magpie
      project that adopted Magpie, `<git-common-dir>/apache-magpie/run/<worktree-id>` in
      one that did not — see [Residual risk](#residual-risk) for
      the one case this cannot fully verify.
+   - When `sandbox.network.allowAllUnixSockets` is `true`,
+     `sandbox.filesystem.denyRead` hides the host sockets it would
+     otherwise open to every sandboxed command: an entry for, or a
+     directory above, each of `/run/docker.sock`, `/var/run/docker.sock`,
+     `/run/docker-cli.sock`, `/run/podman`, `/run/user/<uid>` (the current
+     user's uid, or a glob matching it), `/run/dbus`, `/tmp/.X11-unix`,
+     `/run/WSL` and `/mnt/wslg`. Claude Code skips a `denyRead` path the
+     host lacks, so the full list is safe on every host. See
+     [Linux needs `allowAllUnixSockets`](../../docs/setup/secure-agent-setup.md#linux-needs-allowallunixsockets).
+   - No `sandbox.filesystem.allowRead` entry is a strict parent of an
+     `allowWrite` entry unless the parent is itself writable: bubblewrap
+     then mounts the write path read-only and every Bash call fails. The
+     trap was observed under `denyRead: ["~/"]`; the check applies
+     everywhere, failing closed (see
+     [Every Bash call fails with `bwrap: Can't create file`](../../docs/setup/sandbox-troubleshooting.md#every-bash-call-fails-with-bwrap-cant-create-file--read-only-file-system)).
    - No setting switches a control off wholesale, in any layer (the
      committed file, the local template, or a contributor's own
      `.claude/settings.local.json`): no `sandbox.excludedCommands` entry,
diff --git a/tools/sandbox-lint/src/sandbox_lint/__init__.py b/tools/sandbox-lint/src/sandbox_lint/__init__.py
index 75487aa64..e02fc3386 100644
--- a/tools/sandbox-lint/src/sandbox_lint/__init__.py
+++ b/tools/sandbox-lint/src/sandbox_lint/__init__.py
@@ -226,6 +226,26 @@ def registry_errors(floor: dict[str, Any], registry: dict[str, Any]) -> list[str
 # carved out of a denied home directory.
 REQUIRED_DENY_READ = {"~/"}
 
+# Host sockets that `sandbox.network.allowAllUnixSockets: true` puts in reach
+# of every sandboxed command unless denyRead hides their paths: the container
+# daemons (host root through the daemon), the per-user runtime directory (the
+# systemd user manager over `bus` and `systemd/private` runs commands outside
+# the sandbox; rootless Podman; editor askpass sockets), the system bus, X11,
+# and WSL's interop and WSLg sockets. Claude Code skips a denyRead path the
+# host lacks, so the full list is safe everywhere. `<uid>` is the current
+# user's uid.
+ALL_UNIX_SOCKETS_DENY_READ = (
+    "/run/docker.sock",
+    "/var/run/docker.sock",
+    "/run/docker-cli.sock",
+    "/run/podman",
+    "/run/user/<uid>",
+    "/run/dbus",
+    "/tmp/.X11-unix",
+    "/run/WSL",
+    "/mnt/wslg",
+)
+
 # Settings that switch a control off wholesale, whichever layer sets them. A
 # local file may add personal entries; it may not add one of these.
 #
@@ -466,6 +486,22 @@ def _normalised_set(paths: list[str]) -> set[str]:
     return {_normalise(p) for p in paths}
 
 
+def _deny_covers(entry: str, target: str) -> bool:
+    """Whether a denyRead ``entry`` hides ``target``: the entry is the target
+    or an ancestor of it, segment by segment (globs allowed; a ``<uid>``
+    target segment stands for the current user's uid, so ``/run/user/0``
+    does not cover it for uid 1000)."""
+    expanded = os.path.expanduser(entry)
+    if not os.path.isabs(expanded):
+        return False
+    entry_parts = [p for p in os.path.normpath(expanded).split("/") if p]
+    target_parts = [p for p in target.split("/") if p]
+    return len(entry_parts) <= len(target_parts) and all(
+        fnmatch.fnmatchcase(str(os.getuid()) if t == "<uid>" else t, e)
+        for e, t in zip(entry_parts, target_parts, strict=False)
+    )
+
+
 # ---------------------------------------------------------------------------
 # Deep diff — set semantics on known list-typed keys, equality elsewhere
 # ---------------------------------------------------------------------------
@@ -773,6 +809,22 @@ def check_invariants(settings: dict[str, Any], project_root: Path | None = None)
                 f"sandbox.filesystem.allowWrite: contains {entry!r} which is not in allowRead "
                 "(allowWrite must be a subset of allowRead)"
             )
+        # bubblewrap mounts a read-only allowRead parent over its writable
+        # child, so every Bash call then fails creating its deny-write
+        # placeholders ("Can't create file … Read-only file system"). Seen
+        # under denyRead ~/; checked everywhere, failing closed.
+        for read_entry in fs.get("allowRead", []) or []:
+            parent = _expand(read_entry, project_root) if isinstance(read_entry, str) else None
+            if parent is None or _is_writable(parent, writable):
+                continue
+            for write_entry in fs.get("allowWrite", []) or []:
+                child = _expand(write_entry, project_root) if isinstance(write_entry, str) else None
+                if child is not None and child.startswith(parent.rstrip("/") + "/"):
+                    errors.append(
+                        f"sandbox.filesystem.allowRead: {read_entry!r} is a parent of the allowWrite "
+                        f"entry {write_entry!r}, which the sandbox then mounts read-only (seen under "
+                        "denyRead ~/); list the specific directories under it instead"
+                    )
 
     perms = settings.get("permissions")
     if not isinstance(perms, dict):
@@ -862,6 +914,18 @@ def check_invariants(settings: dict[str, Any], project_root: Path | None = None)
                 "or <git-common-dir>/apache-magpie/run/<worktree-id>/*.sock when the project has not adopted Magpie) instead"
             )
 
+    if settings.get("sandbox", {}).get("network", {}).get("allowAllUnixSockets") is True:
+        deny_entries = [
+            e for e in ((fs.get("denyRead", []) or []) if isinstance(fs, dict) else []) if isinstance(e, str)
+        ]
+        for target in ALL_UNIX_SOCKETS_DENY_READ:
+            if not any(_deny_covers(e, target) for e in deny_entries):
+                errors.append(
+                    f"sandbox.network.allowAllUnixSockets: true lets every sandboxed command connect to "
+                    f"{target}; add it (or its directory) to sandbox.filesystem.denyRead, see "
+                    "docs/setup/secure-agent-setup.md#linux-needs-allowallunixsockets"
+                )
+
     return errors
 
 
diff --git a/tools/sandbox-lint/tests/test_validator.py b/tools/sandbox-lint/tests/test_validator.py
index 01615fe24..38b810b07 100644
--- a/tools/sandbox-lint/tests/test_validator.py
+++ b/tools/sandbox-lint/tests/test_validator.py
@@ -20,6 +20,7 @@
 import copy
 import fnmatch
 import json
+import os
 import subprocess
 from pathlib import Path
 from typing import Any
@@ -973,3 +974,106 @@ def test_the_default_prek_home_is_denied_even_without_prek(baseline: dict[str, A
     settings["permissions"]["deny"].remove("Edit(~/.cache/prek/**)")
     errors = check_invariants(settings, project_root=_git_repo(tmp_path / "r"))
     assert "permissions.deny: must contain 'Edit(~/.cache/prek/**)'" in errors, errors
+
+
+# ---------------------------------------------------------------------------
+# allowAllUnixSockets lifts the Linux seccomp AF_UNIX block, so any socket the
+# sandbox can see becomes connectable; denyRead must hide the host daemons and
+# the per-user runtime directory.
+# ---------------------------------------------------------------------------
+
+_HOST_SOCKETS = [
+    "/run/docker.sock",
+    "/var/run/docker.sock",
+    "/run/docker-cli.sock",
+    "/run/podman",
+    "/run/user/<uid>",
+    "/run/dbus",
+    "/tmp/.X11-unix",
+    "/run/WSL",
+    "/mnt/wslg",
+]
+_UID = os.getuid()
+
+
+def _all_unix_sockets(baseline: dict[str, Any], deny: list[str]) -> dict[str, Any]:
+    settings = copy.deepcopy(baseline)
+    settings["sandbox"]["network"]["allowAllUnixSockets"] = True
+    settings["sandbox"]["filesystem"]["denyRead"] += deny
+    return settings
+
+
+def _flagged_sockets(settings: dict[str, Any]) -> set[str]:
+    errors = check_invariants(settings)
+    return {e.split(" connect to ")[1].split(";")[0] for e in errors if "allowAllUnixSockets" in e}
+
+
+def test_all_unix_sockets_without_socket_denies_is_rejected(baseline: dict[str, Any]) -> None:
+    assert _flagged_sockets(_all_unix_sockets(baseline, [])) == set(_HOST_SOCKETS)
+
+
+@pytest.mark.parametrize("user_deny", [f"/run/user/{_UID}", f"/run/user/{_UID}/", "/run/user/*", "/run/user"])
+def test_all_unix_sockets_with_socket_denies_passes(baseline: dict[str, Any], user_deny: str) -> None:
+    others = [p for p in _HOST_SOCKETS if "<uid>" not in p]
+    assert _flagged_sockets(_all_unix_sockets(baseline, [*others, user_deny])) == set()
+
+
+@pytest.mark.parametrize(
+    "user_deny",
+    [
+        [f"/run/user/{_UID + 1}"],
+        # The systemd user manager also listens on systemd/private, and the
+        # directory holds askpass and agent sockets.
+        [f"/run/user/{_UID}/bus", f"/run/user/{_UID}/podman"],
+    ],
+)
+def test_user_runtime_dir_needs_the_whole_dir_of_this_uid(
+    baseline: dict[str, Any], user_deny: list[str]
+) -> None:
+    others = [p for p in _HOST_SOCKETS if "<uid>" not in p]
+    assert _flagged_sockets(_all_unix_sockets(baseline, [*others, *user_deny])) == {"/run/user/<uid>"}
+
+
+def test_home_and_relative_deny_entries_cover_no_host_socket(baseline: dict[str, Any]) -> None:
+    deny = ["~/", "~/run/docker.sock", "run/docker.sock", "./run/user"]
+    assert _flagged_sockets(_all_unix_sockets(baseline, deny)) == set(_HOST_SOCKETS)
+
+
+def test_socket_denies_are_not_required_without_all_unix_sockets(baseline: dict[str, Any]) -> None:
+    assert not [e for e in check_invariants(baseline) if "allowAllUnixSockets" in e]
+
+
+@pytest.mark.parametrize(
+    ("read", "write"),
+    [
+        ("/home/u/repos", "/home/u/repos/project"),
+        ("/home/u/repos/", "/home/u/repos/project/"),
+        ("~/repos", "~/repos/project"),
+    ],
+)
+def test_allow_read_parent_of_allow_write_is_rejected(
+    baseline: dict[str, Any], read: str, write: str
+) -> None:
+    # bubblewrap mounts the read-only parent over the writable child.
+    settings = copy.deepcopy(baseline)
+    settings["sandbox"]["filesystem"]["allowRead"] += [read, write]
+    settings["sandbox"]["filesystem"]["allowWrite"] += [write]
+    errors = check_invariants(settings)
+    assert any(f"{read!r} is a parent of the allowWrite entry {write!r}" in e for e in errors), errors
+
+
+def test_allow_read_parent_that_is_itself_writable_passes(baseline: dict[str, Any]) -> None:
+    settings = copy.deepcopy(baseline)
+    settings["sandbox"]["filesystem"]["allowRead"] += ["/home/u/repos", "/home/u/repos/project"]
+    settings["sandbox"]["filesystem"]["allowWrite"] += ["/home/u/repos", "/home/u/repos/project"]
+    assert not [e for e in check_invariants(settings) if "is a parent of the allowWrite" in e]
+
+
+def test_dot_allow_read_over_a_project_subdir_passes(baseline: dict[str, Any], tmp_path: Path) -> None:
+    # "." is the project, which the sandbox always makes writable.
+    settings = copy.deepcopy(baseline)
+    settings["sandbox"]["filesystem"]["allowRead"] += [".", "./build"]
+    settings["sandbox"]["filesystem"]["allowWrite"] += ["./build"]
+    assert not [
+        e for e in check_invariants(settings, project_root=tmp_path) if "is a parent of the allowWrite" in e
+    ]
diff --git a/tools/skill-evals/README.md b/tools/skill-evals/README.md
index b356d83d9..9cf900701 100644
--- a/tools/skill-evals/README.md
+++ b/tools/skill-evals/README.md
@@ -35,7 +35,7 @@ Suites are currently implemented for:
 - **pr-management-stats** — 6 cases across 1 step (build-loop)
 - **pr-management-triage** — 33 cases across 6 steps (backport-check, classify-loop, deliver-note, guard-reroute, terminal-links, interaction-progress); the pre-filters, decision table and pagination are pytest-tested in `tools/pr-management`
 - **list-skills** — 8 cases across 2 steps (step-1-command, step-2-present)
-- **setup-isolated-setup-verify** — 27 cases across 4 steps (runtime-routing, codex-native, step-1-classify, step-2-recommend)
+- **setup-isolated-setup-verify** — 28 cases across 4 steps (runtime-routing, codex-native, step-1-classify, step-2-recommend)
 - **setup-isolated-setup-update** — 15 cases across 4 steps (runtime-routing, step-snapshot-drift, step-tool-freshness, step-after-report)
 - **setup-complete-upgrade** — 18 cases across 2 steps (step-plan, step-apply)
 - **setup-isolated-setup-doctor** — 26 cases across 3 steps (runtime-routing, interpret-probes, after-report)
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/README.md b/tools/skill-evals/evals/setup-isolated-setup-verify/README.md
index f6170f830..38310bef5 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/README.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/README.md
@@ -5,13 +5,13 @@
 
 Behavioral evals for the `setup-isolated-setup-verify` skill.
 
-## Suites (27 cases total)
+## Suites (28 cases total)
 
 | Suite | Step | Cases | What it covers |
 |---|---|---|---|
 | codex-native | Codex security model | 3 | untrusted or absent guard despite project trust, unsafe vetted write allowance, and the credential read-isolation gap |
 | runtime-routing | Runtime routing | 2 | Codex and Gemini route to their native adapters and never require Claude files |
-| step-1-classify | The 12 checks | 16 | all-pass, sandbox disabled, missing scripts, version drift, project root missing, injection attempt, signing key unreadable in the sandbox (check 10), dev-tool paths missing from settings.local.json (check 8 ⚠), whole-user hook dir unreadable from the sandbox (check 8 ✗), working directories missing under the read block with a glob entry (check 15 ⚠), roborev installed with `review` and `show` auto-allowed no config-edit deny and an incomplete `ask` list (check 17b, 17d and 17e ✗), roborev's hook replacing the shared whole-user dispatcher (check 17f ✗), `~/.roborev/` made writable with and without step B.2 (check 17c ✗), a roborev MCP server registered (check 17g ⚠), the vetted-ops checkout listed as a working directory (check 16f ✗) |
+| step-1-classify | The 12 checks | 17 | all-pass, sandbox disabled, missing scripts, version drift, project root missing, injection attempt, signing key unreadable in the sandbox (check 10), dev-tool paths missing from settings.local.json (check 8 ⚠), whole-user hook dir unreadable from the sandbox (check 8 ✗), working directories missing under the read block with a glob entry (check 15 ⚠), roborev installed with `review` and `show` auto-allowed no config-edit deny and an incomplete `ask` list (check 17b, 17d and 17e ✗), roborev's hook replacing the shared whole-user dispatcher (check 17f ✗), `~/.roborev/` made writable with and without step B.2 (check 17c ✗), a roborev MCP server registered (check 17g ⚠), the vetted-ops checkout listed as a working directory (check 16f ✗), Linux `allowAllUnixSockets` with no host-socket `denyRead` (check 12e ✗) |
 | step-2-recommend | After the report | 6 | all-pass, install needed, update needed, project-root missing, multiple gaps, roborev findings (settings edit by the operator, `.roborev.toml` left to them) |
 
 ## Run
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-23-linux-all-unix-sockets-exposed/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-23-linux-all-unix-sockets-exposed/expected.json
new file mode 100644
index 000000000..b74da4b87
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-23-linux-all-unix-sockets-exposed/expected.json
@@ -0,0 +1,15 @@
+{
+  "snapshot_drift": "none",
+  "checks": [
+    {
+      "n": 1,
+      "status": "✓",
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"
+    },
+    {
+      "n": 12,
+      "status": "✗",
+      "evidence": "12a–12d pass (hooks, script, env pair, allowAllUnixSockets on Linux, no raw daemon socket); 12e fails: allowAllUnixSockets is true but denyRead (only ~/) does not cover /run/docker.sock, /var/run/docker.sock, /run/user/1000, /run/dbus, /tmp/.X11-unix, which exist on the host"
+    }
+  ]
+}
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-23-linux-all-unix-sockets-exposed/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-23-linux-all-unix-sockets-exposed/report.md
new file mode 100644
index 000000000..70028a516
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-23-linux-all-unix-sockets-exposed/report.md
@@ -0,0 +1,82 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+## Snapshot drift check
+
+cat .apache-magpie.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+cat .apache-magpie.local.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+Result: lock files match — no drift.
+
+---
+
+## Check 1 — Project .claude/settings.json
+
+cat .claude/settings.json:
+```json
+{
+  "sandbox": {
+    "enabled": true,
+    "network": {"allowedDomains": ["github.com", "api.github.com", "pypi.org"]},
+    "filesystem": {"denyRead": ["~/"], "allowRead": ["."], "allowWrite": ["."]}
+  },
+  "permissions": {
+    "deny": ["Read(~/.aws/**)", "Bash(curl *)"],
+    "ask": ["Bash(gh pr create *)"]
+  }
+}
+```
+
+---
+
+## Check 12 — Container gateway wired
+
+Platform: Linux. uname -s → Linux; id -u → 1000
+command -v podman → /usr/bin/podman
+
+~/.claude/settings.local.json hooks:
+  SessionStart → /home/alice/.claude/scripts/container-gateway-hook.sh start
+  SessionEnd → /home/alice/.claude/scripts/container-gateway-hook.sh stop
+test -x /home/alice/.claude/scripts/container-gateway-hook.sh → exists, executable
+
+cat /home/alice/tracker/.claude/settings.local.json:
+```json
+{
+  "env": {
+    "CONTAINER_HOST": "unix:///home/alice/tracker/.apache-magpie-local/run/podman.sock",
+    "DOCKER_HOST": "unix:///home/alice/tracker/.apache-magpie-local/run/docker.sock"
+  },
+  "sandbox": {
+    "network": {
+      "allowAllUnixSockets": true,
+      "allowUnixSockets": [
+        "/home/alice/tracker/.apache-magpie-local/run/podman.sock",
+        "/home/alice/tracker/.apache-magpie-local/run/docker.sock"
+      ]
+    }
+  }
+}
+```
+
+sandbox.filesystem.denyRead in every scope:
+  .claude/settings.json → ["~/"]
+  .claude/settings.local.json → (none)
+  ~/.claude/settings.json → ["~/"]
+
+Host socket paths (test -e on the host):
+  /run/docker.sock → exists
+  /var/run/docker.sock → exists
+  /run/docker-cli.sock → absent
+  /run/podman → absent
+  /run/user/1000 → exists
+  /run/dbus → exists
+  /tmp/.X11-unix → exists
+  /run/WSL → absent
+  /mnt/wslg → absent