diff --git a/server/lib/22-claude-config.sh b/server/lib/22-claude-config.sh
index 7a39d58..f196ae0 100755
--- a/server/lib/22-claude-config.sh
+++ b/server/lib/22-claude-config.sh
@@ -134,6 +134,26 @@ deliver_rendered "$TMP_CHOOK" "$CHOOK_DST" \
   "existing chook.toml differs from the rendered delivery; chook.toml has no box-local override file (unlike settings.json/settings.local.json), so reconcile by hand before re-running" \
   text
 
+# chook.mjs resolves its config to ~/.config/chook.toml and nowhere else — see
+# its DEFAULT_CONFIG constant — while the file is delivered here as part of the
+# ~/.claude payload. Without this link chook loads no rules at all, which fails
+# in the worst possible way: the hooks stay wired in settings.json and every
+# tool call still runs them, so the guards report nothing and read as passing
+# rather than as absent. A link rather than a copy, so the delivered file stays
+# the single source and a later delivery cannot leave the two disagreeing.
+CHOOK_LINK="$H/.config/chook.toml"
+if [[ -L "$CHOOK_LINK" && "$(readlink "$CHOOK_LINK")" == "$CHOOK_DST" ]]; then
+  info "chook config link already points at $CHOOK_DST"
+elif [[ -e "$CHOOK_LINK" && ! -L "$CHOOK_LINK" ]]; then
+  defer "$CHOOK_LINK" \
+    "a real file sits where chook's config link belongs; chook reads only this path, so move it aside and link it to $CHOOK_DST" \
+    "ln -sfn '$CHOOK_DST' '$CHOOK_LINK'"
+else
+  install -d -m 0755 "$H/.config" || die "could not create $H/.config"
+  ln -sfn "$CHOOK_DST" "$CHOOK_LINK" || die "could not link $CHOOK_LINK"
+  info "linked $CHOOK_LINK -> $CHOOK_DST"
+fi
+
 # ---- settings.json -----------------------------------------------------------
 SETTINGS_SRC="$SRC/settings.json"
 SETTINGS_DST="$DST/settings.json"
diff --git a/verify.sh b/verify.sh
index 89267b8..ccacd16 100755
--- a/verify.sh
+++ b/verify.sh
@@ -98,6 +98,15 @@ for c in tmux vim git rg fd jq restic curl mise rustup pnpm claude pass-cli tail
   check_true "present: $c" command -v "$c"
 done
 
+echo "=== claude config ==="
+# chook.mjs resolves its rules to ~/.config/chook.toml and nowhere else, while
+# the file is delivered as part of the ~/.claude payload. When the link is
+# missing chook loads no rules, and the failure is silent in the way that costs
+# most: the hooks stay wired in settings.json and still run on every tool call,
+# so the guards return nothing and read as passing rather than as absent.
+check "chook config resolves to the delivered file" "$HOME/.claude/chook.toml" \
+  readlink -f "$HOME/.config/chook.toml"
+
 echo "=== locale (§4.3) ==="
 check_true "UTF-8 locale active" bash -c '[[ "$(locale charmap)" == "UTF-8" ]]'