chook.mjs resolves its rules to ~/.config/chook.toml and nowhere else — its DEFAULT_CONFIG constant — while server/lib/22-claude-config.sh renders and delivers the file as part of the ~/.claude payload. On the live box the two never met: ~/.claude/chook.toml existed, ~/.config/chook.toml did not, and chook had been running there with no rules at all. The failure mode is the one worth naming. The hooks stay wired in settings.json and still run on every tool call, so a guard that loads nothing returns nothing and reads exactly like a guard that passed. Nothing about the box looks wrong; the metachar guard and every other rule are simply absent. A symlink rather than a copy, so the delivered file stays the single source and a later delivery cannot leave the two disagreeing. A real file already sitting at that path defers rather than being clobbered, as everything else here does. verify.sh asserts the link resolves to the delivered file, because a silent absence is precisely what drift detection is for.