The hook-config question is the right test. A guardrail that the same agent can edit is a preference, not a control, and a proof-of-done check only works if the agent cannot rewrite the check itself. Splitting the verifier into a separate process that has no write access to the hook config would make the switch-off path fail closed. If the agent can edit that config today, what would you log first so you can tell a failed edit from a silent one?

iin1007am