diff --git a/engine/hooks/gh-write-verification/README.md b/engine/hooks/gh-write-verification/README.md
new file mode 100644
index 0000000..e0d30e1
--- /dev/null
+++ b/engine/hooks/gh-write-verification/README.md
@@ -0,0 +1,136 @@
+# gh-write-verification
+
+One principle, three detectors: **a write's report is not the write's
+effect.** A command that changes remote state has to leave behind evidence
+the agent actually looked at, and that evidence has to be the effect itself
+— not the tool's own claim about it.
+
+## 1. `gh pr edit` is refused on every flag (PreToolUse)
+
+`gh pr edit` eagerly queries `repository.pullRequest.projectCards`, a sunset
+Projects-classic GraphQL field, and exits 1 before writing anything —
+`--base`, `--add-label`, `--title`, `--body`, all of them. The equivalent
+REST calls work.
+
+**Fires on:** any `gh pr edit ...` in a shell tool call.
+**Stays silent on:** `gh pr view`, `gh api` reads, and the `gh api` writes it
+redirects to.
+
+The block names the replacements:
+
+```sh
+gh api -X PATCH repos/<owner>/<repo>/pulls/<n> -f base=<branch>
+gh api -X POST repos/<owner>/<repo>/issues/<n>/labels -f 'labels[]=<label>'
+```
+
+Set `GH_WRITE_VERIFICATION_TRUST_PR_EDIT=1` to lift the block once the CLI or
+the API stops erroring. Prior art: fail-fast applied to the tool choice —
+refuse the reliably-broken path up front instead of letting each session
+rediscover the same GraphQL error.
+
+## 2. A mutation with both streams discarded is refused (PreToolUse)
+
+`gh pr edit "$1" --base main >/dev/null 2>&1` exited 1 and printed the reason
+every single time; the redirect threw it away, and the next stale read-back
+reported success. Four PRs merged into the wrong branch as a result.
+
+**Fires on:** an allowlisted state-changing command — `gh pr
+merge|edit|create|close|reopen|ready|comment|review`, `gh issue`/`gh release`
+writes, `gh api -X POST|PATCH|PUT|DELETE`, `git push|merge|rebase|cherry-pick|revert`,
+`git reset --hard`, `git branch -D`, `git tag -d`, `mergify stack push`/`queue`,
+`curl -X POST|PUT|PATCH|DELETE`, `npm publish`, `docker push`, `kubectl
+apply|create|delete|patch|replace`, `systemctl start|stop|restart|…`,
+`terraform apply|destroy` — whose segment discards **both** stdout and stderr
+(`>/dev/null 2>&1`, `&>/dev/null`, `>&/dev/null`, `>/dev/null 2>/dev/null` in
+either order) with no exit-code check.
+
+**Stays silent on:**
+
+- every read-only command, by construction — the mutating set is an explicit
+  allowlist of danger, not a blocklist of safe things. `grep -q … 2>/dev/null`,
+  `command -v x >/dev/null 2>&1`, `git cat-file -e … 2>/dev/null`,
+  `git status --porcelain >/dev/null 2>&1` are all untouched.
+- an exit code that is actually checked: `… || exit 1`, `… && echo ok`,
+  `if ! cmd …; then`, or `set -e` / `pipefail` anywhere in the text.
+- only one stream discarded — `git push … 2>/dev/null` keeps stdout, and
+  `2>&1 >/dev/null` keeps stderr on the terminal.
+- a redirect that belongs to an earlier command in the pipeline:
+  `grep -q main .git/HEAD 2>/dev/null && git push origin HEAD` splits on the
+  `&&`, so the redirect never reaches the `git push` segment.
+- a `Write`/`Edit` tool call whose *content* mentions any of these shapes —
+  only shell-like tool names are matched.
+
+Prior art: Jim Shore, "Fail Fast," IEEE Software 21(5) 2004
+(<https://martinfowler.com/ieeeSoftware/failFast.pdf>). A discarded failure
+surfaces later, somewhere else, with the diagnostic evidence already gone.
+
+## 3. A merge cannot end the turn unverified (Stop)
+
+`gh pr merge` reporting `MERGED` only means the PR closed against **its own
+base ref**. A PR whose base was never retargeted merges into its own stack
+branch and reports exactly the same `MERGED` state. Only this decides it:
+
+```sh
+git merge-base --is-ancestor <merge_commit> origin/<trunk>
+```
+
+**Fires on:** a turn that ran `gh pr merge` and never ran a landing check
+afterwards. Blocking happens at `Stop`, so the last merge of a turn is
+covered too, not just a chained one.
+**Stays silent on:** a turn with no merge; a merge followed by
+`verify_pr_landed_on_trunk.sh <that PR number>`, `git merge-base
+--is-ancestor …`, or `git branch -r --contains …`; a `stop_hook_active`
+rewrite turn; an unreadable or missing transcript.
+
+The shipped script does the whole check and exits non-zero when the commit is
+not on the trunk:
+
+```sh
+bash "$HOME/.claude/hooks/gh-write-verification/verify_pr_landed_on_trunk.sh" <pr-number> [trunk]
+```
+
+Prior art: Saltzer, Reed and Clark, "End-to-End Arguments in System Design,"
+ACM TOCS 2(4) 1984. An intermediate acknowledgement cannot stand in for the
+end-to-end property; only the endpoints can check it.
+
+## Why not extend `pr-schema-gate`
+
+`pr-schema-gate` already blocks `gh pr edit --body`, so extending it was the
+first candidate. It is architecturally repo-scoped: `claude_pretooluse.py`
+returns early unless `repo_root_with_create_pr_tool()` finds
+`scripts/create-pr.mjs`, because its redirect target *is* that script. catstack
+has no `scripts/create-pr.mjs`, so `pr-schema-gate` fails open here — in the
+very repo where all three failures happened. Its scope is also a different
+question ("did the PR body follow the schema?") with a different redirect
+than these ("is this write's effect observable at all?"), and failures 2 and 3
+touch `git push`, `git merge` and `gh api` rather than PRs. Both hooks are
+kept: `pr-schema-gate`'s `--body` block survives a `gh` fix, this one does not.
+
+## Known false positive
+
+Matching is a raw-text scan over the whole hook payload, not a shell parser,
+and unlike `pr-schema-gate` this hook deliberately does **not** strip heredoc
+bodies — a heredoc that writes a shell script containing a silenced mutation
+is the exact shape of the incident, and `bash script.sh` is opaque to a
+PreToolUse hook afterwards. The cost: documenting or testing these detectors
+with an inline heredoc trips them. Write such text to a file with the `Write`
+tool instead.
+
+## Files
+
+- `detect.py` — the three detectors and their messages
+- `claude_pretooluse.py` — Claude/Cursor `PreToolUse`, exits 2 on 1 and 2
+- `claude_stop_check.py` — Claude `Stop`/`SubagentStop`, exits 2 on 3
+- `verify_pr_landed_on_trunk.sh` — the end-to-end landing check
+- `claude.hook.json` — `PreToolUse` (matcher `Bash`) + `Stop` fragments
+- `install_claude_hook.py` — idempotent, marker-based merge
+
+## Install
+
+`./install.sh` from the repo root, then restart the harness.
+
+## Tests
+
+```sh
+python3 -m unittest discover -s engine/hooks/gh-write-verification/tests -v
+```
diff --git a/engine/hooks/gh-write-verification/claude.hook.json b/engine/hooks/gh-write-verification/claude.hook.json
new file mode 100644
index 0000000..9a3c865
--- /dev/null
+++ b/engine/hooks/gh-write-verification/claude.hook.json
@@ -0,0 +1,28 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 $HOME/.claude/hooks/gh-write-verification/claude_pretooluse.py",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 $HOME/.claude/hooks/gh-write-verification/claude_stop_check.py",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/engine/hooks/gh-write-verification/claude_pretooluse.py b/engine/hooks/gh-write-verification/claude_pretooluse.py
new file mode 100644
index 0000000..6e66373
--- /dev/null
+++ b/engine/hooks/gh-write-verification/claude_pretooluse.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+"""Claude/Cursor PreToolUse: refuse `gh pr edit` (broken on every flag) and
+refuse a state-changing command whose stdout and stderr are both discarded
+with no exit-code check. Exits 2 with the redirect on stderr.
+
+Positive-lists shell-like tool names, so a Write/Edit whose *content*
+mentions these shapes is never blocked. Fails open on any parse error.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from detect import pretooluse_problems
+
+SHELL_LIKE_TOOL_NAMES = (
+    "Bash", "bash", "shell", "Shell", "exec", "exec_command",
+    "run_terminal_cmd", "local_shell", "run_command", "shell_call",
+)
+
+
+def _tool_name(payload: dict) -> str:
+    return str(
+        payload.get("tool_name")
+        or payload.get("toolName")
+        or payload.get("tool")
+        or payload.get("name")
+        or ""
+    )
+
+
+def main() -> None:
+    raw = sys.stdin.read()
+    try:
+        payload = json.loads(raw)
+    except (json.JSONDecodeError, OSError):
+        return
+    if not isinstance(payload, dict):
+        return
+    try:
+        if _tool_name(payload) not in SHELL_LIKE_TOOL_NAMES:
+            return
+        problems = pretooluse_problems(raw)
+    except Exception as exc:
+        sys.stderr.write(f"gh-write-verification: detector error, allowing this command: {exc!r}\n")
+        return
+    if not problems:
+        return
+    sys.stderr.write("\n\n".join(problems) + "\n")
+    sys.exit(2)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/engine/hooks/gh-write-verification/claude_stop_check.py b/engine/hooks/gh-write-verification/claude_stop_check.py
new file mode 100644
index 0000000..1509fbe
--- /dev/null
+++ b/engine/hooks/gh-write-verification/claude_stop_check.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""Claude Stop hook: a turn that ran `gh pr merge` cannot end until it has
+checked where the merge commit landed. Exits 2 with the verification command
+on stderr. Fails open on a missing or unreadable transcript; `stop_hook_active`
+skips so the follow-up turn can finish.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from detect import decide_stop
+
+
+def main() -> None:
+    try:
+        payload = json.load(sys.stdin)
+    except (json.JSONDecodeError, OSError):
+        return
+    try:
+        message = decide_stop(payload if isinstance(payload, dict) else {})
+    except Exception as exc:
+        sys.stderr.write(f"gh-write-verification: detector error, allowing this reply: {exc!r}\n")
+        return
+    if not message:
+        return
+    sys.stderr.write(message + "\n")
+    sys.exit(2)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/engine/hooks/gh-write-verification/detect.py b/engine/hooks/gh-write-verification/detect.py
new file mode 100644
index 0000000..8352759
--- /dev/null
+++ b/engine/hooks/gh-write-verification/detect.py
@@ -0,0 +1,314 @@
+"""gh-write-verification: a write's report is not the write's effect.
+
+Three detectors, one principle. A command that changes remote state has to
+leave behind evidence the agent actually looked at, and that evidence has to
+be the effect itself -- not the tool's own claim about it.
+
+1. BROKEN WRITER (`broken_pr_edit`). `gh pr edit` eagerly queries
+   `repository.pullRequest.projectCards`, a sunset Projects-classic field, so
+   it fails on *every* flag -- `--base`, `--add-label`, `--title`, `--body` --
+   before it writes anything. The equivalent `gh api` REST calls work. This
+   is fail-fast applied to the tool choice: the reliably-broken path is
+   refused up front and the working one is named, rather than letting each
+   session rediscover the GraphQL error. Set
+   `GH_WRITE_VERIFICATION_TRUST_PR_EDIT=1` to lift the block once the CLI or
+   the API stops erroring.
+
+2. SILENCED MUTATION (`silenced_mutations`). A state-changing command whose
+   stdout *and* stderr both go to /dev/null with no exit-code check destroys
+   the only report of its own failure. Jim Shore, "Fail Fast," IEEE Software
+   21(5) 2004 (https://martinfowler.com/ieeeSoftware/failFast.pdf), names the
+   defect class: a failure that is discarded surfaces later, somewhere else,
+   with the diagnostic evidence already gone. Read-only commands with
+   discarded output (`grep -q`, `command -v`, `git cat-file -e`) are
+   legitimate and extremely common, so the mutating set is an explicit
+   allowlist of danger -- anything not on it is silent by construction.
+
+3. UNVERIFIED LANDING (`merges_missing_landing_proof`). `gh pr merge`
+   reporting MERGED means the PR closed against *its own base ref*, which is
+   not necessarily the trunk. Saltzer, Reed and Clark's end-to-end argument
+   (ACM TOCS 2(4), 1984) is the established form: an intermediate
+   acknowledgement cannot stand in for the end-to-end property, which here is
+   "the merge commit is reachable from the trunk." Only
+   `git merge-base --is-ancestor <merge_commit> origin/<trunk>` decides that.
+
+KNOWN FALSE POSITIVE: matching is a raw-text scan over the whole hook
+payload, not a shell parser, and unlike the sibling pr-schema-gate this one
+deliberately does *not* strip heredoc bodies -- a heredoc that writes a shell
+script containing a silenced mutation is the exact shape of the incident, and
+`bash script.sh` is opaque to a PreToolUse hook afterwards. The cost is that
+documenting or testing these detectors with an inline heredoc trips them.
+Write such text to a file with the Write tool instead.
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+
+TRUST_PR_EDIT_ENV = "GH_WRITE_VERIFICATION_TRUST_PR_EDIT"
+
+GH_PR_EDIT_RE = re.compile(r"\bgh\s+pr\s+edit\b")
+
+PR_EDIT_MESSAGE = (
+    "gh-write-verification: `gh pr edit` fails on every flag -- it eagerly "
+    "queries the sunset `repository.pullRequest.projectCards` GraphQL field "
+    "and exits 1 before writing anything. Use the REST API instead:\n"
+    "  base / title / body:  gh api -X PATCH repos/<owner>/<repo>/pulls/<n> "
+    "-f base=<branch>\n"
+    "  labels:               gh api -X POST repos/<owner>/<repo>/issues/<n>/labels "
+    "-f 'labels[]=<label>'\n"
+    "Read the result back with `gh api repos/<owner>/<repo>/pulls/<n> --jq "
+    ".base.ref` -- from the response, not from a cached earlier read. Set "
+    f"{TRUST_PR_EDIT_ENV}=1 to lift this once the CLI stops erroring."
+)
+
+MUTATING_RE = re.compile(
+    r"\bgh\s+pr\s+(?:merge|edit|create|close|reopen|ready|comment|review)\b"
+    r"|\bgh\s+issue\s+(?:create|edit|close|reopen|comment|delete)\b"
+    r"|\bgh\s+release\s+(?:create|edit|delete|upload)\b"
+    r"|\bgh\s+api\b[^\n]*?(?:-X|--method)[=\s]+(?:POST|PATCH|PUT|DELETE)\b"
+    r"|\bgit\s+push\b"
+    r"|\bgit\s+(?:merge|rebase|cherry-pick|revert)\b"
+    r"|\bgit\s+reset\s+--hard\b"
+    r"|\bgit\s+branch\s+-[dD]\b"
+    r"|\bgit\s+tag\s+-d\b"
+    r"|\bmergify\s+(?:stack\s+push|queue)\b"
+    r"|\bcurl\b[^\n]*?(?:-X|--request)[=\s]+(?:POST|PUT|PATCH|DELETE)\b"
+    r"|\bnpm\s+publish\b"
+    r"|\bdocker\s+push\b"
+    r"|\bkubectl\s+(?:apply|create|delete|patch|replace)\b"
+    r"|\bsystemctl\s+(?:start|stop|restart|reload|enable|disable)\b"
+    r"|\bterraform\s+(?:apply|destroy)\b",
+    re.IGNORECASE,
+)
+
+DISCARD_BOTH_RE = re.compile(
+    r"&>>?\s*/dev/null"
+    r"|>&\s*/dev/null"
+    r"|1?>>?\s*/dev/null\s+2>&1(?![0-9-])"
+    r"|1?>>?\s*/dev/null[^\n|;&]*?\s2>>?\s*/dev/null"
+    r"|2>>?\s*/dev/null[^\n|;&]*?\s1?>>?\s*/dev/null"
+)
+
+SEGMENT_SPLIT_RE = re.compile(r"(\|\||&&|\||;|\n)")
+CONDITIONAL_HEAD_RE = re.compile(r"(?:^|\W)(?:if|while|until|elif)\s+!?\s*\S")
+EXIT_STATUS_RE = re.compile(r"\$\?|\bset\s+-[a-z]*e[a-z]*\b|\bpipefail\b")
+
+SILENCED_MESSAGE = (
+    "gh-write-verification: this discards both stdout and stderr from a "
+    "state-changing command and never checks its exit code:\n{hits}\n"
+    "A mutation that fails silently is reported as success by the next stale "
+    "read-back. Either drop the redirect and read the output, or check the "
+    "status explicitly (`|| {{ echo failed; exit 1; }}`, `if ! cmd; then`, or "
+    "`set -e`), then verify the effect rather than the command's own report."
+)
+
+GH_PR_MERGE_RE = re.compile(r"\bgh\s+pr\s+merge\b(?:\s+(?P<number>\d+))?")
+LANDING_PROOF_RE = re.compile(
+    r"\bverify_pr_landed_on_trunk\b"
+    r"|\bgit\s+merge-base\s+--is-ancestor\b"
+    r"|\bgit\s+branch\s+-r\s+--contains\b"
+    r"|\bgit\s+branch\s+--contains\b[^\n]*\s-r\b"
+)
+VERIFY_SCRIPT_RELPATH = "gh-write-verification/verify_pr_landed_on_trunk.sh"
+
+UNVERIFIED_MERGE_MESSAGE = (
+    "gh-write-verification: this turn merged {subjects} and never checked "
+    "where the merge commit landed. `gh pr merge` reporting MERGED only means "
+    "the PR closed against its own base ref, which is not necessarily the "
+    "trunk -- a PR whose base was never retargeted merges into its own stack "
+    "branch and reports exactly the same MERGED state.\n"
+    "Run the end-to-end check before finishing:\n"
+    '  bash "$HOME/.claude/hooks/' + VERIFY_SCRIPT_RELPATH + '" <pr-number>\n'
+    "It resolves the merge commit through `gh api` and asserts "
+    "`git merge-base --is-ancestor <merge_commit> origin/<trunk>`, exiting "
+    "non-zero when the commit is not on the trunk."
+)
+
+
+def unescape_payload(raw_text: str) -> str:
+    """Turn a JSON payload's two-character escapes into real whitespace.
+
+    Used only to search. Heredoc bodies are kept: a heredoc that writes a
+    shell script is how a silenced mutation reaches a later opaque
+    `bash script.sh`, which no PreToolUse hook can inspect.
+    """
+    return (raw_text or "").replace("\\n", "\n").replace("\\t", "\t").replace('\\"', '"')
+
+
+def broken_pr_edit(raw_text: str) -> str | None:
+    """Return the offending `gh pr edit` text, or None when it is absent."""
+    if os.environ.get(TRUST_PR_EDIT_ENV):
+        return None
+    match = GH_PR_EDIT_RE.search(unescape_payload(raw_text))
+    return match.group(0) if match else None
+
+
+def _segments(text: str) -> list[tuple[str, str]]:
+    parts = SEGMENT_SPLIT_RE.split(text)
+    pairs: list[tuple[str, str]] = []
+    for index in range(0, len(parts), 2):
+        separator = parts[index + 1] if index + 1 < len(parts) else ""
+        pairs.append((parts[index], separator))
+    return pairs
+
+
+def _status_is_checked(segment: str, separator: str, whole: str) -> bool:
+    if separator in ("||", "&&"):
+        return True
+    if CONDITIONAL_HEAD_RE.search(segment):
+        return True
+    return bool(EXIT_STATUS_RE.search(whole))
+
+
+def silenced_mutations(raw_text: str) -> list[str]:
+    """Mutating commands in the payload whose failure output is thrown away.
+
+    A hit needs all three: an allowlisted state-changing command, a redirect
+    that discards stdout *and* stderr, and no exit-code check anywhere that
+    could surface the failure.
+    """
+    text = unescape_payload(raw_text)
+    hits: list[str] = []
+    for segment, separator in _segments(text):
+        mutation = MUTATING_RE.search(segment)
+        if not mutation:
+            continue
+        discard = DISCARD_BOTH_RE.search(segment, mutation.start())
+        if not discard:
+            continue
+        if _status_is_checked(segment, separator, text):
+            continue
+        hits.append(segment[mutation.start():discard.end()].strip())
+    return hits
+
+
+def _proves_landing(command: str, number: str | None) -> bool:
+    """True when this command checks where a merge commit actually landed.
+
+    An invocation of the shipped verification script must name the PR it is
+    vouching for; a hand-rolled ancestry check is accepted as written, since
+    it takes a commit sha rather than a PR number.
+    """
+    command = command or ""
+    if not LANDING_PROOF_RE.search(command):
+        return False
+    if "verify_pr_landed_on_trunk" in command and number is not None:
+        return number in command
+    return True
+
+
+def merges_missing_landing_proof(commands: list[str]) -> list[str]:
+    """PR subjects merged in this turn with no landing check run afterwards.
+
+    Returns the merged subjects (a PR number, or "the current branch's PR"
+    when the command omitted one) when no later command in the turn proves
+    the merge commit reached the trunk. Empty when nothing merged or when the
+    proof ran after the merge.
+    """
+    subjects: list[str] = []
+    for index, command in enumerate(commands):
+        match = GH_PR_MERGE_RE.search(command or "")
+        if not match:
+            continue
+        number = match.group("number")
+        subject = f"PR #{number}" if number else "the current branch's PR"
+        if any(_proves_landing(later, number) for later in commands[index + 1:]):
+            continue
+        if subject not in subjects:
+            subjects.append(subject)
+    return subjects
+
+
+def unverified_merge_message(subjects: list[str]) -> str:
+    return UNVERIFIED_MERGE_MESSAGE.format(subjects=", ".join(subjects))
+
+
+def silenced_message(hits: list[str]) -> str:
+    return SILENCED_MESSAGE.format(hits="\n".join(f"    {hit}" for hit in hits))
+
+
+def pretooluse_problems(raw_text: str) -> list[str]:
+    """Every blocking message this payload earns, in reporting order."""
+    problems: list[str] = []
+    if broken_pr_edit(raw_text):
+        problems.append(PR_EDIT_MESSAGE)
+    hits = silenced_mutations(raw_text)
+    if hits:
+        problems.append(silenced_message(hits))
+    return problems
+
+
+def _text_content(data: dict) -> str:
+    message = data.get("message")
+    content = message.get("content") if isinstance(message, dict) else data.get("content")
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        return "\n".join(
+            b.get("text", "") for b in content if isinstance(b, dict) and b.get("type") == "text"
+        )
+    return ""
+
+
+def _is_human_user_line(data: dict) -> bool:
+    if data.get("type") != "user":
+        return False
+    text = _text_content(data)
+    return bool(text.strip()) and not text.lstrip().startswith("<")
+
+
+def bash_commands_this_turn(raw_lines) -> list[str]:
+    """Bash tool commands issued since the last authored user message."""
+    parsed: list[dict] = []
+    for raw in raw_lines:
+        try:
+            data = json.loads(raw)
+        except (json.JSONDecodeError, TypeError):
+            continue
+        if isinstance(data, dict):
+            parsed.append(data)
+    turn_start = 0
+    for index, data in enumerate(parsed):
+        if _is_human_user_line(data):
+            turn_start = index
+    commands: list[str] = []
+    for data in parsed[turn_start:]:
+        if data.get("type") != "assistant":
+            continue
+        message = data.get("message")
+        content = message.get("content") if isinstance(message, dict) else None
+        if not isinstance(content, list):
+            continue
+        for block in content:
+            if not isinstance(block, dict) or block.get("type") != "tool_use":
+                continue
+            if block.get("name") not in ("Bash", "bash"):
+                continue
+            tool_input = block.get("input")
+            if isinstance(tool_input, dict):
+                commands.append(str(tool_input.get("command") or ""))
+    return commands
+
+
+def decide_stop(payload: dict) -> str | None:
+    """Blocking feedback for the Stop event, or None to let the turn finish.
+
+    Fails open on a missing or unreadable transcript: a check we could not
+    run must never wedge a turn.
+    """
+    if payload.get("stop_hook_active"):
+        return None
+    transcript_path = payload.get("transcript_path") or payload.get("transcriptPath") or ""
+    if not transcript_path:
+        return None
+    try:
+        with open(transcript_path, encoding="utf-8") as handle:
+            commands = bash_commands_this_turn(handle)
+    except OSError:
+        return None
+    subjects = merges_missing_landing_proof(commands)
+    if not subjects:
+        return None
+    return unverified_merge_message(subjects)
diff --git a/engine/hooks/gh-write-verification/install_claude_hook.py b/engine/hooks/gh-write-verification/install_claude_hook.py
new file mode 100644
index 0000000..d9870bb
--- /dev/null
+++ b/engine/hooks/gh-write-verification/install_claude_hook.py
@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Idempotently merge gh-write-verification into Claude settings."""
+from __future__ import annotations
+
+import copy
+import json
+import os
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+SETTINGS_PATH = os.path.expanduser("~/.claude/settings.json")
+FRAGMENT_PATH = os.path.join(HERE, "claude.hook.json")
+MARKERS = {
+    "PreToolUse": "gh-write-verification/claude_pretooluse.py",
+    "Stop": "gh-write-verification/claude_stop_check.py",
+}
+
+
+def _is_ours(entry: dict, marker: str) -> bool:
+    return any(marker in str(hook.get("command", "")) for hook in entry.get("hooks", []))
+
+
+def merge_hooks(settings: dict) -> dict:
+    result = copy.deepcopy(settings)
+    with open(FRAGMENT_PATH, encoding="utf-8") as handle:
+        fragment = json.load(handle)["hooks"]
+    hooks = result.setdefault("hooks", {})
+    for event, marker in MARKERS.items():
+        kept = [entry for entry in hooks.get(event, []) if not _is_ours(entry, marker)]
+        hooks[event] = kept + fragment[event]
+    return result
+
+
+def main() -> None:
+    settings: dict = {}
+    if os.path.exists(SETTINGS_PATH):
+        with open(SETTINGS_PATH, encoding="utf-8") as handle:
+            settings = json.load(handle)
+    merged = merge_hooks(settings)
+    if merged == settings:
+        print("ok      claude gh-write-verification hooks already up to date")
+        return
+    os.makedirs(os.path.dirname(SETTINGS_PATH), exist_ok=True)
+    with open(SETTINGS_PATH, "w", encoding="utf-8") as handle:
+        json.dump(merged, handle, indent=2)
+        handle.write("\n")
+    print("link    claude PreToolUse + Stop gh-write-verification merged")
+    print("        (restart Claude Code to pick up the change)")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/engine/hooks/gh-write-verification/tests/test_hooks.py b/engine/hooks/gh-write-verification/tests/test_hooks.py
new file mode 100644
index 0000000..011d99d
--- /dev/null
+++ b/engine/hooks/gh-write-verification/tests/test_hooks.py
@@ -0,0 +1,250 @@
+"""End-to-end tests for gh-write-verification's three detectors.
+
+Each detector gets a case that fires and a case that stays quiet, plus the
+entrypoints exercised as real subprocesses so the exit-2 contract is proven,
+not assumed.
+"""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+HOOK_DIR = os.path.dirname(HERE)
+sys.path.insert(0, HOOK_DIR)
+
+from detect import (  # noqa: E402
+    TRUST_PR_EDIT_ENV,
+    broken_pr_edit,
+    decide_stop,
+    merges_missing_landing_proof,
+    pretooluse_problems,
+    silenced_mutations,
+)
+
+PRETOOLUSE = os.path.join(HOOK_DIR, "claude_pretooluse.py")
+STOP_CHECK = os.path.join(HOOK_DIR, "claude_stop_check.py")
+
+INCIDENT_RETARGET = 'gh pr edit "$1" --base main >/dev/null 2>&1'
+
+
+def run_entrypoint(entrypoint: str, payload: dict, env_extra: dict | None = None):
+    env = dict(os.environ)
+    env.pop(TRUST_PR_EDIT_ENV, None)
+    env.update(env_extra or {})
+    return subprocess.run(
+        [sys.executable, entrypoint],
+        input=json.dumps(payload),
+        capture_output=True,
+        text=True,
+        env=env,
+    )
+
+
+def bash_payload(command: str) -> dict:
+    return {"tool_name": "Bash", "cwd": HOOK_DIR, "tool_input": {"command": command}}
+
+
+def transcript(commands: list[str]) -> str:
+    lines = [json.dumps({"type": "user", "message": {"role": "user", "content": "land the stack"}})]
+    for command in commands:
+        lines.append(json.dumps({
+            "type": "assistant",
+            "message": {"content": [
+                {"type": "tool_use", "name": "Bash", "input": {"command": command}}
+            ]},
+        }))
+    handle = tempfile.NamedTemporaryFile("w", suffix=".jsonl", delete=False)
+    handle.write("\n".join(lines) + "\n")
+    handle.close()
+    return handle.name
+
+
+class TestBrokenPrEdit(unittest.TestCase):
+    def test_every_flag_of_gh_pr_edit_is_blocked(self):
+        for command in (
+            "gh pr edit 295 --base main",
+            "gh pr edit 295 --add-label admin-bypass",
+            "gh pr edit 295 --title 'x'",
+            "gh pr edit 295 --body-file /tmp/body.md",
+        ):
+            self.assertIsNotNone(broken_pr_edit(command), command)
+
+    def test_block_message_names_the_gh_api_replacements(self):
+        result = run_entrypoint(PRETOOLUSE, bash_payload("gh pr edit 295 --base main"))
+        self.assertEqual(result.returncode, 2, result.stderr)
+        self.assertIn("gh api -X PATCH repos/<owner>/<repo>/pulls/<n>", result.stderr)
+        self.assertIn("gh api -X POST repos/<owner>/<repo>/issues/<n>/labels", result.stderr)
+
+    def test_the_sanctioned_gh_api_replacement_is_allowed(self):
+        for command in (
+            "gh api -X PATCH repos/EdbertChan/catstack/pulls/295 -f base=main",
+            "gh api repos/EdbertChan/catstack/pulls/295 --jq .base.ref",
+            "gh pr view 295 --json baseRefName",
+        ):
+            self.assertEqual(pretooluse_problems(command), [], command)
+
+    def test_trust_env_lets_gh_pr_edit_through(self):
+        result = run_entrypoint(
+            PRETOOLUSE,
+            bash_payload("gh pr edit 295 --base main"),
+            {TRUST_PR_EDIT_ENV: "1"},
+        )
+        self.assertEqual(result.returncode, 0, result.stderr)
+
+
+class TestSilencedMutation(unittest.TestCase):
+    def test_the_incident_line_is_flagged(self):
+        self.assertEqual(silenced_mutations(INCIDENT_RETARGET), [INCIDENT_RETARGET])
+
+    def test_mutations_with_both_streams_discarded_are_flagged(self):
+        for command in (
+            "git push origin HEAD >/dev/null 2>&1",
+            "gh pr merge 291 --squash &>/dev/null",
+            "gh api -X POST repos/o/r/issues/1/labels -f 'labels[]=x' > /dev/null 2>/dev/null",
+            "git merge origin/main 2>/dev/null >/dev/null",
+            "curl -X DELETE https://example.test/thing >/dev/null 2>&1",
+        ):
+            self.assertTrue(silenced_mutations(command), command)
+
+    def test_read_only_commands_with_discarded_output_stay_silent(self):
+        for command in (
+            "grep -q needle haystack.txt 2>/dev/null",
+            "command -v shellcheck >/dev/null 2>&1",
+            "git cat-file -e abc123^{commit} 2>/dev/null",
+            "git status --porcelain >/dev/null 2>&1",
+            "gh pr view 295 --json state >/dev/null 2>&1",
+            "pgrep -f run_all_tests >/dev/null 2>&1",
+            "diff -q a b >/dev/null 2>&1",
+        ):
+            self.assertEqual(silenced_mutations(command), [], command)
+
+    def test_a_checked_exit_code_stays_silent(self):
+        for command in (
+            "git push origin HEAD >/dev/null 2>&1 || exit 1",
+            "if ! git push origin HEAD >/dev/null 2>&1; then echo failed; fi",
+            "git push origin HEAD >/dev/null 2>&1 && echo pushed",
+            "set -euo pipefail\ngit push origin HEAD >/dev/null 2>&1",
+        ):
+            self.assertEqual(silenced_mutations(command), [], command)
+
+    def test_one_stream_left_visible_stays_silent(self):
+        for command in (
+            "git push origin HEAD >/dev/null",
+            "git push origin HEAD 2>/dev/null",
+            "git push origin HEAD 2>&1 >/dev/null",
+        ):
+            self.assertEqual(silenced_mutations(command), [], command)
+
+    def test_a_redirect_belonging_to_an_earlier_command_stays_silent(self):
+        command = "grep -q main .git/HEAD 2>/dev/null && git push origin HEAD"
+        self.assertEqual(silenced_mutations(command), [])
+
+    def test_a_file_write_mentioning_the_shape_is_allowed(self):
+        payload = {
+            "tool_name": "Write",
+            "cwd": HOOK_DIR,
+            "tool_input": {"file_path": "/tmp/notes.md", "content": INCIDENT_RETARGET},
+        }
+        result = run_entrypoint(PRETOOLUSE, payload)
+        self.assertEqual(result.returncode, 0, result.stderr)
+
+    def test_a_heredoc_written_script_is_flagged(self):
+        command = "cat > retarget.sh <<'EOS'\ngh pr merge 291 --squash >/dev/null 2>&1\nEOS"
+        self.assertTrue(silenced_mutations(command))
+
+    def test_entrypoint_denies_a_discarded_mutation(self):
+        result = run_entrypoint(PRETOOLUSE, bash_payload("git push origin HEAD >/dev/null 2>&1"))
+        self.assertEqual(result.returncode, 2, result.stderr)
+        self.assertIn("discards both stdout and stderr", result.stderr)
+
+
+class TestUnverifiedLanding(unittest.TestCase):
+    def test_a_merge_with_no_landing_check_is_flagged(self):
+        self.assertEqual(
+            merges_missing_landing_proof(["gh pr merge 291 --squash --admin", "gh pr view 291"]),
+            ["PR #291"],
+        )
+
+    def test_every_unproven_merge_in_the_turn_is_flagged(self):
+        commands = [
+            "gh pr merge 291 --squash",
+            "gh pr merge 292 --squash",
+            "bash verify_pr_landed_on_trunk.sh 292",
+        ]
+        self.assertEqual(merges_missing_landing_proof(commands), ["PR #291"])
+
+    def test_a_verified_landing_stays_silent(self):
+        for proof in (
+            "bash verify_pr_landed_on_trunk.sh 291",
+            "git merge-base --is-ancestor 314f0447 origin/main",
+            "git branch -r --contains 314f0447",
+        ):
+            self.assertEqual(
+                merges_missing_landing_proof(["gh pr merge 291 --squash", proof]), [], proof
+            )
+
+    def test_a_turn_with_no_merge_stays_silent(self):
+        self.assertEqual(merges_missing_landing_proof(["git status", "gh pr view 291"]), [])
+
+    def test_stop_entrypoint_denies_an_unproven_merge(self):
+        path = transcript(["gh pr merge 291 --squash --admin"])
+        try:
+            result = run_entrypoint(STOP_CHECK, {"transcript_path": path})
+            self.assertEqual(result.returncode, 2, result.stderr)
+            self.assertIn("verify_pr_landed_on_trunk.sh", result.stderr)
+            self.assertIn("PR #291", result.stderr)
+        finally:
+            os.unlink(path)
+
+    def test_stop_entrypoint_allows_a_proven_merge(self):
+        path = transcript([
+            "gh pr merge 291 --squash --admin",
+            'bash "$HOME/.claude/hooks/gh-write-verification/verify_pr_landed_on_trunk.sh" 291',
+        ])
+        try:
+            result = run_entrypoint(STOP_CHECK, {"transcript_path": path})
+            self.assertEqual(result.returncode, 0, result.stderr)
+        finally:
+            os.unlink(path)
+
+    def test_a_missing_transcript_fails_open(self):
+        self.assertIsNone(decide_stop({"transcript_path": "/nonexistent/transcript.jsonl"}))
+        self.assertIsNone(decide_stop({}))
+
+    def test_a_malformed_transcript_line_is_ignored(self):
+        handle = tempfile.NamedTemporaryFile("w", suffix=".jsonl", delete=False)
+        handle.write("not json at all\n{\n")
+        handle.close()
+        try:
+            self.assertIsNone(decide_stop({"transcript_path": handle.name}))
+        finally:
+            os.unlink(handle.name)
+
+    def test_stop_hook_active_stays_silent(self):
+        path = transcript(["gh pr merge 291 --squash --admin"])
+        try:
+            self.assertIsNone(decide_stop({"transcript_path": path, "stop_hook_active": True}))
+        finally:
+            os.unlink(path)
+
+
+class TestVerificationScript(unittest.TestCase):
+    def test_the_script_refuses_a_call_with_no_pr_number(self):
+        script = os.path.join(HOOK_DIR, "verify_pr_landed_on_trunk.sh")
+        result = subprocess.run(["bash", script], capture_output=True, text=True)
+        self.assertEqual(result.returncode, 64, result.stderr)
+        self.assertIn("usage:", result.stderr)
+
+    def test_the_script_parses_as_valid_bash(self):
+        script = os.path.join(HOOK_DIR, "verify_pr_landed_on_trunk.sh")
+        result = subprocess.run(["bash", "-n", script], capture_output=True, text=True)
+        self.assertEqual(result.returncode, 0, result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/engine/hooks/gh-write-verification/verify_pr_landed_on_trunk.sh b/engine/hooks/gh-write-verification/verify_pr_landed_on_trunk.sh
new file mode 100755
index 0000000..3427222
--- /dev/null
+++ b/engine/hooks/gh-write-verification/verify_pr_landed_on_trunk.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "usage: verify_pr_landed_on_trunk.sh <pr-number> [trunk-branch]" >&2
+  echo "  asserts the PR's merge commit is an ancestor of origin/<trunk-branch>" >&2
+  exit 64
+}
+
+[ "$#" -ge 1 ] || usage
+PR_NUMBER="$1"
+TRUNK="${2:-main}"
+
+if ! SLUG="$(gh repo view --json nameWithOwner --jq .nameWithOwner)"; then
+  echo "FAIL: cannot resolve the current repository with gh repo view" >&2
+  exit 1
+fi
+
+if ! FIELDS="$(gh api "repos/${SLUG}/pulls/${PR_NUMBER}" \
+  --jq '[.merged, .base.ref, (.merge_commit_sha // "none")] | @tsv')"; then
+  echo "FAIL: cannot read PR #${PR_NUMBER} from ${SLUG}" >&2
+  exit 1
+fi
+read -r MERGED BASE_REF MERGE_SHA <<<"$FIELDS"
+
+echo "pr=#${PR_NUMBER} repo=${SLUG} merged=${MERGED} base=${BASE_REF} merge_commit=${MERGE_SHA}"
+
+if [ "$MERGED" != "true" ]; then
+  echo "FAIL: PR #${PR_NUMBER} is not merged" >&2
+  exit 1
+fi
+
+if [ "$MERGE_SHA" = "none" ] || [ -z "$MERGE_SHA" ]; then
+  echo "FAIL: PR #${PR_NUMBER} reports merged with no merge commit sha" >&2
+  exit 1
+fi
+
+git fetch --quiet origin "$TRUNK"
+
+if ! git cat-file -e "${MERGE_SHA}^{commit}" 2>/dev/null; then
+  git fetch --quiet origin "$MERGE_SHA" || true
+fi
+
+if ! git cat-file -e "${MERGE_SHA}^{commit}" 2>/dev/null; then
+  echo "FAIL: merge commit ${MERGE_SHA} is not fetchable into this clone" >&2
+  exit 1
+fi
+
+if git merge-base --is-ancestor "$MERGE_SHA" "origin/${TRUNK}"; then
+  echo "OK: ${MERGE_SHA} is an ancestor of origin/${TRUNK}"
+  exit 0
+fi
+
+echo "FAIL: PR #${PR_NUMBER} reports MERGED but ${MERGE_SHA} is not on origin/${TRUNK}" >&2
+echo "      it landed on: $(git branch -r --contains "$MERGE_SHA" | tr -d ' ' | paste -sd, -)" >&2
+echo "      the PR merged into its own base ref (${BASE_REF}), not the trunk" >&2
+exit 1
diff --git a/install.sh b/install.sh
index 5b06466..5de264a 100755
--- a/install.sh
+++ b/install.sh
@@ -246,6 +246,7 @@ link_item "agent-relay-attribution" "$REPO_DIR/engine/hooks/agent-relay-attribut
 link_item "scratchpad-collision" "$REPO_DIR/engine/hooks/scratchpad-collision" "$HOME/.claude/hooks/scratchpad-collision"
 link_item "ui-input-guard" "$REPO_DIR/engine/hooks/ui-input-guard" "$HOME/.claude/hooks/ui-input-guard"
 link_item "hook-freshness" "$REPO_DIR/engine/hooks/hook-freshness" "$HOME/.claude/hooks/hook-freshness"
+link_item "gh-write-verification" "$REPO_DIR/engine/hooks/gh-write-verification" "$HOME/.claude/hooks/gh-write-verification"
 
 echo "--- cursor hooks dir (\$HOME/.cursor/hooks) ---"
 mkdir -p "$HOME/.cursor/hooks"
@@ -335,6 +336,7 @@ python3 "$REPO_DIR/engine/hooks/skill-usage-log/install_claude_hook.py"
 python3 "$REPO_DIR/engine/hooks/cat-mode-default/install_claude_hook.py"
 python3 "$REPO_DIR/engine/hooks/restated-constraint/install_claude_hook.py"
 python3 "$REPO_DIR/engine/hooks/named-verb-guard/install_claude_hook.py"
+python3 "$REPO_DIR/engine/hooks/gh-write-verification/install_claude_hook.py"
 
 echo "--- subagent-inheritance: every Stop hook above also fires on SubagentStop; a manifest opts out with subagent_stop.inherit=false + reason ---"
 python3 "$REPO_DIR/scripts/mirror_stop_hooks_to_subagent_stop.py"
diff --git a/tests/test_install.py b/tests/test_install.py
index c8e0445..9d230ff 100644
--- a/tests/test_install.py
+++ b/tests/test_install.py
@@ -193,6 +193,17 @@ def test_named_verb_guard_linked_and_stop_wired_for_claude(self):
         self.assertEqual(os.readlink(target), hook_src("named-verb-guard"))
         commands = self._claude_hook_commands("Stop")
         self.assertTrue(any("named-verb-guard/claude_stop_check.py" in c for c in commands), commands)
+
+    def test_gh_write_verification_linked_and_pretooluse_plus_stop_wired_for_claude(self):
+        target = os.path.join(self.fake_home, ".claude", "hooks", "gh-write-verification")
+        self.assertTrue(os.path.islink(target), target)
+        self.assertEqual(os.readlink(target), hook_src("gh-write-verification"))
+        pre = self._claude_hook_commands("PreToolUse")
+        stop = self._claude_hook_commands("Stop")
+        subagent = self._claude_hook_commands("SubagentStop")
+        self.assertTrue(any("gh-write-verification/claude_pretooluse.py" in c for c in pre), pre)
+        self.assertTrue(any("gh-write-verification/claude_stop_check.py" in c for c in stop), stop)
+        self.assertTrue(any("gh-write-verification/claude_stop_check.py" in c for c in subagent), subagent)
     def test_hedge_runs_prove_it_linked_and_stop_wired_for_claude(self):
         target = os.path.join(self.fake_home, ".claude", "hooks", "hedge-runs-prove-it")
         self.assertTrue(os.path.islink(target), target)