settings.local.json created despite project rules prohibiting it

Description

Claude Code automatically creates .claude/settings.local.json when a user grants a one-time permission interactively, even when the project already has .claude/settings.json and project rules (in CLAUDE.md) explicitly prohibit creating settings.local.json.

Expected behavior

• Claude Code should respect project-level rules that opt out of local settings files
• Alternatively, merge granted permissions directly into the existing settings.json instead of creating a parallel file
• At minimum, provide a project-level configuration option to disable settings.local.json creation

Actual behavior

• Every interactive permission grant creates or appends to .claude/settings.local.json
• This happens regardless of CLAUDE.md rules prohibiting the file
• The file reappears immediately after deletion if any new permission is granted
• Project maintainers must repeatedly clean up the file manually

Reproduction steps

1. Create a project with .claude/settings.json containing existing permissions
2. Add a rule to CLAUDE.md: "NEVER create settings.local.json"
3. Run Claude Code and grant any interactive permission
4. Observe that .claude/settings.local.json is created despite the rule

Workaround

We've implemented a SessionStart hook that merges settings.local.json into settings.json and deletes it at the start of every session. This works but shouldn't be necessary.

Impact

In projects with strict configuration management requirements (e.g., high-assurance/compliance environments), uncontrolled settings file proliferation is a governance issue. The project rules exist for a reason — the runtime should respect them.