Native auto-updater ignores autoUpdates:false and autoUpdatesChannel pin — installs latest mid-session (Windows, native install)

Environment

• OS: Windows 11 (native install)
• Binary path: ~/.local/bin/claude.exe (native install, not npm-global)
• Version before update: 2.1.170
• Version after update: 2.1.172

What Happened

The native auto-updater installed 2.1.172 mid-session while all three documented disable/pin guards were active.

Updater receipt — ~/.claude/.last-update-result.json (mtime 2026-06-10T20:58:08Z), verbatim:

{"timestamp":"2026-06-10T20:58:08.835Z","path":"native","outcome":"success","status":"success","version_from":"2.1.170","version_to":"2.1.172","error_code":null}

"path": "native" confirms this was the native auto-update path, not an explicit claude install invocation.

Binary mtime corroboration: ~/.local/bin/claude.exe was rewritten at 2026-06-10 16:57:59 EDT (nine seconds before the receipt timestamp), mid-session.

Guards That Were Set (all three active at update time; names quoted from live config files)

1. ~/.claude/settings.json → "autoUpdatesChannel": "stable" (file mtime 16:10 EDT, before the update)
2. ~/.claude.json → "autoUpdates": false
3. ~/.claude.json → "autoUpdatesProtectedForNative": true

The autoUpdates: false flag is the Option-D posture documented for issue #60065.

npm dist-tags at Diagnosis Time

stable = 2.1.153
latest = 2.1.172
next   = 2.1.172

The updater installed 2.1.172 (latest), not 2.1.153 (stable). This means two bypasses occurred simultaneously:

1. autoUpdates: false was ignored — the update ran at all.
2. autoUpdatesChannel: "stable" was ignored — the target was latest, not the pinned channel's version.

No External Vector

There were no Claude/Anthropic scheduled tasks, no daemon receipt, and no claude install run in the predecessor session. The path: "native" receipt and the absence of a claude.exe.bak-2.1.170 sibling file (which explicit installs on this machine leave behind) both rule out a manual install.

Relationship to Issue #60065

Issue #60065 (filed 2026-05-17, same reporter) described a silent revert class: the native auto-updater installing a lower version than expected. This issue is the forward-direction sibling: the native auto-updater installing a higher version than the configured channel allows, while the disable switch is on. Both share the root mechanism — the native update path does not respect the disable flag or the channel pin on Windows native installs.

Expected Behavior

• "autoUpdates": false in ~/.claude.json should suppress all self-update activity entirely.
• If auto-update is somehow active, "autoUpdatesChannel": "stable" should constrain the target version to the stable dist-tag (2.1.153 at the time), not latest.
• "autoUpdatesProtectedForNative": true should provide an additional guard specific to the native install path.

None of the three guards had any effect.