Windows Smart App Control blocks signed Claude components on Windows 11 ARM64 (service killed, app crashes)

Summary

On Windows 11 ARM64 with Smart App Control (SAC) enabled (enforce mode), Code Integrity repeatedly blocks Anthropic-signed Claude components. This caused the Claude VM service (CoworkVMService) to terminate unexpectedly and the desktop app to close, and it still blocks background launches after an app auto-update.

Environment

• Windows 11 Pro ARM64 (build 26100-series)
• Claude Desktop (MSIX): 1.37937.0.0 -> 1.37937.1.0 -> 1.37937.3.0 (arm64, package Claude_pzs8sxrjxfjjc)
• Claude Code (bundled): 2.1.246
• Smart App Control: ON (enforce), Memory Integrity ON

Evidence (Event Viewer)

CodeIntegrity/Operational, enforcement events 3077 + audit 3033, all Policy ID {0283ac0f-fff1-49ae-ada1-8a933130cad6} (Smart App Control):

1. services.exe blocked from loading ...\WindowsApps\Claude_1.37937.1.0_arm64_...\app\resources\cowork-svc.exe ("did not meet the Enterprise signing level requirements"). Immediately followed by System log 7034: "The Claude service terminated unexpectedly" (twice within minutes).
2. claude.exe (Claude Code 2.1.246) blocked from loading a Bun native module extracted to Temp: ...\AppData\Local\Temp\.bun-*.node — same policy.
3. Repeated event 3010: "Code Integrity was unable to load the ...\Claude_1.37937.x.0_arm64_...\AppxMetadata\CodeIntegrity.cat catalog. Status 0xC000003A" — during/after the in-place auto-update (two package versions with different signing thumbprints present simultaneously: 4a5607733f5ebc05... subject "Anthropic PBC" vs dbde5d16768ed0c1... subject "Anthropic, PBC").
4. After a reboot the service runs, but SAC still blocks svchost.exe from loading ...\Claude_1.37937.3.0_arm64_...\app\claude.exe (background/auto launch), producing recurring Windows Security "features blocked" notifications.

Additional detail

The service log (C:\ProgramData\Claude\Logs\cowork-service.log) also warns on every start: "failed to configure recovery actions (a crashed service will stay down until reboot): open service: Access is denied." — so when SAC kills the service, it stays down until the machine reboots, and the desktop app that depends on it closes.

Expected

Anthropic-signed MSIX components should pass Smart App Control validation; the CodeIntegrity.cat catalog load failure (0xC000003A) around auto-updates looks like the trigger.

Steps that reproduce (observed)

1. Windows 11 ARM64 with Smart App Control enforced.
2. Claude Desktop auto-updates in place while running.
3. SAC blocks cowork-svc.exe / claude.exe; service dies and cannot auto-restart until reboot.

Related

• #84976 (closed as duplicate of #80444) documents the same missing/unloadable CodeIntegrity.cat + Smart App Control blocks on x64 (vk_swiftshader.dll). This report shows the same root cause on ARM64 (1.37937.x) where SAC also blocks and kills the CoworkVMService system service and a Claude Code Bun native module - beyond the GPU-crash scope of #80444.