Managed settings from the Windows registry are held back until they can be trusted

What

Managed settings are settings an organization's administrator sets for everyone. On Windows they can come from the registry, under HKLM or HKCU. Changes:

• Before trusting these registry settings, Claude Code checks the owners and access permissions of the location they come from. If the check fails, the settings are held back instead of applied. Before, they were always read directly.
• The loader now reports where it looked (whereAsked) and which documents it held (heldDocuments, kept as mdmHeldDocuments). The "MDM settings found" log now reports from that record.
• If a flag needed for the check cannot be read, a withheldFlagRecord is added to the settings errors when only held documents are involved, before some errors are turned into warnings.
• The test for whether an administrator policy still applies changed and gained a second lookup used when heldOnly is not true.
• At startup, settings are applied and managed settings are loaded before the rest of setup.

Why

On Windows, managed settings that fail the ownership check are not applied, and you may see a related error or warning. Administrators should make sure the registry location has the expected owner and permissions.