Auto Mode: Rules, the Classifier, and a Stated Boundary

An engineer switches a session to auto mode. Their .claude/settings.json has "allow": ["Bash(npm run build)"]. Partway through the session they type, in chat: "don't touch the deploy pipeline until I've reviewed the diff."

1. When Claude next runs npm run build, does that call go through the classifier? Explain using the fixed decision order auto mode follows.
2. An hour later, after a long research detour triggers context compaction, Claude runs a deploy script anyway. The engineer is confused — they were explicit. What most likely happened, and could it have been prevented?
3. If the engineer instead wanted "never run anything under deploy/" to hold for the rest of the session no matter what else happens, what should they have configured instead of saying it in chat?