Any idea what could be at fault here?

Nope. I don't know much of nothin' on Chrome OS. antrim@: could you triage?

One thing that I'm not sure about, does pinning works on dev-channel?

The device was on M66, but the pin was on M62 which way before what the device is, So what is the behavior of the update here really should be?

If that is not the intended behavior, then we have to figure out why omaha is serving that image.

As mentioned in step #2 to repro, this particular device was made to point to the dev instance of the Omaha Server, which is used by the Chrome OS Test team for manual AU testing. GoldenEye does take care of the pushes and has target version prefixing disabled, which means, enterprise pins won't work here.

Are you sure you wanted to use Omaha Dev? Omaha Prod won't give you this problem and, yes, enterprise pinning does work with other channels like dev.

Relevant logs:

Request: <?xml version="1.0" encoding="UTF-8"?>
<request protocol="3.0" version="ChromeOSUpdateEngine-0.1.0.0" updaterversion="ChromeOSUpdateEngine-0.1.0.0" installsource="ondemandupdate" ismachine="1">
    <os version="Indy" platform="Chrome OS" sp="10452.22.0_aarch64"></os>
    <app appid="{AAE972E1-A913-C860-B7AB-BF7F267F199B}" cohort="1:2:" cohortname="hana_dev" version="10452.22.0" track="dev-channel" lang="en-US" board="hana-signed-mp-v3keys" hardware_class="HANA F6A-D7H-A5A-E2Q-B6A-A62" delta_okay="true" fw_version="" ec_version="" installdate="4095" >
        <updatecheck targetversionprefix="9901."></updatecheck>
    </app>
</request>

Omaha request response: <?xml version="1.0" encoding="UTF-8"?><response protocol="3.0" server="omaha-dev"><daystart elapsed_days="4098" elapsed_seconds="61754"/><app appid="{AAE972E1-A913-C860-B7AB-BF7F267F199B}" cohort="1:2:" cohortname="hana_dev" status="ok"><updatecheck status="ok"><urls><url codebase="http://storage.googleapis.com/chromeos-throw-away-bucket/CrOSPayloads/9bXCK1G7ZwccLAh/"/><url codebase="https://storage.googleapis.com/chromeos-throw-away-bucket/CrOSPayloads/9bXCK1G7ZwccLAh/"/></urls><manifest version="10509.0.0"><actions><action event="update" run="chromeos_10509.0.0_hana_dev-channel_full_mp-v3.bin-80a532cd68cd9a6e005dff4da1a63359.signed"/><action ChromeOSVersion="10509.0.0" ChromeVersion="67.0.3376.0" IsDelta="true" IsDeltaPayload="false" MetadataSignatureRsa="zVui9vEfd2oGCs6UWLXfZmv+ZGMoEsfnM0jZlQCV6Rn50vmck+/sM6VYAUr02zWTkAS4GcDqWIpZI3rMeNdj1xfSJlqq1jJLFbRF6RfWYYNT3WialEHQGJyhkY2+HfNLe1py0aDt/LGy6qklqkh3kDTEFM7+62Ud3UkmVD35ny12Nm4QTJRhX+jrfJMs+zTFeQ3deU37mYI+fiLOJyffYiO6xX9eD4IVOCu73r6ucXfTYs0Kc/Iun2tC8ZAKebu2O/t1NvgA59rHYqCqVUwfRReXrxYIGtJM/Z2LO65Rv2WnAxTxwrxB2gqdydTD3zNU6QgceVYuSONSiKYLcTfDGQ==" MetadataSize="46912" deadline="now" event="postinstall" sha256="INBe78+0L0jfNKlQoc3pevcGtvGUn4/iaUKC0X5JC3I="/></actions><packages><package fp="1.20d05eefcfb42f48df34a950a1cde97af706b6f1949f8fe2694282d17e490b72" hash="3wR4wj08vPwzXwuPBM5h2gA0wf8=" hash_sha256="20d05eefcfb42f48df34a950a1cde97af706b6f1949f8fe2694282d17e490b72" name="chromeos_10509.0.0_hana_dev-channel_full_mp-v3.bin-80a532cd68cd9a6e005dff4da1a63359.signed" required="true" size="1011584377"/></packages></manifest></updatecheck></app></response>

Note "server="omaha-dev"" in the response and "chromeos-throw-away-bucket" in the payload URL.