Development record

2026-10-28 — Model-matrix step 2 (itd-2610161733316518) builds dcn-2610280629294458 in two halves: a run starts only from a plan whose every cell source resolveCell derived from the cell's parsed route and this machine's provider configuration, consented to by its digest; and the run record's pinCells refuses a pin that disagrees with what the route itself fixes (the host leg pinned host and nothing else, a runner route on its own runner and <provider>/<model>). A claude-runner cell is a runner route like any other and names its model: the claude runner runs bare on its API key, so it spends and is never the host, which runs in the host's own harness (decision 10). pinCells does not re-read the provider configuration to tell openrouter, local and provider apart: that split is the configuration's, the plan already reads it, and the plan's digest binds the person's consent to what it read. Grounds: the named risk, a provider route pinned as host skipping the spending cap and provider-pin checks, is the host/route disagreement the record now refuses.