Carry landed master through 18382

Preserve original owner patch sequences and all new master semantics.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/DEVELOPING.md

@@ -274,6 +274,30 @@ ID saved with the plan, even when GitHub increments the run attempt. Turbo hashe
 `PAPERCLIP_CI_SELECTION_HASH`, so a passing subset cannot satisfy a full run or a
 different selection.
 
+Graph discovery runs at most two isolated Node processes concurrently. Each
+project retains its own Vite configuration, aliases and module graph. Any worker
+error or timeout rejects the whole refinement and retains the original task plan.
+The selector checkout needs only the merge commit and its two parents, not the
+repository's complete history.
+
+Server test costs are recorded in CI with tests, hooks, collection, setup and
+environment preparation included. The weekly **Refresh CI test durations**
+workflow reads two successful protected-master Cloud readiness runs and opens a
+timing-only PR. It never executes code from logs, changes test selection rules,
+or grants AWS access. GitHub may require a maintainer to approve the bot PR's
+workflow runs; the refresh never merges itself. An outstanding refresh PR pauses
+new refreshes. Both timing manifests include source runs and measurement coverage.
+The refresh requires at least 90% coverage of each current lane and uses median
+measurements; missing files retain their old weights. Historical logs can bootstrap
+test/hook costs until structured loading/setup measurements are available.
+
+To reproduce a refresh from a full checkout with GitHub Actions read access:
+
+```sh
+node scripts/ci/refresh-test-durations.mjs [master-run-id ...]
+node --test scripts/ci/test-selection-timing*.test.mjs
+```
+
 Set the repository variable `CI_VITEST_SELECTION=off` to disable file selection
 while keeping the existing task-level optimization. Empty or `enabled` enables
 it; other values disable it. `full-ci`, profiling, and task-level `full`/`shadow`

doc/execution-semantics.md

@@ -2240,6 +2240,27 @@ replacement launches use current release authority. A missing historical receipt
 retains the current release gate; guest files cannot establish old authority. A missing, changed, or incompatible package
 must be replaced and verified before launch.
 
+The server records the closed `runnerProfileJson.nativeProviderPackAdmission`
+receipt after actual session admission and attachment. Its `session_admitted`
+stage and `core_verified_selection` authority describe Core's verified selection,
+not an independent provider statement. It includes only the bound run, session,
+runner, lease and pack identities. Retained attachments keep the original pack
+and identify `inheritedFromRunId`. The first receipt is immutable history.
+`nativeProviderPackAdmissionState` separately describes current admission proof:
+`pending`, `verified` or `unknown`, with an opaque admission epoch. The mandatory
+coordinator claim atomically sets a new pending epoch before session admission.
+Only the matching owner and epoch can publish post-attachment proof. Failed
+receipt writes leave pending evidence; changed or unsupported admission leaves
+unknown evidence and does not prevent authorized execution. A missing legacy
+receipt remains unknown; the current release cannot supply that missing history.
+Retained recovery needs positively verified prior provenance, captured before
+same-run invalidation or read from the exact source run. A fresh replacement
+uses its actual newly verified selection. Recording the receipt does not grant
+execution or change the existing recovery gates. Admission proof does not certify
+provider liveness, physical termination or workspace export.
+The `runnerEnvironmentLeaseId` names the logical Runner and provider-pack
+authority scope. It can differ from a physical `environment_leases.id`.
+
 Warm attachment requires two consecutive authenticated readiness snapshots.
 Blocked readiness probes back off within the reconnect deadline so they do not
 fill the durable command journal while waiting. The fast ready path keeps its