[nwparker]

	Files	Added	Deleted	Net
Test	3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​742	0	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​742
Prod	10	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​245	$\color{#cf222e}{\Huge{\mathbf{−}}}$​61	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​184

ELI5

Changing a project’s settings should affect the location you selected. When a paired server publishes two locations with the same project ID, Orca could refuse the edit or update the wrong row. Settings now keep the selected host through the request and reply.

What Changed

Repository updates accept an optional execution host, use the existing exact owner lookup, and write the resolved host’s row. Settings carry the selected publisher and execution owner; older servers are refused before sending a qualified edit. Replies and queued edits are checked against the captured registration and pairing, so an old reply cannot replace a removed and re-added project. Derived host setups retain the private execution host after the response merge.

Why

The existing owner resolver already handles ambiguous and duplicate locations. Reusing it fixes the authority boundary without choosing a first row or retrying an edit without its host. A separate capability preserves mixed-version safety, while legacy unqualified calls and existing input, clearing and sanitization behavior remain supported.

Linked Issue

No exact pre-existing issue was identified in the bounded related-material scan. This is a follow-up stacked on project setup authority #27025.

Visual Proof

Historical rendered proof: ordinary Settings B rename, then reopen the pane (accepted base fc1e9c2 → b634e35 / tree c8e8c706):

Before	After

Historical rendered proof: remove and re-add B while its original update reply is held, then reopen Settings (reproduction at tree 65e0c7d → b634e35 / tree c8e8c706):

Before	After

Both comparisons repeat with each row order. These are hidden Electron renderings of actual Orca Settings components with owned catalog registration and paired transport/status/authentication fixtures. Requests use production preload, registered RPC/schema/runtime and Store/SQLite; no user host or real remote execution is involved. The original reply is held after its production write; actual Store removal/re-addition and registered catalog refresh publish the replacement before release. Uploaded image bytes match the captured PNGs. These captures remain tied to b634e35 / tree c8e8c706. No new rendered or native-host proof was run for the normal restack onto 40ce1bc; all fourteen private file bytes are unchanged.

Testing

• I manually tested these changes locally
• Automated tests added/updated, or explained why not below

macOS: the normal restack onto 40ce1bc passed 18 canonical suites / 235 tests at tree 808b38c41a610424c8421f124969b35f02e8732f. Node, renderer and CLI typechecks passed, as did full-file default and anti-slop lint, formatting and changed-code quality over the 28 distinct private and incoming files. Direct Node 24.20.0 package entry points used the existing dependency lane; no package installation or native rebuild was performed. Renderer types use the reviewed type-only Shiki closure with the same 14,873 canonical source files and compiler options.

The rendered Settings and durable SQLite controls above were run previously at b634e35 / tree c8e8c706. They cover both row orders, local/direct-SSH fixtures, old-peer/re-pair refusal before mutation, B-only writes, private host labels, stale held replies after removal/re-registration, and same-registration metadata refresh. The restack preserves those fourteen private file bytes. This restack has no new Windows, Linux or rendered-app evidence; Linux contact remains unverifiable. Full build and hosted CI are separate gates. The further normal merge inherits the published two-file compatibility correction at c07a30e. Both actual cross-version fixture suites passed all 18 tests at tree 9dd8fb3e7cf6a6174de6bec494af119414bdf014. They materialize bounded release snapshots in this child’s own fixture cache. Full-file default and anti-slop lint, formatting and changed-code quality passed for both incoming files. The earlier 235-test and typecheck runs were not repeated; their private and H2 source bytes remain unchanged.

Review

Independent reviews of the repository-update fix and prior merge retention remain tied to their accepted source. The conflict-free normal merges preserve all fourteen private files, all fifteen incoming H2 files and both inherited compatibility fixtures byte for byte. The thirteen-file private delta against c07a30e is unchanged; the shared routing test already has identical bytes in both earlier parents. The incoming compatibility commit retains Brennan Benson’s authorship and original source-commit reference.

Agent skill upstream boundary

• Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

The new field is optional and limited to repo.update. Qualified clients require the dedicated capability and never retry without the execution owner. Loss of contact does not establish remote process death. No new process launch, polling, filesystem path convention or unrelated repository mutation route was introduced. Full app-session/live SSH validation remains outside the owned fixture evidence.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[OrcaWin]

Closing as superseded. Repository edits on main now route by the project's own host (#27288 project/catalog calls route by owner, #27116 host-catalog fence), and duplicate owners are refused rather than guessed. This draft was stacked on the now-closed setup stack (#27025/#27001) and no longer applies.