[OrcaWin]

	Files	Added	Deleted	Net
Test	23	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​173	$\color{#cf222e}{\Huge{\mathbf{−}}}$​202	$\color{#cf222e}{\Huge{\mathbf{−}}}$​29
Prod	15	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​107	$\color{#cf222e}{\Huge{\mathbf{−}}}$​177	$\color{#cf222e}{\Huge{\mathbf{−}}}$​70

ELI5

This is a tidy-up with no visible change. Four spots had the same logic copied in several places, or offered two ways to do one thing. Now each has a single path. Net change: -99 lines (+280 / -379). Production and build code alone: -66 (+107 / -173).

What Changed

1. One way to remove a project (main process). Main used to offer two removal methods. One took only an id (removeProject, guarded by a repo_id_ambiguous throw). The other took an id plus a host (removeProjectForHost). Since fix(projects): remove a project only on the host the user picked #26340 the renderer only uses the host-scoped path or the repo.rm runtime call. That left the id-only method, the repos:remove IPC handler, its preload bridge and type, and the paired-web remove shim with no production callers.
   • All of them are deleted.
   • repo.rm (RuntimeRepositorySettingsController.remove) already resolves the exact row, so it now always calls removeProjectForHost(repo.id, hostOf(repo)). The "does this id exist on another host?" branch is gone.
   • Tests that called the id-only method now name the row's host. The IPC event tests now exercise repos:removeForHost. The Windows e2e smoke removes by host.
2. Daemon scope probe takes one options object. isDurableDaemonScopeSupported took 6 positional test seams and migrateLegacyDaemonScope took 10. Both now take one shared ScopeProbeDeps object, and migration passes it straight through. An explicit canonicalRuntimeDir: null still means "no canonical dir", because only undefined falls back to the default.
   • The /proc/<pid>/cgroup line parsing that was written twice now lives in one place, cgroupPathFromProcLine.
   • The two probe wrappers return the runProcessSync result directly instead of copying fields out of it.
3. Build smokes run from a table. build-orcad.mjs had three copy-pasted try/catch blocks. Each one ran a smoke under the build's Node and then under the pinned runtime. They are now one loop over a three-row table. The order, the log text and the separate try/catch per smoke are unchanged.
4. SSH PTY obligations check the closed delivery in one place. The same "delivery closed → do nothing" guard and the same transition object were repeated in settleModel, settleDesktop and transferDesktop. Each now asks one private openTransition builder.

Why

How the bug surface shrinks:

• Removal: main has one way to remove a project, so no call site can pick the id-only variant that removeProject without a hostId can delete the wrong host's project when repo IDs are duplicated across hosts #13071 had to fence. The two methods' different handling of scan generations and sessions also goes away.
• Daemon seams: positional seams at positions 6–10 were easy to misorder when someone added a new one. Named fields can't be misordered.
• Build smokes: the next shipped child adds a table row. Copying a block is how a smoke ends up running only on the build's Node.
• SSH PTY: a future settle or transfer variant reuses the builder and carries the guard whose absence fix(ssh): keep crediting a PTY after its recovery delivery is canceled #26341 fixed.

Why behavior is unchanged:

• repo.rm already reached removeProjectForHost for duplicated ids. For a single-host id, that method produces the same final state as the old one. The only difference is one extra scan-generation revision bump, and readers only compare revisions for equality.
• The production callers of the daemon probes pass no arguments and are unchanged.
• The smokes run in the same order with the same messages. Awaiting a sync smoke changes nothing, and its throw is still caught.
• The SSH builder runs the same synchronous guard and builds the same object.

Considered and rejected: dropping the disabled: DBUS strip inside buildDurableDaemonScopeCommand. Today's only caller passes an env that is already stripped. But the function owns its env, and that strip is the #25580 fix, so it stays.

Linked Issue

N/A. This is an internal refactor on the Phase 3.5 branch.

Visual Proof

N/A. Pure refactor with no UI or behavior change.

Testing

• pnpm tc passes. pnpm typecheck:e2e shows no errors in the touched spec; the errors it reports are already on the base in tests/tools.
• Ran these tests with pnpm test; all pass:
  • the daemon scope and lifetime suites
  • the SSH PTY output suites
  • the build-smoke source tests
  • every touched persistence, runtime, IPC and renderer store suite
• pnpm build:orcad passes. All three worker smokes ran under both runtimes.
• oxlint, pnpm run check:code-quality:changed and pnpm run audit:anti-slop pass.
• Failing locally but unrelated to this change, since neither file uses any code touched here:
  • src/main/daemon/shell-ready.test.ts and repro-13767-* (Bun project, real zsh profile on the host)
  • timeouts in profile-state-backup-rotation.test.ts under load
• Automated tests updated. Every case covered before is still covered:
  • The id-only ambiguity test became a host-scoped removal test. It still checks that the sibling host's row and metadata survive, for both git and folder kinds.
  • The repos:remove IPC cases now run against repos:removeForHost, including the local-renderer notification.

Review

Agent skill upstream boundary

• Not applicable.

Notes

• Security: none.
• Cross-platform: the daemon code is Linux-only and keeps its runtime checks.
• SSH / remote: host-scoped removal is already the SSH path. The repo.rm RPC is unchanged.
• Mixed-version clients: repos:remove was a local Electron IPC that the renderer no longer called, so there is no wire change.
• Performance: none.
• build-orcad.mjs is in RUNTIME_LAUNCHER_PATHS, so don't bundle this with a daemon protocol bump.

Checklist

• This PR is small and focused
• I explained what changed and why
• N/A: no UI change
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered
• Typecheck, lint and tests pass locally (see Testing)