update_project restored marketplace installs (and status, container id, flags) from a copy read before validation, then wrote the whole record later, so an install landing in between was lost. ProjectsStore gains update_restoring, which runs restore_store_owned_fields against the record as stored under the lock, and update_project writes through it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>